Informant's channel

Internal whistleblower channel policy

I. INTRODUCTION, PURPOSE AND APPLICATION

Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption (hereinafter Law 2/2023) transposes into Spanish law Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law.

This policy applies to Smileat, S.L. with CIF B87144622 and registered office at Calle Gran Vía 62, 5ºD, 28013, Madrid , Madrid ; and aims to establish an internal channel for the reporting of possible regulatory violations, infringement of internal and/or ethical policies and to establish a whistleblower protection regime, in compliance with Law 2/2023, of February 20, regulating the protection of persons who report regulatory violations and the fight against corruption.

Law 2/2023 explains and clarifies in its preamble, Part III, that its purpose is to protect, against possible retaliation, persons who, in an occupational or professional context, detect serious or very serious criminal or administrative violations and report them through the mechanisms regulated in this policy.

This Channel, therefore, is a mechanism that allows company employees, and other interested parties, to report any type of illegal conduct or conduct contrary to our values and ethical principles, without fear of retaliation, strengthening the culture of information, the integrity infrastructures of organizations and the promotion of the culture of information or communication as a mechanism to prevent and detect threats to the public interest. In this way, we seek to promote a culture of transparency, integrity and accountability in our organization, while protecting those employees who decide to make a report in good faith.

II. INFORMANT'S CHANNEL

A whistleblower channel (hereinafter, the CII) has been created by the entity as the preferred channel for receiving information on actions or omissions that may constitute a serious or very serious criminal or administrative offense, and other actions provided for in Article 2 of Law 2/2023.

The channel is under the administration of the Internal Channel System Manager (hereinafter, the RSII). Access to this channel shall be limited, within the scope of its competencies and functions, to:

1. The person in charge of the Channel's Internal System.
2. To the administrator/s delegated by the system administrator.
3. To the managers designated for the processing of certain complaints according to the area to which they correspond.

The functions of these bodies, as appropriate, shall be:

• Receipt, registration and management of complaints received through the whistleblower channel.
• Designation of the person or team in charge of investigating the complaints received.
• Ensuring the protection of whistleblowers and the confidentiality of reports received.
• Evaluation of the veracity and credibility of the complaints received.
• Decision making on appropriate action based on the results of the investigation.
• Monitoring and periodic review of the whistleblower management process and the company's internal policy.
• Preparation of reports and recommendations to senior management on complaints received and actions taken.

The IIC must technically guarantee the confidentiality or, eventually, the anonymity of the informant, to protect him/her against any leakage and subsequent retaliation to which he/she may be subjected.

• Link to the informant's channel:

https://compliance.legalsending.com/canal/?C=48605139019046683

• QR Code

• Send an e-mail to the following address:

[email protected]

• Postal mail addressed to Calle Gran Vía 62, 5ºD, 28013, Madrid , Madrid, a/a RSII: Javier Quintana Arranz

III. SUBJECTIVE SCOPE - REPORTING PARTIES

Those persons who have an employment or professional relationship with the AEPD to communicate information about the actions or omissions described in Article 2 of Law 2/2023 can use the internal information channel and benefit from the protection granted by Law 2/2023 as informants. This employment or professional relationship, which entails a dependence on the AEPD, is what makes the special protection against possible retaliation necessary and appropriate.

In any case, they are considered informants, for this AEPD, for the purposes of Law 2/2023:

• Persons who have the status of employees or workers employed by others.
• The freelance collaborators (freelance).
• Shareholders, participants and persons belonging to the administrative, management or supervisory body of the company, including non-executive members.
• Any person working for or under the supervision and direction of contractors, subcontractors and suppliers.
• Informants who communicate or publicly disclose information on violations obtained within the framework of an employment or statutory relationship that has already ended, volunteers, interns, trainees, workers in training periods regardless of whether or not they receive remuneration, as well as those whose employment relationship has not yet begun, in cases where the information on violations has been obtained during the selection process or pre-contractual negotiation.

