- INTRODUCTION
1.1. Whistleblower Channel
With the reform of Article 31 bis of the Criminal Code (LO 1/2015) in relation to the prevention of crimes in the company and the approval of Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption (L2/23), the “obligation to report possible risks and breaches to the body in charge of monitoring the operation and observance of the prevention model” was established, and the internal whistleblowing channels became, in addition to a regulatory obligation, one of the bases on which the Compliance programs are based.
1.2. Internal Investigations
Employees may seek advice or support from their line manager or any member of management in case of doubt about the application of the Code of Conduct or any of the Protocols, Manuals, Policies and Operating Procedures applicable in the Lyvea Group. In many cases, a conversation with any of these people will probably be the best and most expeditious way to resolve the problem.
Notwithstanding the foregoing, if the employee has knowledge or suspicions that a violation of these documents or the law has occurred, without prejudice to the possibility of discussing it with the aforementioned persons, the Whistleblower Channel is available to the employee. Submitting the incident through the Whistleblower Channel is mandatory in those cases in which the employee has knowledge or suspicions that a crime has been committed or any activity that may generate criminal liability has been carried out. - OBJECT
The purpose of this Protocol is to encourage and enable those bound by the Lyvea Group’s Protocols, Manuals, Policies and Operating Procedures to report possible breaches of such internal rules or any other rules applicable to the Lyvea Group’s operations, and to ensure that such reports are treated with all legal safeguards and, in particular, the guarantees of presumption of innocence, confidentiality and non-retaliation.
This Protocol also regulates the Whistleblowing Channel and establishes its rules of use, as well as describing the investigation procedure to be followed with respect to any matter reported through the Whistleblowing Channel or that comes to the attention of the Lyvea Group by any other means. - SCOPE OF APPLICATION
This Whistleblowing and Internal Investigations Channel Protocol applies to all members of the partners, management bodies, members of the management teams and other employees of the Lyvea Group, and must be complied with by all of them, regardless of their location or position.
These rules shall be interpreted under Law 2/2023. In case of conflict, the former shall prevail over the latter. - PROCEDURE, ACTIONS OF THE AGENTS INVOLVED
4.1. The Lyvea Group has an open-door policy and encourages employees to share their questions, concerns, suggestions or complaints with their manager. However, if employees become aware of an event that may constitute a violation of Lyvea Group Protocols, Manuals, Policies or Operating Procedures and do not feel comfortable speaking with their supervisor or if they are dissatisfied with their supervisor’s response, they should report it to the management team.
4.2. Reporting Complaints and/or Incidents
4.2.1. The Whistleblower Channel is managed by the managers designated by management. To use this channel, you can: (a) send an e-mail to compliance.denuncias@lyvea.com or (b) use the following link to access an anonymous form:
http://canaldenuncias/
An acknowledgement of receipt of any complaint received will be sent within seven calendar days of receipt, unless this may jeopardize the confidentiality of the communication.
The response to any complaint will be made within a maximum of three months of receipt, unless its complexity requires an increase in time up to a maximum of an additional three months.
4.2.2. The complainant may request a complementary interview with the compliance officer in order to provide any clarifications that may be useful. This interview may be recorded, and the complainant shall be informed of the fact beforehand.
4.2.3. Any incident received shall be immediately reported to the compliance officer. In the event that the incident involves the compliance officer, the complaint may be submitted directly to the management body compliance.comite@lyvea.com.
4.2.4. The persons responsible for receiving and channeling the communications, queries or complaints regulated in this protocol are the following:
- Responsible Madrid: LJN
- Responsible Guadalajara: MLI
- Compliance Committee: ALM, LVR, LJN and MLI.
Likewise, for the purposes legally foreseen, the Compliance Committee delegates to [MLI] the management of the system and the processing of investigation files.
The appointment or dismissal of the persons in charge shall be communicated to the Independent Authority for Whistleblower Protection.
