PROTOCOL FOR USE OF THE INTERNAL INFORMATION SYSTEM WHISTLEBLOWING CHANNEL
1. Purpose
Shopping Basket SL establishes this protocol to receive, manage, and respond to reports of possible irregularities, legal or ethical breaches, acts of corruption, workplace or sexual harassment, discrimination, or any other misconduct related to the activities of the company or its employees or other persons working with the company.
This protocol is established in compliance with Spanish Law 2/2023 of 20 February, which regulates the procedure for receiving reports and the protection of whistleblowers, and is disseminated among all employees of the entity.
2. Scope of application
This protocol applies to all natural or legal persons who, in good faith, report to Shopping Basket SL the existence of irregular, illicit, or unethical conduct. Reports may refer to conduct related to employees, governing bodies, persons working with the company, or the company's activities.
3. Types of reports
Any conduct that may be considered illegal or unethical may be reported, including, but not limited to:
- Corruption, fraud, or embezzlement of funds.
- Workplace harassment or discrimination for any reason.
- Violation of human or labor rights.
- Non-compliance with applicable laws or regulations.
- Disclosure of confidential data or privileged information.
- Conflicts of interest.
4. Whistleblowing Channel principles
This Whistleblowing Channel is based on key principles intended to guarantee a fair, confidential and accessible process for all users of the channel. These principles ensure that communications are managed objectively, protecting both the reporting person and the persons affected by the communications.
- ● Accessibility: The channel is for public and permanent access so that employees and third parties can submit their communications.
- ● Transparency: The System is designed to foster trust among our Company's stakeholders.
- ● Objectivity and impartiality: Communications will be managed in an objective and impartial manner.
- ● Confidentiality: All information, including the identity of the whistleblower and the affected person, will be treated confidentially.
- ● Right to privacy and reputation of all parties involved.
- ● Good faith and promptness: Communications must be made in good faith and without delay, providing sufficient details to allow for their proper investigation.
- ● Protection of the whistleblower and prohibition of retaliation: Any type of retaliation is prohibited.
- ● Right to anonymity of the whistleblower: The submission of communications anonymously is permitted, with the same guarantees of confidentiality.
- ● Right of the whistleblower to opt out: The whistleblower may waive the right to receive communications regarding the reported incident.
- ● Right to defense and the presumption of innocence of the affected person.
- ● Right of the affected person to access the investigation file and to be heard: The affected person may be informed of the facts, present allegations, and be heard at any time.
- ● Right to defense and to the reputation of the Company: Our Company may adopt disciplinary and/or legal measures to protect its rights, assets, and image against those who, in bad faith, make false reports.
- ● Conflicts of interest: The Person Responsible must abstain in the event of conflicts of interest and guarantee impartiality, delegating or outsourcing the management when necessary.
5. Means of access to the Whistleblowing Channel
Reports may be submitted through the channels established by the company. Shopping Basket SL will guarantee the confidentiality and protection of the personal data of the whistleblower and the reported person within the framework of the report management procedure.
The Whistleblowing Channel is available to all interested persons through the following means:
- - POSTAL MAIL: Postal address provided for this purpose at the company's headquarters located at Pol. Ind. Les Verdunes, parc. 33, 25400, Les Borges Blanques, Lleida. For the attention of: 'Whistleblowing Channel'.
- - EMAIL: A specific email address [email protected] has been set up to receive reports. This address is communicated to all company personnel and included in all documents that the company provides to its clients, suppliers and any other parties with which it has business relationships.
- - WEBSITE: A specific section for submitting reports has been set up on the company's corporate website, www.sbshoppingbasket.com: denuncias.sbshoppingbasket.com. The report may be submitted without the need to identify oneself, and a confirmation message must be sent to the reporting person.
Regardless of the means used to make the report, the whistleblower may identify themselves or make the communication anonymously. If they choose to identify themselves, their identity will be considered confidential information and may not be disclosed without consent.
To track the communication submitted, you will need to enter the Password when accessing the Channel's Communications Inbox on the website, or provide the password in the subject line of the follow-up email sent to [email protected] or inside the envelope sent by post.
