Internal
information system

I.- INTERNAL INFORMATION SYSTEM  (IIS)

In compliance with Law 2/2023, of February the 20th, regulating the protection of people who report regulatory infractions and the fight against corruption, AUSA CENTER SLU, AUSACORP SL and IMPROBAGES SAU state that they have an Internal Information System, been, each company, responsible for the processing of personal data in accordance with the provisions of current legislation in this area.

In order to strengthen the culture of information and integrity infrastructures of the aforementioned companies, and to promote the culture of communication as a mechanism for preventing activities or omissions that may constitute serious or very serious criminal or administrative offenses, the companies, for this purpose, have appointed the Director of Human Resources of the Group as a person  Responsible for Criminal Enforcement, as well as person responsible for the System and have activated by various means, an Ethical Channel (Internal Information Channel) to contact:

At the request of the reporting person, the communication may also be submitted through a face-to-face meeting with the PCR/RSII person, within a maximum period of seven days.

Verbal information made through a face-to-face meeting with the CPR/RSII person must be documented in one of the following ways, with the prior consent of the reporting person:

(a) by recording the conversation in a secure, durable and accessible format; or

(*) The reporting person will be warned that the communication will be recorded and will be informed of the processing of their data in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

b) through a complete and accurate transcript of the conversation conducted by the CPR/RSII person.

Without prejudice to the rights that correspond to him in accordance with the regulations on data protection, it will be offered to the reporting person the opportunity to verify, rectify and accept, by signing the transcript of the conversation.

The Internal Information System complies with the requirements of article 5.2 of the Law of reference:

a) It allows persons to whom the Law applies to communicate information, by various means, on the infractions provided for in its article 2.

b).- It is managed securely, ensuring that communications can be treated effectively within companies, as well as the confidentiality of the identity of the reporting person and any third person mentioned in the communication and the actions that are developed in the management and processing of the same, as well as data protection,  preventing access by unauthorized personnel.

c).- There is a Protocol that establishes guarantees for the protection of reporting persons:

-Proof of receipt within seven natural days after the reception of the information.

-Maximum period of three months to reply to the actions of the investigation, under the terms of article 9 of the Law, diligently completing and guarding a Book-Record of Information.

            -Possibility of maintaining communication with the reporting person.

-Establishment of the right of the affected person to be informed of the actions or omissions attributed to him and to be heard.

-Guarantee of confidentiality when the communication is sent through complaint channels other than those established or to staff not responsible for its treatment, as well as the obligation for the person who receives it, to immediately send it to the person responsible for the System.

-Regarding the presumption of innocence and the honor of the persons affected.

-Regarding the provisions on Data Protection (Title VI Law of reference).

-Engagement to send the information to the Public Prosecutor's Office immediately, when the facts could be indicative of a crime.

II.- PROCESSING OF PERSONAL DATA.

AUSA CENTER SLU will treat the personal data included in the communications received and that are protected by Law 2/2023, as responsible for the treatment, when you are a worker of AUSA CENTER SLU (and when, in another case, you have submitted information regarding this company), and as in charge of the treatment when you are a worker of AUSACORP SL or IMPROBAGES SAU (and when,  otherwise, you have submitted information regarding any of these companies), in order to be able to manage them and initiate, where appropriate, the corresponding investigation procedure. The legal basis of the treatment will be the fulfillment of a legal obligation, derived from the Law of reference. If the communication contains information of a special nature, the legal basis shall be the essential public interest and other provisions set out in paragraph 2 of art. 9.2. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data.

Likewise, it has been indicated that these personal data may be processed and transferred by the personnel authorized for this purpose only, when it is necessary for the adoption of corrective measures to AUSA CENTER or the processing of sanctioning or criminal procedures that, where appropriate, proceed. The personal data will be kept for the time necessary to decide on the appropriateness of initiating an investigation into the facts reported. In any case, if this decision is not taken within three months, the personal data contained in the communication will be deleted, except for the purpose of maintaining evidence of the operation of the system.

Personal data not considered true will also be deleted, except that this lack of veracity may constitute a criminal offense, in which case the information will be kept for the necessary time during which the judicial procedure is processed.

Finally, it is stated that at any time the communicating person may request from the corresponding data controller, access to their personal data, their rectification or deletion, or the limitation of their treatment, or to oppose, as well as the right to data portability, by sending a letter accompanied by a photocopy of their identity document by ordinary mail C / Castelladral,  1 08243 Manresa (Barcelona), email rgpd@ausa.com; T: 938 74 73 11 Fax: +34 938 741 211 and that in the event that you have suffered any type of interference in the exercise of your rights, you have the option of filing a claim with the competent authority, the Spanish Agency for Data Protection, the body that holds the control authority in the matter,  located at C/ Jorge Juan, 6 (28001) Madrid (www.aepd.es).

III.- NON-RETALIATION.

AUSA CENTER expressly undertakes not to carry out acts constituting retaliation, including threats or attempts at retaliation against persons who submit a communication in accordance with the provisions of Law 2/2023, and to apply protection measures during the processing of a file, with respect to persons affected by a possible communication.

IV.- EXEMPTION AND MITIGATION OF THE SANCTION.

When a person who has participated in the commission of the administrative offence, been the subject of the information the one who reports its existence by submitting the information and provided that it was submitted before the initiation of the investigation or sanctioning procedure had been notified, the  competent Organism to  solve the procedure,  by reasoned decision, it may exempt it from compliance with the administrative sanction that corresponds to it,  provided that the points mentioned in Article 40 of the Law in question are accredited.