4.3. Anonymity
4.3.1. Following the publication of Organic Law 3/2018 on Personal Data Protection and guarantee of digital rights, it is considered lawful to create and maintain information systems through which the entity may be informed, even anonymously, of the commission within the entity or in the actions of third parties contracting with it, of acts or conduct that could be contrary to the general or sectorial regulations applicable to it.
4.3.2. In accordance with the foregoing, those complaints in which the identification data of the complainant are not included shall be accepted for processing and shall be investigated with the utmost prudence and proportionality.
4.3.3. Complaints must be accompanied by all relevant information available to the complainant.
4.3.4. The Compliance Officer shall create a register of the complaints received, which shall comply with the requirements of the applicable data protection legislation.
4.4. Body responsible for internal investigations
4.4.1. The Compliance Committee is the body responsible for conducting internal investigations of facts that may constitute violations of the Protocols, Manuals, Policies and Operating Procedures of the Lyvea Group when these may constitute a crime. If the complaint does not refer to facts that may constitute a crime, then the Compliance Committee shall refer such complaint to the person in each case responsible for managing that issue within the Lyvea Group.
4.4.2. For each investigation, the Compliance Committee shall appoint the Investigator of the investigation, who may be an external advisor or one of the members of the Compliance Committee. The Instructor shall be responsible for (i) conducting the appropriate investigative procedures; and (ii) issuing a proposed investigation report.
4.4.3. In order to carry out the investigation, the Instructing Officer may have the support of: (i) the other members of the Compliance Committee; (ii) those responsible for Legal Counsel; (iii) members of the areas related to the facts under investigation; (iv) an external lawyer; (v) an external company specialized in forensic services; (vi) a notary; or (vii) any other external professional, in order to ensure the proper conduct of the investigation. In any case, the Instructor will try to reduce as much as possible the number of persons who have knowledge of the investigation, limiting them to those who “need to know”.
4.4.4. Should there be an investigation by the competent authorities for the same facts, both national and supranational, the Compliance Committee shall collaborate with such authorities.
4.5. Admissibility or inadmissibility of the complaint
4.5.1. Once the complaint has been received, the Compliance Committee may admit or reject it for processing.
4.5.2. The complaints and/or incidents to be processed through the Whistleblower Channel must refer to any of the following behaviors:
4.5.2.1. Discovery and disclosure of secrets: for example, if a Lyvea Group employee or officer takes possession of papers or letters from other employees or a customer.
4.5.2.2. Fraud: which would occur if, for example, you ask for payment from a customer in return for services that you do not intend to provide or the use of money from customers who have entrusted us with their management or supervision.
4.5.2.3. Frustration of execution: which could occur if assets of the Lyvea Group or of its customers over which the Lyvea Group has some management capacity are sold and which are under seizure.
4.5.2.4. Punishable insolvencies: if, for example, an asset of any Lyvea Group company or of its customers over which Lyvea Group has any management capacity is sold at a negligible price when such company is insolvent.
4.5.2.5. Computer damage: if, for example, third parties’ computer programs are accessed without their consent in order to damage such programs or if e-mails containing viruses are knowingly sent.
4.5.2.6. Crimes against intellectual or industrial property: which could occur if, for example, pirated software is downloaded or the number of licenses contracted is exceeded.
4.5.2.7. Offenses against the market and consumers: which could occur if, for example, industrial secrets of third parties are disclosed without their consent or if misleading advertising is used for patients.
4.5.2.8. Corruption in the marketplace: if, for example, money or something of value is offered to an employee of another company in order for that company to hire the services of a Lyvea Group company for its employees.
4.5.2.9. Money laundering: occurs, for example, if you buy or sell any property knowing that it originates from a criminal activity, such as tax evasion, or if you allow the use of corporate or ownership structures or funds whose origin is not properly justified and declared.
4.5.2.10. Offenses against the Treasury or Social Security: if, for example, taxes or Social Security contributions due to the Lyvea Group or its customers are not paid.
4.5.2.11. Illegal financing of political parties: what happens if one of the Lyvea Group companies makes a donation to a political party.
