Report anonymously or confidentially?

You can report either Anonymously or Confidentially. If you report anonymously, the IP address of your computer will not be recorded, nor any data that could identify you. Anonymous reports do not allow you to attach documents to the report, and we will not be able to validate the form so the resolution of the report will be more difficult. In the case that the communication is made in a confidential way, your data will be treated under strict security measures, and we will validate your identity through the email or the cell phone number you provide. Once the documentation has been sent, you will be able to attach the documentation you deem appropriate.

If you choose to report anonymously, no communication on the status of your report can be sent to you, even if it is essential to provide further information. Therefore, if you opt for anonymity, we ask you to check the status of your communication within 7 working days using the reference code that will have been provided to you when registering your complaint, using the "Check your case" functionality on this website.

What information do you need to provide ?

It is necessary that you provide as much information as possible and in detail, otherwise we will not be able to admit your complaint. The necessary data are:

CITLE OF THE COMPLAINT
Indicate a descriptive title for your complaint. It is like putting the "Subject" in an e-mail. For example, if you detect that a money laundering crime is taking place, you could put as title of the complaint: "COLLECTIONS IN CASH IN THE COMMERCIAL DEPARTMENT".

DATE OF THE EVENTS
You must enter the approximate date on which the events occurred. This is mandatory, so if you do not know the date, please enter an approximate date.

CATEGORY
Select from the available options the one you consider most appropriate to categorize the events. This option is not shown in the Employee Reporting Channels.

RELATIONSHIP WITH THE COMPANY
In this section you must indicate from the available options, which is the relationship you have with the company. This option is not shown in the Channels of Complaint for workers.

DESCRIPTION OF THE FACTS
Describe here the facts that are the subject of the complaint in as much detail as possible to facilitate the investigation tasks to be carried out. In any case, the complaints must include a minimum set of data to proceed to its admission, such as: details of the behaviors carried out, date on which the events took place, centers involved and type of regulations not complied with. Any information that may be related to the same is recommended to be provided, even if it seems irrelevant. If you know the identity of the person responsible for the facts, you should indicate it here. If there are several people, you can indicate the name and surname of the person you consider to be the main responsible, and the data of the rest of the people who may be involved.

PLACE OF EVENTS
Indicate at which location(s) the events occurred. For example, at the main office, at the Barcelona branch office, at a trade fair, etc.

WITNESSES
Indicate the persons who have witnessed the facts (not mandatory)

Responsible

EROS SA
NIF: A07023138
Telèfon: +34 971 850 005
Email: INFO@EXAGONPARK.COM

Purpose of Treatment

The purpose is the development and management of the corresponding channels for informants for the management of complaints and communications related to criminal offenses and administrative infractions in relation to the Public Treasury and Social Security, as well as infractions of labor law in matters of safety and health at work, without prejudice to the protection established in Law 31/1995 and other specific provisions. The identity of the informant will be confidential and will not be communicated to the persons to whom the reported facts refer.

Legal basis

The basis of legitimacy lies in the fulfillment of a legal obligation (art. 6.1.c of the RGPD 679/2016), regulated by Law 2/2023 of February 20, regulating the protection of persons reporting on regulatory infringements and the fight against corruption, which transposes the European Directive 2019/1937/EU, of October 23. In cases where it is not mandatory, the basis of legitimization will be the fulfillment of a mission carried out in the public interest or in the exercise of public powers vested in the controller (art. 6.1.e of GDPR 2016/679).

Conservation period

The identification data will be kept for the time necessary to decide whether or not to initiate an investigation on the reported facts, for the management of the investigation if appropriate and to determine the possible responsibilities arising from the investigation, with a maximum of three months. Once this period has elapsed, the data may continue to be processed by the body in charge of the investigation, within the corresponding procedure, provided that the extension of the conservation period is justified. Complaints that have not been followed up may be stored in the channel in an anonymized form. In no case may data be kept for a period of more than ten years.

Stakeholder categories

Employees, customers and users, suppliers, associates or members, students, contact persons, legal representatives, public offices. As well as: shareholders, persons belonging to the administrative body, supervisors and directors, contractors, and in general the persons affected by the complaint or communication and/or their legal representatives.

Categories of personal data

Union membership, health data, administrative offenses, criminal offenses, political opinions, email, address, manual signature, image, ip, mobile, nif or dni, name and surname, telephone, voice, personal characteristics, social, academic and professional circumstances, employment and business details, family relationships and other personal aspects that may give rise to a conflict of interest, regulatory infringement and/or economic loss for the Treasury and Social Security.

Categories of recipients of assignments

Los datos personales podrán ser cedidos por obligación legal a la dministración pública con competencia en la materia, aasí como a la Autoridad independiente de Protección del Informante.

International data transfers

No se realizan transferencias internacionales de datos.

Safety measures

In accordance with Art. 32 of GDPR 679/2016 the controller and the data processors where applicable, has carried out a risk assessment in order to be able to guarantee the rights of the data subjects. Based on this assessment, the necessary technical and organizational measures have been adopted, which have been reflected in the corresponding risk analysis report.

