WHISTLEBLOWING MANAGEMENT SYSTEM POLICY

INTRODUCTION

VALUE RETAIL MANAGEMENT SPAIN, S.L.U. (hereinafter “VRMS” or the “Company”) manages La Roca Village (owned by VALUE RETAIL BARCELONA, S.L.) and Las Rozas Village (owner of VALUE RETAIL MADRID, S.L.). VRMS is committed to fostering a culture of transparency, ethical conduct and zero tolerance towards any behaviour that contravenes applicable legislation, its Code of Conduct or other internal regulations. The purpose of this Policy is to define the fundamental principles upheld, promoted and adopted by VRMS for the management of whistleblowing reports. The policy also describes the essential components of the system and provides information on other “external” information channels as alternatives for whistleblowers to communicate with the appropriate regulatory authorities. This Policy will be made publicly available on the VRMS website, in a specific and easily available section.

SCOPE OF APPLICATION

This Policy is applicable to activities carried out by VRMS anywhere in the world and with other organisations in which the Company exercises effective control or holds positions on their governing bodies. It also applies to the Board of Directors, managerial positions and oversight bodies. The Policy is applicable to all VRMS employees, suppliers, distributors, franchises, consultants, licensees, agents, companies in which VRMS holds a stake, customers, tenants and consumers, and any other natural or legal person who uses the VALUE RETAIL brand or has a relationship with VRMS.

APPLICABLE REGULATION

This Policy is adapted to the following laws, among others:

• Organic Law 10/1995, of 23 November, on the Criminal Code and its subsequent amendments.
• Law 2/2023, of 20 February, regulating the protection of persons who report regulatory offences and the fight against corruption.
• Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights, and Regulation (EU) 2016/679 (GDPR).
• Directive (EU)2019/1937 of the European Parliament and of the Council of 23 October 2019, on the protection of persons who report breaches of Union law.

This Policy will be updated to reflect legislative changes in Spain and in the countries in which VRMS conducts any form of business activity, as well as the principles established in judgements of the Spanish Supreme Court, the Spanish Constitutional Court, the Court of Justice of the European Union and the European Court of Human Rights. It will also take into account the indications set out in guidelines, reports, recommendations and decisions issued by national or European public authorities, in particular the recommendations issued by the Autoridad Independiente de Protección del Informante (Independent Authority for the Protection of Whistleblowers (AIPI)).

APPLICABLE COMPLIANCE STANDARDS

This Policy is adapted to the following national regulations:

• Circular 1/2016 issued by the Spanish Public Prosecutor’s Office.
• UNE 19601:2017. Criminal Compliance Management Systems.
• Key judgements of the Spanish Supreme Court since 2010.

01 WHISTLEBLOWER CHANNEL

1. VVRMS provides the Whistleblower Channel as the preferred channel for whistleblowers reporting conduct that may constitute a breach of the law, the Code of Ethics or internal regulations. The Whistleblower Channel accepts both written and verbal reports and allows them to be made anonymously, in accordance with article 7.3 of Law 2/2023. The following channels are available for reporting information:

• The Speak Up Channel, available exclusively to employees, which is managed by the VRMS holding company. It ensures all reports regarding or related to VRMS are sent to and managed by the Whistleblowing System Manager. The Speak Up Channel may have its own policies, which will be made available to all employees.
• Other interested parties in Spain may use any of the following channels, managed by VRMS, and therefore controlled by the Whistleblowing System Manager.
  • Email address: canaldeinformantes@valueretail.com
  • Postal communication addressed to the System Manager at the official VRMS registered office, in a sealed envelope marked “Confidential – Whistleblower Channel”.
  • In-person meeting with the System Manager, held within seven (7) from the date of the informant’s request. Verbal reports will be registered by means of a secure recording or a complete transcript, giving the whistleblower the opportunity to review the recording or transcript, request amendments and sign it for validation.

2. The whistleblower may provide a postal address, email address or secure location for receiving notifications and for contact purposes. The system also permits anonymous reports, for which the same rights and procedural guarantees are ensured, to the extent permitted by the anonymous nature of the report.
3. Clear and accessible information is provided for whistleblowers on the external channels available for reporting to the competent authorities. Accordingly, the whistleblower has the right to report the information directly to the following authorities even after having used the internal channel:

• European Union:
  • Name: European Anti-Fraud Office (OLAF).
  • Contact details: https://anti-fraud.ec.europa.eu/index_en
• Spain (state authority):
  • Name: Autoridad Independiente de Protección del Informante, A.A.I (Independent Authority for the Protection of Whistleblowers (AIPI)).
  • Contact details: the official electronic office and the forms provided for this purpose via the external information channel.
• Catalonia (autonomous authority):
  • Name: Oficina Antifrau de Catalunya (Anti-Fraud Office of Catalonia).
  • Contact details: https://www.antifrau.cat

02 WHISTLEBLOWING SYSTEM MANAGER

1. The Internal Information System Manager (hereinafter, the “System Manager” or “RSII”) is the recipient of and is responsible for managing the Whistleblowing Management System in Spain, including reports relating to VRMS received through the Speak Up Channel or any other channel under its control. They are responsible for managing reports received through the Whistleblower Channel and for conducting any investigations that may be required.

2. Where necessary, the System Manager may share relevant information concerning any of the reports received with the person responsible for Value Retail’s Global Whistleblowing Management System, ensuring that all information is handled in accordance with this Policy and any other applicable global policies, and always in compliance with the confidentiality and data protection requirements laid down in applicable legislation.