4.5.2.12. Offenses against foreign nationals: if, for example, clandestine foreign workers are hired in the Lyvea Group.
4.5.2.13. Bribery or improper bribery: which occurs if, for example, money or something of value is offered to a public official or a third party to make a decision in favor of the Lyvea Group.
4.5.2.14. Influence peddling: i.e. if, for example, a personal relationship with a public official is used to influence the public official to make a decision in favor of the Lyvea Group.
4.5.3. The following complaints shall be inadmissible:
4.5.3.1. Complaints that do not refer to facts that may constitute a breach of the Protocols, Manuals, Policies or Operating Procedures of Lyvea Group or infringement under the terms of Law 2/2023. If they do not constitute a crime, they will be processed outside the procedure set out in this Protocol. Inadmissibility will be communicated, where appropriate, to the complainant.
4.5.3.2. When there is insufficient information on the facts under investigation (as when the complaint is too generic), nor is it reasonably possible to obtain it, requiring a disproportionate investigation.
4.5.3.3.3. Complaints that, for whatever reason, do not present a minimum of plausibility or appear to be manifestly unfounded.
4.6. Preliminary investigation
4.6.1. After having admitted the complaint for processing, and in order to verify the plausibility of the facts reported, and their possible opposition to the Protocols, Manuals, Policies or Operating Procedures of the Lyvea Group, the Instructing Officer shall conduct a preliminary investigation of the same.
4.6.2. Such investigation shall consist of gathering documents available to the Lyvea Group that may serve to corroborate the alleged facts (e.g. contracts, invoices, delivery notes, etc.). The Instructor may communicate with the informant and request any additional information that may be necessary to resolve the complaint.
4.6.3. If the preliminary investigation demonstrates that the reported facts are not true or do not constitute a violation of Lyvea Group Protocols, Manuals, Policies or Operating Procedures, the Trainer will close the investigation at this stage.
4.7. Information to the investigated
4.7.1. In the event that the preliminary investigation demonstrates that the facts under investigation may be true and may constitute a violation of the Protocols, Manuals, Policies and Operating Procedures of Lyvea Group, the Instructor shall inform the investigated, if any, about (i) the existence of the investigation; (ii) a brief summary of the alleged facts under investigation; and (iii) their rights and obligations, including the rights to be heard at any time and rights of access, rectification, cancellation and opposition where appropriate.
4.7.2. The information shall be provided in the time and manner deemed appropriate to ensure the proper conduct of the investigation.
4.8. Investigation proceedings
4.8.1. The Instructing Officer shall carry out all the investigative measures that he/she deems appropriate for the clarification of the facts.
4.8.2 Said proceedings may consist of:
4.8.2.1. Interviews with the investigated person or with other persons, which may be documented or recorded on a suitable support for this purpose.
4.8.2.2.2. Requests for information and documentation to the investigated person or to third parties.
4.8.2.3. Collect any information or documentation it deems necessary from all areas or companies of the Lyvea Group, respecting the applicable regulations on data protection, the applicable labor law and the fundamental rights of the person under investigation.
4.8.2.4. To request the support of external investigators for the analysis of certain information.
4.8.2.5. Any other procedure that the Instructing Officer deems appropriate for the investigation of the facts.
4.8.3. All the proceedings carried out by the Instructing Officer: (i) shall be confidential; and (ii) a written record shall be made of the fact that they have been carried out.
4.9. Conclusion of the internal investigation
4.9.1. When the Investigator considers the investigation to be concluded, he/she shall prepare a proposed report in which he/she shall state: (i) the proceedings carried out; (ii) the facts considered accredited; (iii) the possible violations of the Protocols, Manuals, Policies and Operating Procedures of the Lyvea Group committed; (iv) if applicable, those responsible for such violations; (v) a proposal for the adoption of possible disciplinary measures with respect to those responsible; (vi) an analysis of the operation of the breached Lyvea Group Protocol, Manual, Policy or Operating Procedure; and (vii) a proposal for the adoption of corrective measures for the breached Lyvea Group Protocol, Manual, Policy or Operating Procedure to prevent the recurrence of the breach under investigation.