Rights of interested parties

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. In certain circumstances, interested parties may request the limitation of the processing of their data, in which case we will only keep them for the exercise or defense of claims. For reasons related to their particular situation, data subjects may object to the processing of their data. The Data Controller will stop processing the data, except for compelling legitimate reasons, or the exercise or defense of possible claims. The data subject is also informed that he/she may file a complaint with the Data Protection Supervisory Authority. Pursuant to Article 31.4 of Law 2/2023, in the event that the person to whom the facts related in the communication or to whom the disclosure refers public exercises the right to object, it will be presumed that, unless proven otherwise, there are compelling legitimate reasons that legitimize the processing of their personal data.

Introduction

This Electronic Whistleblower Channel is the only channel that guarantees the anonymity of the whistleblower and the confidentiality of the whistleblower. The complaints are registered in the platform with a digital fingerprint that allows verifying that the content of the complaint has not been altered, ensuring the integrity of the same and it is not possible to delete them by the responsible or of their managers. At any time and with the unique code generated for the complaint, you can consult to check the progress of the complaint. You can also contact the telephone number and e-mail address indicated on this website to submit any complaints you wish.

Means of reporting

This Electronic Whistleblower Channel is the only channel that guarantees the anonymity of the whistleblower and the confidentiality of the whistleblower. confidentiality. The reports are registered in the platform with a digital fingerprint that allows verifying that the content of the report has not been altered, guaranteeing its integrity. the content of the complaint has not been altered, guaranteeing the integrity of the same and it is not possible to delete them by the person responsible or their managers. its managers. At any time and with the unique code generated for the complaint, you can consult the progress of the complaint by this same means. You may also contact the telephone number and e-mail address indicated on this website to submit any complaints you may wish to make.

Uses not permitted

El canal de denuncias no puede emplearse como un buzón de sugerencias ajenas a la mejora del nivel de cumplimiento normativola organización y no se tolerará que se utilice con ese fin. Asimismo, el canal de denuncias no se debe emplear para quejas que sean ajenas al cumplimiento normativo.. A título de ejemplo, se señalan posibles hechos que no se deben denunciar a través de este medio: quejas o reclamaciones relacionadas con las condiciones laborales o contractuales aplicables a cada trabajador o grupo de trabajadores, salvo que puedan implicar la comisión de una conducta poco ética o ilícita (ejemplo: dar empleo a personas sin contrato de trabajo), quejas o reclamaciones formuladas por los asegurados sobre el contrato del seguro que deben ser interpuestas ante el Servicio de Atención al Cliente de la Entidad, meros rumores, habladurías, comentarios o juicios de valor que no estén relacionados en modo alguno con una conducta poco ética o ilícita (ejemplo: opiniones personales de trabajadores, clientes, proveedores, etc.).

Confidentiality

Personal data communicated through the whistleblowing channel can only be accessed by the Channel Manager, the Whistleblower Channel Manager(s), the Compliance Officer and the Data Protection Officer. Those who have access to the personal data shall at all times guarantee the confidentiality of the complaints received, compliance with the regulations compliance with the applicable rules on the protection of personal data, the safeguarding of the fundamental rights of the persons concerned and respect for current labor legislation. Anonymous complaints will be accepted, without prejudice to the need to be able to arrange with the complainant a method of contact in order to be in contact with the complainant. a method of contact in order to comply with whistleblower protection regulations. However, we recommend that reports should not be made anonymously, as anonymity makes it difficult to gather additional information if necessary. the Complaints Channel Manager or the person in charge of the Complaints Channel to collect additional data, if necessary. In any case, the personal data communicated through the complaints channel are confidential. Confidentiality implies that, initially, only the persons indicated above will be able to know the identity of the complainants and the and the information provided in the complaints, except with the express consent of the complainant or when it is necessary to share this information with specific express consent of the complainant or when it is necessary to share this information with specific individuals in order to take disciplinary action or when it is a necessary disciplinary measures or where it constitutes a necessary and proportionate obligation imposed by European Union or national law in the context of an investigation. or national law in the context of an investigation carried out by national authorities or in the context of judicial proceedings. judicial proceedings. A reported subject may never have access to the personal data of the complainant, except with the complainant's consent or where this is consent of the complainant or when this is necessary for reasons of judicial proceedings, in order to safeguard the right of defense of the the defendant's right of defense.

