ARISTOCRAZY ETHICAL CHANNEL

COMPLAINMENT CHANNEL ACCESS HERE
Information management procedure

This document establishes in detail the procedure for the Aristocrazy Ethical Channel to comply with the requirements established in Law 2/2023, of February 20, regulating the protection of people to report on regulatory violations and the fight against corruption.

1. IDENTIFICATION OF ARISTOCRAZY INTERNAL INFORMATION CHANNELS

Communications may be sent in writing or verbally or in both ways, through the following means:

Access to the online form (preferred).

Postal or in-person channel: Gran Vía 40 bis, 3º 48009 Bilbao (Vizcaya) Spain.

Email: comitedeetica@gruposuarez.com

In-person meeting, at the request of the informant at the agreed address, within a maximum period of seven (7) calendar days from the request.

2. WHAT IS THE ARISTOCRAZY ETHICAL CHANNEL?

This is a confidential communication channel available to all people who are part of Aristocrazy, as well as people, both natural and legal, who have any type of relationship with the people who are members of Aristocrazy. (employees, suppliers, franchisees, etc.).
Aristocrazy is committed to transparency, ethical culture and regulatory compliance in all its aspects, so any communication related to regulatory breaches of any type, unethical behavior such as bad labor, financial, accounting, commercial practices, etc. to be able to take all necessary measures to correct these attitudes and achieve our objective of full ethical and regulatory compliance as an organization.
The communication will be carried out through the form created for this purpose that is found on the home page of this website, through which we guarantee anonymity if the informant so wishes, the total confidentiality of the communication and the protection of the informant, to thus avoiding any type of retaliation.
This communication channel may also be used to make inquiries in case of doubts that may arise in the application of the company's internal rules and procedures.

3.EXTERNAL INFORMATION CHANNELS BEFORE THE COMPETENT AUTHORITIES AND, WHERE APPROPRIATE, BEFORE THE INSTITUTIONS, BODIES OR AGENCIES OF THE EUROPEAN UNION.

In the event that any informant wishes, he or she may make a communication to the Independent Authority for the Protection of Informants, A.A.I. any breach or omission of the principles and guarantees established in this document that are supported by compliance with Law 2/2023.
Likewise, the informant can turn to the competent Authorities to receive advice, support or process their communication, receiving the same guarantees as in the Ethical Channel.

4. PROCEDURE FOR MANAGEMENT AND PROCESSING OF COMMUNICATIONS RECEIVED.

a) Issuance of the communication by the informant and its content.

The informant may send the communication through any of the methods detailed in section 1, the preferred channel being the online form.
For correct management and analysis of the communications received and the facts contained therein, all communications must contain the following data:

- Explanation of the events in the most detailed way possible, indicating the dates on which they took place, as well as whether they were specific or continuous over time and whether they continue to occur.

- Identify the person(s) involved either for having committed the facts, for being victims or aware of them.

- Attach all documents and information about the reported facts that allow the complaint to be justified.

- Provide, if the informant so wishes, a contact method in the event that Aristocrazy considers it necessary to contact him to expand the information provided through the communication.

At the option of the informant, the communication made through the form may be anonymous, so that the informant may choose between providing their data or not providing it. In any case, whether the communication is anonymous or not, the entire management procedure, from the receipt of the communication to the conclusion of the investigation and resolution of the case, will be confidential.

b) Reception of the communication.

The System Manager designated by the Administrative Body at all times will be the one who receives the communications made to the Aristocrazy Ethical Channel.
Once the communication is received, the System Manager will send the informant the acknowledgment of receipt of the communication within a period of no more than (7) seven calendar days following its receipt, unless this may jeopardize the confidentiality of the communication.

c) Communication analysis.

The communication sent is reviewed by the System Manager, after applying the corresponding conflict of interest filter to guarantee objectivity and independence in the analysis and resolution of the communications.
Once the conflict of interest has been ruled out, the System Manager will contact the department or departments involved or that may be related to the communication to carry out the pertinent investigative actions and request the informant, in case the contact With this, it is possible, the additional information or documentation that is considered necessary for the resolution of the case.
The maximum period to respond to the investigation actions and issue the corresponding report may not exceed three months from receipt of the communication.

d) Rights of the affected person.

Any affected person to whom actions or omissions are attributed in a communication will be informed and heard in the time and manner that the System Manager together with the departments involved in the investigation consider appropriate to guarantee the good end of the investigation.
At all times, absolute respect for the presumption of innocence and the right to honor of the affected persons will be required.

e) Resolution of the communication and issuance of the final report.

