SONPURA

LUIS SORIANO S.A

Internal whistleblower channel policy

I. INTRODUCTION, PURPOSE AND APPLICATION

Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption (hereinafter, Law 2/2023) transposes into Spanish law Directive 2019/1937 of the European Parliament and of the Council, of 23 October 2019, on the protection of persons who report breaches of Union law.

This policy applies to LUIS SORIANO S.A with CIF A08608770 and registered office at c/ Sant Miquel de Toudell s/n, Polígono Industrial Can Mir, 8232, Viladecavalls, Barcelona; and aims to establish an internal channel for reporting potential regulatory breaches, violations of internal and/or ethical policies, and to establish a protection regime for the whistleblower, in compliance with Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption.

Law 2/2023 explains and clarifies in its preamble, Part III, that its purpose is to protect, against possible reprisals, persons who, in a work or professional context, detect serious or very serious criminal or administrative offences and report them through the mechanisms regulated in this policy.

This Channel is therefore a mechanism that allows company employees, as well as other stakeholders, to report any type of illegal conduct or behavior contrary to our values and ethical principles, without fear of reprisals. It strengthens the culture of information, the integrity infrastructures of organizations, and promotes the culture of communication as a mechanism to prevent and detect threats to the public interest. In this way, it seeks to promote a culture of transparency, integrity, and responsibility within our organization, while protecting those employees who decide to report in good faith.

II. WHISTLEBLOWER CHANNEL

The entity has created a whistleblower channel (hereinafter, the WC) as the preferred means to receive information on actions or omissions that may constitute a serious or very serious criminal or administrative offence, as well as other actions provided for in Article 2 of Law 2/2023.

The channel is managed by the Internal System Manager of the Channel (hereinafter, the ISMC). Access to this channel will be limited, within the scope of their duties and responsibilities, to:

1. The Internal System Manager of the Channel.
2. The administrator(s) delegated by the system manager.
3. The managers designated for handling specific complaints according to their area of competence.

The functions of these bodies, as applicable, shall be:

• Reception, registration, and management of reports received through the whistleblower channel.
• Designation of the person or team in charge of investigating the reports received.
• Ensuring the protection of whistleblowers and the confidentiality of the reports received.
• Assessment of the truthfulness and credibility of the reports received.
• Decision-making on appropriate measures based on the results of the investigation.
• Monitoring and periodic review of the reporting management process and the company’s internal policy.
• Preparation of reports and recommendations for senior management regarding the reports received and the measures adopted.

Les fonctions de ces organes, selon le cas, seront :

• Réception, enregistrement et gestion des signalements reçus via le canal du lanceur d’alerte.
• Désignation de la personne ou de l’équipe chargée de l’enquête sur les signalements reçus.
• Assurer la protection des lanceurs d’alerte et la confidentialité des signalements reçus.
• Évaluation de la véracité et de la crédibilité des signalements reçus.
• Prise de décisions concernant les mesures appropriées en fonction des résultats de l’enquête.
• Suivi et révision périodique du processus de gestion des signalements et de la politique interne de l’entreprise.
• Élaboration de rapports et recommandations à la direction générale sur les signalements reçus et les mesures adoptées.

• Individuals who are employees or salaried workers.
• Self-employed collaborators (freelancers).
• Shareholders, partners, and members of the company’s administrative, management, or supervisory bodies, including non-executive members.
• Any person working for or under the supervision and direction of contractors, subcontractors, and suppliers.
• Whistleblowers who disclose or publicly reveal information about breaches obtained within the framework of an employment or statutory relationship that has already ended, as well as volunteers, interns, trainees—whether remunerated or not—and those whose employment relationship has not yet begun, in cases where information on breaches was obtained during the recruitment or pre-contractual negotiation process.

It is important to note that reports made through the whistleblower channel must be made in good faith, that is, supported by evidence and concrete facts.

