Introduction, object and application

Law 2/2023, of 20 February, regulating the protection of persons who report regulatory breaches and combating corruption (hereinafter, Law 2/2023) transposes into Spanish law Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law.

This policy applies to Lordship of Montanera SL with CIF B06328348 and registered office at Rincón de Caya Road, Km 3.5, 6080, Badajoz (Badajoz) and aims to establish an internal channel for reporting potential regulatory violations, violations of internal and/or ethical policies, and to establish a whistleblower protection regime, in compliance with Law 2/2023, of February 20, regulating the protection of persons who report regulatory violations and the fight against corruption.

Law 2/2023 explains and clarifies in its preamble, Part III, that its purpose is to protect, against possible retaliation, persons who, in a work or professional context, detect serious or very serious criminal or administrative violations and report them through the mechanisms regulated in this policy.

This Channel, therefore, is a mechanism that allows company employees and other stakeholders to report any type of illegal conduct or conduct contrary to our values and ethical principles without fear of retaliation, strengthening the information culture, the organizations' integrity infrastructures, and fostering a culture of information or communication as a mechanism to prevent and detect threats to the public interest. In this way, we seek to promote a culture of transparency, integrity, and responsibility within our organization, while protecting those employees who choose to make a report in good faith.

Informant Channel

The entity has created an informant channel (hereinafter, the CII) as a preferred channel for receiving information on actions or omissions that may constitute a serious or very serious criminal or administrative offense, and other actions provided for in Article 2 of Law 2/2023.

The channel is managed by the Channel's Internal System Manager (hereinafter, the RSII). Access to this channel will be limited, within the scope of their powers and functions, to:

1. The Head of the Channel's Internal System.
2. To the administrator(s) delegated by the person responsible for the system.
3. To the managers designated to process certain communications according to the area to which they correspond.

The functions of these bodies, as appropriate, will be:

• Reception, recording and management of communications received through the informant channel.
• Designation of the person or team responsible for investigating the communications received.
• Ensuring the protection of informants and the confidentiality of communications received.
• Evaluation of the veracity and credibility of the communications received.
• Decision-making on appropriate measures based on the results of the investigation.
• Monitoring and periodic review of the company's communications management process and internal policy.
• Preparation of reports and recommendations for senior management on communications received and actions taken.

The CII must technically guarantee the confidentiality or, if necessary, the anonymity of the informant, to protect him or her from any leaks and subsequent retaliation.

Informants within the scope of the law may make their communications through the following means:

• Link to the informant's channel: https://compliance.legalsending.com/canal/?C=48604099019037219
• QR Code:

• Sending an email to the following address: info@señorio.es
• Postal mail addressed to Rincón de Caya Km 3.5, 6080, Badajoz (Badajoz) a/a RSII: Francisco Esparrago Carande
• In person, at the request of the reporting person, through a request addressed to the RSII.

Subjective scope – Reporting subjects

Those individuals who have an employment or professional relationship with the AEPD may use the internal information channel and benefit from the protection granted by Law 2/2023 as informants to communicate information about the actions or omissions described in Article 2 of Law 2/2023. This employment or professional relationship, which entails dependence on the AEPD, is what makes special protection against possible retaliation necessary and appropriate.

In any case, the following are considered informants for this AEPD, for the purposes of Law 2/2023:

• People who are employees or self-employed workers.
• Freelance collaborators.
• Shareholders, participants, and persons belonging to the company's administrative, management, or supervisory body, including non-executive members.
• Any person working for or under the supervision and direction of contractors, subcontractors and suppliers.
• Whistleblowers who communicate or publicly disclose information about violations obtained within the framework of an already terminated employment or statutory relationship, volunteers, interns, workers in training periods, regardless of whether they receive remuneration, as well as those whose employment relationship has not yet begun, in cases where the information about violations was obtained during the selection process or pre-contract negotiation.

It is important to emphasize that communications made through the informant channel must be in good faith, meaning they must be supported by concrete evidence and facts.

Objective scope – Facts to be communicated

Regarding the purpose of the information, Law 2/2023 establishes that the internal information channel may be used to report serious misconduct or alleged corruption, which may constitute serious or very serious criminal or administrative offenses related to the entity's activities, which the informant has observed or about which he or she has received information in the course of his or her work or professional relationship.

