Internal Whistleblower Channel Policy

1. INTRODUCTION, PURPOSE AND APPLICATION

Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption (hereinafter Law 2/2023) transposes into Spanish law Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law.

This policy applies to Gestiones Comerciales Sportivas Genovés, S.L. with CIF B97688527 and registered office at Ctra. De Simat, N. º 14 46800, 46800, Xàtiva (Valencia) and aims to establish an internal channel for the reporting of possible regulatory violations, infringement of internal policies and / or ethics and establish a regime of whistleblower protection, in compliance with Law 2/2023 of 20 February, regulating the protection of persons who report regulatory violations and anti-corruption.

Law 2/2023 explains and clarifies in its preamble, Part III, that its purpose is to protect, against possible retaliation, persons who, in an occupational or professional context, detect serious or very serious criminal or administrative violations and report them through the mechanisms regulated in this policy.

This Channel, therefore, is a mechanism that allows company employees, and other interested parties, to report any type of illegal conduct or conduct contrary to our values and ethical principles, without fear of retaliation, strengthening the culture of information, the integrity infrastructures of organizations and the promotion of the culture of information or communication as a mechanism to prevent and detect threats to the public interest. In this way, we seek to promote a culture of transparency, integrity and accountability in our organization, while protecting those employees who decide to make a report in good faith.

1. WHISTLEBLOWER CHANNEL

A whistleblower channel (hereinafter, the CII) has been created by the entity as the preferred channel for receiving information on actions or omissions that may constitute a serious or very serious criminal or administrative offense, and other actions provided for in Article 2 of Law 2/2023.

The channel is under the administration of the person in charge of the Internal Channel System (hereinafter, the RSII). Access to this channel shall be limited, within the scope of its competences and functions, to:

1. The Internal Channel System Manager.
2. The administrator/s delegated by the system manager.
3. To the managers designated for the processing of certain complaints according to the scope to which they correspond.

The functions of these bodies, as appropriate, will be:

Receipt, registration and management of complaints received through the whistleblower channel.
Designation of the person or team in charge of investigating the complaints received.
Ensuring the protection of whistleblowers and the confidentiality of the complaints received.
Evaluating the veracity and credibility of the reports received.
Decision making on appropriate action based on the results of the investigation.
Monitoring and periodic review of the whistleblower management process and internal company policy.
Preparation of reports and recommendations to senior management on complaints received and actions taken.

The IIC must technically guarantee the confidentiality or, eventually, the anonymity of the whistleblower, to protect him/her against any leakage and subsequent retaliation to which he/she may be subjected.

Whistleblowers within the scope of the law can make their reports through the following means:

Link to the whistleblower channel:

Canal del Informante

Send an e-mail to the following address: rrhh@gsport.es

Postal mail addressed to Carretera De Simat, Nº 14 46800, 46800, Xàtiva (Valencia) a/a RSII: Fernando Márquez Monzó
In person, at the request of the informant, by means of a request addressed to RSII.

SUBJECTIVE SCOPE - REPORTING SUBJECTS

Those persons who have an employment or professional relationship with the AEPD may use the internal information channel and benefit from the protection granted by Law 2/2023 as informants, in order to communicate information on the actions or omissions described in article 2 of Law 2/2023. This employment or professional relationship, which entails a dependence on the AEPD, is what makes the special protection against possible retaliation necessary and appropriate.

In any case, they are considered informants, for this AEPD, for the purposes of Law 2/2023:

Persons who have the status of employees or workers employed by others.
Self-employed collaborators (freelance).
Shareholders, participants and persons belonging to the administrative, management or supervisory body of the company, including non-executive members.
Any person working for or under the supervision and direction of contractors, subcontractors and suppliers.
Whistleblowers who communicate or publicly disclose information on violations obtained within the framework of an employment or statutory relationship that has already ended, volunteers, interns, trainees, workers in training periods regardless of whether or not they receive remuneration, as well as those whose employment relationship has not yet begun, in cases where the information on violations has been obtained during the selection process or pre-contractual negotiation.

It is important to emphasize that reports made through the whistleblower channel must be in good faith, i.e., they must be supported by concrete evidence and facts.

