INTERNAL INFORMATION SYSTEM
INTRODUCTION
The transposition of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 into Spanish law by Law 2/2023 of 20 February, regulating the protection of persons reporting regulatory infringements and combating corruption, entails the introduction of specific mechanisms to enable those aware of illegal or irregular conduct to provide useful data and information, whilst ensuring the full and effective protection of such whistleblowers.
In this regard, the aforementioned regulations set out the minimum requirements that must be met by the various internal and external reporting channels, alongside a system providing special protection for whistleblowers who act in good faith and with honest intentions, acting in a selfless manner.
In accordance with the above, KONVEX Storage Systems, S.L. has implemented an Internal Reporting System (SIIF), which serves as a cornerstone for oversight, control and prevention in the area of regulatory compliance. This system constitutes a preferred channel and a mandatory tool for channelling information diligently, with a view to strengthening the culture of information within the organisation itself. The SIIF has been designed as a control and prevention tool, incorporating reporting channels managed both internally and by a specialist external firm. These channels are characterised by the highest levels of professionalism, experience, independence, confidentiality, compliance with data protection regulations and other applicable regulatory frameworks. Furthermore, the SIIF guarantees the basic principles of anonymity, proper recording, retention and non-alteration, prevention of conflicts of interest, protection of the whistleblower and prohibition of retaliation. In accordance with the aforementioned Law, it is an essential requirement that the SIIF has a Policy setting out the general principles of the system and the protection of whistleblowers, duly publicised within the Organisation. Therefore, together with the Procedure for the management of information received, this Policy is an essential element of the configuration and operation of the SIIF.
PRINCIPLES OF OPERATION AND FUNDAMENTAL GUARANTEES
The Internal Reporting System (SIIF) is one of the cornerstones of regulatory compliance and criminal prevention systems. In line with the highest standards of due diligence in this area, the Organisation has equipped the SIIF with a series of safeguards to ensure its effectiveness, with the collaboration and support of the external expert BONET consulting. Specifically, the basic principles and fundamental safeguards governing the process and the Organisation’s actions in relation to the SIIF are as follows:
> Independence, autonomy, impartiality and the absence of conflicts of interest: In the receipt and processing of information regarding infringements, response mechanisms have been established to manage and control potential conflicts of interest and/or lack of independence, where those responsible for management, control and/or supervision exhibit characteristics that compromise and influence the performance of their duties. Furthermore, all communications received are analysed in accordance with the necessary independence requirements, which guarantee fairness and justice in their handling.
> Professionalism and experience: Experts in regulatory compliance, crime prevention and good governance are responsible for the proper handling and management of communications, whilst safeguarding the rights of both whistleblowers and those against whom allegations are made.
> Completeness, integrity and confidentiality of information: Those involved in the various stages of the research are bound by a duty of confidentiality regarding any information to which they may have access or of which they may become aware in the course of their duties. Furthermore, unauthorised personnel are prevented from accessing such information, and its long-term, secure storage is ensured through the creation of backups of the information and separate files.
> Data protection and confidentiality of communications: Data processing is carried out in accordance with and complies with the highest standards and policies regarding the protection of personal data, in line with the applicable regulations on the protection of personal data. Similarly, there is a duty of confidentiality regarding any aspect of the information communicated.
> Anonymity and Anonymisation: Provision is made for the submission and subsequent processing of anonymous reports, as well as a general duty to protect the identity of any informant who has identified themselves when making a report, ensuring they remain anonymous and not disclosing their identity to third parties.
> Affordability, simplicity and free access: We ensure that communication is straightforward, enabling universal access to the system at no cost, and the effective application of the legal and ethical principles governing the Organisation’s activities.
> Proper and independent record-keeping: A private register is maintained of the information received and the internal investigations to which it has given rise, as a guarantee of its processing, management and integrity, in an independent manner and free from conflicts of interest, for a period of time that is necessary and proportionate in accordance with current legislation. Under no circumstances shall the data be retained for a period exceeding ten years.
> Best practices for monitoring and investigation: In order to verify the accuracy of reports, ensure that evidence is gathered correctly and safeguard the rights of those affected, the lifecycle of each report will be governed by an effective and transparent internal procedure. These practices will be documented in the Procedure for the Management of Information Received.
