Internal information channel

1.- Introduction
Al employees of MOIRA CAPITAL PARTNERS, SGEIC, S.A.U. must act with integrity and comply with applicable regulations, and must cooperate in order to prevent any employee, shareholder or director of the Company from acting improperly or in breach of the law.

For this reason, all employees, directors, shareholders or persons referred to in this policy (section 2) are obliged to report any suspected irregularity or act contrary to regulations of which they become aware, so that MOIRA may adopt the appropriate measures and prevent any possible irregularity from recurring in the future. This will help improve our working environment. In this respect, reporting is not an option but an obligation for all persons who are aware of potential infringements to be managed through this internal channel.

In compliance with applicable legislation, the Company’s management body has approved the internal reporting channel procedure set out in this policy, which is available to employees and through which potential breaches of regulations may be reported. Among other matters that may be reported by employees (and which are indicated in this policy), particular attention is drawn to the possible commission of offences involving sexual harassment or sexual abuse, workplace harassment, disclosure of confidential information, corruption, tax fraud or social security fraud.

The main purpose of this policy and the internal reporting channel is not only to enable the Company to be made aware of irregular conduct occurring within it, but also to protect those who decide to report acts or omissions that may constitute a criminal offence or a serious or very serious administrative infringement, when they have obtained the information in a work or professional context.

Accordingly, this policy provides a structured outline of the procedure established for managing the reports received by MOIRA.

During the processing of reports, the confidentiality of the data provided and statements made must be guaranteed. Any decision adopted following receipt of a report will therefore be reasoned and proportionate, taking into account the circumstances of the reported facts, with full respect for rights and with due safeguards both for the reporting person and for the persons concerned.

With the sole purpose of facilitating the investigation of the facts and reaching an appropriate solution, we recommend that, when completing the form provided, you give a full description of the reported facts, identify the persons allegedly affected or involved (victims and alleged offenders) and provide all information that may be necessary.

2.- Scope of application

This channel may be used by:

Employees of the Company with an active employment contract;
Shareholders, unitholders and persons belonging to the Company’s administrative, management or supervisory body;
Third-party companies (contractors, subcontractors or suppliers);
Former employees;
Interns;
Trainees;
Persons whose employment relationship has not yet begun, provided that the information was obtained during the selection process or during pre-contractual negotiations.

All employees, directors, members of the administrative body or external collaborators of the Company who have committed any irregularity or any of the types of conduct described in section 3 of this policy may be reported.

3.- Matters that may be reported

The conduct that may be reported through the internal reporting channel includes, among others, the following:

Sexual assault, abuse and harassment

Conduct by third parties that you have become aware of in the course of providing your services at MOIRA consisting of acts that infringe another person’s sexual freedom or integrity, using violence (any type of force) or intimidation (threats), such as, for example:

Touching intimate parts after intimidating the victim.
Forcing the victim to engage in unwanted sexual behaviour such as kissing.

You may also report conduct consisting of acts which, without the offender using violence or intimidation, infringe another person’s sexual freedom or integrity, such as, for example:

Touching intimate parts without consent.
Repeated sexual comments and looks or gestures.

You may also report conduct by third parties consisting of requesting sexual favours for themselves or for others, causing the victim a seriously intimidating or humiliating situation.

Inappropriate or supposedly humorous remarks made by the alleged offender should not be considered sexual abuse or harassment, as they do not constitute such conduct.

Please note that, in these cases, if you submit the report anonymously, the investigation of the described facts may be more difficult to carry out, which could affect the outcome of the investigation. In addition, we would not be able to inform you of the progress or result of the investigation.

Breach of occupational risk prevention regulations

Lack of the necessary means made available by MOIRA for you to carry out your activity with adequate safety and hygiene measures, putting your life, health or physical integrity at risk, for example:

Lack of approved fire extinguishers.
Lack of evacuation plans in the event of fire.
Lack of cleanliness in the workplace when it is habitual or when it gives rise to risks to the physical integrity and health of employees.

Occasional lack of cleanliness in the workplace or the Company’s failure to carry out medical check-ups cannot be considered a serious breach of occupational risk prevention regulations reportable through this internal reporting channel.