6. Submission of the report
Regardless of the submission method chosen, the report must contain the necessary data to be able to initiate an investigation. To facilitate this work, the whistleblower is requested to provide the following information:
- ● A description, in as much detail as possible, of the facts being reported. Organize the description chronologically and provide all information that may be relevant.
- ● The place or places where the reported events have taken place or are taking place.
- ● The time or period of time during which the reported events have taken place.
- ● The person or persons who are the subject of the report and, where applicable, the company office or branch where they work, if known.
- ● The business areas affected by or related to the reported facts, if you know them.
7. Body in charge of managing the Whistleblowing Channel
In accordance with Article 8 and Article 11.2 of Law 2/2023, of February 20, the management of Shopping Basket SL has appointed Florentina González Pareja as the person responsible for the Whistleblowing Channel / Internal Information System. The appointment will be communicated to the competent authority.
The Person Responsible will perform the functions assigned to them under the aforementioned law, carrying them out independently and autonomously from the company's other areas and business units. In this sense, the Person Responsible for the Internal System will not receive instructions of any kind in the exercise of their functions, and must have the necessary human and material resources to carry them out, in accordance with Article 8.4 of Law 2/2023 of 20 February.
The Person Responsible may designate another person or persons within the company with access to the Channel platform, who will have the necessary training and may perform the functions involved in conducting the case management procedure.
In those situations where the Person Responsible for the Internal Information System cannot exercise their functions due to reasons of conflict of interest, vacation, illness, or other duly justified causes, the company management will proceed to appoint a substitute. The deputy will assume the functions of the Person Responsible, ensuring continuity, impartiality and objectivity in the management of the report of an infringement. This person will be selected in compliance with the requirements of suitability and absence of conflict of interest in the matter to be addressed.
Likewise, the company's management will also be the competent body to dismiss or terminate the appointment of the Person Responsible for the Whistleblowing Channel / Internal Information System, which will likewise be communicated to the competent regional authority.
8. Stages of the report handling procedure
| PHASES | DOCUMENTATION | DEADLINE | |
|---|---|---|---|
| 1 | Submission of the infringement report | ||
| 2 | Receipt and Acknowledgement | Acknowledgement of receipt of the report | The acknowledgement of receipt must be sent as soon as possible and, in any event, within a maximum of 7 calendar days from submission of the report. |
| A private communication channel must be provided to the whistleblower so that, if they wish, they can follow up on the case. | |||
| 3 | Preliminary analysis |
If the case can already be resolved at this stage, a conclusions report. shall be issued. Notification to the whistleblower as to whether their report has been accepted for processing. Notification to the person affected by the report. |
The affected person must be notified within 20 days of receipt of the report. Maximum period of 3 months from submission of the complaint or report (to complete the preliminary analysis, investigation and conclusions report stages), unless it is necessary to apply the Harassment Prevention Protocol. Exceptionally, in particularly complex cases, the above period may be extended by a maximum of a further 3 months (making a total of 6 months). |
| 4 | Investigation |
Where applicable, Minutes of interviews conducted. Where applicable, Inspection Plan and Record of Inspection. Where applicable, Questionnaires (to the whistleblower, the affected person, witnesses). |
|
| 5 | Conclusions report |
Conclusion report. Communication of the checks carried out to the relevant parties. Notification to the whistleblower and the affected person of the outcome of the investigation. Where there are indications of a criminal offence, the matter shall be reported to the Public Prosecutor's Office or other competent bodies. |
|
| 6 | Closure by the Management Body | Formalization of the decisions adopted in the minutes. | |
| 7 | Follow-up | Follow-up minutes | To be assessed in each case |
Once the report has been received, it will be registered and an acknowledgement of receipt will be sent within seven calendar days, unless doing so could jeopardize the confidentiality of the report.
The company will guarantee the independence and impartiality of the investigation. If the report is anonymous, its viability will be assessed and a preliminary investigation will be carried out to determine whether the reported facts are true. If the preliminary investigation confirms that the reported facts are unfounded, the report will be closed. If the preliminary investigation reveals indications of an unlawful act, the body responsible for management will report the opening of formal proceedings and inform company management.
