Internal Information System or Complaints Channel Procedure

1.- THE INTERNAL INFORMATION SYSTEM OR COMPLAINT CHANNEL.

1.1.- Concept and nature.

The penal code warns in its art. 31 bis, of the obligation of the legal entity to establish within itself systems or means for communication about possible risks or legal breaches.

Likewise, Law 2/2023, of February 20, regulating the protection of persons who report regulatory infringements and the fight against corruption, has also introduced a series of requirements that legal entities must meet for the establishment and management of these “internal information systems” or “reporting channel”.

Therefore, this Entity, as part of its culture of ethical compliance, has implemented this INTERNAL INFORMATION SYSTEM OR COMPLAINT CHANNEL, through which it will be possible to report events related to materialized risks, facts on which there are suspicions of the commission of a crime and also any other conduct that implies a breach of legal regulations, as well as the Internal Policies of the Company.

It may be used by all workers, members of the administrative body or any other interested third party included in art. 3 of the aforementioned Law 2/2023 of February 20, in a confidential or anonymous manner without fear of any reprisal under the provisions of the aforementioned regulation.

By filing their complaint and expressing their concern, the complainant is contributing to our Entity being recognized as a responsible organization in all aspects of its activity.

1.2.- Basic guiding principles of the System

Accessibility: There are different options for filing complaints:

  • Through the following email address: canalcomunicacion@kbv-group.com
  • By mail to the address Attn: Compliance Officer, Kitchen Bath Ventures, SL, C/ Acanto, 22-9, 28045 Madrid

Confidentiality: The identity and contact details of the person making the communication, as well as the facts and documents communicated regarding the possible irregular activity through this channel, will always be considered confidential information and, therefore, will not be communicated without their consent to the accused and/or third parties or unless required by an administrative or judicial authority, in accordance with the provisions of art. 31.1 of Law 2/2023.

Anonymity: Anonymous complaints are accepted, for which only the options of sending by post or hand delivery must be used, by means of a sealed envelope addressed to the attention of the INFORMATION SYSTEM MANAGER and without indicating any data of the person presenting the communication, either on the envelope or in the complaint itself.

System Manager: The Entity has delegated the management of complaints to a system manager, duly identified and in accordance with Law 2/2023.

Objectivity and impartiality: all complaints will be handled objectively and impartially, guaranteeing the right to privacy, defense and the presumption of innocence of the people involved.

Data protection: In accordance with Article 24 of Organic Law 3/2018 of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (amended by Additional Provision Seven of the aforementioned Law 2/2023), “The processing of personal data necessary to guarantee the protection of persons who report regulatory infringements shall be lawful. Such processing shall be governed by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, Organic Law 3/2018 of December 5, on the Protection of Personal Data and Guarantee of Digital Rights, and the Law regulating the protection of persons who report regulatory infringements and the fight against corruption.” The legal basis for the processing of data is found in Article 30.3 of the LOPDGDD.

The data must be kept in the reporting system only for as long as necessary to decide whether or not to initiate an investigation into the reported events. In any case, after three months from the date the data was entered (or six months if the period has been extended due to the complexity of the report), it must be deleted from the system, unless the purpose of retaining it is to provide evidence of the functioning of the model for preventing the commission of crimes by the legal entity.

Under no circumstances will personal data that is not necessary for these purposes or that relates to conduct not included within the scope of the law be processed; such data will be immediately deleted. If the information received contains special category personal data, it will be immediately deleted, without being recorded or processed.

If the facts are proven or there is sufficient evidence, the data will be kept as long as necessary for the Entity to exercise its rights before the courts of justice.

Those complaints that have been made anonymously will be identified by an internal reference in order to be incorporated into the complaints system.