> Protection of whistleblowers and affected individuals: Individuals who report or disclose breaches are entitled to protective measures and shall not be subject to any reprisals or adverse consequences as a result of their cooperation, including threats of reprisal and attempts at reprisal. Similarly, those affected by the report shall be entitled to the same protection as that provided for whistleblowers, with their identity being protected and the confidentiality of the facts and details of the proceedings being guaranteed.
> Diligence, responsibility and good faith on the part of the whistleblower: The use of the system is based on the principles of responsibility, diligence and good faith; therefore, every whistleblower must have reasonable grounds to believe that the information is true at the time it is reported. The reporting of unfounded, false or distorted facts, as well as the submission of information obtained unlawfully, with malicious intent or in a morally dishonest manner, constitutes a breach of the principle of good faith and may result in disciplinary action.
HEAD OF THE INTERNAL INFORMATION SYSTEM
For the Internal Reporting System (SIIF) to be effective, it is essential to appoint a person responsible for its proper functioning, organisation and the prompt processing of information. This person will also be responsible for ensuring the proper communication and dissemination of the SIIF, as well as for drawing up and updating the relevant training plan. The Entity’s administrative or governing body is responsible for appointing and notifying the competent authority of the individual or collegiate body responsible for managing the system, and for their dismissal or removal from office (hereinafter, the System Manager). The System Manager performs their duties independently and autonomously from the Entity’s other organisational bodies, avoiding any potential conflicts of interest with the ordinary performance of their role. However, the System Manager may engage third parties to receive specialist support and/or to meet independence requirements, in order to ensure the proper performance of their duties. In particular, in the performance of their duties, the System Manager shall coordinate with the following parties: A. The head of human resources, where disciplinary measures may need to be taken against the persons involved and/or to coordinate the implementation of protective measures.
A. The Entity’s compliance officers and/or legal department, where legal or compliance measures need to be taken into account by them in relation to reports received via the SIIF.
B. Any data processors that may be appointed.
C. The Data Protection Officer.
D. Other individuals and/or entities involved in the management of the SIIF.
INDEPENDENT AUTHORITY FOR THE PROTECTION OF WHISTLEBLOWERS (AINPI)
The Organisation’s Internal Reporting System (SIIF) is the primary and mandatory channel for reporting any unlawful conduct or breaches of which one becomes aware, as it ensures that appropriate protective measures are taken and fosters a culture of reporting within the organisation.
However, other “external” channels of communication have been established, with the aim of offering citizens an alternative means of submitting a report and/or complaint, in cases where the internal channels do not meet the safeguards required by the applicable regulations, the relevant protective measures are not applied, or individuals are exposed to reprisals due to their status as whistleblowers.
Consequently, anyone who, in the course of their employment or professional activities, becomes aware of infringements of European Union law, criminal offences, or serious or very serious administrative offences may report these directly to the Independent Whistleblower Protection Authority (AINPI), a state authority, at http://whistleblowersoftware.com/secure/canal_externo_de_denuncias_AINPI or by email to canal.externo@proteccioninformante.es. Reports may also be made by post (Independent Whistleblower Protection Authority, Calle Luis Cabrera 9, 28002 Madrid) or by requesting a face-to-face meeting.
CONFIDENTIALITY AND PROTECTION OF PERSONAL DATA
The processing of personal data arising from the Internal Information System (SIIF) is governed by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, Organic Law 3/2018 of 5 December and Organic Law 7/2021 of 26 May. Consequently, at the time of data collection, data subjects are informed of the processing of their data and of their rights, in accordance with current legislation. In compliance with the principle of data minimisation, the personal data collected is that which is necessary and relevant for the processing of the report. In the event that data is collected accidentally, which is not necessary for the investigation of the actions or omissions, it will be deleted without undue delay. Furthermore, the data will be retained for the time strictly necessary to decide on the appropriateness of initiating an investigation. Moreover, the design of the SIIF guarantees the confidentiality of the whistleblower’s identity and that of any third party mentioned in the report, as well as the actions taken in the management and processing thereof. In this regard, access to personal data and all other information contained in the system is restricted to those responsible for its management, within the scope of their powers and duties. Consequently, appropriate technical and organisational measures are in place to protect the identity of data subjects and prevent access by unauthorised persons. In the event of any queries or concerns regarding the processing of personal data carried out within the Organisation in relation to the SIIF, any data subject may contact the designated Data Protection Officer using the contact details previously provided and which are available to them.