It is important to emphasize that reports made through the whistleblower channel must be bona fide, i.e., they must be supported by concrete evidence and facts.

IV. OBJECTIVE SCOPE - REPORTABLE EVENTS

As regards the purpose of the information, it follows from Law 2/2023 that the internal reporting channel may be used to report serious misconduct or suspected corruption, which may constitute serious or very serious criminal or administrative offenses related to the activities of the entity, which the reporting person has observed or about which he/she has received information in the course of his/her work or professional relationship.

Law 2/2023 itself and Directive (EU) 2019/1937 list as such, information that refers to:

1. Infringements falling within the scope of the acts of the European Union listed in the Annex to the aforementioned Directive in the following areas
   1. public procurement,
   2. financial services, products and markets, and prevention of money laundering and financing of terrorism,
   3. product safety and compliance,
   4. transport safety,
   5. environmental protection,
   6. radiation protection and nuclear safety,
   7. food and feed safety, animal health and animal welfare,
   8. public health,
   9. consumer protection,
   10. protection of privacy and personal data, network and information systems security
2. Affecting the financial interests of the European Union as referred to in Article 325 of the Treaty on the Functioning of the European Union (TFEU).
3. Having an impact on the internal market, as referred to in Article 26(2) TFEU, including infringements of European Union competition rules and aid granted by States, as well as infringements relating to the internal market in connection with acts that infringe the corporate tax rules or practices aimed at obtaining a tax advantage that distorts the object or purpose of the legislation applicable to corporate taxation.
4. Actions or omissions that may constitute a serious or very serious criminal or administrative infraction. In any case, all serious or very serious criminal or administrative offenses that involve economic loss to the Treasury and Social Security shall be understood to be included.
5. Violations of labor law on occupational health and safety reported by workers, without prejudice to the provisions of its specific regulations.

The informant must provide at least the reference to the subjective scope of the infringement (subject matter or legislation infringed: European Union Law; criminal infringement; or administrative infringement); and a description of the facts reported (relevant information on what happened), as detailed as possible, attaching any documentation that may be available, if applicable.

You can also provide your name and surname, and a contact telephone number, if you do not choose to make this communication anonymously.

If it knows the identity of the person responsible for the reported irregularity, or has brought these facts to the attention of another body or entity through some external channel, it may also provide this information.

V. COMPLAINT PROCEDURE

The information may be communicated to the entity anonymously. Otherwise, the identity of the informant shall be kept confidential and shall be limited to the knowledge of the RSII, delegated administrators or appointed managers. These members shall perform their functions independently and autonomously from the rest of the bodies of the entity or organization and may not receive instructions of any kind in their exercise, having at their disposal all the personal and material means necessary to carry them out.

The company is committed to investigating all reports of possible violations or non-compliance received through the whistleblower channel. All reports will be investigated impartially and confidentially and appropriate action will be taken based on the results of the investigation for the protection of the whistleblower.

The information or complaint will be communicated through the internal information channel by means of the specific electronic application for this purpose, identified and accessible from the web page: https://www.smileatbaby.com/.

At the informant's request, the complaint may also be submitted by means of a face-to-face meeting that will take place within a maximum period of seven days. Where appropriate, the informant will be warned that the communication will be recorded and will be informed of the processing of their data in accordance with the provisions of the RGPD and the LOPDPGDD. When submitting the information, the informant must indicate an address, email, or safe place for the purpose of receiving notifications, unless he/she expressly waives the receipt of any communication of actions carried out by the RSII as a result of the information.

Once the information has been submitted, it will be registered in the information management system by assigning an identification code, which will be contained in a secure database with access restricted exclusively to RSII personnel, duly authorized, in which all communications received will be registered with the following data:

1. Date received.
2. Identification code.
3. Actions carried out.
4. Actions taken.
5. Closing date.

Once the information has been received, within a period of no more than 7 calendar days from said receipt, the informant will be acknowledged, unless he/she has expressly waived the right to receive communications related to the investigation. These reports will be managed for a maximum period of 3 months, except in cases of special complexity that require an extension of the period, in which case, this may be extended up to a maximum of 3 additional months.