Only the following will have access to the complaints:

  • The person in charge of the system.
  • The competent internal body duly designated in the Entity, when the adoption of disciplinary measures against a worker may be appropriate.
  • The head of the Entity’s legal services, if the adoption of legal measures in relation to the reported facts is appropriate.
  • External advisors or third parties that may be necessary due to the nature of the case, who will be considered as processors or sub-processors of the data processing.
  • The Data Protection Officer and the Compliance Officer

1.3.- Rights and Obligations

Rights and Guarantees of Informants

Informants will be guaranteed the effective exercise of the following rights, without prejudice to any others recognized by the Constitution and the laws:

  • submit information anonymously, as long as anonymity is maintained during the procedure, provided that the established procedure indicated above is followed.
  • You may submit your complaint verbally or in writing. For verbal complaints, a system will be made available to facilitate this method of communication.
  • Please provide an address, email address, or secure location where you can receive communications from the System Manager, except for anonymous complaints.
  • appear before the System Manager or the delegated manager on your own initiative.
  • waiver of the right to communicate with the System Manager or the delegated manager who is instructing the procedure and, where applicable, to the revocation of said waiver at any time.
  • Preservation of their identity. The identity of the informant may not be revealed without their express consent to any person who is not competent to receive and manage the complaints, with the exceptions established by European Union law or Spanish regulations in the context of investigations carried out by the authorities or in the course of judicial proceedings.
  • protection of your personal data.
  • to know the identity of the manager who will instruct the procedure.
  • confidentiality of communications.
  • protection and support measures as provided for in Law 2/2023.
  • file a complaint with the Independent Whistleblower Protection Authority.
  • not to be subject to reprisals, even if the results of the investigations verify that there has been no breach of the applicable regulations or the internal regulations of the Entity, provided that he/she has not acted in bad faith.

1.4.- Obligations of the Informants

Informants, with respect to the submission of their communications through the Internal Information Channel, will be subject to the following obligations:

  • They must have reasonable or sufficient evidence about the accuracy of the information they communicate, and cannot make generic, bad-faith, or abusive communications, in which case they could incur civil, criminal, or administrative liability.
  • Describe in as much detail as possible the facts or behaviors you are reporting, providing all available documentation on the situation described or objective evidence to obtain proof.
  • Refrain from making communications with a purpose other than that intended by the System or that violate the fundamental rights to honor, image and personal and family privacy of third parties or that are contrary to the dignity of the person.

1.5.- Rights of Third Parties

Persons considered as third parties in the proceedings will be granted the rights recognized by the Constitution and the laws, without prejudice to the possibility of extending to them, to the extent possible, the support and protection measures for informants provided for in Law 2/2023; specifically the following:

  • to be informed, as soon as possible, of information that affects them
  • access to the proceedings against them, without prejudice to any time limitations that may be adopted to guarantee the outcome of the proceedings.
  • to know the identity of the manager who will instruct the procedure.
  • To honor and privacy, as well as to the preservation of their identity. The identity of the third party may not be revealed without their express consent to any person who is not competent to receive and manage complaints, with the exceptions established by European Union law or Spanish regulations in the context of investigations carried out by the authorities or in the course of judicial proceedings.
  • presumption of innocence and to use all legally valid means for their defense
  • Please provide an address, email address, or secure location where you can receive communications from the System administrator.
  • appear before the System Manager or the delegated manager on your own initiative.
  • protection of your personal data.
  • confidentiality of communications.
  • not to be subject to reprisals.

2. PROCEDURE FOR REPORTING INCIDENTS

2.1.- Incidents or non-compliance to be reported

The following are considered reportable incidents or non-compliance:

  • Any violation of current legislation
  • Any breach of the INTERNAL POLICIES of our Entity or of the values, general principles of action or rules of conduct of the workers, which are included therein.
  • Any contingency that may pose a risk to the reputation of our Entity.

2.2.- Minimum content of complaints.

For their admission and proper processing, communications or complaints must necessarily contain the following information:

  • Complainant identified by name and surname (except for anonymous complaints) concise statement of the facts or arguments that support the communication/complaint.
  • person or department against whom the communication/complaint is directed

The burden of proof will always fall on the complaining party, who must provide the documents on which the complaint is based, and the accused party may provide the documents that it deems appropriate to counter those of the other party.