1. OBJECTIVE SCOPE - REPORTABLE FACTS
As regards the subject matter of the information, it follows from Law 2/2023 that the internal reporting channel may be used to report serious misconduct or suspected corruption, which may constitute serious or very serious criminal or administrative offenses related to the activities of the entity, which the reporting person has observed or about which he has received information in the course of his work or professional relationship.

Law 2/2023 itself and Directive (EU) 2019/1937 list as such, information relating to:

Infringements falling within the scope of the European Union acts listed in the Annex to the aforementioned Directive relating to the following areas:
public procurement,
financial services, products and markets, and prevention of money laundering and terrorist financing,
product safety and conformity,
transport safety,
environmental protection,
radiation protection and nuclear safety,
food and feed safety, animal health and animal welfare,
public health,
consumer protection,
protection of privacy and personal data, and security of networks and information systems.
Affecting the financial interests of the European Union as referred to in Article 325 of the Treaty on the Functioning of the European Union (TFEU).
Affecting the internal market, as referred to in Article 26(2) of the TFEU, including infringements of European Union rules on competition and aid granted by States, as well as infringements relating to the internal market in connection with acts that infringe corporate tax rules or practices intended to obtain a tax advantage that distorts the object or purpose of the legislation applicable to corporate taxation.
Actions or omissions that may constitute a serious or very serious criminal or administrative infraction. In any case, this shall include all those serious or very serious criminal or administrative offenses that imply economic losses for the Public Treasury and for the Social Security.
Infringements of labor law in matters of occupational health and safety reported by workers, without prejudice to the provisions of their specific regulations.

The informant must provide, as a minimum, the reference to the subjective scope of the infringement (matter or regulation infringed: European Union Law; criminal infringement; or administrative infringement); and a description of the facts object of the communication (relevant information about what happened), as detailed as possible, attaching the documentation that may be available, if any.

You can also provide your name and surname, and a contact telephone number, if you do not choose to make this communication anonymously.

If you know the identity of the person responsible for the reported irregularity, or if you have brought these facts to the attention of another body or entity through an external channel, you may also provide this information.

1. REPORTING PROCEDURE
The information may be communicated to the entity anonymously. Otherwise, the identity of the informant will be kept confidential and will be limited to the knowledge of the RSII, delegated administrators or appointed managers. These members shall perform their duties independently and autonomously from the rest of the bodies of the entity or organization and may not receive instructions of any kind in their exercise, having all the personal and material means necessary to carry them out.

The company undertakes to investigate all reports of possible breaches or non-compliance received through the whistleblower channel. All reports will be investigated impartially and confidentially and appropriate action will be taken based on the results of the investigation for the protection of the whistleblower.

The information or complaint will be communicated through the internal reporting channel by means of the specific electronic application for this purpose, identified and accessible from the website: https://gsportapparel.com

At the informant's request, the complaint may also be submitted by means of a face-to-face meeting that will take place within a maximum period of seven days. Where appropriate, the informant will be warned that the communication will be recorded and will be informed of the processing of their data in accordance with the provisions of the RGPD and the LOPDPGDD. When submitting the information, the informant must indicate an address, email, or safe place for the purpose of receiving notifications, unless he/she expressly waives the receipt of any communication of actions carried out by the RSII as a result of the information.

Once the information has been submitted, it will be registered in the information management system, by assigning an identification code, which will be contained in a secure database with access restricted exclusively to RSII personnel, suitably authorized, in which all the communications received will be registered with the following data:

1. Date of receipt.
2. Identification code.
3. Actions taken.
4. Actions taken.
5. Closing date.

Once the information has been received, within a period of no more than 7 calendar days from said receipt, the informant will be acknowledged, unless he/she has expressly waived the right to receive communications related to the investigation. These reports will be managed for a maximum period of 3 months, except in cases of special complexity that require an extension of the period, in which case, this may be extended up to a maximum of 3 additional months.

Once the information has been registered, the RSII and his team will proceed to analyze the admissibility in accordance with the material and personal scope provided for in articles 2 and 3 of Law 2/2023.