4.9.2. This proposed report will be approved, if appropriate, by the Compliance Committee who will decide on the implementation of the proposed measures.
4.9.3. Decisions shall be communicated to the persons responsible for the subjects under investigation. The communication to the persons responsible for the Incident may omit any information on the nature of the procedure followed, the facts or the measures adopted.
4.9.4. If the reported facts could be indicative of a crime, the Compliance Committee shall forward the information to the Public Prosecutor’s Office.
- RIGHTS AND OBLIGATIONS OF THE WHISTLEBLOWER
5.1. Presumption of innocence and professional honorability.
The investigation procedure, as a result of a complaint, shall at all times guarantee the presumption of innocence and the professional honorability of the persons involved in the same, regardless of the decisions that may be taken by their direct managers or the Human Resources area.
5.2. Management of conflicts of interest
If any of the persons participating in the investigation is involved in the reported facts or considers that he/she may be involved in any type of conflict of interest, he/she must abstain from participating in the management of the report from the very first moment by informing the Compliance Committee.
5.3. Rights and Obligations of the Whistleblower
5.3.1. The Compliance Committee shall ensure the confidentiality of the identity of the whistleblower by not disclosing it to the whistleblower or to other employees or representatives of the Lyvea Group. However, in the event of an investigation carried out by an authority such as the Police, the Public Prosecutor’s Office or the
However, in the event of an investigation conducted by an authority such as the police, the Public Prosecutor’s Office, a judicial body or other authority with jurisdiction, it may be necessary to inform such authority of the identity of the complainant.
5.3.2. The exercise of the right of access by the data subject to the file containing his or her personal data does not include the disclosure of the complainant’s identification data.
5.3.3. There shall be no retaliation or negative consequence of any kind against the complainant for the fact of the complaint, unless the internal investigation determines that the complaint is false or has been made with reckless disregard for the truth, bad faith or abuse of rights.
5.3.4. Complainants shall be informed of the receipt of the complaint (and may be informed of the filing of the complaint or the outcome of the internal investigation).
5.3.5. Complainants shall cooperate with the Compliance Committee and the Instructor in the internal investigation.
5.3.6. Whistleblowers who have participated in the violation of Lyvea Group policies shall not be exempted from any liability for the mere fact of having made the report.
5.3.7. Making false reports, with reckless disregard for the truth, bad faith or abuse of law is a serious violation of Lyvea Group policies and may result in appropriate disciplinary action.
5.3.8. The Whistleblower shall be entitled to the protection and support measures contained in Law 2/2023.
5.4. Rights and obligations of the person under investigation
5.4.1. During the investigation, the person under investigation may be heard at any time and may be assisted by a lawyer.
5.4.2. The person under investigation shall maintain confidentiality about the existence of the investigation and its contents.
5.4.3. In the event of non-compliance by the person under investigation with the obligations described above, he/she may be subject to the appropriate disciplinary sanction.
5.4.4. The person under investigation shall be entitled to the protection measures contained in art. 39 of Law 2/2023.
5.5. Rights and duties of the persons called upon to collaborate with the investigation
5.5.1. All persons subject to this Protocol shall cooperate with the internal investigation. In particular, they shall:
5.5.1.1. appear for interviews with the Instructor, in the event that they are required to do so, answering all the questions asked.
5.5.1.2. Answer all the requests for information or documentation formulated by the Instructing Officer.
5.5.1.3. To provide the Instructing Officer with all the documents that serve to prove the facts denounced.
5.5.1.4. Maintain absolute confidentiality about the existence of the investigation and its contents, without being able to inform any other person.
5.5.2. Failure to comply with the above obligations may give rise to the imposition of the corresponding disciplinary liability.
5.5.3. The mere fact of collaborating in the investigation shall never give rise to any sanction or reprisal. - PROTECTION OF PERSONAL DATA
6.1. The personal data provided on the occasion of the complaint and obtained as a result of the corresponding internal investigation (the “Personal Data”) shall be processed solely for the purpose of concluding such investigation under the terms of this Protocol and Law 2/2023.