IV. OBJECTIVE SCOPE - REPORTABLE FACTS

Regarding the subject matter of the information, Law 2/2023 establishes that the internal reporting channel may be used to report serious misconduct or suspected corruption that may constitute serious or very serious criminal or administrative offenses related to the entity’s activities, which the whistleblower has observed or of which they have become aware in the course of their work or professional relationship.

Law 2/2023 itself and Directive (EU) 2019/1937 list as such, information relating to:

1. Infringements falling within the scope of the acts of the European Union listed in the Annex to the aforementioned Directive, relating to the following areas:

• public procurement,
• financial services, products and markets, and prevention of money laundering and terrorist financing,
• product safety and compliance,
• transport safety,
• environmental protection,
• protection against radiation and nuclear safety,
• food and feed safety, animal health and animal welfare,
• public health,
• consumer protection,
• privacy and personal data protection, and security of networks and information systems.

2. That affect the financial interests of the European Union as provided for in Article 325 of the Treaty on the Functioning of the European Union (TFEU).

3. That impact the internal market, as provided for in Article 26(2) of the TFEU, including infringements of EU rules on competition and State aid, as well as infringements relating to the internal market in connection with acts that breach corporate tax rules or practices aimed at obtaining a tax advantage that undermines the purpose or intent of the applicable corporate tax legislation.

4. Actions or omissions that may constitute a serious or very serious criminal or administrative offence. In any case, this includes all serious or very serious criminal or administrative infringements that cause economic damage to the Public Treasury and Social Security.

5. Breaches of labor law concerning occupational health and safety reported by workers, without prejudice to what is established in their specific regulations.

The reporting person must provide, at a minimum, a reference to the scope of the infringement (subject matter or regulation violated: European Union law; criminal offence; or administrative offence), and a description of the reported facts (relevant information about what occurred), as detailed as possible, attaching any supporting documentation available, where applicable.

Likewise, you may provide your full name and a contact phone number, should you choose not to make this communication anonymously.

If you know the identity of the person responsible for the reported irregularity, or if you have already brought these facts to the attention of another body or entity through an external channel, you may also provide this information.

V. REPORTING PROCEDURE

Information may be communicated to the entity anonymously. Otherwise, the identity of the whistleblower will be kept confidential and will only be known to the RSII, delegated administrators, or appointed managers. These members will perform their duties independently and autonomously from the other bodies of the entity and shall not receive any instructions in their role, having all necessary personal and material resources to carry them out.

The company is committed to investigating all reports of potential breaches or violations received through the reporting channel. All reports will be investigated impartially and confidentially, and appropriate measures will be taken based on the investigation results to protect the whistleblower.

The information or report will be communicated through the internal reporting channel using the specific electronic application created for this purpose, identified and accessible via the website: https://www.sonpura.es/

At the whistleblower’s request, the report may also be submitted through a face-to-face meeting that will take place within a maximum of seven days. The whistleblower will be informed that the communication will be recorded and will be informed about the processing of their data in accordance with the GDPR and the LOPDPGDD. When submitting the information, the whistleblower must provide an address, email, or safe place for receiving notifications, unless they expressly waive receipt of any communications regarding actions taken by the RSII as a result of the report.

Once the information has been submitted, it will be recorded in the information management system by assigning an identification code, which will be stored in a secure database with restricted access exclusively to duly authorized RSII staff. All communications received will be recorded in this system with the following data:

1. Date of receipt.
2. Identification code.
3. Actions taken.
4. Measures adopted.
5. Closing date.

Once the information has been received, within no more than 7 calendar days, an acknowledgment of receipt will be sent to the whistleblower, unless they have expressly waived receiving communications regarding the investigation. These reports will be handled within a maximum of 3 months, except in cases of particular complexity requiring an extension, in which case the period may be extended by up to an additional 3 months.

Once the information has been registered, the RSII and its team will analyze its admissibility in accordance with the material and personal scope set out in Articles 2 and 3 of Law 2/2023.

The company undertakes to inform the whistleblower about the status of the investigation and the measures adopted, whenever possible and without compromising the confidentiality and protection of the whistleblower, and may request additional information regarding the facts reported through the channel.