Based on the investigation report, it will be decided whether measures should be applied or not and, where appropriate, the notification will be archived.

5. CONFIDENTIALITY GUARANTEE

All information provided by the informant through their communication will be treated confidentially.
Likewise, the confidentiality of any communication is guaranteed when it is sent through reporting channels other than those established in section 1 or to members of staff not responsible for its treatment, who will have been trained in this matter and warned of the classification as very serious violation of the breach of the obligation of confidentiality and, likewise, the establishment of the obligation of the recipient of the communication to immediately send it to the System Controller.

6. PROTECTION OF PERSONAL DATA.

The processing of personal data will be governed by the provisions of Title VI of Law 2/2023, of February 20, regulating the protection of people who report regulatory infractions and the fight against corruption, in Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, in Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights , in Organic Law 7/2021, of May 26, on the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offenses and execution of criminal sanctions, and in this title.
Personal data that is not clearly relevant to processing specific information will not be collected or, if collected by accident, will be deleted without undue delay.

a) Contact details of the data controller and the data protection officer

In accordance with the provisions of Regulation (EU) 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of your personal data (hereinafter, the “RGPD”), Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (hereinafter, “LOPDGDD”) and Law 2/2023, of February 20, regulating the protection of people who report regulatory infractions and the fight against corruption (“Informant Protection Law”) as well as other applicable regulations regarding the protection of personal data ARISTOCRAZY will treat the data collected through the Ethical Channel as responsible for the treatment. For this purpose, the identification data of the company that will process the data is:

ARISTOCRAZY, S.A.

Registered office: Gran Vía 40 bis, 3º 48009 Bilbao (Vizcaya) Spain.

C.I.F.: A48231146

E-mail: dpo@aristocrazy.com

If you have any questions or queries, you can contact our data protection officer by sending your request to dpo@aristocrazy.com

b) Typology of personal data subject to processing

The use of the Ethical Channel and the inclusion of personal data is voluntary. If you provide us with your personal data directly or if a third party provides it to us through the channel, we may process the following personal data:

Typology of interested party	Categories of data and data subject to processing
Nominal whistleblower	Identification data: name and surname. Contact information: email. Evidence: photographs or documents that can demonstrate the reported facts, including employment, tax information, etc.
Anonymous whistleblower (The complainant can send messages anonymously. In these cases we will not process personal data.)	Pseudonym, if used. Contact information, if provided: email. Evidence: photographs or documents that can demonstrate the reported facts, including employment, tax information, etc.
Reported person	Identification data: name and surname. Data associated with the reported conduct: employment data, tax data, economic data, etc., if provided during the investigation. Evidence: photographs or documents that can demonstrate the facts reported.
Witness	Identification data: name and surname. Contact information: email, telephone, etc. Data associated with the reported conduct: employment data, tax data, economic data, etc., if provided during the investigation. Evidence: photographs or documents that can demonstrate the facts reported.
Third parties	Identification data: name and surname. Contact information: email, telephone, etc. Data associated with the reported conduct: employment data, tax data, economic data, etc. Evidence: photographs or documents that can demonstrate the reported facts, if provided during the investigation.

When sending a message or additional information, you have the possibility of attaching evidence. If you want to send a message anonymously, you should be aware that attachments may contain personal data that jeopardizes your anonymity. Delete this data before sending the files.

c) Purposes of the treatment

We will process your personal data, the information and the documents that you provide us with the purpose of processing, investigating and proposing resolutions on communications and complaints related to possible criminal acts or regulatory and ethical breaches received through this channel, in accordance with the provisions of the Procedure and Policy of the Complaint Management System, as well as the Aristocrazy Code of Ethics.
Additionally, certain information may be processed in order to leave evidence of the operation of the system; this information will be stored in an anonymized manner.

d) Basis of legitimation of the treatment

The legal basis that legitimizes the processing of your data lies in the fulfillment of a legal obligation, by virtue of the provisions of article 30 of the Informant Protection Law (article 6.1.c) of the GDPR). In the event that the data is considered a special category, its processing is excepted in accordance with the provisions of article 30 of the Informant Protection Law, in relation to article 9.2.g) of the RGPD because it is necessary for reasons of essential public interest.

