PRIVACY POLICY - WHISTLEBLOWING CHANNEL

1. DATA CONTROLLER:

GRUPO ANTOLIN IRAUSA, S.A., domiciled in Burgos, at Carretera Madrid-Irún, Km. 244,8 (SPAIN), with employer identification number A09092305 (“Antolin” or the “Company”) is the controller of the personal data that are processed through the Antolin transparency and whistle-blowing channel. This clause provides information on the use that the Company will make of your personal data and your rights under the General Data Protection Regulation (“GDPR”). Should you have any questions regarding the processing of your data, please contact the Company at the following addresses: by mail, at Grupo Antolin Irausa, S.A. (Ctra. Madrid-Irún Km. 244,8 09007 Burgos) or via the Company’s website, at: https://www.antolin.com/en/contact-us?contact=privacy.

2. PURPOSES OF THE PROCESSING, LEGAL GROUNDS AND DATA DISCLOSURES:

In the following table you can consult the purposes of the processing of your data, the legal grounds that entitle the Company to process your data for those purposes, the possible disclosure of your data to third parties and the existence of potential international data transfers. You will receive information on the storage periods of your data on the Company’s systems, notwithstanding the obligations to block data set forth in applicable legislation. You may request a list of recipients of your data by writing to https://www.antolin.com/en/contact-us?contact=privacy, indicating the specific recipients in relation to which you require information.

Purpose of the processing	Legal basis	Recipients	International transfers	Storage period
Processing of personal data necessary to manage reports that any person related in any way to Antolin may file in order to notify Antolin of the breach of any regulations at Antolin, as well as to manage reports or communications sent by any person related to Antolin using this Channel.	Compliance with a legal obligation: Need to ensure compliance with regulations that are applicable at Antolin and require the obligation to implement an internal whistleblowing system that includes a Whistleblowing Channel.	Data may be disclosed, on the legal basis of Antolin’s right to due process, to courts or tribunals. The categories of service providers of Antolin that may have access to your data as data processors, given the services they provide to the Company, are: • Technology services and systems maintenance companies of Antolin.	Your data may be transferred to technology services and systems maintenance companies of Antolin located outside the European Union (“EU”). If you would like to know where these companies are located, please write to the following address https://www.antolin.com/en/contact-us?contact=privacy and you will be provided with an updated list. These transfers would be carried out on the basis of the signature by these companies located outside the EU of standard data protection clauses adopted by the European Commission for international transfers. Should you require a copy of these contractual clauses please write to Antolin at: https://www.antolin.com/en/contact-us?contact=privacy.	Data contained in reports sent via the Transparency Channel shall be kept in the system for the time necessary to ascertain whether it is necessary to open an investigation into the case reported, and such time period may not exceed three months following the filing of the report. If it is decided not to open an investigation, the data shall be deleted from the whistle-blowing system. If it is decided that an investigation should be opened, the data will be migrated to the system and area of Antolin tasked with carrying out such investigations, and the data may be kept on such systems for the time strictly necessary for the successful conclusion of the investigation.

Purpose of the processing

Legal basis

Recipients

International transfers

Storage period

Processing of personal data necessary to manage reports that any person related in any way to Antolin may file in order to notify Antolin of the breach of any regulations at Antolin, as well as to manage reports or communications sent by any person related to Antolin using this Channel.

Compliance with a legal obligation: Need to ensure compliance with regulations that are applicable at Antolin and require the obligation to implement an internal whistleblowing system that includes a Whistleblowing Channel.

Data may be disclosed, on the legal basis of Antolin’s right to due process, to courts or tribunals.
The categories of service providers of Antolin that may have access to your data as data processors, given the services they provide to the Company, are:
• Technology services and systems maintenance companies of Antolin.

Your data may be transferred to technology services and systems maintenance companies of Antolin located outside the European Union (“EU”). If you would like to know where these companies are located, please write to the following address https://www.antolin.com/en/contact-us?contact=privacy and you will be provided with an updated list.