In addition, the company undertakes to monitor all reports received and the measures adopted to ensure the effectiveness of this policy and to continuously improve the process.

Any information will be immediately forwarded to the Public Prosecutor’s Office when the facts may constitute a criminal offense. If the facts affect the financial interests of the European Union, they will be referred to the European Public Prosecutor’s Office.

VI. PROTECTION OF WHISTLEBLOWERS

The company is committed to protecting individuals who report violations or breaches, in accordance with Law 2/2023.

A. Acts Constituting Retaliation

Acts constituting retaliation, including threats of retaliation and attempts of retaliation against persons who make a report in accordance with the law, are expressly prohibited.

Retaliation is understood as any act or omission prohibited by law, or that, directly or indirectly, results in unfavorable treatment placing the affected persons at a particular disadvantage compared to others in the professional context, solely because of their status as whistleblowers or for having made a public disclosure.

For the purposes of Law 2/2023, and by way of example, retaliation shall be considered as those adopted in the form of:

a. Suspension of the employment contract, dismissal or termination of the employment or statutory relationship, including non-renewal or early termination of a temporary employment contract after the probationary period, or early termination or cancellation of contracts for goods or services, imposition of any disciplinary measure, demotion or denial of promotion and any other substantial modification of working conditions, as well as the failure to convert a temporary contract into a permanent one where the worker had legitimate expectations of being offered permanent employment; unless such measures are carried out in the regular exercise of management authority under applicable labor law or public service regulations, for proven circumstances, facts or breaches unrelated to the filing of the report.

b. Damages, including reputational harm, or financial losses, coercion, intimidation, harassment or ostracism.

c. Negative evaluations or references regarding job or professional performance. d. Blacklisting or dissemination of information within a specific sector that hinders or prevents access to employment or the awarding of contracts for works or services.

e. Denial or cancellation of a license or permit.

f. Denial of training.

g. Discrimination, or unfavorable or unfair treatment.

Any person whose rights have been infringed as a result of their communication or disclosure, after a period of two years, may request protection from the competent authority which, exceptionally and with due justification, may extend the protection period, after hearing the persons or bodies that may be affected. The refusal to extend the protection period must be duly reasoned.

Administrative acts intended to prevent or hinder the submission of communications and disclosures, as well as those that constitute retaliation or cause discrimination following such submissions under this law, shall be null and void and may give rise, where applicable, to disciplinary or liability corrective measures, which may include appropriate compensation for damages suffered by the affected party.

B. Protection measures for whistleblowers against retaliation

Persons who report information on the actions or omissions set out in section FOUR, or who make a public disclosure in accordance with Law 2/2023, shall not be deemed to have breached any restrictions on the disclosure of information and shall not incur any liability of any kind in relation to such communication or public disclosure, provided they had reasonable grounds to believe that the communication or public disclosure of such information was necessary to reveal an action or omission under said law, without prejudice to specific protection rules applicable in the labor field. This measure shall not affect criminal liability.

The above also applies to the communication of information made by workers’ representatives, even when subject to legal obligations of secrecy or non-disclosure of confidential information. All this without prejudice, likewise, to the specific protection rules applicable in the labor field.

Whistleblower protection measures shall also apply, where appropriate, to:

a. natural persons who assist the whistleblower in the process;

b. natural persons related to the whistleblower who may suffer retaliation, such as co-workers or family members of the whistleblower;

c. legal entities for which the whistleblower works, with which they have any other type of relationship in a professional context, or in which they hold a significant participation.

For these purposes, participation in share capital or voting rights shall be considered significant when, due to its proportion, it enables the holder to exercise influence over the legal entity concerned.

Whistleblowers shall not be held liable for the acquisition of, or access to, information that is communicated or publicly disclosed, provided that such acquisition or access does not constitute a criminal offence.

Any other potential liability of whistleblowers arising from acts or omissions not related to the communication or public disclosure, or not necessary to reveal a violation under Law 2/2023, shall be enforceable in accordance with the applicable regulations.