e) Data conservation period in the Ethical Channel

Personal data processed for this purpose will be kept in the Ethics Channel only for the time necessary to decide whether to initiate an investigation into the reported events. In any case, after three months from the introduction of the data, it must be deleted from the Ethical Channel. If it is decided to initiate an investigation, personal data will be kept outside the complaints channel for the duration of the investigation of the facts. In the event that the investigation results in the adoption of certain measures against the investigated persons, the data will be kept as long as the appropriate legal actions persist.
Once the corresponding conservation period ends, the data will be duly blocked and preserved in order to prove compliance with the regulations regarding the provision of an Aristocrazy ethics and compliance model in accordance with the requirements of art. 31 bis of the Penal Code.

f) Access to the Ethical Channel

In general, access to data will be limited exclusively to those who are part of governing bodies related to compliance functions (members of the Aristocrazy Corporate Ethics and Compliance Committee and, where applicable, the Board Ethics and Compliance Advisor), and/or to those in charge of the internal or external investigation (the latter as data processors) who may eventually be designated. Likewise, when disciplinary measures are adopted against Aristocrazy personnel, said access will also be allowed to personnel with management and control functions of the Human Resources area of Aristocrazy.

g) Data recipients

Your data will not be transferred or made available in any way to any third party, except to legal service providers.
Without prejudice to the above, the personal data of the complaints may be communicated to the security forces, Judges or Courts, as well as any other competent body if required in compliance with current legislation.
In particular, in the case of people from Aristocrazy companies located outside the European Economic Area, international transfers of data may be made as long as it is strictly necessary to resolve the case reported through the Ethical Channel. Where appropriate, Aristocrazy will take appropriate measures to ensure that your personal data remains protected as set out in this document and applying the appropriate mechanism in each case in accordance with the GDPR when transferred outside the EEA. Likewise, we ensure that any third party that receives your personal data has appropriate security measures in place to protect said data.

h) Automated decisions and profiling

In no case will Aristocrazy make automated decisions with your data or create profiles.

i) International transfers

Aristocrazy has different subsidiaries, so it is possible that, if necessary based on the specific case and, after carrying out the corresponding investigation, your data may be processed outside the European Union or the European Economic Area.
In any case, Aristocrazy will ensure that said data processing is always protected with the appropriate guarantees, which may include, among others, the signing of standard contractual clauses approved by the European Commission. These clauses consist of contracts approved by the Commission that provide sufficient guarantees to ensure that the processing complies with the requirements established by the GDPR.

j) Exercise of rights

You can exercise, at any time and free of charge, your rights of access, rectification, deletion, limitation of processing, data portability and opposition, expressly indicating which right among those listed above you wish to exercise. . You can direct your request to the following addresses:

- Sending an email to dpo@aristocrazy.com

- By postal mail addressed to Aristocrazy S.A. to the registered office Gran Vía 40 bis, 3º 48009 Bilbao (Vizcaya) Spain.

We will consider all requests and provide our response within the time period established by applicable law. Keep in mind, however, that the rights of access, deletion and opposition may be limited while the investigation of the reported facts is in progress or judicial or extrajudicial actions are being taken over them, and the identity of the complainant must be preserved for the satisfaction of the interests of Aristocrazy or for compliance with a legal obligation.
In any case, you have the right to file a claim with the Spanish Data Protection Agency (www.aepd.es), located at C/Jorge Juan núm. 6 of 28001 Madrid, in the event that you consider that Aristocrazy has violated the rights that are recognized by the applicable legislation.

7. REFERENCE OF INFORMATION TO THE TAX MINISTRY

Immediately, when the facts could indirectly constitute a crime, the System Manager will send the information to the Public Prosecutor's Office. In the event that the facts affect the financial interests of the European Union, it will be referred to the European Public Prosecutor's Office.

8. ABUSE OF THE SYSTEM, FALSE COMPLAINT AND COMMITMENT TO NON-RETALIATION.

Users who use the Ethical Channel in good faith will not suffer any type of retaliation as a result of using the system, and will not face any type of sanction from Aristocrazy.
Aristocrazy will guarantee the adequate protection of privacy and personal data and the preservation of honor, the presumption of innocence and the right to defense of the reported persons, in particular, against unfounded, false or bad faith complaints, regarding the that, where appropriate, the corresponding disciplinary measures will be adopted. Likewise, you must guarantee that the personal data provided through the Ethical Channel is true, accurate, complete and updated.