The company undertakes to inform the complainant about the status of the investigation and the measures taken, whenever possible and without compromising the confidentiality and protection of the complainant and may request additional information to the facts communicated through the channel.

In addition, the company undertakes to monitor all reports received and the measures taken to ensure the effectiveness of this policy and continuously improve the process.

Any information shall be immediately forwarded to the Public Prosecutor's Office when the facts could be indicative of a crime. In the event that the facts affect the financial interests of the European Union, it shall be referred to the European Public Prosecutor's Office.

1. PROTECTION OF WHISTLEBLOWERS

The Company undertakes to protect persons who report breaches or non-compliance, in accordance with Law 2/2023.

1. Acts constituting retaliation.

Acts constituting retaliation, including threats of retaliation and attempts to retaliate against persons who report as required by law, are expressly prohibited.

Retaliation means any act or omission that is prohibited by law, or that, directly or indirectly, involves unfavorable treatment that places the persons who suffer it at a particular disadvantage with respect to another in the employment or professional context, solely because of their status as whistleblowers, or because they have made a public disclosure.

For the purposes of the provisions of Law 2/2023, and by way of example, reprisals are considered to be those taken in the form of:

Suspension of the employment contract, dismissal or termination of the employment or statutory relationship, including the non-renewal or early termination of a temporary employment contract once the probationary period has passed, or early termination or cancellation of contracts for goods or services, imposition of any disciplinary measure, demotion or denial of promotions and any other substantial modification of working conditions and the failure to convert a temporary employment contract into an indefinite one, in the event that the employee had legitimate expectations that he/she would be offered an indefinite job; unless these measures were carried out as part of the regular exercise of management powers under labor legislation or the corresponding public employee statute, due to circumstances, facts or accredited infractions, and unrelated to the presentation of the communication.
Damages, including those of a reputational nature, or economic losses, coercion, intimidation, harassment or ostracism.
Negative evaluation or references regarding work or professional performance.
Inclusion in black lists or dissemination of information in a specific sector, which hinder or prevent access to employment or the contracting of works or services.
Denial or cancellation of a license or permit.
Denial of training.
Discrimination, or unfavorable or unfair treatment.

A person whose rights have been harmed as a result of its communication or disclosure after the two-year period has expired may request protection from the competent authority which, exceptionally and with justification, may extend the period of protection, after hearing the persons or bodies likely to be affected. The refusal to extend the period of protection must be justified.

Administrative acts aimed at preventing or hindering the submission of communications and disclosures, as well as those that constitute retaliation or cause discrimination after the submission of such communications and disclosures under this law, shall be null and void and shall give rise, where appropriate, to corrective disciplinary or liability measures, which may include the corresponding compensation for damages to the injured party.

1. Measures to protect the whistleblower against retaliation.

Persons who communicate information concerning the acts or omissions set forth in Section FOUR, or who make a public disclosure pursuant to Act 2/2023, shall not be deemed to have violated any disclosure restrictions and shall not incur any liability of any kind in connection with such communication or public disclosure, provided that they had reasonable grounds to believe that the communication or public disclosure of such information was necessary to disclose an act or omission under such Act, all without prejudice to the provisions of any specific employment protection rules that may apply. This measure shall not affect criminal liabilities.

The provisions of the preceding paragraph extend to the communication of information made by the representatives of the workers, even if they are subject to legal obligations of confidentiality or not to disclose confidential information. All of the above is also without prejudice to the specific protection rules applicable in the workplace.

The measures for the protection of the informant shall also apply, as the case may be, to:

a) natural persons who assist the informant in the process;
b) natural persons who are related to the informant and who may suffer retaliation, such as co-workers or relatives of the informant;
c) legal persons, for whom he/she works or with whom he/she maintains any other type of relationship in an employment context or in which he/she holds a significant shareholding.
For these purposes, it is understood that the participation in the capital or in the voting rights corresponding to shares or participations is significant when, due to its proportion, it allows the person who holds it to have the capacity to influence the legal person in which he/she participates.

Whistleblowers shall not incur liability in respect of the acquisition of or access to information that is publicly communicated or disclosed, provided that such acquisition or access does not constitute a criminal offense.