Workplace harassment

Conduct by third parties that you have become aware of in the course of providing your services at MOIRA consisting of habitual and persistent verbal or psychological actions intended to humiliate, offend or intimidate an employee in the workplace, for example:

Repeatedly and seriously using abusive, threatening or rude language when addressing others.
Repeatedly assigning goals or projects with impossible deadlines and tasks that are clearly impossible to complete within the time allowed.
Blocking a colleague’s professional development.

Workplace harassment should not be considered to occur when a supervisor reprimands an employee for having carried out work that does not meet the Company’s quality standards.

Actions against workers’ rights

Conduct by third parties that you have become aware of in the course of providing your services at MOIRA consisting of:

Imposing on employees, through deception or abuse, working conditions that harm, suppress or restrict their rights (for example, requiring more hours for a certain job without paying overtime, or requiring work on rest days).
Discriminating in the workplace against a person on the grounds of ideology, religion or beliefs, family situation, sexual orientation, gender-related reasons, etc. For these purposes, the supervisor’s conduct must allow it to be demonstrated that the discrimination occurred for these reasons and not for any other reason such as, for example, a decrease in the quality of the employee’s work.
Preventing or limiting by any means the exercise of the right to strike or trade union freedom.
Breach of the protection of the safety and health of female employees during pregnancy and breastfeeding periods.

Conduct by third parties that you have become aware of in the course of providing your services at MOIRA consisting of:

Exposing female employees who are pregnant or have recently given birth to procedures or working conditions that may negatively affect their health or that of the foetus.
Preventing absence from work, with entitlement to remuneration, in order to undergo prenatal examinations and childbirth preparation techniques.

Degrading treatment

Conduct by third parties that you have become aware of in the course of providing your services at MOIRA consisting of repeatedly carrying out hostile or humiliating acts against another employee, abusing a position of superiority, which amount to serious harassment of the employee, such as insults or the use of derogatory nicknames (e.g., “four-eyes”, “fatty”, etc.). Such conduct includes, among others:

Making aggressive, insulting or humiliating comments or threats repeatedly and seriously.
Repeatedly spreading rumours (to colleagues or other managers), knowing them to be false, that undermine the employee’s reputation or image.

Inappropriate or supposedly humorous remarks made by the alleged offender should not be considered degrading treatment.

Unlawful obtaining and disclosure of secrets

Conduct by third parties that you have become aware of in the course of providing your services at MOIRA consisting of:

Seizing papers, letters, email messages or any other document, or using listening, recording or sound/image reproduction devices, with the purpose of discovering secrets or violating another employee’s privacy, without their consent.
Disclosing, without the affected person’s authorisation, images or recordings obtained unlawfully, where such disclosure undermines the privacy of the affected employee.
Seizing, using or modifying, to the detriment of a colleague, personal or family data of that colleague recorded on the Company’s media.
Breaching the security measures established by MOIRA and, without authorisation, accessing or facilitating access to all or part of the entity’s information system with the intention of discovering information or providing it to third parties.
Disseminating or revealing a trade secret.

Corruption

Conduct by third parties that you have become aware of in the course of providing your services at MOIRA consisting of receiving, requesting or accepting an unjustified advantage of any nature (or the promise of obtaining one), for themselves or for a third party, as consideration for unduly favouring another party.

For example, the delivery of gifts (jewellery, luxury items, etc.) to employees in positions of responsibility should be considered corruption, where it is done in order to achieve objectives that would not otherwise have been obtained.

Bribery

Conduct by third parties that you have become aware of in the course of providing your services at MOIRA consisting of offering or giving gifts or any other form of remuneration by an employee to a public official so that the official acts in a manner contrary to the duties inherent to their position.

Trading in influence

Conduct by third parties that you have become aware of in the course of providing your services at MOIRA consisting of influencing a public official or authority by taking advantage of a situation arising from a personal relationship with that official or with another official, in order to obtain a decision that may generate an economic benefit for themselves or for the Company.

Tax fraud

Conduct by third parties that you have become aware of in the course of providing your services at MOIRA consisting of the entity avoiding the payment of taxes, withheld amounts or amounts that should have been withheld, or payments on account, unduly obtaining refunds or improperly benefiting from tax advantages in the same manner.