6.2. Have access to such Personal Data:
6.2.1. LYVEA GLOBAL, S.L.P., S.L., responsible for the design, implementation and control, at a global level within Lyvea Group, of the Code of Conduct, the Anti-Corruption Policy and this Protocol, and responsible for the processing of the file containing the Personal Data.
6.2.2. The Lyvea Group companies that have a contractual or corporate relationship with the complainant(s) and reported person(s), if this is necessary to carry out the internal investigation and take disciplinary or other appropriate measures, depending on the nature of the relationship with the person concerned.
6.2.3. Lyvea Group companies employing members of the Compliance Committee, Lyvea Group’s legal counsel and internal audit and external professionals and public authorities to be understood as such in accordance with section 4.3.4. above.
6.3. The files in respect of specific individuals in which the complaints are recorded shall be registered in the General Data Protection Register.
6.4. The owners of the Personal Data may exercise their rights of access, rectification, cancellation and opposition (where applicable in accordance with the provisions of the personal data protection regulations) by sending an e-mail to the address compliance.comité@lyvea.com. However, the exercise of such rights shall not be applicable in the following cases:
6.4.1. When the reported person exercises his or her right of access, the complainant’s identifying data will not be communicated; or 6.4.2.
6.4.2. When the exercise of these rights is projected with respect to a complaint related to the prevention of money laundering and financing of terrorism, in which case the provisions of Article 32 of Law 10/2010, of April 28, on the prevention of money laundering and financing of terrorism shall apply.
6.5. The data collected through this Channel will be used for the sole purpose of processing the complaints received, and if necessary, investigate the facts reported. The operation will be governed at all times by the legislation in force and, more specifically, in accordance with the provisions of Article 24 of the Organic Law 3/2018 of December 5, 2018 on Data Protection and Guarantee of Digital Rights and Title VI of Law 2/2023 .
6.6. The Personal Data obtained on the occasion of the complaint will be canceled when 2 months have elapsed since the end of the internal investigation initiated as a result of the complaint, except in the case of complaints not admitted for processing which will be canceled immediately. The cancellation entails the blocking of the Personal Data in such a way that they may only be kept in separate custody, during the period of limitation of the liabilities related to the complaint, to be made available to authorities such as the Police, the Public Prosecutor’s Office or a Judicial Body, where appropriate.
6.7. By filling in the minutes of the meetings or interviews that are carried out, the participants expressly consent to the use and processing of the data provided for the above-mentioned purposes.
6.8. Persons who make a communication through the complaints channel represent and warrant that the personal data provided are true, accurate, complete and updated, and shall hold harmless Lyvea Group from any liability that may arise from the breach of such representations and warranties. - TRAINING AND DISSEMINATION
7.1. This Protocol is included among the subjects of mandatory training for all parties bound by it. This training shall be carried out during the first full year of employment and at least every three years thereafter.
7.2. The following channels shall in any case be used to disseminate this Protocol:
7.2.1. A copy of the Protocol shall be given to every director, officer and employee of the Lyvea Group, and they shall be required to sign the acceptance of the same, in accreditation of delivery.
7.2.2. A copy of the Protocol shall be attached to the Welcome Manual, which is given to all new Lyvea Group employees;
7.2.3. The Intranet, which shall contain a specific section on this Protocol.
7.2.4. The Lyvea Group’s website shall contain a copy of this protocol. - CONSEQUENCES OF NON-COMPLIANCE
8.1. Failure to comply with this Protocol may result in employment disciplinary measures, including disciplinary dismissal, or termination of the relevant service contract.
8.2. Breaches of the Lyvea Group’s Protocols, Manuals, Policies and Operating Procedures may be reported to the Police or the Public Prosecutor’s Office, in the event that they may constitute a criminal offense. - APPROVAL
This Whistleblowing and Internal Investigations Channel Protocol has been approved by the Board of Directors of LYVEA GLOBAL, S.L.P. on October 26, 2023 and ratified by the Board of Directors of the other affected companies indicated at the beginning of the document.