Law 2/2023 itself and Directive (EU) 2019/1937 list as such the information that refers to:

1. Infringements falling within the scope of the European Union acts listed in the Annex to the aforementioned Directive relating to the following areas:
   • public procurement,
   • financial services, products and markets, and prevention of money laundering and terrorist financing,
   • product safety and compliance,
   • transport safety,
   • environmental protection,
   • radiation protection and nuclear safety,
   • food and feed safety, animal health and animal welfare,
   • public health,
   • consumer protection,
   • protection of privacy and personal data, and security of networks and information systems
2. That affect the financial interests of the European Union as referred to in Article 325 of the Treaty on the Functioning of the European Union (TFEU).
3. That have an impact on the internal market, as referred to in Article 26(2) TFEU, including infringements of European Union competition rules and aid granted by States, as well as infringements relating to the internal market in relation to acts that infringe corporate tax rules or practices whose purpose is to obtain a tax advantage that distorts the object or purpose of the legislation applicable to corporate tax.
4. Actions or omissions that may constitute a serious or very serious criminal or administrative offense. In any case, this includes all serious or very serious criminal or administrative offenses that entail financial losses for the Public Treasury and Social Security.
5. Violations of labor law regarding occupational health and safety reported by workers, without prejudice to the provisions of their specific regulations.

The reporting party must provide, at a minimum, a reference to the specific scope of the violation (subject matter or regulation violated: European Union law; criminal offense; or administrative offense); and a description of the facts being reported (relevant information about what happened), as detailed as possible, attaching any available documentation.

You can also provide your first and last name, and a contact telephone number, if you do not choose to make this communication anonymous.

If you know the identity of the person responsible for the reported irregularity, or have reported these facts to another body or entity through an external channel, you may also provide this information.

Communication procedure

The information may be communicated to the entity anonymously. Otherwise, the identity of the informant will be kept confidential and will be limited to the RSII, managing directors, or appointed managers. These members will perform their functions independently and autonomously from the rest of the entity or organization's bodies and may not receive any instructions in their performance, and they will have all the necessary personnel and material resources to carry them out.

The company is committed to investigating all communications regarding potential violations or non-compliance received through the whistleblower channel. All communications will be investigated impartially and confidentially, and appropriate measures will be taken based on the results of the investigation to protect the whistleblower.

Communication will be made through the internal information channel using the specific electronic application for this purpose, identified and accessible from the website: https://senorio.es/

At the request of the informant, the communication may also be submitted through an in-person meeting, which will take place within a maximum period of seven days. If applicable, the informant will be warned that the communication will be recorded and will be informed of the processing of their data in accordance with the GDPR and the LOPDPGDD. When submitting the information, the informant must provide an address, email address, or a secure location for receiving notifications, unless they expressly waive the right to receive any communication regarding actions taken by the RSII as a result of the information.

Once the information has been submitted, it will be registered in the information management system by assigning an identification code. This code will be contained in a secure database with restricted access exclusively to authorized RSII personnel. All communications received will be recorded with the following data:

1. Date of receipt.
2. Identification code.
3. Actions carried out.
4. Measures taken.
5. Closing date.

Once the information has been received, the informant will be acknowledged within a period of no more than 7 calendar days, unless they have expressly opted out of receiving communications related to the investigation. These communications will be processed for a maximum period of 3 months, except in cases of special complexity that require an extension, in which case, the deadline may be extended for up to an additional 3 months.

Once the information has been recorded, the RSII and its team will proceed to analyze its admissibility in accordance with the material and personnel scope provided for in Articles 2 and 3 of Law 2/2023.

The company undertakes to notify the informant about the status of the investigation and the measures taken, whenever possible and without compromising the confidentiality and protection of the informant. In addition, additional information beyond the facts reported through the channel may be requested.

Furthermore, the company undertakes to monitor all communications received and the measures taken to ensure the effectiveness of this policy and to continuously improve the process.

Any information that could indicate a crime will be immediately forwarded to the Public Prosecutor's Office. If the facts affect the financial interests of the European Union, it will be forwarded to the European Public Prosecutor's Office.

Protection of whistleblowers

The company is committed to protecting individuals who report violations or non-compliance, in accordance with Law 2/2023.

A) Acts constituting retaliation.

Acts constituting retaliation, including threats of retaliation and attempted retaliation, against persons who submit a communication under the law are expressly prohibited.

Retaliation is understood to mean any act or omission that is prohibited by law, or that, directly or indirectly, results in unfavorable treatment that places the person who suffers it at a particular disadvantage compared to another person in the workplace or professional context, solely because of their status as informants or because they have made a public disclosure.

