Informer Channel

Internal policy of the whistleblower channel

I. INTRODUCTION, PURPOSE, AND APPLICATION

Law 2/2023, of February 20, regulating the protection of persons who report regulatory violations and the fight against corruption (hereinafter, Law 2/2023) transposes into Spanish law Directive 2019/1937 of the European Parliament and of the Council, of October 23, 2019, on the protection of persons who report breaches of Union law.

This policy applies to Smileat, S.L. with CIF B87144622 and registered office at Calle Gran Vía 62, 5ºD, 28013, Madrid, Madrid; and aims to establish an internal channel for reporting possible regulatory violations, breaches of internal and/or ethical policies, and to establish a protection regime for the whistleblower, in compliance with Law 2/2023, of February 20, regulating the protection of persons who report regulatory violations and the fight against corruption.

Law 2/2023 explains and clarifies in its preamble, Part III, that its purpose is to protect, against possible retaliation, those who, in a work or professional context, detect serious or very serious criminal or administrative offenses and report them through the mechanisms regulated in this policy.

This Channel, therefore, is a mechanism that allows company employees and other interested parties to report any type of illegal conduct or conduct contrary to our values and ethical principles, without fear of retaliation, strengthening the culture of information, the integrity infrastructures of organizations, and promoting a culture of information or communication as a mechanism to prevent and detect threats to the public interest. In this way, it seeks to promote a culture of transparency, integrity, and responsibility in our organization, while protecting those employees who decide to make a good faith report.

II. WHISTLEBLOWER CHANNEL

The entity has created a whistleblower channel (hereinafter, the WBC) as the preferred means to receive information about actions or omissions that may constitute serious or very serious criminal or administrative offenses, and other actions provided for in Article 2 of Law 2/2023.

The channel is under the administration of the Internal System Manager of the Channel (hereinafter, the ISMC). Access to this channel will be limited, within the scope of their competencies and functions, to:

1. The Internal System Manager of the Channel.
2. The administrator(s) delegated by the system manager.
3. To the managers designated for processing certain complaints according to the scope to which they correspond.

The functions of these bodies, as appropriate, will be:

• Reception, registration, and management of complaints received through the informant channel.
• Appointment of the person or team responsible for investigating the complaints received.
• Ensuring the protection of informants and the confidentiality of the complaints received.
• Evaluation of the truthfulness and credibility of the complaints received.
• Decision-making on appropriate measures based on the investigation results.
• Periodic monitoring and review of the complaint management process and the company's internal policy.
• Preparation of reports and recommendations for senior management on the complaints received and the measures adopted.

The CII must technically guarantee the confidentiality or, eventually, the anonymity of the informant, to protect them from any leak and subsequent retaliation they may be subject to.

• Link to the informant channel:

https://compliance.legalsending.com/canal/?C=48605139019046683

• QR Code

• Sending an email to the following address:

rrhh@smileat.com

• Postal mail addressed to Calle Gran Vía 62, 5ºD, 28013, Madrid, Madrid, attn: RSII: Javier Quintana Arranz

III. SUBJECTIVE SCOPE - INFORMANT SUBJECTS

Those who have a labor or professional relationship with the AEPD may use the internal information channel and benefit from the protection granted by Law 2/2023 as informants, to report information about the actions or omissions described in Article 2 of Law 2/2023. This labor or professional relationship, which entails dependence on the AEPD, is what makes special protection against possible retaliation necessary and appropriate.

In any case, for the purposes of this AEPD, informants are considered under Law 2/2023:

• Persons who have the status of employees or workers under an employment contract.
• Collaborating freelancers (freelance).
• Shareholders, participants, and persons belonging to the company's management, direction, or supervisory body, including non-executive members.
• Any person who works for or under the supervision and direction of contractors, subcontractors, and suppliers.
• Informants who communicate or publicly disclose information about violations obtained within the framework of a labor or statutory relationship already terminated, volunteers, interns, workers in training periods regardless of whether they receive remuneration or not, as well as those whose labor relationship has not yet begun, in cases where information about violations was obtained during the selection or pre-contractual negotiation process.