For example, falsifying, concealing or simulating data, accounting entries or transactions, or keeping double accounts, invoices, etc., aimed at avoiding payments or obtaining unlawful benefits, should be considered a tax fraud offence.

Forgery of documents

Conduct by third parties that you have become aware of in the course of providing your services at MOIRA consisting of forging public or private documents.

Money laundering

Conduct by third parties that you have become aware of in the course of providing your services at MOIRA consisting of:

Acquiring, possessing, using, converting or transferring assets, knowing that they originate from a criminal activity committed by them or by a third party (for example, drug trafficking or human trafficking).
Carrying out any act to conceal or disguise their illicit origin.
Carrying out any act to help the person who participated in the offence(s) to evade the legal consequences of their acts.

Fraud (swindling)

Conduct by third parties that you have become aware of in the course of providing your services at MOIRA consisting of using deception sufficient to cause another person to be mistaken, inducing them to carry out an act of disposal to their own or another’s detriment, for example:

Carrying out actions that may be interpreted as deception to the detriment of clients, suppliers or third parties (offering products or services that do not match clients’ characteristics and needs).
Deceiving or lying about the conditions of certain products.

Misleading advertising

Conduct by third parties that you have become aware of in the course of providing your services at MOIRA consisting of making false claims or stating uncertain characteristics about products or services for advertising purposes, in a way that may cause serious and manifest harm to clients.

Computer damage

Conduct by third parties that you have become aware of in the course of providing your services at MOIRA consisting of deleting, damaging, deteriorating, altering, suppressing or making inaccessible computer data, computer programs or electronic documents, by any means, without authorisation and in a serious manner.

Social security fraud

Conduct by third parties that you have become aware of in the course of providing your services at MOIRA consisting of:

Avoiding payment of Social Security contributions and jointly collected items, unduly obtaining refunds or improperly enjoying deductions of any kind.
Simulating, distorting or concealing facts that they had a duty to report in order to improperly obtain Social Security benefits.
Falsifying the conditions required to obtain grants or aid, or concealing those that would have prevented obtaining them, in order to benefit from them.

Hate conduct, racism or advocacy of terrorism

Conduct by third parties that you have become aware of in the course of providing your services at MOIRA consisting of:

Encouraging, promoting or inciting hatred, discrimination or violence against a group of employees or against an employee on racist, anti-Semitic, anti-Roma grounds, on grounds relating to ideology, religion or beliefs, belonging to a race or nation, sexual identity, gender-related reasons, etc.
Preparing or possessing, with the intention of distributing, writings or any other type of material which, by their content, are suitable for promoting or inciting hatred, hostility, discrimination, etc. within the Company.
Denying, grossly trivialising or glorifying crimes of genocide, crimes against humanity or crimes against persons and property protected in the event of armed conflict, where they were committed against a group on racist, anti-Semitic, anti-Roma grounds, etc.

Inappropriate or supposedly humorous remarks made by the alleged offender in relation to these matters should not be considered a hate offence.

Breach of personal data protection regulations

Conduct by third parties that you have become aware of in the course of providing your services at MOIRA consisting of processing personal data of which you are the data subject in breach of applicable regulations, for example:

Not adequately informing you about the processing that will be carried out on your data.
Using your data for purposes other than those you were informed of.
Not obtaining your express consent where the processing carried out requires it.
Not respecting your privacy in the use of the digital devices made available to you.
Not respecting your rest time, leave and holidays (right to digital disconnection).

4.- Principles governing the channel

Duty to report

Anyone who has well-founded knowledge of any conduct that may constitute a serious or very serious act contrary to applicable regulations is obliged to report it to MOIRA CAPITAL PARTNERS, SGEIC, S.A.U. through this internal reporting channel.

Confidentiality

The Company guarantees the confidentiality of the reporting person’s identity and of any third party mentioned in the report, as well as of the actions carried out during its management and processing. This principle is one of the basic pillars of the internal reporting channel, as its operation depends on ensuring that reporting persons’ identities are protected.