In proceedings before a court or other authority, relating to damages suffered by whistleblowers, once the whistleblower has reasonably demonstrated that they reported or made a public disclosure in accordance with Law 2/2023 and that they suffered harm, it shall be presumed that the harm occurred as a reprisal for reporting or making a public disclosure. In such cases, it shall be for the person who took the detrimental measure to prove that such measure was based on duly justified grounds unrelated to the report or public disclosure.

In judicial proceedings, including those concerning defamation, copyright infringement, breach of confidentiality, violation of data protection rules, disclosure of trade secrets, or claims for damages under labor or statutory law, whistleblowers shall not incur any liability as a result of communications or public disclosures protected under Law 2/2023. Such persons shall have the right to plead, in their defense and within the framework of such proceedings, that they reported or made a public disclosure, provided they had reasonable grounds to believe that the report or public disclosure was necessary to expose a violation under Law 2/2023.

Explicitly excluded from the protection provided by the law are those persons who report or disclose:

1. Information contained in reports that has been deemed inadmissible by an internal reporting channel or for any of the reasons set out in the law.
2. Information related to claims about interpersonal conflicts or that concern only the whistleblower and the persons referred to in the report or disclosure.
3. Information already fully available to the public or that constitutes mere rumors.
4. Information relating to actions or omissions not covered by the scope of the law.

C. Measures for the protection of affected persons

During the processing of the case, the persons affected by the report shall have the right to the presumption of innocence, the right of defense, and the right of access to the file under the terms set out in Law 2/2023, as well as the same protection established for whistleblowers, with their identity preserved and confidentiality of the facts and data of the procedure guaranteed.

The Independent Whistleblower Protection Authority, A.A.I., may, within the framework of the sanctioning procedures it conducts, adopt interim measures under the terms established in Article 56 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations.

D. Cases of exemption and mitigation of sanctions

When a person who has participated in the commission of the administrative offense that is the subject of the report is the one who discloses its existence by submitting the information, and provided that it was submitted prior to notification of the initiation of the investigation or sanctioning procedure, the competent authority to decide on the procedure may, by reasoned resolution, exempt them from the administrative sanction that would otherwise apply, provided that the following circumstances are duly established in the file:

a. Having ceased the commission of the offense at the time of submitting the report or disclosure and, where applicable, having identified the other persons who participated in or facilitated it.

b. Having fully, continuously, and diligently cooperated throughout the investigation procedure.

c. Having provided truthful and relevant information, evidence, or significant data to substantiate the facts under investigation, without having destroyed or concealed them, nor disclosed their content to third parties, directly or indirectly.

d. Having repaired the damage caused that can be attributed to them.

When these requirements are not fully met, including partial reparation of the damage, it shall be at the discretion of the competent authority, after assessing the degree of contribution to the resolution of the case, to decide whether to mitigate the sanction corresponding to the committed offense, provided that the whistleblower or the disclosing party has not previously been sanctioned for acts of the same nature that led to the initiation of the procedure.

The mitigation of the sanction may also be extended to the other participants in the commission of the offense, depending on their level of active cooperation in clarifying the facts, identifying other participants, and repairing or reducing the damage caused, as assessed by the authority in charge of the resolution.

Law 2/2023 excludes from this provision the offenses established in Law 15/2007 of July 3, on the Defense of Competition.

VII. CONFIDENTIALITY AND DATA PROTECTION

The processing of personal data shall be carried out in compliance with Law 2/2023 of February 20, regulating the protection of persons who report regulatory violations and the fight against corruption, Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, Organic Law 3/2018 of December 5, on the Protection of Personal Data and Guarantee of Digital Rights, and Organic Law 7/2021 of May 26, on the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offenses and the enforcement of criminal penalties.

The personal data processed, the documents provided, and any other information included in the report containing personal data shall be treated confidentially by the channel managers, as well as by administrators and potential processors, for the purpose of complying with the obligation to investigate and manage the submitted report, as well as to fulfill the legal obligations established in Law 2/2023 of February 20.