If any of the people affected by the communication/complaint are involved in the investigation of this communication/complaint, they must be replaced by someone who is not directly related to the communication/complaint in question.

3.- INSTRUCTION PHASE OF THE PROCEDURE

3.1.- Receipt and acknowledgment of receipt

Upon receiving the communication/complaint, the system administrator will acknowledge receipt to the complainant within a maximum of 3 days, unless the complainant is anonymous, and will initiate the appropriate verifications and checks; generating a file that will be registered and identified by a reference.

If necessary and the complaint is not anonymous, the system administrator may request clarifications or further information.

3.2.- Preliminary analysis of the information received

With this initial information, the system administrator will conduct a preliminary analysis to verify the nature, sufficiency, and plausibility of the complaint, the credibility of the complainant, and the relevance of the reported facts to these purposes; determining whether they may constitute a legal infraction or a violation of the Entity’s internal policies.

Depending on the outcome of this preliminary analysis, one of the following decisions may be adopted, with a reasoned report, by means of a written decision:

  • Inadmissibility of the notification or complaint and immediate archiving of the file when the reported facts do not constitute any of the cases provided for this channel
  • Acceptance of the notification or complaint and immediate filing of the file when its content is manifestly irrelevant, when the information is insufficient to proceed with any further action, when the reported facts are implausible or the informant is totally lacking in credibility.
  • Admission of the notification or complaint and initiation of the corresponding investigation file in relation to the reported facts.

3.3.- Procedure after the analysis

If the complaint is deemed inadmissible, the system manager will inform the complainant or informant (except for anonymous complaints) of the inadmissibility of the complaint or the filing of the file, as the case may be, as well as any additional measures that may have been taken.

If the complaint is accepted, the investigating body will be formed, whose functions are to process the complaint and to draft the report for its resolution.

However, urgent measures may be adopted, always with justification, and for the following purposes:

  • To mitigate the effects of the risk that has materialized or is yet to materialize
  • Implementation of urgent measures to preserve evidence
  • Urgent communication, where applicable, of the information to the Governing Bodies of the Entity

If admitted, the procedure will follow these steps:

  • Identify the legislation, policies, procedures or internal regulations affected, as well as the reputational, economic, financial or legal risks that may arise from the incident.
  • Identify all information and documents that may be relevant and whose review is considered useful (emails, websites, audiovisual media for surveillance and security of the company, lists of attendees, passwords or electronic security devices, accounting records, etc.).
  • To determine, with the collaboration of the Human Resources Department, the need and, where appropriate, the urgency of adopting precautionary measures with respect to the subjects under investigation.
  • Depending on the severity, suspend the subjects under investigation immediately.

The investigation will include all investigative steps that may be appropriate to clarify the facts, the responsible parties, and the corrective measures that should be adopted.

The following are some of the main steps that may form part of any investigation:

  • In the case of a non-anonymous complaint, an interview will be held with the complainant in order to obtain more information about the complaint filed.
  • Statement of the subjects under investigation.
  • Conduct confidential questionnaires and interviews with witnesses.
  • Arrange hearings with the subjects under investigation, their superiors and colleagues, as well as with any other persons deemed necessary.
  • Gather as much information as possible through the company’s documentation.
  • If it is essential for clarifying the facts, adopt surveillance measures through detectives or computer, telematics or audiovisual means, provided that they comply with criteria of reasonableness, suitability and proportionality, ensuring at all times the right to privacy of the worker and the right to the secrecy of communications.
  • Request external help from other professionals.
  • Any other steps that the Investigating Body deems necessary for the clarification of the facts.

3.4.- Communication to the subjects under investigation

Except for anonymous complaints, the system manager will contact the parties, identifying himself to them as the person in charge of investigating the complaint and briefly informing them about the facts attributed to them and the main milestones that may occur during the investigation.

In the event that the complaint is deemed inadmissible, the complainant will be informed of this fact within a maximum period of 3 days from its submission (except for anonymous complaints).