It is important to emphasize that reports made through the whistleblowing channel must be made in good faith, meaning they must be supported by evidence and concrete facts.

IV. OBJECTIVE SCOPE - REPORTABLE FACTS

Regarding the subject matter of the information, Law 2/2023 indicates that the internal reporting channel can be used to report serious misconduct or suspected corruption that may constitute serious or very serious criminal or administrative offenses related to the entity's activities, which the whistleblower has observed or received information about in the course of their work or professional relationship.

Law 2/2023 itself and Directive (EU) 2019/1937 list as such the information relating to:

1. Offenses falling within the scope of the European Union acts listed in the annex to the aforementioned Directive relating to the following areas
   1. Public procurement,
   2. Services, products and financial markets, and prevention of money laundering and terrorist financing,
   3. Product safety and compliance,
   4. Transport safety,
   5. Environmental protection,
   6. Protection against radiation and nuclear safety,
   7. Food and feed safety, animal health and animal welfare,
   8. Public health,
   9. Consumer protection,
   10. Protection of privacy and personal data, and security of networks and information systems.
2. That affect the financial interests of the European Union as set out in Article 325 of the Treaty on the Functioning of the European Union (TFEU).
3. That affect the internal market, as set out in Article 26, paragraph 2 of the TFEU, including violations of European Union competition rules and State aid, as well as infringements related to the internal market concerning acts that violate corporate tax rules or practices aimed at obtaining a tax advantage that distorts the purpose or objective of the applicable corporate tax legislation.
4. Actions or omissions that may constitute serious or very serious criminal or administrative offenses. In any case, all serious or very serious criminal or administrative offenses involving economic damage to the Public Treasury and Social Security shall be understood to be included.
5. Labor law violations regarding occupational health and safety reported by workers, without prejudice to what is established in their specific regulations.

The informant must provide at least a reference to the subjective scope of the violation (subject matter or regulation violated: European Union law; criminal offense; or administrative offense); and a description of the facts being reported (relevant information about what happened), as detailed as possible, attaching any documentation available, if applicable.

Similarly, you may provide your full name and a contact phone number if you do not choose to make this communication anonymously.

If the identity of the person responsible for the reported irregularity is known, or if these facts have been reported to another body or entity through an external channel, this information may also be provided.

V. COMPLAINT PROCEDURE

Information may be submitted to the entity anonymously. Otherwise, the informant’s identity will be kept confidential and limited to the knowledge of the RSII, managing directors, or appointed managers. These members will perform their duties independently and autonomously from the rest of the entity’s or organization’s bodies and will not receive instructions of any kind in their role, having all the necessary personal and material resources to carry out their tasks.

The company commits to investigating all reports of possible violations or breaches received through the complaint channel. All complaints will be investigated impartially and confidentially, and appropriate measures will be taken based on the investigation results to protect the informant.

The information or complaint will be communicated through the internal information channel via the specific electronic application designed for this purpose, identified and accessible from the website: https://www.smileat.com/

At the request of the informant, the complaint may also be submitted through an in-person meeting to be held within a maximum period of seven days. In such cases, the informant will be warned that the communication will be recorded and will be informed about the processing of their data in accordance with the provisions of the GDPR and the LOPDPGDD. When submitting the information, the informant must provide an address, email, or secure place for receiving notifications, unless they expressly waive receiving any communication regarding actions taken by the RSII as a result of the information.

Once the information is submitted, it will be registered in the information management system by assigning an identification code, which will be contained in a secure database with access restricted exclusively to authorized RSII personnel, where all received communications will be recorded with the following data:

1. Date of receipt.
2. Identification code.
3. Actions carried out.
4. Measures taken.
5. Closing date.

Upon receipt of the information, within no more than 7 calendar days from such receipt, an acknowledgment of receipt will be sent to the whistleblower, unless they have expressly waived receiving communications related to the investigation. These reports will be managed within a maximum period of 3 months except in cases of special complexity requiring an extension of the period, in which case it may be extended up to a maximum of an additional 3 months.

Once the information is registered, the RSII and its team will proceed to analyze its admissibility according to the material and personal scope provided in Articles 2 and 3 of Law 2/2023.

