Complaints Channel

Buy Hold is fully committed to compliance with the law in general and with the observance, in particular, of all current regulations that apply to us in the development of our activity. Within the regulatory framework of the obligations imposed by the “Law 2/2023, of February 20, regulating the protection of persons who report regulatory violations and the fight against corruption”, Buy Hold has adapted its internal information system and the internal information channel (whistleblower channel) existing in the Company, which are essential elements of our “Model of Organization and Management of Regulatory Compliance and Crime Prevention”, to comply with the provisions of that standard and adjust them to its requirements.

Buy Hold ‘s internal information channel is integrated within the Company’s internal information system and regulated in accordance with the applicable law in force and the internal corporate regulations, having been appointed by the management body as “System Manager” the Company’s Compliance Officer who, together with the Data Protection Officer, receives and processes the information collected in accordance with the provisions of Law 2/2023 and internal regulations, complying with all the requirements of professionalism, security and privacy that are required of them. As well as, with absolute respect for the presumption of innocence and the honor of the persons affected by the communication received and the applicable legal provisions in force on personal data protection.

What does our internal Channel allow?

The Channel allows the submission of information (communication or complaint) by a person who, in an employment or professional context with Buy Hold, has obtained information about violations or non-compliance.

In particular, the Internal Channel is authorized to receive information regarding: 1) any irregular or illegal act or conduct committed within the Company, or in the actions of third parties contracting with it, which may be contrary to the applicable regulations in force; 2) any breach or conduct in violation of the principles set forth in the Company’s internal compliance rules and affecting its competencies. Including actions or omissions that may constitute a serious or very serious criminal or administrative infringement, infringements of labor law in the area of occupational health and safety, and any other infringements set forth in Law 2/2023.

Employees who have professional or employment ties with the Company are also understood to be those who have already completed their professional relationship, interns or trainees, regardless of whether or not they receive remuneration, persons who participate in selection processes and those whose employment relationship has not yet begun, in cases where information on breaches has been obtained during the selection process or pre-contractual negotiation.

In addition, our internal reporting channel is also enabled to receive communications from those persons who have obtained the information in a context other than employment or professional with Buy Hold and who report actions or omissions contrary to the law by Buy Hold personnel.

Where and in what form can the communication be presented?

The Channel allows you to communicate in writing and verbally, both ways. So, to communicate information you can use any of the following ways:

1.- Send a letter in a sealed envelope addressed to Buy Hold’ s Compliance Officer at C/ de la Cultura, 1, Ciutat Vella, 460028 Valencia.

2.- Send an e-mail to the following address: denuncias@canaldenunciainformativo.es.

3.- Fill out this downloadable form by clicking here

4.- Make a phone call to any of the following numbers: (+34) 963 238 080 / (+34) 918 336 830.

In any case, you will be warned as the informant that the communication will be recorded and you will be informed of the processing of your data in compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

As a whistleblower, you may request a face-to-face meeting to explain what you consider relevant. This meeting will be convened by the System Manager within a maximum period of seven days from receipt of your request, during working hours and at Buy Hold‘s head office.

Content of the communication

If you decide to submit a communication, you may choose to provide your identification data or to make the communication anonymously. Therefore, the submission and subsequent processing of anonymous communications is permitted.

The communication submitted shall contain an explanation of the specific facts that are denounced or communicated, as well as any others that are considered relevant, attaching to the same the supporting documentation of the facts that, where appropriate, are available. Likewise, the communication you submit must include as much identifying information as possible about the person to whom the information refers -name and surname, specific office where he/she works, job position held and others known to him/her-, so that his/her identification is clear and unequivocal.

Processing of the communication

The procedure for processing the communications received is established as follows:

• Formulation. Both communications containing the informant’s identification data and anonymous communications will be processed.
• Receipt. Once the information has been received, it shall be recorded in the Company’s internal information system and an instructor of the procedure shall be appointed, who shall acknowledge receipt of the communication within a period not exceeding five working days from the date of receipt.
• Instruction. The instructor will make a preliminary assessment of the facts and data contained in the communication, and, depending on the conviction reached in the specific case assessed, the pertinent proceedings and actions will be carried out and the appropriate measures and/or sanctions will be decided in a reasoned manner and it is considered advisable to adopt.

The term to finalize the proceedings and provide a response to the informant, as the case may be, may not exceed three months from the entry of the information into the registry, except in cases of special complexity that require an exceptional extension of this term, which shall be declared by means of a reasoned resolution of the instructor.

All of the above, without prejudice to the provisions of Law 2/2023 in relation to the sanctioning regime and the concurrence with the sanctioning power that corresponds to the Independent Authority for the Protection of the Informant (A.A.I.) and to the competent bodies of the autonomous communities.

