WHISTLEBLOWING CHANNEL
At Koroshi, we are committed to complying with the law and with internal regulations, as well as with the principles established within our company. For this reason, we make tools available to detect and prevent conduct that does not align with our values. The success of our company is founded on integrity and compliance. Therefore, our HR department manages our entirely impartial and confidential Whistleblowing Channel, through which matters such as the following may be reported:
· Sexual or workplace harassment and/or discrimination
· Suspicions of other infringements of laws in force, legal regulations, other state provisions or directly applicable legal acts of the European Union
· Risks to human rights and the environment that could be attributable to the company
· Other conduct that may constitute an abuse of rights on the part of the company or its suppliers
I. INTRODUCTION, PURPOSE AND SCOPE
Its purpose is to establish an internal channel for reporting possible regulatory infringements, breaches of internal and/or ethical policies, and to establish a regime for the protection of whistleblowers, in compliance with Spanish Law 2/2023 of 20 February, regulating the protection of persons who report regulatory infringements and on the fight against corruption.
This Channel is a mechanism that enables employees and other interested parties to report any type of conduct that is unlawful or contrary to our values and ethical principles, without fear of reprisals, thereby strengthening the culture of reporting, the integrity infrastructures of organisations and the promotion of a culture of reporting or communication as a mechanism to prevent and detect threats to the public interest. In this way, we seek to promote a culture of transparency, integrity and responsibility within our organisation, while at the same time protecting those employees who decide to make a report in good faith.
II. WHISTLEBLOWING CHANNEL
The Whistleblowing Channel is the responsibility of the person in charge of the internal Channel system, and has various managers depending on the area to which the information received relates.
The person in charge of the system will be responsible for:
• Receiving, recording and managing the reports received through the whistleblowing channel.
• Appointing the person or team responsible for investigating the reports received.
• Ensuring the protection of whistleblowers and the confidentiality of the reports received.
• Assessing the truthfulness and credibility of the reports received.
• Making decisions on the appropriate measures in light of the results of the investigation.
• Monitoring and periodically reviewing the report management process and the company's internal policy.
• Preparing reports and recommendations for senior management on the reports received and the measures taken.
Whistleblowers falling within the scope of the law may submit their reports through the following means:
· Link to the online whistleblowing channel: https://compliance.legalsending.com/canal/?C=4860789019017098
· QR code:
· Sending an email to the following address:canalcomunicacion@koroshi.tv
· Postal mail addressed to HR; Person in Charge of the Internal Information System, of the company.
At the request of the whistleblower, by means of a request addressed to the person in charge of the System, the report may be made by way of an in-person meeting.
III. WHISTLEBLOWERS
The channel may be used by:
1. Persons who have the status of employees or salaried workers.
2. Self-employed contributors (freelancers).
3. Shareholders, members and persons belonging to the administrative, management or supervisory body of the company, including non-executive members.
4. Any person who works for or under the supervision and direction of contractors, subcontractors and suppliers.
5. Others
It is important to note that reports made through the whistleblowing channel must be made in good faith; that is, they must be supported by evidence and specific facts.
IV. REPORTABLE FACTS
The channel will be used solely to alert the company to the following matters:
A. Any acts or omissions that may constitute infringements of European Union law, provided that they:
1.º Fall within the scope of the European Union acts listed in the annex to Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, regardless of how they are classified under domestic law.
2.º Affect the financial interests of the European Union as referred to in Article 325 of the Treaty on the Functioning of the European Union (TFEU); or
3.º Have an impact on the internal market, as referred to in Article 26(2) of the TFEU, including infringements of European Union competition rules and State aid rules, as well as infringements relating to the internal market in connection with acts that breach corporation tax rules or with practices whose purpose is to obtain a tax advantage that defeats the object or purpose of the applicable corporation tax legislation.
B. Acts or omissions that may constitute a serious or very serious criminal or administrative infringement*.
*In any event, all serious or very serious criminal or administrative infringements that entail financial loss to the Public Treasury and to the Social Security system shall be deemed to be included.