Within fifteen working days of the opening of the proceedings, the affected person will be informed of the actions and omissions attributed to them and will have the right to be heard at any time during the investigation. This fifteen-day period may be extended only where necessary to ensure the proper conduct of the investigation. The maximum period for completing the investigation and providing a response will be three months from receipt of the report or, if no acknowledgement of receipt was sent to the whistleblower, three months from the expiry of the seven-day period following submission of the report. In particularly complex cases requiring an extension, this period may be extended by a maximum of a further three months. During the procedure, all necessary evidence will be gathered to establish the truth of the reported facts. This investigation period is called Preliminary Proceedings.
During this period, both the investigator and the person who is the subject of the report may request that any necessary and relevant evidence be obtained, such as:
a) Request for documents.b) Expert assessments.
c) Statements from persons with knowledge of the reported facts.
d) Interviews with the persons involved and affected.
The evidence requested by the interested parties must be relevant. In all cases, the investigator will give reasons for accepting or rejecting requests for evidence. All members of the Whistleblowing Channel Processing Body will have the necessary powers to contact any department or person within the company in order to obtain the necessary information or documentation. During the proceedings, appropriate precautionary measures aimed at immediately bringing any ongoing regulatory non-compliance to an end may be adopted either on the company's own initiative or at the investigator's request.
Shopping Basket SL guarantees confidentiality where a report is submitted through channels other than those established or to members of staff who are not responsible for handling it. Such staff will have been trained in this matter and informed that any breach of confidentiality constitutes a very serious infringement and that they are required to forward the report immediately to the person responsible for the System. The company will guarantee the protection of the rights of whistleblowers and persons who are the subject of reports within the framework of the report management procedure, particularly the presumption of innocence of the person reported and the right to reputation of all persons involved.
9. Follow-up and communication with the whistleblower
The whistleblower has a full guarantee of anonymity in the digital environment if they choose to make the report anonymously.
If the whistleblower wishes to follow up on the case anonymously via the website, they can identify themselves in the Communications Inbox using a PASSWORD.
They may also communicate with the Person Responsible for the Whistleblowing Channel using the password via the dedicated email address [email protected] or by post.
10. Resolution of reported cases
Once the investigation has been completed, a detailed report will be prepared containing duly reasoned conclusions and proposing one of the following recommendations to company management:
a) Closure of the report if it is established that the facts do not constitute an unlawful act or regulatory breach.
b) The appropriate corrective or disciplinary measures to remedy the possible irregularities or misconduct detected. The company will communicate the resolution of the report to the whistleblower, provided that they have provided their contact details and have expressed their desire to receive information about the result of the investigation.
In any case, during the proceedings and without waiting for their conclusion, if the investigator considers that the reported facts may constitute a criminal offence, they will immediately inform company management and the Public Prosecutor's Office. In the event that the facts affect the financial interests of the European Union, the European Public Prosecutor's Office will be informed.
11. Confidentiality and data protection
Shopping Basket SL will guarantee the confidentiality of reports and the protection of the personal data of the whistleblower and the person who is the subject of the report within the framework of the report management procedure. The company will inform the whistleblower of the need to provide personal data in order to ensure the effectiveness of the report management procedure.
The duty of confidentiality is established as a guiding principle that directs the company's Compliance actions in the management of reports.
Access to information is restricted to persons with management authority according to their assigned functions, and it is expressly prohibited to disclose any type of information regarding the reports.
11.1. Legal framework for the processing of personal data
The processing of personal data derived from the application of this law will be governed by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, in Organic Law 3/2018 of 5 December on Personal Data Protection and the Guarantee of Digital Rights, Organic Law 7/2021 of 26 May on the protection of personal data processed for the purposes of the prevention, detection, investigation and prosecution of criminal offences and the execution of criminal penalties, and this Title.
11.2. Lawfulness of personal data processing
1. The processing of personal data necessary for the investigation of reports submitted in accordance with the Law will be considered lawful.
2. The processing of personal data in cases of internal reporting shall be considered lawful pursuant to Article 6(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, Article 8 of Organic Law 3/2018 of 5 December, and Article 11 of Organic Law 7/2021 of 26 May.
3. The processing of personal data in the case of external reporting channels shall be considered lawful pursuant to Article 6(1)(c) of Regulation (EU) 2016/679, Article 8 of Organic Law 3/2018 of 5 December, and Article 11 of Organic Law 7/2021 of 26 May.