3.5.- Documentation of the investigation procedure

It will be essential to include in the file the detailed documentation of the entire investigation procedure carried out, such as the documents that are collected and the minutes of the interviews that are held.

In all interviews conducted by the Investigating Body, it will take written note of the relevant facts of the interview, incorporating them into a record, which must be signed by the appearing parties and by the members of the investigating committee.

Furthermore, information will be provided in all cases regarding the requirements of current legislation on data protection.

3.6.- Final report of the investigating body

Once all investigative procedures have been completed, the Investigating Body will prepare a report of conclusions within 15 days, which will contain a brief description of the following elements:

  • Identity of the members of the investigating committee.
  • Nature of the contingency. The intervening subjects, the nature of the events, the date, place and circumstances in which they supposedly occurred, the legal precepts or internal regulations infringed or endangered will be identified to the extent possible.
  • Statement of relevant facts and findings. The most relevant facts gathered throughout the investigation procedure will be described, differentiating between those obtained from company documentation, information provided by the complainant, or interviews conducted with the subjects under investigation and with witnesses.
  • Conclusions and assessment of the facts. The conclusions drawn by the investigating committee will be specified, as well as its assessment of the reported facts, and may propose two possible actions:
  • Proposal for continuation of the procedure, if it is considered that the investigations carried out have sufficiently proven the commission by the investigated subject of a punishable offense, a final section will be included in which the sanctions that may be adopted by the company against the subjects responsible for the facts are identified, as well as any other type of additional measures, including possible compensatory actions that may be adopted with respect to any person harmed by the facts
  • The proceedings will be archived if it is determined that the act does not constitute an offense, that its perpetration is not sufficiently justified, or that a known perpetrator has not been identified.

Once prepared, the final investigation report will be immediately forwarded to the Decision-Making Body and must be filed along with the rest of the investigation file.

4.- DECISION-MAKING PHASE

In view of the report prepared by the Investigating Body, if the complaint is deemed appropriate, the Decision Body will be constituted, whose function is to form the will of the Entity in response to the complaint filed.

For the formation of said will, the Decision-Making Body may request advice from as many external services as necessary, as well as any clarifications required from the Investigating Body itself.

Its composition is collegiate, being made up of the members of the Investigation Body, to which a representative of the Entity’s Administration Body will be incorporated.

In the event of incompatibility of any of the members of the Decision Body for the processing of a specific matter, said member will be removed from all proceedings carried out in relation to it.

The Decision Body will forward the file to the investigated subjects, who will be granted a period of 5 days to allege in writing whatever they deem appropriate for their defense and to provide the documents they consider relevant, and after this period, it may adopt one of the following decisions:

  • Request the performance of additional investigative procedures
  • Request the governing body to impose sanctions and/or additional measures
  • In the case of possible criminal acts, you will be obliged to inform the competent authority, whether administrative or judicial.
  • Take compensatory action with respect to any person or entity that may have been harmed by the events.
  • Making decisions regarding communication, training, or internal dissemination of the facts, both to any body or unit of the company and in general to all employees, when this is considered an effective tool to prevent similar incidents in the future (always with due precautions regarding the Protection of Personal Data).

5.- REGISTRATION

For the purpose of documenting the actions, the person in charge must maintain an up-to-date and confidential Chronological Record of the investigation (both those that are ongoing and those that have already been closed), complaints and disciplinary measures applied in relation to the non-compliance.

The record must contain at least:

  • Date of incident
  • Incident type
  • Date of complaint
  • Type of whistleblower
  • People involved in the situation
  • Incident description
  • Actions taken
  • Resulting consequences

The record referred to in the previous paragraph must always be up-to-date and available for review by those responsible for this policy (the system manager and the Entity’s Compliance Officer), always maintaining the strictest confidentiality.

However, it will be determined what publicity or communication will be made to the rest of the employees and managers about the facts once they have been resolved, either as a deterrent measure or as an improvement of procedures and future actions to avoid bad practices.

Furthermore, the resolution of the procedure will become part of the file (labor file, if applicable) of the accused person.