Any other potential liability of insiders arising from acts or omissions that are unrelated to the communication or public disclosure, or that are not necessary to disclose a violation under Law 2/2023 will be enforceable under applicable law.

In proceedings before a court or other authority, concerning prejudice suffered by whistleblowers, once the whistleblower has reasonably demonstrated that he or she has communicated or made a public disclosure pursuant to Law 2/2023 and has suffered prejudice, it shall be presumed that the prejudice occurred in retaliation for reporting or making a public disclosure. In such cases, it shall be incumbent upon the person who has taken the injurious action to prove that such action was based on duly justified grounds not linked to the public communication or disclosure.

In legal proceedings, including those relating to defamation, copyright infringement, breach of secrecy, infringement of data protection rules, disclosure of trade secrets, or to claims for compensation based on labor or statutory law, informants shall not incur liability of any kind as a result of communications or public disclosures protected by Law 2/2023. Such persons shall be entitled to assert in their own defense in such legal proceedings that they have communicated or made a public disclosure, provided that they had reasonable grounds to believe that the communication or public disclosure was necessary to expose a violation under the 2/2023 Act.

Are expressly excluded from the protection provided by law, those persons who communicate or disclose:

Information contained in communications that have been inadmissible by any internal information channel or for any of the causes provided by law.
Information linked to claims regarding interpersonal conflicts or affecting only the informant and the persons to whom the communication or disclosure refers.
Information that is already fully available to the public or that constitutes mere rumors.
Information that relates to actions or omissions that do not fall within the scope of the law.
Measures for the protection of the persons concerned
During the processing of the file, the persons affected by the communication shall be entitled to the presumption of innocence, to the right of defense and to the right of access to the file under the terms provided for in Law 2/2023, as well as to the same protection established for informants, with their identity being preserved and the confidentiality of the facts and data of the procedure being guaranteed.

The Independent Authority for the Protection of the Informant, A.A.I. may, within the framework of the sanctioning procedures it instructs, adopt provisional measures under the terms established in Article 56 of Law 39/2015, of October 1, of the Common Administrative Procedure of Public Administrations.

Are expressly excluded from the protection provided by law, those persons who communicate or disclose:

Information contained in communications that have been inadmissible by any internal information channel or for any of the causes provided by law.
Information linked to claims regarding interpersonal conflicts or affecting only the informant and the persons to whom the communication or disclosure refers.
Information that is already fully available to the public or that constitutes mere rumors.
Information that relates to actions or omissions that do not fall within the scope of the law.
Measures for the protection of the persons concerned

During the processing of the file, the persons affected by the communication shall be entitled to the presumption of innocence, to the right of defense and to the right of access to the file under the terms provided for in Law 2/2023, as well as to the same protection established for informants, with their identity being preserved and the confidentiality of the facts and data of the procedure being guaranteed.

The Independent Authority for the Protection of the Informant, A.A.I. may, within the framework of the sanctioning procedures it instructs, adopt provisional measures under the terms established in Article 56 of Law 39/2015, of October 1, of the Common Administrative Procedure of Public Administrations.

1. Exemption and mitigation of penalties

When a person who has participated in the commission of the administrative infringement that is the object of the information is the one who reports its existence by submitting the information and provided that the same has been submitted prior to the notification of the initiation of the investigation or sanctioning procedure, the competent body to resolve the procedure, by means of a reasoned resolution, may exempt him/her from compliance with the corresponding administrative sanction, provided that the following points are accredited in the file:

a) To have ceased the commission of the infringement at the time of presentation of the communication or disclosure and to have identified, as the case may be, the rest of the persons who have participated in or favored the infringement.
b) To have cooperated fully, continuously and diligently throughout the investigation procedure.
c) To have provided truthful and relevant information, means of proof or significant data for the accreditation of the investigated facts, without having proceeded to the destruction or concealment thereof, nor having disclosed to third parties, directly or indirectly, their content.
d) To have proceeded to repair the damage caused that can be attributed to it.

Cuando estos requisitos no se cumplan en su totalidad, incluida la reparación parcial del daño, quedará a criterio de la autoridad competente, previa valoración del grado de contribución a la resolución del expediente, la posibilidad de atenuar la sanción que habría correspondido a la infracción cometida, siempre que el informante o autor de la revelación no haya sido sancionado anteriormente por hechos de la misma naturaleza que dieron origen al inicio del procedimiento.

