I. INTERNAL INFORMATION SYSTEM.

In accordance with Law 2/2023, of February 20, regulating the fight against corruption and the protection of persons who report regulatory breaches, ROMETA SA certifies that it has an internal information system.

In order to strengthen the integrity of the company, and to promote communication as a mechanism for preventing activities or omissions that may constitute serious criminal or administrative offences, the company has designated the Responsable of Human Resources as Compliance Officer, and has set up an internal communication channel which can be contacted:

• at the e-mail address: This email address is being protected from spambots. You need JavaScript enabled to view it..
• at the postal address: Zona Industrial, Ronda de les Conques, 21-23 08180 Moià for the attention of the Compliance Officer.
• in writing given to the Compliance Officer.

This channel allows the presentation of anonymous communications.

At the request of the person making the report, the information may also be transmitted during an in-person interview with the Compliance Officer, which must take place within seven days.

With the prior consent of the informant, the verbal report should be recorded in one of the following ways:

a) recording the conversation in a secure, durable and accessible format. In this case, the declarant will be notified that the communication will be recorded and will be informed of the processing of their data in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

b) by a full and accurate transcription of the conversation conducted by the Compliance Officer. Without prejudice to their rights under data protection regulations, the informant will be offered the opportunity to check and correct the transcription of the conversation before signing it.

The internal information procedure complies with the requirements of article 5.2 of the reference law:

a)it allows persons to whom the law applies to communicate information, by various means, on the offenses provided for in its article 2 of the latter.

b) it is managed in a secure manner, guaranteeing efficient processing of communications, as well as confidentiality regarding the identity of the declarant, any third party mentioned in the communication and the actions taken to process the communication.

It also guarantees data protection, preventing access to information by unauthorized personnel.

c) its protocol lays down guarantees for the protection of informants:

• Sending of proof of receipt within seven calendar days of receipt of the information.
• Maximum period of three months for responding to investigative acts, in compliance with article 9 of the aforementioned law.
• Possibility of maintaining communication with the declarant.
• Right of the person concerned to be informed of the actions or omissions attributed to him and right to be heard.
• Guarantee of confidentiality when the information is transmitted through channels other than those established or via a member of staff other than the Compliance Officer, as well as the obligation for the person who receives it to send it immediately to the Compliance Officer.
• Respect for the presumption of innocence and the honor of the persons concerned.
• Compliance with the provisions relating to data protection (Title VI of the reference law).
• Commitment to send the elements without delay to the Public Prosecutor, when the facts could constitute an offence.

NB: Although the information is presented, preferably internally, it can also be sent to the Independent Authority for the Protection of Whistleblowers (Anti-Fraud Office of Catalonia), the Public Prosecutor's Office or the European Public Prosecutor's Office.

II. PROCESSING OF PERSONAL DATA.

ROMETA SA will process the personal data included in the communications received and protected by Law 2/2023. The legal basis for the processing will be compliance with the legal obligation, derived from the law of reference. If the communication contains data of a particular nature, the legal basis will be the public interest and the provisions present in section 2 of art. 9.2. of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

This personal data may be processed and transferred by authorized personnel, when this is necessary for the adoption of corrective measures by ROMETA SA or to initiate the disciplinary or criminal procedures. Personal data will be kept for the time necessary to decide whether to open an investigation. In any case, if no decision is made within three months, the personal data contained in the communication will be deleted, except those necessary to prove the correct functioning of the system.

Any personal data not considered to be accurate will be deleted, unless this lack of veracity may constitute a criminal offence, in which case the information will be kept for the conduct of legal proceedings.

Finally, at any time the declarant may request access to their personal data, their rectification or deletion, or the limitation of their processing, or oppose the portability of the data, by sending a letter accompanied by a photocopy of their identity document by ordinary mail to the address: Zona Industrial, Ronda de les Conques, 21-23 08180 Moià (Barcelona), and that in the event of interference in the exercise of their rights, the declarant has the possibility of filing a claim with the competent authority, the Spanish Data Protection Agency at C/ Jorge Juan, 6 (28001) Madrid (www.aepd.es).

III. ABSENCE OF RETORSION MEASURES.

ROMETA SA expressly undertakes not to commit acts constituting reprisals, including threats against persons who make a report and to apply protective measures with regard to the persons concerned by a possible communication.

IV. EXEMPTION AND MITIGATION OF SANCTION.

When a person who participated in the commission of the reported administrative offense is the one who reports its existence and provided that the report was made before the notification of the opening of an investigation or of a disciplinary procedure, the competent body may, by reasoned decision, exempt them from the corresponding administrative sanction, provided that the points mentioned in article 40 of the law in reference are respected.