The company commits to informing the whistleblower about the status of the investigation and the measures taken, whenever possible and without compromising the confidentiality and protection of the whistleblower, who may request additional information regarding the facts reported through the channel.

Additionally, the company commits to monitoring all received reports and the measures taken to ensure the effectiveness of this policy and to continuously improve the process.

Any information that could indicatively constitute a crime will be immediately referred to the Public Prosecutor's Office. If the facts affect the financial interests of the European Union, the case will be referred to the European Public Prosecutor's Office.

VI. PROTECTION OF WHISTLEBLOWERS

The company commits to protecting individuals who report violations or non-compliance, in accordance with Law 2/2023.

A. Acts constituting retaliation.

Acts constituting retaliation, including threats of retaliation and attempts at retaliation against individuals who submit a report as provided by law, are expressly prohibited.

Retaliation is understood as any act or omission prohibited by law, or that, directly or indirectly, results in unfavorable treatment placing the affected individuals at a particular disadvantage compared to others in the work or professional context, solely because of their status as whistleblowers or for having made a public disclosure.

For the purposes of Law 2/2023, and by way of example, retaliation is considered to include measures adopted in the form of:

1. Suspension of the employment contract, dismissal, or termination of the employment or statutory relationship, including non-renewal or early termination of a temporary employment contract after the probation period, or early termination or cancellation of goods or services contracts, imposition of any disciplinary measure, demotion or denial of promotions, and any other substantial modification of working conditions, as well as failure to convert a temporary employment contract into a permanent one when the worker had legitimate expectations of being offered permanent employment; unless these measures are carried out within the regular exercise of managerial authority under labor legislation or the applicable public employee statute, due to circumstances, facts, or proven infractions unrelated to the submission of the report.
2. Damage, including reputational harm, economic losses, coercion, intimidation, harassment, or ostracism.
3. Negative evaluations or references regarding job or professional performance.
4. Inclusion on blacklists or dissemination of information within a specific sectoral scope that hinders or prevents access to employment or contracting of works or services.
5. Denial or cancellation of a license or permit.
6. Denial of training.
7. Discrimination, or unfavorable or unfair treatment.

A person whose rights have been violated due to their report or disclosure may request protection from the competent authority after a period of two years has elapsed. Exceptionally and with justification, the authority may extend the protection period, after hearing the persons or bodies that might be affected. Any denial to extend the protection period must be justified.

Administrative acts aimed at preventing or hindering the submission of reports and disclosures, as well as those that constitute retaliation or cause discrimination following the submission of such reports under this law, shall be null and void and may give rise, where appropriate, to corrective disciplinary or liability measures, which may include compensation for damages to the affected party.

B. Measures to protect the whistleblower against retaliation

Persons who communicate information about the actions or omissions covered in SECTION FOUR, or who make a public disclosure in accordance with Law 2/2023, shall not be considered to have violated any restriction on information disclosure and shall not incur any liability in connection with such communication or public disclosure, provided they had reasonable grounds to believe that the communication or public disclosure of such information was necessary to reveal an action or omission under said law, all without prejudice to the provisions of specific protection rules applicable in the labor field. This measure shall not affect criminal liabilities.

The provisions of the previous paragraph extend to communications made by workers' representatives, even if they are subject to legal obligations of confidentiality or non-disclosure of reserved information. This is without prejudice to the specific protection rules applicable in the labor field.

Whistleblower protection measures shall also apply, where appropriate, to:

1. natural persons who assist the whistleblower in the process;
2. natural persons related to the whistleblower who may suffer retaliation, such as coworkers or family members of the whistleblower;
3. legal entities for which they work or with which they maintain any other type of relationship in a work context or in which they hold a significant participation.

For these purposes, participation in the capital or voting rights corresponding to shares or stakes is considered significant when, due to its proportion, it allows the holder to have influence over the participated legal entity.

Whistleblowers shall not be held liable regarding the acquisition or access to information that is communicated or publicly disclosed, provided that such acquisition or access does not constitute a crime.