Once the information has been registered, the RSII and his team will proceed to analyze the admissibility in accordance with the material and personal scope provided for in articles 2 and 3 of Law 2/2023.

The company undertakes to inform the whistleblower about the status of the investigation and the measures taken, whenever possible and without compromising the confidentiality and protection of the whistleblower, and may request additional information to the facts communicated through the channel.

In addition, the company is committed to following up on all complaints received and actions taken to ensure the effectiveness of this policy and to continuously improve the process.

Any information shall be immediately forwarded to the Public Prosecutor's Office when the facts could be indicative of a crime. In the event that the facts affect the financial interests of the European Union, it shall be referred to the European Public Prosecutor's Office.

VI. PROTECTION OF INFORMANTS

The company is committed to protecting individuals who report violations or non-compliance, in accordance with Law 2/2023.

A. Acts constituting retaliation.

Acts constituting retaliation, including threats of retaliation and attempts to retaliate against persons making a communication in accordance with the law, are expressly prohibited.

Retaliation means any act or omission that is prohibited by law, or that, directly or indirectly, involves unfavorable treatment that places the persons who suffer it at a particular disadvantage with respect to another in the work or professional context, solely because of their status as whistleblowers, or because they have made a public disclosure.

For the purposes of the provisions of Law 2/2023, and by way of example, reprisals are considered to be those adopted in the form of:

1. Suspension of the employment contract, dismissal or termination of the employment or statutory relationship, including the non-renewal or early termination of a temporary employment contract once the probationary period has passed, or early termination or cancellation of contracts for goods or services, imposition of any disciplinary measure, demotion or denial of promotions and any other substantial modification of working conditions and the failure to convert a temporary employment contract into an indefinite one, in the event that the employee had legitimate expectations that he/she would be offered an indefinite job; unless these measures were carried out as part of the regular exercise of management powers under labor legislation or the corresponding public employee statute, due to circumstances, facts or accredited infractions, unrelated to the presentation of the communication.
2. Damages, including those of a reputational nature, or economic losses, coercion, intimidation, harassment or ostracism.
3. Negative evaluation or references regarding work or professional performance.
4. Inclusion in black lists or dissemination of information in a specific sectoral area, which hinder or prevent access to employment or the contracting of works or services.
5. Denial or cancellation of a license or permit.
6. Denial of training.
7. Discrimination, or unfavorable or unfair treatment.

A person whose rights have been harmed as a result of its communication or disclosure after the two-year period has expired may request protection from the competent authority which, exceptionally and with justification, may extend the period of protection, after hearing the persons or bodies likely to be affected. The refusal to extend the protection period must be justified.

Administrative actions aimed at preventing or hindering the submission of communications and disclosures, as well as those that constitute retaliation or cause discrimination after the submission of such communications and disclosures under this law, shall be null and void and shall give rise, where appropriate, to corrective disciplinary or liability measures, which may include the corresponding compensation for damages to the injured party.

B. Measures to protect the whistleblower against retaliation

Persons who communicate information concerning the actions or omissions set forth in Section FOUR, or who make a public disclosure pursuant to Act 2/2023, shall not be deemed to have violated any disclosure restrictions and shall incur no liability of any kind in connection with such communication or public disclosure, provided that they had reasonable grounds to believe that the communication or public disclosure of such information was necessary to disclose an action or omission under such Act, all without prejudice to the provisions of the specific protective rules applicable in the employment setting. This measure shall not affect criminal liabilities.

The provisions of the preceding paragraph extend to the communication of information made by the representatives of the employees, even if they are subject to legal obligations of confidentiality or not to disclose confidential information. All the above without prejudice, likewise, to the specific rules of protection applicable in the labor field.