Notwithstanding the above, the persons responsible for the investigation and management of the channel will have access to this information. In addition, in cases where it is requested by the judicial authority, the Public Prosecutor’s Office or the competent administrative authority within the framework of a criminal, disciplinary or sanctioning investigation, the Company will be obliged to provide such bodies with the reporting person’s identity, where possible.

Prompt processing

MOIRA guarantees that any unjustified delays in the development of the investigation process will be avoided.

Existence of an external channel

Applicable legislation regulates the existence of an external reporting channel before the Independent Whistleblower Protection Authority (Autoridad Independiente de Protección del Informante, A.A.I.) (separate from the internal channel).

Through this channel, reporting persons may report the infringements indicated in this policy to the Independent Whistleblower Protection Authority (A.A.I.), or to the relevant regional authorities or bodies, either directly or after first reporting through the corresponding internal channel.

This means that the employee has two options for reporting a fact they consider unlawful and in breach of applicable regulations:

To the Company through the internal channel and subsequently (but never simultaneously), in cases where it is considered that the complaint has not been properly handled, to the A.A.I. using the external channel.
Directly to the said authority using the external channel, without first having to use the internal channel.

Personal data protection

The processing of the personal data of the reporting person and the person concerned in connection with the management of this internal reporting channel will be carried out in full compliance with the provisions of the General Data Protection Regulation and Organic Law 3/2018 of 5 December on Personal Data Protection and the guarantee of digital rights.

MOIRA will not collect personal data that are not necessary for the purposes of the processing (managing and resolving the reports submitted). If such information is collected by accident, it will be deleted without undue delay.

Controller of your personal data

The controller is MOIRA CAPITAL PARTNERS, SGEIC, S.A.U., with registered office at Calle Almagro, number 1, 2nd floor, left, 28010 Madrid (Spain), Tax ID No. A87750634, registered with the Madrid Mercantile Registry: Volume 35,607, Section 8, page 186 and sheet M-639961.

You may contact us by telephone at +34 913 578 422 or by email at enrique.gimenez@moiracapitalpartners.com.

Purpose for which we process your personal data
At MOIRA, we process the data provided in the form made available, or through a telephone conversation or an in-person meeting, exclusively for the receipt, management and investigation of reports submitted through this channel.

How long do we process your data for?
The personal data provided will be retained for the duration of the corresponding investigation process (if the Company decides not to carry out investigative actions, they will be deleted after three months). They will be kept in the information records implemented by the Company in accordance with Law 2/2023 of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption, for the period that is necessary and proportionate in order to comply with said law.

Subsequently, the data provided will be erased.

Legal basis for processing your personal data
Processing of the data provided is necessary in order to comply with a legal obligation applicable to MOIRA (the aforementioned Law 2/2023), as well as for the performance of a task carried out in the public interest, namely the prevention of criminal offences and the prevention of the entity’s criminal liability.

Categories and types of data processed
The categories of data processed are:

Identification data (first and last name).
Email addresses.
Telephone number.
Voice.
Any other personal data necessary to process the report received.

To which recipients will your personal data be disclosed?
No data will be disclosed to third parties, except where required by law.

What are your rights when you provide us with your personal data?
Any person has the right to obtain confirmation as to whether the Company is processing personal data concerning them.

Data subjects have the right to access their personal data, as well as to request rectification of inaccurate data or, where applicable, request erasure when, among other reasons, the data are no longer necessary for the purposes for which they were collected. In certain circumstances, data subjects may request restriction of the processing of their data, in which case we will retain them only for the exercise or defence of legal claims. Likewise, they may exercise their rights to object and to data portability.

If the person to whom the facts described in the report relate exercises the right to object, it shall be presumed that, unless proven otherwise, there are compelling legitimate grounds that justify the processing of their personal data. Likewise, if the affected person exercises their right of access, the information contained in the register may be provided provided that doing so does not hinder or prevent the investigation.

The data subject may exercise these rights by writing to MOIRA, C/ Almagro 1, 2nd floor (left), 28010 Madrid, or by email to enrique.gimenez@moiracapitalpartners.com.

They may also request information about their rights and lodge a complaint with the supervisory authority, in this case the Spanish Data Protection Agency (Agencia Española de Protección de Datos), with registered office at Calle Jorge Juan, No. 6, 28001 Madrid, if they consider that the processing of personal data concerning them infringes the General Data Protection Regulation.