4. The processing of personal data resulting from a public disclosure shall be presumed lawful pursuant to Article 6(1)(e) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and Article 11 of Organic Law 7/2021 of 26 May.
5. The processing of special categories of personal data for reasons of essential public interest may be carried out in accordance with the provisions of Article 9.2.g) of Regulation (EU) 2016/679.
11.3. Information on personal data protection and the exercise of rights
1. When personal data are obtained directly from the data subjects, they shall be provided with the information referred to in Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, and Article 11 of Organic Law 3/2018 of 5 December. Whistleblowers and those who make a public disclosure shall also be expressly informed that their identity will in all cases be kept confidential and will not be disclosed to the persons to whom the reported facts relate or to third parties.
2. The person to whom the reported facts relate shall under no circumstances be informed of the identity of the whistleblower or of the person who made the public disclosure.
3. Data subjects may exercise the rights referred to in Articles 15 to 22 of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016.
4. If the person to whom the facts reported in the communication or public disclosure relate exercises the right to object, it shall be presumed, unless proven otherwise, that there are compelling legitimate grounds for the processing of their personal data.
11.4. Processing of personal data in the Internal Information System
1. Access to the personal data contained in the internal information system shall be limited, within the scope of their powers and functions, exclusively to:
a) The System Manager and whoever manages it directly.
b) The human resources manager or the duly designated competent body, only when the adoption of disciplinary measures against an employee could be appropriate.
c) The head of the entity's or organization's legal services, where legal measures may need to be taken in relation to the facts reported.
d) The data processors that may be designated.
e) The data protection officer.
2. The processing of data by other persons, or even its disclosure to third parties, shall be lawful where necessary for the adoption of corrective measures within the entity or for the conduct of any applicable disciplinary or criminal proceedings. Personal data that are clearly not relevant to the handling of a specific report shall not be collected or, if collected accidentally, shall be deleted without undue delay.
12. Protection of the whistleblower
Shopping Basket SL shall guarantee the protection of the whistleblower against any retaliation or discrimination arising from the submission of the report. In this regard, specific protection measures shall be adopted based on the severity.
Tracking and traceability of anonymous reports are expressly prohibited. Any breach of this prohibition will result in the corresponding disciplinary measures. To ensure this, appropriate IT measures have been implemented to guarantee the automatic deletion of records of access to the Whistleblowing Channel.
In the case of reports where the whistleblower is identified, the whistleblower's identity will under no circumstances be disclosed to the person who is the subject of the report and will only be disclosed to other areas involved in its management where this information is essential for investigating the facts/conduct. The disclosure of the whistleblower's identity requires, in any case, the prior consent of the whistleblower.
The disclosure of the whistleblower's identity other than in permitted circumstances, or the carrying out of enquiries aimed at obtaining information about submitted reports, regardless of the person's position or duties, will result in the appropriate disciplinary measures, where applicable.
13. Independent Whistleblower Protection Authority (AIPI)
Furthermore, it should be noted that, pursuant to Article 16 of Law 2/2023, any person may report to the Independent Whistleblower Protection Authority (A.A.I.) or the corresponding regional authority or body any action or omission falling within the scope of Law 2/2023, either directly or after first reporting it through our Ethics Channel.
The Whistleblower Protection Unit of the Protection Department provides support and assistance to persons who may be subject to retaliation as a result of submitting a report (internally or externally) or publicly disclosing an infringement.
If a person finds themselves in the situation described after submitting a report, they may apply to this independent government body for protection by sending an email to: [email protected].
You can find all the information at www.proteccioninformante.gob.es
14. Rights of the reported person
The person who is the subject of the report and, where applicable, any persons who may be affected by an internal investigation have the right to be informed of the report made against them as soon as the appropriate checks have been carried out and the case has been accepted for investigation.
15. Communication and dissemination of the Whistleblowing Channel
Shopping Basket SL will communicate this Whistleblowing Channel protocol to all company employees.
In the event of having a website, you will have a specific section for the Whistleblowing Channel.
In addition, the company will announce the existence of the Whistleblowing Channel by including the following clause in its various official documents, such as contracts with clients and suppliers and email signatures.