The whistleblower protection measures shall also apply, where appropriate, to:

1. natural persons who assist the informant in the process;
2. natural persons who are related to the informant and who may suffer reprisals, such as coworkers or relatives of the informant;
3. legal entities, for which it works or with which it maintains any other type of relationship in an employment context or in which it has a significant shareholding.

For these purposes, it is understood that the participation in the capital or in the voting rights corresponding to shares or participations is significant when, due to its proportion, it allows the person who holds it to have the capacity to influence the legal entity in which it has an interest.

Whistleblowers shall not incur liability in respect of the acquisition of or access to information that is publicly communicated or disclosed, provided that such acquisition or access does not constitute a criminal offense.

Any other potential whistleblower liability arising from acts or omissions that are not related to the communication or public disclosure, or that are not necessary to disclose a violation under the 2/2023 Act will be enforceable under applicable law.

In proceedings before a court or other authority, concerning prejudice suffered by whistleblowers, once the whistleblower has reasonably demonstrated that he or she has communicated or made a public disclosure pursuant to Law 2/2023 and has suffered prejudice, it shall be presumed that the prejudice occurred in retaliation for reporting or making a public disclosure. In such cases, the burden shall be on the person who has taken the injurious action to prove that such action was based on duly justified grounds not related to the communication or public disclosure.

In legal proceedings, including those relating to defamation, copyright infringement, breach of secrecy, breach of data protection regulations, disclosure of trade secrets, or claims for damages based on labor or statutory law, informants shall not incur liability of any kind as a result of communications or public disclosures protected by Law 2/2023. Such persons shall have the right to assert in their defense in such legal proceedings that they communicated or made a public disclosure, provided that they had reasonable grounds to believe that the communication or public disclosure was necessary to expose a violation under the 2/2023 Act.

Those persons who communicate or disclose the information are expressly excluded from the protection provided by law:

1. Information contained in communications that have been rejected by any internal information channel or for any of the reasons provided by law.
2. Information related to complaints about interpersonal conflicts or that affect only the informant and the persons to whom the communication or disclosure refers.
3. Information that is already fully available to the public or that constitutes mere hearsay.
4. Information that refers to actions or omissions outside the scope of the law.

C. Measures for the protection of affected persons

During the processing of the file, the persons affected by the communication shall have the right to the presumption of innocence, the right of defense and the right of access to the file under the terms set forth in Law 2/2023, as well as the same protection established for informants, preserving their identity and guaranteeing the confidentiality of the facts and data of the procedure.

The Independent Authority for the Protection of the Informant, A.A.I. may, within the framework of the sanctioning procedures it instructs, adopt provisional measures under the terms established in Article 56 of Law 39/2015, of October 1, of the Common Administrative Procedure of Public Administrations.

D. Exemption and mitigation of penalties

When a person who has participated in the commission of the administrative infringement that is the object of the information is the one who reports its existence by submitting the information and provided that such information was submitted prior to the notification of the initiation of the investigation or sanctioning procedure, the body competent to resolve the procedure, by means of a reasoned resolution, may exempt him/her from compliance with the corresponding administrative sanction, provided that the following points are accredited in the file:

1. To have ceased the commission of the infringement at the time of submission of the communication or disclosure and to have identified, if applicable, the other persons who participated in or favored the infringement.
2. To have cooperated fully, continuously and diligently throughout the investigation procedure.
3. To have provided truthful and relevant information, means of proof or significant data for the accreditation of the investigated facts, without having proceeded to the destruction or concealment thereof, or having disclosed to third parties, directly or indirectly, their content.
4. To have proceeded to the reparation of the damage caused that is attributable to it.

When these requirements are not fully met, including the partial repair of the damage, the competent authority, after assessing the degree of contribution to the resolution of the case, may decide to mitigate the sanction that would have corresponded to the offense committed, provided that the informant or author of the disclosure has not been previously sanctioned for acts of the same nature that gave rise to the initiation of the proceeding.

