I.- INTERNAL INFORMATION SYSTEM
Pursuant to Law 2/2023, of February 20, 23, regulating the protection of persons who report regulatory violations and the fight against corruption (hereinafter referred to as "Law 2/2023"), R&G METAL SHAPING, SL(hereinafter, "R&G METAL SHAPING" or "the company") states that it has an Internal Information System, being the company responsible for the processing of personal data in accordance with the provisions of current legislation in this area.
In order to strengthen the culture of information and integrity infrastructures of R&G METAL SHAPING, and to promote the culture of communication as a mechanism for preventing activities or omissions that may constitute infringements in the field of European Union law, serious or very serious criminal or administrative offences, as well as labour offences in the field of health and safety at work, R&G METAL SHAPING has a person in charge of Criminal Compliance (RCP), who is also responsible for the company's Internal Information System (RSII) (hereinafter, the "RCP/RSII" person). For this purpose, R&G METAL SHAPING has appointed as such the person who holds the position of Quality Manager of the company.
Reports of violations related to the areas mentioned in the preceding paragraph may be made to the RCP/RSII person by any of the following means of the Ethics Channel (Internal Reporting Channel):
| - By e-mail to the following address: canaletic@rgmetalshaping.com - By ordinary mail to the address of the company: Pol. Ind. Malloles, C. Esquirol, 4, 08500 Vic a the attention of the person RCP/RSII-. - In writing delivered to the RCP/RSII person. |
Reporting persons may also request a face-to-face visit with the RCP/RSII person within a maximum period of seven days.
Information communicated verbally through a face-to-face meeting with the CPR/RSII person should be documented in one of the following ways, subject to the consent of the reporting person:
a) By means of a recording of the conversation in a secure, durable and accessible format.
In this case, the reporting person will be warned that the communication will be recorded and will be informed of the processing of his or her data in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation or GDPR).
b) Through a complete and accurate transcript of the conversation made by the RCP/RSII person.
Without prejudice to his or her rights under data protection regulations, the informant shall be given the opportunity to verify, rectify and agree to the transcription of the conversation by signing it.
The Internal Information System of R&G METAL SHAPING complies with the requirements of Article 5.2 of Law 2/2023, that is:
a) Allows persons to whom Law 2/2023 applies to communicate information, by various means, on the offenses provided for in Article 2 of the law.
b) - It is managed in a secure manner, guaranteeing that communications can be handled effectively within the company, as well as the confidentiality of the identity of the informant and of any third party mentioned in the communication and of the actions carried out in the management and processing of the same, as well as data protection, preventing access by unauthorized personnel.
c) - It has a Protocol for the Internal Information System, for the use of the Ethics Channel, and for the actions of the person responsible for Criminal Compliance and the Internal Information System, which establishes guarantees for the protection of informants, essentially:
- Proof of receipt within seven calendar days of receipt of the information.
- Ordinary maximum period of three months to respond to the actions of the investigation, under the terms of Article 9 of the Law, filling out and diligently keeping a Book-Register of Information.
- Possibility of maintaining communication with the informant.
- Establishment of the right of the affected person to be informed of the actions or omissions attributed to him or her and to be heard.
- Guarantee of confidentiality when the communication is sent through non-established reporting channels or to personnel not responsible for its treatment, as well as the obligation for the person receiving it to immediately forward it to the RCP/RSII person.
- Respect for the presumption of innocence and the honor of the persons concerned.
- Compliance with the provisions on Data Protection (Title VI Law 2/2023).
- Commitment to immediately submit the information to the Public Prosecutor's Office, when the facts could be indicative of a crime.
II.- PROCESSING OF PERSONAL DATA
R&G METAL SHAPING will process the personal data included in the communications received and covered by Law 2/2023, as data controller, in order to manage them and initiate, where appropriate, the corresponding investigation procedure and adopt the appropriate corrective measures.
The legal basis for the processing will be compliance with the obligations imposed by Law 2/2023. If the communication contains data of a special nature, such data will only be processed when strictly necessary for the adoption of corrective measures and/or the initiation of the corresponding investigation procedure and/or the processing of the sanctioning or criminal proceedings that, where appropriate, may be applicable, in accordance with the legislation in force, and in these cases the legal basis will be the essential public interest. The processing of personal data will be the indispensable one, since without them the objectives and obligations stipulated in Law 2/2023 cannot be fulfilled.
It is also reported that these personal data may be processed by authorized personnel only when necessary for the investigation of breaches of the company's internal regulations, infringements in the field of European Union law, serious or very serious criminal or administrative offenses, as well as labor offenses in the field of occupational health and safety, for the adoption of corrective measures, or for the processing of disciplinary or criminal proceedings, if any. Likewise, personal data may be communicated to third parties in case of legal obligation, and may be communicated to the judicial authority, the Public Prosecutor's Office or the competent administrative authorities within the framework of such investigation.
Personal data will be kept for the time necessary to decide whether to initiate an investigation into the reported facts. In the event that it is necessary to adopt corrective measures, the data will be kept for the duration of the application of these measures. On the other hand, in the event that it is necessary to initiate disciplinary or criminal proceedings, the data will be kept for the duration of the disciplinary or criminal proceedings.
In any case, if the decision on the appropriateness of initiating an investigation into the reported facts is not taken within three months, the personal data contained in the communication will be deleted, except those that it is strictly necessary to keep blocked in order to maintain evidence of the functioning of the company's Internal Information System in accordance with Law 2/2023.
Personal data revealing conduct not included in the scope of application of Law 2/2023 will also be deleted, as well as personal data not considered truthful, unless such untruthfulness may constitute a criminal offense, in which case the information will be stored for the time necessary during the processing of the corresponding legal proceedings.
Finally, it is noted that, at any time, the communicating person may request from the data controller access to their personal data, its rectification or deletion, the limitation of its processing, or oppose to it, as well as the right to data portability, by sending a letter to the email info@rgmetalshaping.com. In case of disagreement with the processing of your data, you may file a complaint with the Spanish Data Protection Agency, the body that holds the supervisory authority on the matter, located at C/ Jorge Juan, 6 (28001) Madrid (www.aepd.es).
III.- NON-RETALIATION
R&G METAL SHAPING expressly undertakes not to carry out acts constituting retaliation, including threats or attempts of retaliation, against persons submitting a communication in accordance with the provisions of Law 2/2023, and to implement protective measures during the processing of a file, with respect to persons concerned by a possible communication.
IV.- EXEMPTION AND MITIGATION OF THE PENALTY
In accordance with the provisions of Law 2/2023, when a person who has participated in the commission of the administrative infringement that is the object of the information is the one who reports its existence by submitting the information, and provided that the information was submitted before the notification of the initiation of the investigation or sanctioning procedure, the administrative body competent to resolve the procedure, by means of a reasoned resolution, may exempt him/her from compliance with the administrative penalty that would correspond to him/her, provided that the points mentioned in article 40 of Law 2/2023 are accredited.
(*) The Internal Reporting Channel allows the submission of anonymous communications.
(**) Although whenever possible, the use of the internal channel shall be preferred, depending on the circumstances and seriousness of the information, communications may also be sent, where appropriate, to the Independent Whistleblower Protection Authority (in the Autonomous Community of Catalonia, to the Anti-Fraud Office of Catalonia), or to the corresponding regional authorities or bodies, the Public Prosecutor's Office, the European Public Prosecutor's Office, or the competent authority, as appropriate.
