INTERNAL INFORMATION SYSTEM

The Internal Information System (hereinafter, IIS) is the system implemented by CIDETEC to receive and manage information regarding potential irregularities, ensuring protection against retaliation for reporting people, provided that the communication falls within the established legal framework.

The relevant regulation is the Whistleblowing Directive (European Directive 1937/2019), which was transposed into Spanish law by Law 2/2023, regulating the protection of individuals reporting regulatory infringements and anti-corruption measures.

Through the internal channels provided, any person with a work or professional relationship with our organization can report potential criminal, administrative (serious or very serious), or European Union law violations, as well as breaches of our ethical code, with full guarantees of security and confidentiality and without risk of retaliation, provided they act in good faith.

The IIS is part of our Compliance System and comprises the following elements:

• A policy or fundamental principles of the IIS.
• A specific and independent responsible body, legally appointed by the Governing Board, which has designated a natural person to be in charge of receiving and processing information.
• Internal channels for receiving communications, designed and enabled to comply with the legal requirements of security and confidentiality.
• A mandatory communication management procedure that ensures the requirements of protection, confidentiality, objectivity and effectiveness in the process of receiving, processing and resolving the communications received.
• And an IT platform that enables both case reporting and internal management of the procedure. This is carried out in a secure way, with restricted data access exclusively for legally authorised personnel, and includes a private web area for tracking and bidirectional information and documentation exchange with the reporting person.

Upon entering our internal channel platform, you will reach a main page where you will be reminded of the general aspects of the channel and where you can read detailed information about our privacy policies for reporting people and affected individuals.

From there, you can access the form that allows you to provide the details of your information, either in written form, through a secure audio recording, or by attaching additional documentation if desired. We apply technical measures to protect your identity by removing metadata from files, distorting voice recordings, and always encrypting any information exchange.

You may report information anonymously or by identifying yourself. Your personal data will be used exclusively for the intended purposes, as outlined in the privacy policy, and will be processed by authorized personnel. Your identity will never be revealed to the person to whom the reported facts relate, nor to third parties.

In the form, you will have the option to request an appointment to present or expand upon the information in person with the case manager. This appointment will be scheduled within a maximum of 7 days from your request via the private web tracking area, which is explained below.

Verbal communications must be documented, with the reporting person’s prior consent, either by secure, durable, and accessible recording or by a complete and accurate transcription of the communication. Without prejudice to the rights you are entitled to under data protection regulations, the reporting person will be offered, whenever possible, the opportunity to review, correct, and sign the transcription of the conversation.

Once the form is completed, we will confirm the registration of your communication and provide you with an access key to the private tracking area, where you can, if you wish, monitor the progress of your case and communicate and exchange information and documentation with the case manager in an easy, secure, and confidential manner. It is essential to keep this key safe as, for confidentiality reasons, it cannot be recovered, and in case of loss or forgetting, you will need to resubmit the information.

During the case management process, you may be asked for additional information through this private tracking area, so it is advisable to check periodically to review its status. If you wish, when you are provided with access keys to the private tracking area, you will be given the option to provide an email address solely for the purpose of notifying you of updates in your case.

The case manager will review the submitted information to determine whether it can be processed and will notify the reporting person of the acceptance or rejection of the communication.

If your communication is accepted for processing, an internal investigation will begin, and within a maximum of 3 months (extendable to 6 months due to case complexity), you will be notified of the final resolution.

External channel of the Independent Whistleblower Protection Authority:

Although the preferred channel for reporting potential breaches is through the internal channel, if the irregularity you wish to report falls within the scope of Article 2 of Law 2/2023, in other words, it concerns possible criminal, serious or very serious administrative or EU law violations, you may report it through the external channel of the competent Independent Whistleblower Protection Authority, either directly or after having reported it through our internal channel.