The whistleblower must provide, as a minimum, a reference to the subjective scope of the infringement (the matter or regulation infringed: European Union law; criminal infringement; or administrative infringement); and a description of the facts being reported (relevant information about what occurred), in as much detail as possible, attaching any documentation that may be available, where applicable.
Likewise, the whistleblower may provide their full name and a contact telephone number, should they choose not to make this report anonymously.
If the whistleblower is aware of the identity of the person responsible for the irregularity reported, or has brought these facts to the attention of another body or entity through an external channel, they may also provide this information.
V. REPORTING PROCEDURE
The company undertakes to investigate all reports of possible infringements or breaches received through the whistleblowing channel.
The company will appoint a person or team as the person in charge of the information system or reporting channel responsible for receiving, recording and managing the reports received through the whistleblowing channel.
The person in charge of the System will carry out their duties independently and autonomously from the other bodies of the entity or organisation, may not receive instructions of any kind in the exercise of those duties, and will have all the personal and material resources necessary to carry them out.
All reports will be investigated impartially and confidentially, and appropriate measures will be taken in light of the results of the investigation, aimed at protecting the whistleblower.
The company undertakes to inform the whistleblower about the status of the investigation and the measures taken, whenever possible and without compromising the confidentiality and protection of the whistleblower, and may request additional information about the facts reported through the channel.
At the request of the whistleblower, the report may also be made by way of an in-person meeting within a maximum period of seven days. Such meeting will be recorded under the terms established by law. Without prejudice to the rights to which the whistleblower is entitled in accordance with data protection regulations, the whistleblower will be given the opportunity to check, correct and accept, by signing it, the transcript of the conversation.
In addition, the company undertakes to monitor all reports received and the measures taken in order to ensure the effectiveness of this policy and to continuously improve the process.
Communications through the information system may be anonymous.
Communications received will be acknowledged within a maximum period of 7 days and managed within a maximum period of 3 months, except in cases of particular complexity that require an extension of the period, in which case it may be extended by up to a maximum of a further three months.
Any information will be referred immediately to the Public Prosecutor's Office where the facts could prima facie constitute a criminal offence. In the event that the facts affect the financial interests of the European Union, the matter will be referred to the European Public Prosecutor's Office.
In addition to this Internal Channel, there are other external channels established by the competent authorities for likewise reporting acts or omissions that may constitute infringements in the areas indicated above. These channels include:
State or Regional Channels:
· National Anti-Fraud Coordination Service
· Public Prosecutor's Office against Corruption and Organised Crime
· Independent Whistleblower Protection Authority*:
* Spanish Law 2/2023 provides for the specific creation of this external reporting channel and for the appointment of an Independent Whistleblower Protection Authority. The persons indicated above ("whistleblowers") may report to that Authority, or to the relevant regional authorities or bodies, the commission of any acts or omissions covered in the "communications" section, either directly or after having made that report through this Internal Information Channel. (INFORMATION ON ACCESS TO THIS EXTERNAL CHANNEL IS NOT YET AVAILABLE)
European Channels
· European Anti-Fraud Office (OLAF)
VI. PROTECTION OF WHISTLEBLOWERS
We undertake to protect persons who report infringements or breaches, in accordance with Spanish Law 2/2023.
Persons who report or disclose infringements will be entitled to protection against reprisals provided that the following circumstances are met:
1. They have reasonable grounds to believe that the information reported is truthful at the time of the report or disclosure, even where they do not provide conclusive evidence, and that the said information falls within the scope of the law.
2. The report or disclosure has been made in accordance with the requirements set out in the law.
Acts constituting reprisal are expressly prohibited, including threats of reprisal and attempted reprisals against persons who make a report in accordance with the provisions of the law.
Reprisal is understood to mean any act or omission that is prohibited by law, or that, directly or indirectly, entails unfavourable treatment placing the persons who suffer it at a particular disadvantage relative to another in the work or professional context, solely on account of their status as whistleblowers, or for having made a public disclosure.