Any other possible liability of whistleblowers arising from acts or omissions not related to the communication or public disclosure, or not necessary to reveal an infringement under Law 2/2023, shall be enforceable in accordance with applicable regulations.

In proceedings before a judicial body or other authority concerning damages suffered by whistleblowers, once the whistleblower has reasonably demonstrated that they have communicated or made a public disclosure in accordance with Law 2/2023 and have suffered harm, it shall be presumed that the harm was caused as retaliation for reporting or making a public disclosure. In such cases, the person who took the harmful measure shall have the burden of proving that the measure was based on duly justified reasons unrelated to the communication or public disclosure.

In judicial proceedings, including those related to defamation, copyright infringement, breach of confidentiality, violation of data protection rules, disclosure of trade secrets, or claims for compensation based on labor or statutory law, whistleblowers shall not incur any liability as a result of communications or public disclosures protected by Law 2/2023. Such persons shall have the right to argue in their defense, within the framework of the aforementioned judicial proceedings, that they communicated or made a public disclosure, provided they had reasonable grounds to believe that the communication or public disclosure was necessary to reveal a violation under Law 2/2023.

Explicitly excluded from the protection provided by the law are those persons who communicate or disclose:

1. Information contained in reports that have been rejected by any internal reporting channel or for any of the causes provided for in the law.
2. Information related to claims about interpersonal conflicts or that affect only the whistleblower and the persons referred to in the report or disclosure.
3. Information that is already fully available to the public or that constitutes mere rumors.
4. Information referring to actions or omissions not covered by the scope of the law.

C. Measures for the protection of affected persons

During the processing of the file, the persons affected by the report shall have the right to the presumption of innocence, the right of defense, and the right to access the file under the terms provided in Law 2/2023, as well as the same protection established for whistleblowers, preserving their identity and guaranteeing the confidentiality of the facts and data of the procedure.

The Independent Whistleblower Protection Authority, A.A.I., may, within the framework of the sanctioning procedures it conducts, adopt provisional measures under the terms established in article 56 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations.

D. Cases of exemption and mitigation of the sanction

When a person who participated in the commission of the administrative offense subject to the report is the one who informs of its existence by submitting the report, and provided that it was submitted before the initiation of the investigation or sanctioning procedure was notified, the competent authority to resolve the procedure may, by reasoned resolution, exempt them from complying with the corresponding administrative sanction, provided that the following points are proven in the file:

1. Having ceased the commission of the violation at the time of submitting the communication or disclosure and, if applicable, identified the other persons who participated in or facilitated it.
2. Having cooperated fully, continuously, and diligently throughout the entire investigation procedure.
3. Having provided truthful and relevant information, evidence, or significant data to prove the investigated facts, without having destroyed or hidden them, nor disclosed their content to third parties, directly or indirectly.
4. Having proceeded to repair the damage caused that is attributable to them.

When these requirements are not fully met, including partial repair of the damage, it will be at the discretion of the competent authority, after evaluating the degree of contribution to the resolution of the case, whether to mitigate the sanction that would have corresponded to the committed violation, provided that the informant or whistleblower has not been previously sanctioned for acts of the same nature that gave rise to the initiation of the procedure.

The mitigation of the sanction may extend to the other participants in the commission of the violation, depending on the degree of active collaboration in clarifying the facts, identifying other participants, and repairing or reducing the damage caused, as assessed by the body responsible for the resolution.

Law 2/2023 excludes from the provisions in this section the violations established in Law 15/2007, of July 3, on Defense of Competition.

VII. CONFIDENTIALITY AND DATA PROTECTION

Any personal data collected will be processed in accordance with the Privacy Policy

VIII. COMMUNICATION AND REVIEW OF POLICIES AND PROCEDURES

The company will conduct regular training sessions and awareness campaigns to promote a culture of integrity and transparency, and to inform employees and other stakeholders about the whistleblowing channel. It will also provide information about the rights and protections offered to whistleblowers under Law 2/2023.

The company commits to disseminate this policy to all employees and stakeholders, and will update, at least every three years, and if applicable, modify this internal channel policy, taking into account the experience gained and the recommendations of the Competent Authority.

In Madrid on November 29, 2024