For the purposes of Law 2/2023, and by way of example, reprisals are considered to be those adopted in the form of:

1. Suspension of the employment contract, dismissal, or termination of the employment or statutory relationship, including the non-renewal or early termination of a temporary employment contract once the probationary period has passed, or the early termination or cancellation of contracts for goods or services, the imposition of any disciplinary measure, demotion or denial of promotion, and any other substantial modification of working conditions, and the failure to convert a temporary employment contract into a permanent one, if the employee had legitimate expectations of being offered permanent employment; unless these measures were carried out within the regular exercise of management powers under labor legislation or legislation regulating the corresponding public employee statute, due to proven circumstances, facts, or violations unrelated to the filing of the communication.
2. Damage, including reputational or economic loss, coercion, intimidation, harassment or ostracism.
3. Negative evaluations or references regarding job or professional performance.
4. Blacklisting or dissemination of information in a specific sector that hinders or prevents access to employment or the contracting of works or services.
5. Denial or cancellation of a license or permit.
6. Denial of training.
7. Discrimination, or unfavorable or unfair treatment.

Any person whose rights are violated by communication or disclosure after the two-year period has elapsed may request protection from the competent authority, which may, exceptionally and with justified justification, extend the protection period, after hearing from the persons or bodies that may be affected. Reasons must be given for refusing to extend the protection period.

Administrative acts intended to prevent or hinder the submission of communications and disclosures, as well as those that constitute retaliation or cause discrimination following the submission of such communications and disclosures under this law, shall be null and void and, where appropriate, shall give rise to disciplinary or liability corrective measures, which may include compensation for damages to the injured party.

B) Measures to protect the informant from retaliation

Persons who communicate information about the actions or omissions listed in Section FOUR, or who make a public disclosure pursuant to Law 2/2023, shall not be deemed to have violated any restrictions on disclosure of information and shall not incur any liability of any kind in connection with such communication or public disclosure, provided that they had reasonable grounds to believe that the communication or public disclosure of such information was necessary to reveal an action or omission under said law, all without prejudice to the provisions of the specific protection rules applicable in the workplace. This measure shall not affect criminal liability.

The provisions of the preceding paragraph extend to the communication of information by employee representatives, even if they are subject to legal obligations of confidentiality or confidentiality. This is without prejudice, likewise, to the specific protection regulations applicable in the workplace.

The whistleblower protection measures shall also apply, where appropriate, to:

1. natural persons who assist the informant in the process;
2. natural persons who are related to the informant and who may suffer retaliation, such as colleagues or family members of the informant;
3. legal entities, for which you work or with which you maintain any other type of relationship in a work context or in which you hold a significant stake.

For these purposes, participation in the capital or voting rights corresponding to shares or interests is considered significant when, due to its proportion, it allows the person holding it to have the capacity to influence the participating legal entity.

Informants shall not incur liability for the acquisition or access to information that is publicly communicated or disclosed, provided that such acquisition or access does not constitute a crime.

Any other potential liability of informants arising from acts or omissions that are not related to the communication or public disclosure, or that are not necessary to reveal a violation under Law 2/2023, will be enforceable in accordance with applicable regulations.

In proceedings before a court or other authority concerning harm suffered by whistleblowers, once the whistleblower has reasonably demonstrated that he or she has communicated or made a public disclosure in accordance with Law 2/2023 and has suffered harm, it shall be presumed that the harm arose in retaliation for the disclosure or public disclosure. In such cases, it shall be for the person who took the harmful measure to prove that the measure was based on duly justified reasons unrelated to the communication or public disclosure.

In legal proceedings, including those relating to defamation, copyright infringement, breach of confidentiality, violation of data protection regulations, disclosure of trade secrets, or claims for compensation based on labor or statutory law, whistleblowers shall not incur any liability of any kind as a result of communications or public disclosures protected by Law 2/2023. Such persons shall have the right to claim in their defense and within the framework of such legal proceedings that they have communicated or made a public disclosure, provided that they have reasonable grounds to believe that the communication or public disclosure was necessary to reveal an infringement under Law 2/2023.

They are expressly excluded from the protection provided by law, those persons who communicate or reveal:

1. Information contained in communications that has been rejected by an internal information channel or for any of the reasons provided for by law.
2. Information related to claims about interpersonal conflicts or that affect only the informant and the persons to whom the communication or disclosure refers.
3. Information that is already fully available to the public or that constitutes mere rumors.
4. Information referring to actions or omissions not covered by the law.

C) Measures for the protection of affected persons

During the processing of the case, the persons affected by the communication shall have the right to the presumption of innocence, the right to a defense, and the right to access the case file under the terms provided for in Law 2/2023, as well as the same protection established for informants, preserving their identity and guaranteeing the confidentiality of the facts and data of the procedure.

The Independent Authority for the Protection of Whistleblowers (AAI) may, within the framework of the sanctioning procedures it conducts, adopt provisional measures under the terms established in Article 56 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations.