PROTECTIVE MEASURES
Persons who report or disclose breaches using the Organisation’s Internal Reporting System (SIIF) are entitled to protection, on the same terms as those who report via external channels, provided they have reasonable grounds to believe that the information in question is true at the time of reporting or disclosure, even if they do not provide conclusive evidence. In this regard, acts constituting retaliation, including threats and attempts at retaliation, against individuals who submit a report are expressly prohibited. In order to guarantee the right to protection of the whistleblower and of those affected by the report, the Organisation has established the following technical and organisational measures, which are applied from the moment the report is received:
SIIF Configuration: The SIIF has been designed with appropriate technical and organisational measures to ensure the protection of the whistleblower’s identity, as well as that of any data and information arising from the reports submitted. In this regard, the Organisation has established a number of internal reporting channels, which allow reports to be submitted anonymously. These channels are:
Online/digital channel: A digital platform for submitting written communications.
Face-to-face channel: The system for receiving communications via face-to-face meetings or video conferences.
Regardless of the channel used, the SIIF ensures the effective application of the basic principles and safeguards set out in this Policy, in order to comply with the requirements of the regulatory framework and to protect the rights of whistleblowers and those affected.
SIIF Officer: To ensure the proper implementation of the SIIF, the Organisation has appointed an Officer whose role is to supervise, monitor and control its operation. In this regard, the Officer, together with the external expert, will adopt the necessary protective measures and ensure their proper monitoring and implementation. The involvement of the external expert provides the Officer’s role with the autonomy and independence required by current regulations. Furthermore, the Officer will be responsible for conducting a preliminary analysis of the communications received in order to determine the appropriateness of adopting specific protective measures regarding the whistleblower and/or affected third parties. Furthermore, depending on the nature and scope of the information, the Officer will have the support and advice of the heads of the Entity’s various operational areas to ensure the successful completion of the investigation. The Officer may also consult other third parties specialising in matters requiring expert opinion.
Safekeeping, management and security of SIIF information: The Organisation has a document management system in place, configured with appropriate security and control measures, in order to demonstrate the effectiveness of the SIIF itself. It should be noted that this system includes anonymisation processes to prevent the identification of whistleblowers. In addition, the Organisation has adopted reasonable technical measures for the secure storage, retrieval and disposal of information, as well as implementing access controls to prevent unauthorised use.
However, information provided that is false, misleading, manifestly lacking in any plausibility or basis, or where there are reasonable grounds to believe it was obtained through the commission of a criminal offence, is excluded from the aforementioned protection. This is because all communications must be made in good faith and, therefore, the informant must have reasonable grounds to believe that the information is true at the time of communication. In short, the principle of good faith requires that under no circumstances may it be inferred that there is falsity, untruthfulness, or an intention to seek revenge or harm a third party. It is important to remember that the protective measures are not intended solely for the benefit of whistleblowers. Those persons to whom the facts described in the report relate (affected persons) also enjoy special protection against the risk that the information, even if it appears to be true, may have been manipulated, may be false or may be motivated by other factors. During the processing of the case, these individuals are entitled to the presumption of innocence, judicial protection and defence, access to the case file, as well as confidentiality regarding the facts and details of the proceedings and the protection of their identity. In conclusion, they enjoy the same protection and rights as the whistleblower.
DISCIPLINARY PROCEDURES
Failure to comply with applicable regulations and conduct contrary to the Organisation’s instructions, policies, codes, procedures and protocols shall give rise to disciplinary action under employment and commercial law, in accordance with the provisions of the applicable Collective Agreement, the Workers’ Statute and all other applicable regulations. The Organisation shall report and sanction any acts or omissions contrary to this Policy committed by employees, collaborators or any other person associated with the Organisation, and in particular: Failure to report any suspicion or knowledge of breaches or non-compliance with the regulatory framework and the Organisation’s internal protocols and rules via the SIIF; any attempt or actual action to obstruct the submission of reports or to prevent, frustrate or delay their follow-up; The use of the SIIF in bad faith, for example, by providing information or documentation in the knowledge that it is false; the taking of any retaliatory action against whistleblowers or other affected persons as a result of the report; breach of confidentiality and anonymity guarantees, by revealing the identity of the persons concerned and breaching the duty of confidentiality regarding the information; failure to comply with the obligation to cooperate with the investigation of reports.
