Policy on the use and operation of the internal complaints channel

TABLE OF CONTENTS

1. Definitions
2. Introduction
3. Purpose
4. Scope of application
5. Principles and safeguards of the Internal Reporting System
6. Fraudulent or bad faith reporting
7. Preservation, custody and archiving of information
8. Responsible for the Internal Information System
9. Means of communication of complaints
10. Contents and identifying data of the complaints
11. Procedure for processing and management of complaints
12. Approval
13. Communication and entry into forcé

Organisation/Company: Asturiana de Laminados, S.A. (hereinafter, “ELZINC”)

Internal Information Channel/Internal Information System/Internal Complaints Channel: channel through which the employees of ELZINC. as well as third parties who collaborate professionally with the Company, shall have the possibility of reporting an action, conduct or behaviour that could result in the commission of a breach of the legal regulations in force, as well as of the Company’s internal policies, by virtue of Law 2/2023, of 20 February, regulating the protection of persons who report breaches of regulations and the fight against corruption (hereinafter, “Whistleblower Protection Law”).

Infringement: action, conduct or behaviour that entails the violation of European Union Law or Spanish Law in the sense indicated in the Whistleblower Protection Act, including those conducts typified in the Criminal Code that are likely to generate criminal liability for the company; as well as of the internal policies of the Organisation.

Whistleblower/Complaint: communication, by an employee of the Organisation or a third party who collaborates professionally with it, of an action, conduct or behaviour that could result in the commission of an offence, as established in the personal sphere of the Whistleblower Protection Act and the Criminal Code.

Whistleblower: a person working for the Organisation or a third party collaborating professionally with it who informs the Organisation of an action, conduct or behaviour that could lead to the commission of an offence.

Respondent: a person against whom a complaint has been lodged in respect of an action, conduct or behaviour that could lead to the commission of a violation.
Stakeholders/Third Parties: persons or entities, external or internal, who collaborate professionally with the Organisation and who may affect or be affected by an action, decision or activity of the Organisation.

Retaliation: any action, conduct or behaviour intended to punish the whistleblower for bringing to the attention of the organisation an action, conduct or behaviour that could lead to the commission of an offence.

The Whistleblower Protection Act establishes the need for companies with more than 50 employees to have an Internal Reporting Channel. With the approval of this law, Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 is transposed into Spanish law, incorporating two clear objectives of the Directive: (i) to protect whistleblowers; (ii) to establish minimum standards for information channels.

The purpose of the rule is to protect persons who, in an employment or professional context, detect serious or very serious criminal or administrative offences and report them through the mechanisms regulated therein. Good faith, the honest awareness that serious harmful acts have occurred or may occur, is a prerequisite for the protection of the whistleblower. This good faith is the expression of their civic behaviour and contrasts with other actions that, on the contrary, it is essential to exclude from protection, such as the transmission of false or distorted information, as well as information that has been obtained illegally.

This Internal Reporting System and Whistleblowing Channel is also a key element of ELZINC’s Compliance Model, thus constituting an effective mechanism for preventing and detecting the commission of crimes within the Company.

The purpose of this ELZINC Whistleblower Channel and Internal Reporting System Operating Policy is to specify the criteria for the use and management of the channel through which queries and/or complaints may be sent regarding potential offences that may arise within the Company in the course of its activities.

The Company wishes to emphasise that retaliation and other harmful conduct on the grounds that a query and/or complaint has been made in good faith is strictly prohibited.

This Policy shall apply to any person who reports, through the Internal Reporting System provided for this purpose and having obtained the information in an employment or professional context, any action, conduct or behaviour that could be considered a breach of European Union or Spanish law with respect to ELZINC, as well as of the internal policies of the Organisation, as indicated above and as established in the Whistleblower Protection Act.

The management of the Internal Reporting System and Complaints Channel shall guarantee, with regard to any action arising from the procedure, the following principles:

• Principle of presumption of innocence: the Internal Information System and Complaints Channel shall ensure the right to the presumption of innocence of the accused, being treated as innocent until the commission of an offence is accredited and, where appropriate, the corresponding sanction is imposed.
• Principle of confidentiality: the Internal Information System and Complaints Channel shall guarantee the confidentiality of the identity of the informant, the reported person and any third party involved in the complaint.