During the processing of the case file, the persons affected by the report will be entitled to the presumption of innocence, to the right of defence and to the right of access to the case file under the terms regulated in this law, as well as to the same protection established for whistleblowers, with their identity being preserved and the confidentiality of the facts and data of the procedure being guaranteed.
The Independent Whistleblower Protection Authority, A.A.I. may, within the framework of the penalty proceedings that it conducts, adopt interim measures under the terms established in Article 56 of Spanish Law 39/2015 of 1 October on the Common Administrative Procedure of Public Administrations.
The following persons are expressly excluded from the protection provided for in the law where they report or disclose:
1. Information contained in communications that have been rejected by an internal information channel or for any of the reasons provided for in the law.
2. Information linked to claims about interpersonal conflicts or affecting only the whistleblower and the persons to whom the report or disclosure relates.
3. Information that is already fully available to the public or that constitutes mere rumours.
4. Information relating to acts or omissions not covered by the scope of the law.
VII. CONFIDENTIALITY AND DATA PROTECTION
The personal data being processed, the documents provided and any other information supplied in the report that contains personal information will be treated confidentially by those in charge of the whistleblowing/reporting channel, for the purpose of fulfilling the obligation to investigate and manage the report submitted, as well as to comply with the legal obligations established in Spanish Law 2/2023 of 20 February, regulating the protection of persons who report regulatory infringements and on the fight against corruption.
Personal data whose relevance is not manifest for processing a specific item of information will not be collected, or, if collected by accident, will be deleted without undue delay.
The processing of personal data will be carried out ensuring compliance with Spanish Law 2/2023 of 20 February, regulating the protection of persons who report regulatory infringements and on the fight against corruption, with Regulation (EU) 2016/679 (GDPR) of the European Parliament and of the Council of 27 April 2016, with Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights, and with Organic Law 7/2021 of 26 May on the protection of personal data processed for the purposes of preventing, detecting, investigating and prosecuting criminal offences and enforcing criminal penalties.
Access to the personal data contained in the internal information system will be limited to:
a) The person in charge of the System and whoever directly manages it.
b) The person in charge of Human Resources or the duly appointed competent body, only where disciplinary measures against an employee may be appropriate.
c) The person in charge of the legal services of the entity or organisation, where the adoption of legal measures in relation to the facts reported in the communication may be appropriate.
d) The data processors who may eventually be appointed.
e) The data protection officer.
The data may be brought to the attention of the Legal Department, lawyers, judicial bodies and the State Security Forces and Corps in the event that any of the information received is liable to be considered a criminal offence or a legal infringement of any kind.
Legal basis for the processing: The processing of personal data, in cases of internal communications, will be deemed lawful under Articles 6.1.c) of Regulation (EU) 2016/679 (GDPR) of the European Parliament and of the Council of 27 April 2016, 8 of Organic Law 3/2018 of 5 December, and 11 of Organic Law 7/2021 of 26 May, where, in accordance with Articles 10 and 13 of the law, it is mandatory to have an internal information system. If it is not mandatory, the processing will be presumed to be covered by Article 6.1.e) of the aforementioned regulation. The processing of personal data in cases of external communication channels will be deemed lawful under Articles 6.1.c) of Regulation (EU) 2016/679, 8 of Organic Law 3/2018 of 5 December, and 11 of Organic Law 7/2021 of 26 May.
Rights of the data subject: access, rectification, erasure, restriction, portability and objection, free of charge, by email to: canalcomunicacion@koroshi.tv in the cases provided for by law.
Retention: The data will be retained for the legal period established for the processing of the case file (3 months) and for the time necessary to exercise legal actions or, if it is necessary, to keep evidence of the management of the channel. The data subject also has the right to lodge a complaint with the AEPD (Spanish Data Protection Agency) at www.aepd.es to seek the protection of their rights.
VIII. COMMUNICATION AND AWARENESS
Periodic training sessions and awareness campaigns will be carried out to foster a culture of integrity and transparency, and to inform employees and other interested parties about the whistleblowing channel.
The company undertakes to disseminate this policy to all employees and interested parties, and to update it regularly in order to ensure its compliance with applicable laws and regulations.
June 2023.