COMMUNICATION, REVIEW AND UPDATES
This Policy, together with all necessary information regarding the use of the Internal Information System (SIIF) that has been implemented, is available in a separate and easily identifiable section, so that all interested parties can access it clearly and easily. However, anyone may request further information from the Organisation using the contact details of the System Manager. The System Manager will periodically review and, where appropriate, propose to the Entity’s administrative or governing body that this Policy be updated, with the aim of adapting it to any circumstances and changes that may arise, as well as to any regulations or case law that may be issued. All of this is aimed at ensuring that the SIIF meets the highest standards of regulatory compliance for its proper functioning and effectiveness. Furthermore, the Entity is open to any suggestions and/or proposals that may improve its ethical conduct and foster a culture of regulatory compliance, emphasising the need for all employees and members associated with the Entity or third parties to collaborate in upholding its values and principles.
INTERNAL INFORMATION CHANNELS
In order to comply with the provisions of Law 2/2023, the Organisation has implemented a system that meets the technical and procedural requirements set out in that Law for the proper handling of reports. The aim is to provide whistleblowers with a secure, confidential or even anonymous channel for communicating with the Organisation, and to process information efficiently, professionally and independently. To this end, the Organisation has equipped itself with material, technical and human resources to set up various internal channels that allow reports to be submitted in written or verbal form. These channels have been configured, designed and supported by an external expert in order to ensure the highest levels of professionalism, experience, independence, confidentiality, data protection and whistleblower protection, as well as other relevant aspects for this type of channel. It should be noted that information provided through any of the internal channels will be treated as confidential, and only authorised personnel will have access to it for proper management and processing. The channels available to any employee or third party associated with the Organisation for submitting reports are detailed below:
Online/Digital Channel: The Organisation has a digital tool that allows written communications to be submitted via a form, which permits the attachment of files. Once the form has been completed, the tool automatically generates a code that enables the case handler to track and manage the case appropriately. Furthermore, a confirmation is sent to the informant regarding the receipt and registration of the communication in the system, which contains a summary of the information provided, as well as the code so that the informant can also track the process. This tool features security measures that guarantee the protection of the information, the identity of the whistleblower and that of those affected by the report, as well as the confidentiality and discretion of the entire process of managing and processing the report. In this regard, the Organisation guarantees a secure and efficient reporting environment for the receipt of reports. The tool also allows reports to be submitted anonymously. The Organisation provides an online tool through which any employee or person associated with the Organisation may submit a written report via the following link: https://corporate-line.com/cnormativo-konvex. Thanks to the communication and tracking system in place, the whistleblower and the System Manager will be able to communicate via the tool, regardless of whether the report was submitted anonymously.
Face-to-face channel: Another channel that the Organisation makes available to its employees and third parties with whom it interacts is the face-to-face channel, the purpose of which is to enable verbal reports to be made via an in-person meeting or by videoconference. In this case, and given the complexity involved for the Organisation in guaranteeing the anonymity of the whistleblower where requested, the Organisation has entrusted this function to the external expert BONET consulting, which is responsible for receiving and managing communications of this nature, as well as those in which the whistleblowers are identified and face-to-face handling is required. In this regard, the external expert guarantees the protection of the whistleblower’s identity both during the appointment booking process, when submitting a report in person, and at the venue where the meeting takes place. In order to ensure security and preserve the integrity of the information provided by the whistleblower, the meeting will be recorded in accordance with the provisions of the Law and with the whistleblower’s prior consent. This meeting will be documented in a secure format, with the security and anonymisation measures required by the regulatory framework. In this regard, BONET consulting has and will provide the necessary technological mechanisms for the submission of supplementary documentation to the information provided during the meeting. To use this channel, the Organisation has set up a telephone number and an email address for requesting communications in this format; the handling and coordination of the meeting will be carried out exclusively by BONET consulting. To use this channel, you must book an appointment in advance by calling 911087727 / 930460116 (information service hours: Monday to Thursday from 8.30 am to 2.00 pm and from 3.00 pm to 6.00 pm / Friday from 8.30 am to 2.30 pm) or via email: konvex@sistema-interno-informacion.com. If you have any questions or queries regarding the operation of the Organisation’s Internal Reporting System, please contact the System Manager at the following email address: siif@konvex.com.
COPYRIGHT
The content of this general policy on the internal reporting system is subject to copyright. Consequently, the express consent of the copyright holder is required in order to distribute or communicate it to other entities.