Persons who, as a result of the initiation of the complaint procedure, have access to information relating to third parties, shall be obliged to maintain the confidentiality of such information, which may not be disclosed to third parties, with the exception of the need to share information with the persons involved in the procedure, respecting, in all cases, the principles of necessity and appropriateness.

• Principle of legality: the infringements investigated, as well as the sanctions that may derive from their commission, must be in accordance with the provisions of the applicable regulations.
• Principle of proportionality: the sanctions that may be imposed by virtue of the commission of an infringement must be adjusted to the seriousness of the acts committed, avoiding arbitrary or disproportionate decisions.
• Principle of integration: all Internal Information Systems that may be established within ELZINC must be integrated with each other, implementing coordination systems that ensure that the processing of the data obtained complies with the regulations in force, as well as guaranteeing the use of the procedures stipulated for this purpose.
• Principle of impartiality and independence: the Internal Reporting System and Complaints Channel shall act independently from the rest of the Organisation’s bodies, guaranteeing the impartiality and objectivity of the procedure and the decisions that may derive from it.
• Prohibition of retaliation: the Internal Reporting System and Whistleblowing Channel shall guarantee the necessary protection and support to the persons involved in the procedure, excluding any type of retaliation against persons who, in good faith, report facts that could constitute an infringement.
• Protection of personal data: the Internal Information System and Complaints Channel shall ensure the protection of the rights conferred by the data protection regulations in force in respect of all parties involved in the procedure.

The protections and safeguards set out in this Policy are subject to the reporting person making the report in good faith, having reasonable grounds to believe that the reported action, conduct or behaviour could result in the commission of a breach.

However, whistleblowers who knowingly report incorrect or misleading information will not be afforded the protections and safeguards set forth in this Policy. In addition, the Organisation will conduct a case-by-case review and reserves the right to take disciplinary action against whistleblowers who act in bad faith.

A record shall be kept of all complaints received and, where appropriate, of all information for the time legally permitted by the regulations in force at any given time. The aforementioned register shall comply with the technical and organisational security measures.

Pursuant to the provisions of article 24 of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”), the informant’s data shall be kept in the Internal Information System only for the time required to decide on the appropriateness of initiating an investigation into the reported facts.

In any case, 3 months after the data have been entered, they must be deleted from the Internal Information System. This cancellation shall consist of blocking the data, that is, reserving them in order to prevent their processing, with the exception of making them available to the public administrations and judges and courts for the attention of possible liabilities during the corresponding prescription periods, in accordance with the provisions of the regulations in force. After this, the data will be physically deleted.

Notwithstanding the foregoing, once the 3-month period has elapsed, the data may continue to be processed by the person responsible for the investigation of the reported facts, and will not be kept in the Internal Information System itself.

In order to guarantee the purpose and principles of this Policy, in accordance with Law 2/2023, the Governing Body of ELZINC appoints the Head of the Internal Reporting System and Whistleblowing Channel to the Legal Department and the Human Resources Department (hereinafter, “the Head”), notifying the Independent Authority for the Protection of Whistleblowers (A.A.I.) of his or her appointment.

The Officer shall carry out his or her duties independently and autonomously from the rest of the Organisation, ensuring the impartiality and objectivity of the procedures and decision-making. In addition, he/she must guarantee full guarantees of confidentiality and security with respect to the information he/she receives.

The Governing Body may dismiss the Head, appoint a new Head, communicate the decision to the Organisation’s employees and

In order to guarantee the confidentiality of the whistleblower, an information channel has been set up, which can be accessed via a link that has been incorporated into the Company’s website and which can be accessed via the following link: https://elzinc.es/en/the-company/complaints-channel/

(**) The channel makes it possible to file a complaint, verbally or in writing, guaranteeing the anonymity of the informant, as well as the confidentiality of the information provided, including the personal details of the person reported and third parties involved in the procedure.

The complainant, once accessing the channel through the link provided, must complete the following predefined fields in relation to the reported infringement in order to be able to carry out an analysis of the reported facts:

1. Place where the incident occurred, detailing (i) Address, (ii) Locality, (iii) Province, (iv) Postcode and (v) Workplace.
2. Your relationship with the Company, to be chosen from the options indicated.