Conflicts of interest

Submitting a report that affects persons who may actively participate in its investigation will result in their exclusion during its processing and management. Accordingly, the person concerned must refrain from taking part in the resolution procedure. This is intended to avoid any conflict of interest and incompatibility, thereby ensuring the objectivity and independence of the actions taken.

A conflict of interest shall be deemed to exist where the private interests of the persons concerned may limit their ability to investigate the report with the required objectivity and impartiality.

In such case, the person excluded from the investigation is prohibited from accessing any information regarding the reporting person’s identity, as well as any information about the investigation process.

⸻

Rights of the reporting person

I. Anonymity

MOIRA guarantees that reports submitted through this internal channel may be made anonymously. However, there may be certain infringements for which anonymous reporting makes it more difficult to carry out the investigation appropriately (for example, sexual harassment or sexual abuse), as well as to communicate properly with the reporting person (if the Company does not know their identity, it will not be able to request additional information if necessary).

II. Protection during the investigation

MOIRA guarantees the protection of all persons who submit a report through the internal reporting channel in accordance with this policy.

III. Right to receive information during processing

Whenever possible (for example, where the reporting person is not acting anonymously), MOIRA will acknowledge receipt of the report and, once the investigation has concluded, the reporting person will be informed of its outcome, explaining the reasons why the entity has adopted measures or sanctions in relation to the person concerned.

The Company will not request from the reporting person information or personal data that are not strictly necessary to process the report and carry out investigative actions.

In this regard, the information provided by the reporting person may not be processed for purposes other than investigating the reported facts.

IV. Prohibition of retaliation

Persons who provide information about infringements as provided herein, and who do so in good faith, are protected against any form of retaliation, discrimination or penalty as a result of the report they have submitted. MOIRA states that this prohibition of retaliation will also be complied with even where the investigation concludes that no breach of applicable regulations has been committed by the person concerned, provided that the reporting person has not acted in bad faith.

Retaliatory acts are understood to be those prohibited by law or that, directly or indirectly, entail unfavourable treatment that places the persons who suffer them at a disadvantage compared to others solely because of their status as reporting persons; this also includes threats or attempts at retaliation against persons who submit a report.

By way of example, the law considers the following to be retaliatory acts:

Suspension of the employment contract, dismissal or termination of the employment relationship, unless the decision is based on circumstances, facts or proven infringements unrelated to the submission of the report.
Imposition of any disciplinary measure, demotion or denial of promotion, and any other substantial modification of working conditions, unless such measures are imposed for reasons unrelated to the submission of the report.
Reputational harm, coercion, harassment or ostracism.
Negative evaluations or references regarding professional or work performance.
Inclusion on blacklists that hinder or prevent access to employment.
Denial of training.
Discrimination or unfavourable treatment.

In this regard, persons who provide information through the channel shall not be considered to be breaching any restriction on disclosure of information, nor incurring any liability of any kind in relation to such communication, provided they had reasonable grounds to believe that the information was necessary to reveal an unlawful act or omission.

Any reporting person who considers that retaliation has been taken against them solely as a result of having reported certain infringements through this internal channel may inform the lead investigator, who will analyse the specific case and take appropriate measures to prevent such retaliation or, failing that, to remedy it.

⸻

Rights of the investigated person

The investigated person has the right to be informed of the acts or omissions attributed to them and to be heard at any time during the processing of the investigation (where possible, since there may be investigations that, in order to resolve them properly, require that the person concerned not be aware of their processing). However, under no circumstances must that person be informed of the reporting person’s identity.

In addition, during the processing of the file, the right to the presumption of innocence, the right of defence and the right of the person concerned to access the file must be guaranteed, while preserving their identity and ensuring the confidentiality of the facts and data of the procedure.

In this sense, no disciplinary or sanctioning measures shall be applied until the truthfulness of the reported facts has been verified and the investigation has been concluded.

Accordingly, if, once the investigation has been processed, it is verified that the reported facts are true and that applicable regulations have been breached, the disciplinary measures that the Company deems appropriate may be applied.