PWhistleblower protection

The entity will provide due protection to all persons who make a good faith report in accordance with applicable law, and always in compliance with Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law. reporting breaches of Union law. In particular, (a) no person who reports in good faith shall be dismissed, disciplined or suffer any other prejudice to his or her employment relationship or promotion (b) whistleblowing in good faith shall not constitute a breach of the principle of good faith in employment relations, nor shall it constitute a disclosure of a breach of the principle of good faith in employment relations. (b) a good faith report does not constitute a breach of the principle of good faith in labor relations or the disclosure of a trade secret, (c) if adverse employment consequences have been taken against the complainant in retaliation for making a good faith complaint, the entity shall promptly revoke such adverse action and reinstate the complainant's and shall restore the complainant's rights and sanction, as appropriate, those who have taken or encouraged the retaliation, (d) the organization shall investigate for disciplinary purposes (d) the organization shall investigate for disciplinary purposes any type of threat or situation of discrimination, harassment or other negative measures of a formal or informal nature suffered by the bona fide complainant or persons to whom the (d) the organization shall investigate for disciplinary purposes any type of threat or situation of discrimination, harassment or other negative measures of a formal or informal nature suffered by the bona fide complainant or persons close to him. When these facts could constitute a crime, the organization may bring them to the attention of the competent authorities.

Fraudulent use of the whistleblower channel

The reporting channel must be used in a responsible manner. The reporting of false facts or facts that do not conform to the principles of use of this channel could be a violation of the good faith that should govern labor relations and could lead to disciplinary sanctions and other legal consequences. of the good faith that should govern working relationships and could lead to disciplinary sanctions and other legal consequences. The Company does NOT tolerate the indiscriminate use of the whistleblowing channel for any of the whistleblowing channel for purposes other than those set out in this Policy or those covered by Directive (EU) 2019/1937 and applicable regulations, and will act immediately against those complainants who, in bad faith, violate the provisions contained in this Policy.

Processing of the whistleblow

(1) RECEIPT and ACKNOWLEDGEMENT OF RECEIPT:
The Electronic Complaints Channel (CDE), automatically acknowledges receipt of your complaint by generating a unique, personal and non-transferable code that the complainant (whether anonymous or confidential) can use to subsequently consult the status of their complaint, using this same website, in the ‘Consult your case’ section.

(2) ACCEPTANCE AND ACCEPTANCE OF THE COMPLAINT:
Within seven days of acknowledgement of receipt of the complaint, the Manager will issue a preliminary report describing the complaint and making an initial proposal for action. initial proposal for action, which will be sent to the Head of the Complaints Channel. This report will include an assessment whether the complaint falls within the scope of what are considered reportable facts (‘complaint ADMITTED’) or whether, on the contrary, it is about facts outside the purpose and scope of the whistleblowing channel, for example, complaints about working conditions that are not related to non-compliance with internal or legal regulations, mere unsubstantiated rumours, isolated complaints about a supplier, etc. (‘complaint REJECTED’). Additional information may be requested from the complainant to decide whether the complaint is admissible (only if it is NOT an anonymous complaint).
As soon as it is decided that the complaint is REJECTED, this will be communicated to the complainant (only if it is NOT an anonymous complaint) and the data of the complaint will be transferred to a complaint register which do not consist of personal data (anonymised record of the complaint) will be transferred to a register of complaints. Once this transfer has been made, the Head of the Complaints Channel shall instruct the Manager to archive and close the complaint in the complaint channel mailbox.

(3) INVESTIGATION: The Whistleblower Channel Manager shall decide on the steps of the investigation with a maximum of three months for its resolution, taking into account the preliminary report. The the subject of the complaint within a reasonable period of time and at the latest within one month of the ADMISSION of the complaint. Unless communication within that period is likely to make it impossible or seriously impede the achievement of the objectives of the investigation.

Both the steps taken during the investigation and the sanctioning decision shall be recorded in writing, stating the facts and the grounds on which they are based. Likewise, the Head of the Complaints Channel shall duly report to the Regulatory Compliance Officer, providing all relevant information regarding the complaints received and their processing.

The institution shall provide complainants with information on the complaint lodged and on the measures envisaged or taken to follow up the complaint. This response should be given within a reasonable time, not exceeding three months from the acknowledgement of receipt of the complaint. The time limit could be extended to six months where necessary due to the specific circumstances of the case, in particular the nature and complexity where necessary due to the specific circumstances of the case.

The imposition of sanctions, as well as any complementary management measures that may be adopted, shall in all cases be in accordance with the provisions of the applicable legislation or the collective bargaining agreement in force, as the case may be. applicable legislation or the collective bargaining agreement in force, as the case may be. A person may not be sanctioned without having been given a prior hearing and the opportunity to present any evidence and allegations he/she deems appropriate.

The Head of the Complaints Channel and the Head of Regulatory Compliance shall report to the Board of Directors at the end of the financial year, to the Board of Directors information on the number of complaints received, the issues involved and other aspects that may help to identify compliance issues. may help to identify existing compliance problems. In addition, if the seriousness of the complaint so warrants, the Board of Directors shall be duly informed of the number of complaints received, the issues involved and other aspects that may help to identify compliance issues, the Board of Directors shall be duly informed of the facts reported, for the sole purpose of adopting the necessary measures to put an end to irregular situations, and to put an end to irregular situations, and always in compliance with the duties of confidentiality with respect to the information received.

Versió 1.2 - June de 2025