Information to the caller

When making the communication, you as the informant may indicate an address, e-mail or safe place to receive notifications about the information communicated and the procedure, if any, to be processed.

However, by making the communication you may expressly opt out of receiving communications relating to the research to be conducted.

Protection of the informant and the affected person

If you submit a communication through our Channel you are entitled to the protection measures set forth in Law 2/2023 and to have your identity not disclosed to third parties.

Notwithstanding the foregoing, those persons who communicate or disclose are expressly excluded from protection: (a) Information that is false, manipulated or misrepresented or responds to motivations that the Law cannot protect; b) Information provided with the intention of imputing a crime or serious or very serious civil or administrative offense to the Company, with knowledge of its falsity or reckless disregard for the truth. Likewise, information provided to insult the Company or its representatives, undermining its reputation or undermining its own esteem; c) Information that has been obtained in an unlawful manner. d) Information contained in communications that have been disregarded by any internal information channel or by the Independent Authority; d) Information linked to claims regarding interpersonal conflicts or that affect only the informant and the persons to whom the communication or disclosure refers; e) Information that is already fully available to the public or that constitutes mere hearsay; f) Information that relates to actions or omissions not covered by Law 2/2023.

The internal information system implemented in Buy Hold is designed, established and managed in a secure manner, so as to guarantee the confidentiality of your identity as informant -in case you have identified yourself-, as well as that of the data corresponding to the persons concerned and to any third party mentioned in the information provided, preventing access by unauthorized personnel with the exception of the safeguards established in the applicable Law in force. Thus, your identity as informant may only be communicated to the Judicial Authority, the Public Prosecutor’s Office, the European Public Prosecutor’s Office or the competent administrative authority within the framework of a criminal, disciplinary or sanctioning investigation.

Acts constituting retaliation, including threats of retaliation and attempts to retaliate against individuals who make a communication in accordance with the Act and our internal regulations are expressly prohibited. Retaliation is any act or omission that is prohibited by law or that, directly or indirectly, involves unfavorable treatment that places the persons who suffer it at a particular disadvantage with respect to another in the work or professional context, solely because of their status as whistleblowers, or because they have made a public disclosure.

Throughout the investigation and proceedings that the facts reported may give rise to, the persons affected by the communication shall be entitled to the presumption of innocence, the right of defense and the right of access to the file under the terms provided in Law 2/2023 and in our internal regulations, as well as to the same protection established for the informants in the preceding paragraphs, preserving their identity and guaranteeing the confidentiality of the facts and data of the proceeding.

A person whose rights have been harmed as a result of its communication or disclosure after the two-year period has elapsed may request protection from the competent authority which, exceptionally and in a justified manner, may extend the period of protection, after hearing the persons or bodies that could be affected.

Protection of personal data

The processing of personal data shall be governed by the provisions of Law 2/2023, in the “.Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation)”in the “Organic Law 3/2018 of December 5, 2018, on the protection of personal data and guarantee of digital rights.“, and, in the “Organic Law 7/2021, of May 26, on the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offenses and the execution of criminal sanctions“without prejudice to the provisions of the Company’s internal regulations.

The rights of access, rectification and deletion of your data as an informant, of limitation and opposition to its processing, as well as not to be subject to decisions based solely on the automated processing of your data, where applicable, can be exercised before the data controller of the Company:

C/ de la Cultura, 1, Ciutat Vella, 460028. Valencia

Contact DPD: antonioaspas@buyandhold.es

Personal data obtained from the information received and processed may be stored in Buy Hold ‘s internal information system only for the period of time that is necessary and proportionate to fulfill the purpose for which they were collected. In particular, the provisions of paragraphs 3 and 4 of article 32 of Law 2/2023 shall be taken into account. In no case may the data be kept for a period longer than ten years.

If it is proven that the information provided or part of it is not truthful, it shall be immediately deleted as soon as such circumstance comes to light, unless such lack of truthfulness may constitute a criminal offense, in which case the information shall be kept for the necessary time during the legal proceedings.

In any case, once three months have elapsed since the receipt of the communication without any investigation actions having been initiated, it will be deleted, unless the purpose of the conservation is to leave evidence of the operation of the system. Communications that have not been followed up may only be recorded in anonymized form, without the blocking obligation provided for in article 32 of Organic Law 3/2018, of December 5, 2018, being applicable.

External information channels

A person considered to be a whistleblower under the terms established by the Law 2/2023, of February 20, 23, regulating the protection of persons who report regulatory breaches and the fight against corruption may also communicate information on infringements or breaches through an external channel, which for these purposes shall be the Independent Authority for the Protection of Whistleblowers (A.A.I.) when it is created or the competent regional authorities.

Buy Hold’s Internal Information System Policy and Procedure for Management of the Internal Information Channel