⸻

Reporting false information or acting in bad faith

Knowingly reporting false facts constitutes a breach of the good faith that governs any employment relationship, and MOIRA may adopt such disciplinary or sanctioning measures as it deems appropriate in relation to that reporting person.

Accordingly, the prohibition of retaliation provided for herein shall not prevent the Company from adopting the corresponding disciplinary or sanctioning measures where the investigation concludes that the information provided is false and was submitted knowingly, and that the reporting person therefore acted in bad faith.

⸻

5.- Operation of the channel

For the purposes of processing reports received through the internal reporting channel, this procedure has been developed from submission to resolution. Accordingly, the internal reporting channel is implemented by enabling a specific email address: canaldedenuncias@moiracapitalpartners.com.

MOIRA has appointed Mr. Enrique Giménez-Arnau Durán as lead investigator for the purposes of processing and analysing reports submitted through the internal reporting channel. If necessary, and taking into account the reported infringement, third parties may be appointed to assist the lead investigator during the processing of the file (for example, if the infringement concerns matters related to the prevention of money laundering, the investigative team will be made up of the Internal Control Body (OCI); if the infringement concerns labour matters, the investigative team will be made up of the Head of Human Resources). Processing may vary in certain aspects depending on the reported infringement.

In addition, data subjects are hereby informed that the system manager, appointed by the management body, is Mr. Enrique Giménez-Arnau Durán. The system manager will perform their functions independently and autonomously from the entity’s other bodies and may not receive instructions of any kind. Furthermore, they will have at their disposal all personal and material resources necessary to carry out their functions. Their functions include, in particular:

Promoting and supervising the implementation and effectiveness of the channel.
Ensuring that this Policy is accessible to all members of the organization.
Implementing procedures to manage reports.

Access to this information is limited to those persons who need to know it in order to process the reports, specifically:

The System Manager and whoever directly manages it.
The investigative team (the competent body processing the report).
The Head of Human Resources, only where disciplinary measures against an employee may be adopted.
The Head of Legal Services, where legal measures may be adopted in relation to the facts described in the report.
The Data Protection Officer.

⸻

I. Receipt of the report

Reports may be made verbally, by telephone (calling +34 913 578 422) or by holding an in-person meeting, or in writing by completing the form template available, which is attached as an annex to this policy, enclosing any documentation that may assist the investigation, and sending it to canaldedenuncias@moiracapitalpartners.com.

Although reports will be made in writing, once the information has been provided, the reporting person may also request an in-person meeting within a maximum period of seven days.

Where a report is submitted through internal channels other than the one established in this policy or is received by staff members who are not responsible for processing it, the report must be immediately forwarded to the System Manager. In all such cases, the confidentiality of the information will also be ensured.

Where a report is made verbally, it will be recorded. In addition, such verbal reports will be documented, with the reporting person’s prior consent, in one of the following ways:

By recording the conversation in a secure, durable and accessible format.
By a complete and accurate transcript of the conversation prepared by the staff responsible for processing it. In this case, the reporting person will be offered the opportunity to verify, correct and accept the transcript by signing it.

When making the report, the reporting person may indicate an address, email address or safe place for the purpose of receiving notifications.

It is important that the reporting person provides sufficient detail about the reported facts or conduct, as well as as much documentation as possible, so that the investigation and analysis can be as accurate as possible.

MOIRA will acknowledge receipt of the report to the reporting person within seven calendar days of receipt, unless doing so may jeopardise the confidentiality of the report.

Where there is a potential infringement within the Company, a prior analysis process of the information must be initiated. Accordingly, once the report and documentation have been received, MOIRA will decide to:

Admit the report for processing: the reported facts or conduct may constitute an act contrary to applicable regulations.
Decline to process the report: if it does not meet the formal requirements or if the reported facts or conduct do not relate to matters that may be reported through this channel, in which case the procedure will be closed.

Likewise, whenever possible (if the lead investigator considers there is a risk that such notification may compromise the investigation, communication may be postponed), the person concerned will be informed of the receipt of the report, as well as of the fact and alleged infringement of which they are accused.