The mitigation of the sanction may be extended to the rest of the participants in the commission of the infraction, depending on the degree of active collaboration in the clarification of the facts, identification of other participants and repair or mitigation of the damage caused, appreciated by the body in charge of the resolution.

Law 2/2023 excludes from the provisions of this section the infringements established in Law 15/2007, of July 3, 2007, on the Defense of Competition.

VII. CONFIDENTIALITY AND DATA PROTECTION

The processing of personal data will be carried out ensuring compliance with Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption , of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, of the Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights and of the Organic Law 7/2021, of May 26, on the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offenses and enforcement of criminal penalties.

The personal data subject to processing, the documents provided and any other information provided in the complaint containing personal information will be treated confidentially by those responsible for the channel, as well as by the administrators and possible managers, in order to comply with the obligation to investigate and manage the complaint submitted and to comply with the legal obligations established in Law 2/2023, of February 20, regulating the protection of persons who report regulatory violations and the fight against corruption.

The Internal Information System must prevent unauthorized access and preserve the identity and guarantee the confidentiality of the data pertaining to the persons concerned and to any third party mentioned in the information provided, especially the identity of the informant in case he/she has been identified. The identity of the informant may only be communicated to the Judicial Authority, the Public Prosecutor's Office or the competent administrative authority in the context of a criminal, disciplinary or sanctioning investigation, and these cases will be subject to safeguards established in the applicable regulations.

If the information received contains special categories of personal data, subject to special protection, it will be immediately deleted, unless the processing is necessary for reasons of essential public interest as provided for in Article 9.2.g) of the RGPD, as provided for in Article 30.5 of Law 2/2023.

In any case, personal data will not be collected if it is not manifestly relevant to the processing of specific information or, if collected by accident, will be deleted without undue delay.

Communications that have not been followed up may only be recorded in anonymized form, without the blocking obligation provided for in article 32 of the LOPDPGDD being applicable.

Access to personal data contained in the internal information system shall be limited to:

1. The person in charge of the Channel's Internal System.
2. To the administrator/s delegated by the system administrator.
3. To the managers designated for the processing of certain complaints according to the area to which they correspond.
4. The data may be brought to the attention of the Legal Department, Lawyers, Judicial Bodies and State Security Forces and Corps in the event that any of the information received could be considered a crime or legal infraction of any kind.

Legal basis for processing: The processing of personal data, in cases of internal communication, shall be deemed lawful under the provisions of Articles 6.1.c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, 8 of Organic Law 3/2018 of 5 December and 11 of Organic Law 7/2021 of 26 May, when, in accordance with the provisions of Articles 10 and 13 of the law, it is mandatory to have an internal information system. If it is not mandatory, the processing shall be presumed to be covered by article 6.1.e) of the aforementioned regulation. The processing of personal data in the cases of external communication channels shall be deemed lawful under the provisions of Articles 6.1.c) of Regulation (EU) 2016/679, 8 of Organic Law 3/2018, of December 5, and 11 of Organic Law 7/2021, of May 26.

Rights of the interested party: access, rectification, deletion, limitation, portability and opposition, free of charge by e-mail to: [email protected] in the cases legally provided for.

Retention: The data will be kept for the legal term established for the processing of the file and for the time necessary for the exercise of legal actions or if it were necessary to leave evidence of the management of the channel. The interested party has the right to file a complaint to the AEPD at www.aepd.es to request the protection of their rights.

VIII. COMMUNICATION AND REVIEW OF POLICIES AND PROCEDURES

The company will conduct regular trainings and awareness campaigns to foster a culture of integrity and transparency, and to inform employees and other stakeholders about the whistleblower channel. It will also provide information on the rights and protections afforded to whistleblowers under Law 2/2023.

The company undertakes to disseminate this policy to all employees and stakeholders, and will update, at least every three years and, if necessary, modify this internal channel policy, taking into account the experience gained and the recommendations of the Competent Authority.

In Madrid on November 29, 2024