La atenuación de la sanción podrá extenderse al resto de los participantes en la comisión de la infracción, en función del grado de colaboración activa en el esclarecimiento de los hechos, identificación de otros participantes y reparación o minoración del daño causado, apreciado por el órgano encargado de la resolución.

La Ley 2/2023 excluye de lo dispuesto en este apartado a las infracciones establecidas en la Ley 15/2007, de 3 de julio, de Defensa de la Competencia.

CONFIDENTIALITY AND DATA PROTECTION

The processing of personal data will be carried out ensuring compliance with Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption , of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, of the Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights and of the Organic Law 7/2021 of 26 May on the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offenses and enforcement of criminal penalties.

The personal data subject to processing, the documents provided and any other information provided in the complaint containing personal information, will be treated confidentially by those responsible for the channel, as well as by the administrators and possible managers, in order to comply with the obligation to investigate and manage the complaint filed as well as to comply with the legal obligations established in Law 2/2023, of February 20, regulating the protection of persons who report regulatory infringements and the fight against corruption.

The Internal Information System must prevent unauthorized access and preserve the identity and guarantee the confidentiality of the data pertaining to the persons concerned and to any third party mentioned in the information provided, especially the identity of the informant in case he/she has been identified. The identity of the informant may only be communicated to the Judicial Authority, the Public Prosecutor's Office or the competent administrative authority in the context of a criminal, disciplinary or sanctioning investigation, and these cases shall be subject to safeguards established in the applicable regulations.

If the information received contains special categories of personal data, subject to special protection, it will be immediately deleted, unless the processing is necessary for reasons of essential public interest as provided for in Article 9.2.g) of the RGPD, as provided for in Article 30.5 of Law 2/2023.

In any case, no personal data will be collected if it is not manifestly relevant to the processing of specific information or, if collected by accident, it will be deleted without undue delay.

Communications that have not been followed up may only be recorded in anonymized form, without the blocking obligation provided for in article 32 of the LOPDPGDD being applicable.

Access to the personal data contained in the internal information system shall be limited to:

The person in charge of the Channel's internal system.
To the administrator/s delegated by the person in charge of the system.
To the managers designated for the processing of certain complaints according to the scope to which they correspond.
The data may be brought to the attention of the Legal Department, Lawyers, Judicial Bodies and State Security Forces and Corps in the event that any of the information received could be considered a crime or legal infraction of any kind.

Legal basis for processing: The processing of personal data, in cases of internal communication, shall be deemed lawful under the provisions of Articles 6.1.c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, 8 of Organic Law 3/2018 of 5 December and 11 of Organic Law 7/2021 of 26 May, when, in accordance with the provisions of Articles 10 and 13 of the law, it is mandatory to have an internal information system. If it is not mandatory, the processing shall be presumed to be covered by article 6.1.e) of the aforementioned regulation. The processing of personal data in the cases of external communication channels shall be deemed lawful under the provisions of Articles 6.1.c) of Regulation (EU) 2016/679, 8 of Organic Law 3/2018, of December 5, and 11 of Organic Law 7/2021, of May 26.

Rights of the data subject: access, rectification, deletion, limitation, portability and opposition, free of charge by email to: info@gsport.es in the cases legally provided for.

Conservation: The data will be kept for the legal term established for the processing of the file and for the time necessary for the exercise of legal actions or if it were necessary to leave evidence of the management of the channel. The interested party has the right to file a complaint to the AEPD at www.aepd.es to request the protection of their rights.

COMMUNICATION AND REVIEW OF POLICIES AND PROCEDURES

The company will conduct periodic trainings and awareness campaigns to foster a culture of integrity and transparency, and to inform employees and other stakeholders about the whistleblower channel. It will also provide information on the rights and protections afforded to whistleblowers under Law 2/2023.

The company undertakes to disseminate this policy to all employees and stakeholders, and will update, at least every three years and, if necessary, modify this internal channel policy, taking into account the experience gained and the recommendations of the Competent Authority.