Compliance

Reports submitted through the Internal Ethics Channel shall be processed in accordance with the principles of confidentiality, diligence, independence, objectivity, and respect for the rights of all persons involved, in compliance with Spanish Law 2/2023 of 20 February, regulating the protection of persons who report regulatory infringements and combating corruption.

Submission and Content of Reports

Any person with knowledge or reasonable indication of misconduct may submit a report through the Internal Ethics Channel. Reports should include a clear and detailed statement of the facts, including as applicable:

• The place, department, or business unit where the events occurred;
• The date and timeframe of the events;
• Persons involved or potentially involved;
• Relevant documents or evidence related to the report;
• Actions taken in connection with the reported matters.

The reporting person may choose to remain anonymous. The system shall allow anonymous reporting and shall maintain anonymity unless the reporting person voluntarily provides contact information. All reports, whether anonymous or identified, shall be treated with the same confidentiality and procedural guarantees.

Acknowledgment and Preliminary Assessment

Upon receipt of a report, the designated Channel Manager shall acknowledge receipt to the reporting person within seven (7) calendar days, provided contact details are available and unless doing so would compromise anonymity or confidentiality.

Following acknowledgment, an initial assessment will be conducted to determine whether the report is suitable for handling through the Channel and whether further investigation is warranted. The reporting person may be provided with a follow-up link or mechanism to track the progress of the case and, where necessary, to submit additional information.

Investigation and Resolution Timeframes

The internal handling and investigation of the report shall be concluded within a maximum period of three (3) months from the date of the acknowledgment of receipt or, if no acknowledgment was sent, from the expiration of the seven-day period following receipt. This period may be extended up to a total of six (6) months in cases of complexity, provided that the extension is duly justified and documented.

During the investigation, the reporting person may be informed, where appropriate and to the extent permitted without jeopardizing the process, about the status of the proceedings and actions taken. Upon conclusion, the reporting person shall be informed of the outcome of the investigation and any measures adopted or planned, respecting all applicable data protection and confidentiality requirements.

Confidentiality and Anonymity

The system will ensure the confidentiality of the reporting person’s identity and safeguards shall be in place to prevent retaliation. Anonymity shall be preserved unless the reporter voluntarily reveals their identity or its disclosure is legally required in the context of judicial or administrative proceedings. All data collected shall be handled in accordance with applicable data protection laws.

Retention of Information

Data and documentation related to reports shall be retained for the period necessary to determine the appropriateness of initiating an investigation and, where applicable, to document the investigation itself, in accordance with data protection and evidence preservation requirements.

Outcomes and Follow-Up

Upon completion of the internal process, a report may result in:

• Filing and closure without further action;
• Initiation of internal corrective or disciplinary measures; or
• Referral to the competent authorities where the reported conduct may constitute a serious administrative infringement or a criminal offense.

The Channel Manager shall ensure that information on external reporting channels (e.g., competent authorities or, where relevant, the Independent Authority for the Protection of Reporting Persons) is available to the reporting person.

Link to form

COMPLIANCE CHANNEL PRIVACY POLICY

DATA CONTROLLER:
The data controller is ENTREPRENEUR CAPITAL, S.L C.I.F. B-85053353 Adress: Travesía de Navaluenga , 38 , Majadahonda- Madrid ( Spain), Email: lopd@opinno.com

PURPOSES OF THE DATA PROCESSING :
The purposes of the processing are the processing of your request and, if the complaint is followed up, the investigation of the reported facts and the adoption of the appropriate measures.

THE LEGITIMACY OF DATA PROCESSING:
The legal basis for the processing is the existence of a legal obligation, in the terms set forth in Article 6.1 c) of the General Data Protection Regulation.

RECIPIENTS :
The data will be communicated to suppliers of the company, as processors, within the framework of the corresponding provision of services (e.g. legal assistance), and to the competent authorities and bodies in compliance with legal obligations or for the formulation, exercise or defense of claims.

CROSS-BORDER PROCESSING :
The company has contracted IT service providers who act as processors. Transfers to third countries associated with these services will be made either on the basis of an adequacy decision of the European Commission (Article 45 of the General Data Protection Regulation) or on the basis of appropriate safeguards such as standard data protection clauses adopted by the Commission (Article 46 of the General Data Protection Regulation).

CONSERVATION PERIODS:
The data will be kept for the time necessary to decide whether to initiate an investigation into the facts reported. If it is proven that the information provided or part of it is not truthful, it will be immediately deleted as soon as this circumstance is known, unless the lack of truthfulness may constitute a criminal offense, in which case the information will be kept for the time necessary during the judicial proceedings.

RIGHTS:

You may exercise your rights by sending a communication and proof of your identity to: lopd@opinno.com
• Access: Interested parties have the right to obtain confirmation as to whether or not personal data concerning them is being processed.
• Rectification: Interested parties have the right to request the rectification of inaccurate data concerning them.
• Deletion: Data subjects have the right to request deletion of their data when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
• Limitation: In certain circumstances, data subjects may request the limitation of the processing of their data.

• n EN
• n ES
• n IT

• n EN
• n ES
• n IT