II. Investigation of the report

Once admitted for processing, the lead investigator will open an individual file in relation to it, which will include:

The report form (if it was submitted verbally, the information provided by the reporting person will be recorded through a transcript of the meeting or a recording of the call).
The investigators’ assessment of the content of the report.
Minutes of any meetings held to examine the alleged infringement.
A summary of the actions carried out. Such actions may include:
- Requesting the reporting person to provide additional information so that the investigation is more complete.
- Conducting interviews with the victim, witnesses, etc.
- Inspecting the technical means made available to employees (desktop computers, laptops, mobile phones, etc.), as well as corporate email inboxes and network folders, in accordance with the rules on use and security of corporate systems and applicable regulations.
- Holding an interview with the person or persons concerned.
- Any other action deemed necessary to continue the investigation process.

The maximum period to carry out investigative actions and provide a response may not exceed three months, counted:

From receipt of the report; or
If no acknowledgement of receipt was sent to the reporting person, from the expiry of the seven-day period following submission of the report.

However, in cases of particular complexity that require an extension in order to ensure that the investigation is carried out properly and in full compliance with the principles set out in this policy, the response period may be extended by up to a further three additional months.

⸻

III. Resolution of the report

Once the investigative actions have been carried out, the lead investigator and, where applicable, the investigators designated by them, must evaluate the results obtained and make the appropriate decision on the basis of that analysis. The analysis of the described facts and the proposed resolution arising from the investigation must be set out in a report containing the following information:

Form.
Analysis of the facts described in the form.
Actions taken by the lead investigator, facts investigated and evidence analysed.
Conclusions reached based on the investigation.

If, after analysing the facts, it is determined that no breach of regulations has occurred, the reporting person (where the report was not submitted anonymously) and the person concerned will be informed of that decision, together with the reasons supporting it.

If, after analysing the facts, it is determined that a criminal offence has been committed or that conduct has occurred that breaches the other rules indicated in this policy, the report must include proposed sanctioning measures.

This conclusions report will be sent to the person concerned so that they may submit representations within 5 days. Once their representations have been analysed, the final report will be prepared and sent to the management body so that it may adopt the decisions it considers most appropriate.

Where the facts may constitute a criminal offence, the information will be forwarded to the Public Prosecutor’s Office without undue delay.

⸻

6.- Annex: Report form

We remind you that you have the option of submitting the report anonymously. However, please note that, in such case, it may be more difficult to investigate the described facts, which could affect the outcome of the investigation and, in addition, we will not be able to contact you to inform you of the result.

Processing of this report will be subject to the required confidentiality, in full compliance with the principles set out in our policy. Only the System Manager, the lead investigator, the Head of Human Resources (where disciplinary measures may be adopted), the Head of Legal Services (where legal action may be taken) and the Data Protection Officer will be able to access the internal reporting system data for the investigation of the facts.

REPORTING PERSON’S DETAILS (if the report is not submitted anonymously)

Full name:
National ID number:
Position within the Company:
Email address:
Telephone number:

DETAILS OF THE PERSONS INVOLVED

Offender(s):
Full name:
Position within the Company:

Victim(s):
Full name:
Position within the Company:

FACTS THAT HAVE OCCURRED

Description of the facts:
Approximate date of the described facts:
Could these facts affect third parties? If so, please indicate whom.
Other possible witnesses:

EVIDENCE OF THE FACTS

If you have it, documentation proving the described facts (Attach).
Have these facts been reported previously? If so, please indicate when.

By submitting this report, the reporting person confirms that it has been made in good faith and that the information included in this form is true and accurate.

The person concerned will be informed as soon as possible, provided that it does not hinder the processing of the report, of the facts set out in the form and of their rights, in order to guarantee their right to be heard as well as their right to the presumption of innocence; however, the reporting person’s identity will not be disclosed.

Pursuant to applicable data protection regulations, we inform you that the data you provide may be processed as follows:

Controller
MOIRA CAPITAL PARTNERS, SGEIC, S.A.U.

Purpose of processing
Receipt, management and investigation of reports submitted through this channel.

Legal basis
Processing is necessary for compliance with a legal obligation applicable to MOIRA, as well as for the performance of a task carried out in the public interest, namely the prevention of criminal offences and the prevention of the entity’s criminal liability.