D) Cases of exemption and mitigation of the sanction

When a person who has participated in the commission of the administrative offense that is the subject of the information is the one who reports its existence by submitting the information and provided that it has been submitted before the initiation of the investigation or sanctioning procedure has been notified, the body competent to resolve the procedure, by means of a reasoned resolution, may exempt him from compliance with the administrative sanction that corresponds to him, provided that the following aspects are proven in the file:

1. Having ceased committing the offense at the time of submission of the communication or disclosure and having identified, where applicable, any other persons who participated in or facilitated the offense.
2. Having cooperated fully, continuously and diligently throughout the investigation procedure.
3. Having provided truthful and relevant information, evidence or significant data to prove the facts under investigation, without having destroyed or hidden them, nor having revealed their content to third parties, directly or indirectly.
4. Having proceeded to repair the damage caused that is attributable to him.

When these requirements are not fully met, including partial reparation of the damage, it will be at the discretion of the competent authority, after assessing the degree of contribution to the resolution of the case, whether to mitigate the sanction that would have corresponded to the infringement committed, provided that the informant or author of the disclosure has not previously been sanctioned for acts of the same nature that gave rise to the initiation of the procedure.

The mitigated penalty may be extended to the other participants in the commission of the offense, depending on the degree of active collaboration in clarifying the facts, identifying other participants, and repairing or mitigating the damage caused, as assessed by the body responsible for the resolution.

Law 2/2023 excludes from the provisions of this section the violations established in Law 15/2007, of July 3, on the Defense of Competition.

Confidentiality and data protection

The processing of personal data will be carried out ensuring compliance with Law 2/2023, of February 20, regulating the protection of persons who report regulatory breaches and the fight against corruption, Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights and Organic Law 7/2021, of May 26, on the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offenses and the execution of criminal penalties.

The personal data processed, the documents provided, and any other information provided in the communication containing personal information will be treated confidentially by those responsible for the channel, as well as by the administrators and potential managers, for the purpose of fulfilling the obligation to investigate and manage the communication submitted, as well as to comply with the legal obligations established in Law 2/2023, of February 20, regulating the protection of persons who report regulatory violations and the fight against corruption.

The Internal Information System must prevent unauthorized access and preserve the identity and guarantee the confidentiality of data corresponding to the affected individuals and any third party mentioned in the information provided, especially the identity of the informant, if identified. The identity of the informant may only be communicated to the judicial authority, the Public Prosecutor's Office, or the competent administrative authority within the framework of a criminal, disciplinary, or sanctioning investigation, and these cases will be subject to safeguards established in the applicable regulations.

If the information received contains special categories of personal data subject to special protection, it will be deleted immediately, unless the processing is necessary for reasons of essential public interest as provided for in Article 9.2.g) of the GDPR, as provided for in Article 30.5 of Law 2/2023.

In any case, personal data that is not clearly relevant to the processing of specific information will not be collected, or if collected accidentally, it will be deleted without undue delay.

Communications that have not been processed may only be recorded in anonymized form, and the blocking obligation provided for in Article 32 of the LOPDPGDD (Organic Law on Data Protection) does not apply.

Access to personal data contained in the internal information system will be limited to:

1. The Head of the Channel's Internal System.
2. To the administrator(s) delegated by the person responsible for the system.
3. To the managers designated to process certain communications according to the area to which they correspond.
4. Data may be reported to the Legal Department, attorneys, judicial bodies, and state security forces if any of the information received could be considered a crime or legal violation of any kind.

Legal basis for processing: The processing of personal data, in the case of internal communications, will be deemed lawful pursuant to Articles 6.1.c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, Article 8 of Organic Law 3/2018 of 5 December, and Article 11 of Organic Law 7/2021 of 26 May, when, in accordance with Articles 10 and 13 of the law, an internal information system is required. If it is not required, the processing will be presumed to be covered by Article 6.1.e) of the aforementioned regulation. The processing of personal data in the case of external communication channels shall be deemed lawful pursuant to Articles 6.1.c) of Regulation (EU) 2016/679, Article 8 of Organic Law 3/2018, of December 5, and Article 11 of Organic Law 7/2021, of May 26.

Rights of the interested party: access, rectification, deletion, limitation, portability and opposition, free of charge by email to: info@señorio.es in the cases provided for by law.

Conservation: The data will be retained for the legal period established for processing the file and for the time necessary to exercise legal action or, if necessary, to provide evidence of the channel's management. The interested party also has the right to file a complaint with the AEPD at www.aepd.es to request protection of their rights.

Communication and review of policies and procedures

The company will conduct periodic training and awareness campaigns to foster a culture of integrity and transparency, and to inform employees and other stakeholders about the whistleblower channel. It will also provide information on the rights and protections afforded to whistleblowers under Law 2/2023.

The company undertakes to disseminate this policy to all employees and stakeholders, and will update, at least every three years, and, where appropriate, modify this internal channel policy, taking into account the experience gained and the recommendations of the Competent Authority.

In Badajoz on April 8, 2024