• The way in which you wish to submit the complaint, to choose between the options indicated: anonymous or confidential. Anonymous means that the complainant will not identify him/herself, while confidential means that the complainant will identify him/herself, but information about his/her identity will not be disclosed throughout the process and afterwards.
  • Date of the complaint.
  • Reported offence, to be chosen from the options indicated.
  • Description of the facts.
• Information on whether the events are currently taking place or, if so, on what date they occurred.
• Those affected by the events.
  • Statement as to whether you know the identity of the persons involved in the events, to be chosen from the options indicated.
  • Statement as to whether any managerial position is involved in the possible infringement, to be chosen from the options indicated.
  • Statement as to whether the situation is known to the highest body, to be chosen from the options indicated.

• Statement as to whether the possible infringement reported affects third parties related to the Company, to be chosen from the options indicated.
• Statement as to whether the possible infringement reported has an economic impact, to be chosen from the options indicated.
• Statement as to whether you have documentation supporting the possible infringement, to be chosen from the options indicated.

Once the predefined fields have been filled in, the complainant, before sending the communication, must tick two boxes, indicating the following:

• That the information sent will be used only for the treatment of the specific complaint and in compliance with the provisions of this Policy.
• That he/she has read and accepts the terms set out in this Policy.

The procedure for processing and handling complaints shall be in accordance with the provisions of Articles 8 and 9 of the Whistleblower Protection Act.

Once the complaint has been submitted, it shall be received by the Head of the Internal Information System and Complaints Channel, who shall be responsible for carrying out a preliminary analysis of the facts reported and deciding whether to admit the complaint for processing. In this preliminary analysis, the Officer shall assess the indications of the reported infringement and, consequently, decide whether or not to initiate an investigation. Consequently, this first phase of the procedure will end, following a report justifying the decision taken, with two possible resolutions:

1. Refusal to admit the complaint for processing, communicating the decision to both the complainant and the respondent.
2. Admission of the complaint for processing and commencement of the investigation phase. The person in charge will open the investigation proceedings that he/she deems necessary to confirm the veracity of the facts reported. Once the investigation phase has concluded, the Head will formulate a written proposal for resolution, indicating, where appropriate, the measures and/or sanctions to be applied in each case, which will be sent to the Company’s Human Resources Department, which will be responsible for the execution of the sanction.

Prior to the commencement of the investigation phase, the Head must inform the complainant of (i) the receipt of the complaint within seven calendar days of its actual receipt, unless this could jeopardise the confidentiality of the communication, (ii) the absolutely confidential processing of the complaint, (iii) if applicable, the transfer of the complaint to the Company’s Human Resources Department for the study of the facts and the imposition of sanctions. Likewise, the reported party must be informed of (i) the receipt of the report, (ii) the facts of which he/she is accused, (iii) the departments and third parties that may be recipients of the report, (iv) how to exercise his/her rights of access, rectification, cancellation and opposition, in accordance with data protection regulations.

Subsequently, the maximum period for responding to the investigation proceedings will be determined, which may not exceed three months from receipt of the communication or, if no acknowledgement of receipt was sent to the informant, three months from the expiry of the seven-day period following the communication, except in cases of particular complexity that require an extension of the period, in which case, this may be extended for a maximum of a further three months. Similarly, provision is made for the possibility of maintaining communication with the informant and, if deemed necessary, requesting additional information from the informant or whistleblower.

Similarly, provision is made for the possibility of establishing the right of the person concerned to be informed of the actions or omissions attributed to him or her, and to be heard at any time. The information shall be forwarded to the Public Prosecutor’s Office immediately when the facts could be indicative of a criminal offence. Where the facts affect the financial interests of the European Union, it shall be referred to the European Public Prosecutor’s Office.

Once the investigation has been completed, the person in charge shall formulate a duly justified proposal for a resolution on the dismissal of the complaint, if applicable, or on the possible disciplinary measures to be adopted. Said resolution shall be forwarded to the Board of Directors of the Company as well as to the Administration Department in charge of executing the sanction.

Without prejudice to priority being given to the use of the Internal Information System and Complaints Channel, the whistle-blower may use external information channels with the competent authorities and, where appropriate, with the institutions, bodies, offices or agencies of the European Union.

This Policy has been approved by the Governing Body of ELZINC.

This Policy shall be communicated and disseminated to the Company’s employees by digital and/or physical means. In addition, the Company undertakes to inform new employees of the existence of the Policy.

This Policy shall enter into force on the day following its dissemination to the Organisation’s employees.