These transfers would be carried out on the basis of the signature by these companies located outside the EU of standard data protection clauses adopted by the European Commission for international transfers. Should you require a copy of these contractual clauses please write to Antolin at: https://www.antolin.com/en/contact-us?contact=privacy.

Data contained in reports sent via the Transparency Channel shall be kept in the system for the time necessary to ascertain whether it is necessary to open an investigation into the case reported, and such time period may not exceed three months following the filing of the report. If it is decided not to open an investigation, the data shall be deleted from the whistle-blowing system.
If it is decided that an investigation should be opened, the data will be migrated to the system and area of Antolin tasked with carrying out such investigations, and the data may be kept on such systems for the time strictly necessary for the successful conclusion of the investigation.

Necessary, up-to-date information

Completion of all the fields marked with an asterisk (*) in the forms you may be given is compulsory. Failure to complete any of these fields could lead to your being denied access to the functionalities of this tool.

In order to ensure that the information provided is constantly up to date and does not contain errors, you should notify Antolin as soon as possible of any amendments or changes to your personal data. By clicking on the “Send” button (or similar) on such forms, you state that the information and data provided are accurate and true.

3. ASPECTS TO BE TAKEN INTO ACCOUNT WITH RESPECT TO THE WHISTLE-BLOWING CHANNEL:

Antolin makes this whistle-blowing channel available to all persons related in any way to the Company. Through this channel, that forms part of Antolin’s Whistleblowing System, any person may inform Antolin of the commission of any type of inappropriate act or conduct that could be contrary to the general or industry legislation applicable to Antolin carried out by any person or group of people related to Antolin in any way (employees, clients, suppliers, visitors, etc.). The informant/whistleblowers may identify themselves with their personal data on filing the report, or may do so anonymously. Only our Compliance department will have access to this channel, following at all times the principles established in our Internal Information System Policy and the Procedure established for this purpose.

Antolin maintains the strictest confidentiality of all personal data and information provided through the whistle-blowing channel, and has implemented the technical and organizational security measures necessary to protect this information. The data included in whistle-blowing reports shall be kept only for the time strictly necessary to decide whether it is appropriate to open an investigation and shall be erased from the whistle-blowing channel in all cases three months after the data is entered, unless its purpose is to leave evidence of the operation of the system.

4. DATA SUBJECTS’ RIGHTS:

You may exercise the following rights:
(i)   right of access to your personal data to know which data are being processed and the processing operations that are being performed with that data;
(ii)   right to rectification of any inaccurate data;
(iii)   right to erasure of the personal data, where possible;
(iv)   right to request the restriction of the processing of your personal data where the accuracy, legality or need to process the data is doubtful and in the other cases envisaged in the GDPR;
(v)   right to object, at any time, for reasons related to your specific situation. The Company shall stop processing your data unless it has a compelling legitimate interest for the processing, or for the establishment, exercise or defense of legal claims.

In order to exercise these rights, you should send a written request by letter to Grupo Antolin Irausa, S.A. (Ctra. Madrid-Irún Km. 244,8 09007 Burgos), through the following email address [privacy@antolin.com] or via the Company’s website: : https://www.antolin.com/en/contact-us?contact=privacy. You must sign the request, include your full name and address, and indicate which rights you wish to exercise.

You may also lodge a complaint with the AEPD if you consider that data protection legislation has been breached in the processing of your personal data.

5. CONFIDENTIALITY AND SECURITY

The Company shall make all reasonable efforts to maintain the confidentiality of the personal information in question through this tool. Antolin has implemented and maintains strict levels of security in order to protect the personal data it processes from accidental loss and unauthorized access, processing or disclosure, having regard to the state of the art, the nature of the stored data and the risks to which they are exposed. This notwithstanding, the transmission of information via the Internet is not totally secure; accordingly, and despite the fact that the Company shall make its best efforts to protect your personal data, it cannot guarantee the security of such data during transit to the tool or systems of Antolin. All information provided by you shall be sent at your own risk. Once your personal data have been received, the Company shall use rigorous security functions and procedures to prevent any unauthorized access.