03 GUARANTEES FOR THE WHISTLEBLOWER CHANNEL AND INVESTIGATION PROCESS

1. All reports received via the Whistleblower Channel shall be subject to the following guarantees:

• Security measures: The Whistleblower Channel shall have the appropriate technical and organisational security measures in place to avoid the risk of disclosure, unavailability, loss or destruction of data. The confidentiality, availability and integrity of enquiries and reports received shall be ensured.
• Confidentiality: The confidentiality of the identity of the whistleblower, the reported person and any third parties mentioned in the report, as well as the facts reported, shall be ensured. Only authorised personnel shall have access to the report. The identity of the whistleblower shall never be accessible through the right of access to personal data and may only be disclosed to a judicial authority, the Public Prosecutor’s Office or the competent government authority in the course of an investigation.
• Privacy: Personal data shall be processed in accordance with applicable data protection legislation. The data shall be retained only for as long as strictly necessary and, in all cases, for a maximum period of ten (10) years, in accordance with Article 26.4 of Law 2/2023.
• Diligent and reasoned response: Reports shall be answered within the applicable time limits, and responses shall always be sufficiently reasoned and address the various matters raised.
• Register: A register shall be kept of the reports received and the internal investigations arising from them. The register shall not be public. Personal data logged in the register shall be retained only for as long as strictly necessary and, in all cases, for a maximum period of ten (10) years.

04 GUARANTEES FOR WHISTLEBLOWERS AND REPORTED PERSONS

1. The rights of whistleblowers and reported persons in relation to reports received through the Whistleblower Channel shall be guaranteed as set out below.
2. Whistleblowers shall have the following rights:

• Not to have their identity disclosed to unauthorised persons without their express consent, including the right to report information anonymously.
• Not to be subjected to any form of retaliation for making a report in good faith, in accordance with Section VII of Law 2/2023. Retaliation is expressly prohibited, including dismissal, suspension, a substantial change to terms and conditions of employment, denial of training, negative assessments or references, damage to reputation, blacklisting, early termination of contracts, refusal or revocation of licences, or any other form of unfavourable treatment.
• To have any act constituting retaliation declared null and void, as well as to the reversal of the burden of proof in judicial or administrative proceedings in which retaliation is alleged, in accordance with Article 38 of Law 2/2023.
• To receive acknowledgement of reception of the report within a maximum period of seven (7) calendar days of reception, unless this could jeopardise the confidentiality of the report.
• To receive information on the status and outcome of the report within a maximum period of three (3) months, extendible by a further three (3) months in particularly complex cases.

3. Reported persons shall have the right to the presumption of innocence and to protect their reputation, as well as the right to be heard, to confidentiality, to a defence, to access the case file (subject to limitations established by law), and to have decisions made objectively and impartially. They shall also have the right to due process with all the safeguards provided for under applicable legislation and internal regulations, including compliance with the applicable time limits and the adoption of measures proportionate to the seriousness of the facts. They shall have the right to be informed of the outcome of the investigation and any applicable corrective measures.
4. Persons who knowingly report false information shall not be entitled to protection, without prejudice to any liability of any kind that they may incur.

WHISTLEBLOWING REPORT MANAGEMENT PROCEDURE

INTRODUCTION

VALUE RETAIL MANAGEMENT SPAIN, S.L.U. (hereinafter “VRMS” or the “Company”) manages La Roca Village (owned by VALUE RETAIL BARCELONA, S.L.) and Las Rozas Village (owner of VALUE RETAIL MADRID, S.L.). This Procedure implements the Whistleblowing Management System Policy and describes how reports received through the Whistleblower Channel are handled. In particular, it sets out the process VRMS must adopt when handling reports, including the investigation of reports and, where applicable, any disciplinary proceedings arising from breaches of the law, the Code of Ethics or other internal regulations. The Procedure shall be implemented by the System Manager, who, upon being notified of a potential breach, must initiate the appropriate investigation, with the full support of VRMS. Effective and proper implementation of this Procedure shall be ensured at all levels of VRMS, and all persons involved must comply with it.

AREA OF APPLICATION

This Procedure is applicable to activities carried out in VRMS anywhere in the world and with other organisations in which the Company exercises effective control or holds positions on their governing bodies. It also applies to the Board of Directors, managerial positions and oversight bodies. The result of this Procedure is applicable to all VRMS employees, suppliers, distributors, franchises, consultants, licensees, agents, companies in which VRMS holds an interest, customers, tenants and consumers, and another other natural or legal person who uses the VALUE RETAIL brand or has a relationship with VRMS.

APPLICABLE REGULATION

This Procedure is adapted to the following laws, among others:

• Organic Law 10/1995, of 23 November, on the Criminal Code and its subsequent amendments.
• Law 2/2023, of 20 February, regulating the protection of persons who report regulatory offences and the fight against corruption.
• Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights, and Regulation (EU) 2016/679 (GDPR).
• Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019.

LEGISLATION APPLICABLE TO COMPLIANCE

This Procedure is adapted to the following national laws, among others:

• Circular 1/2016 issued by the Spanish Public Prosecutor’s Office.
• UNE 19601:2017. Criminal Compliance Management Systems.
• Key judgements of the Spanish Supreme Court since 2010.

WHISTLEBLOWING REPORT MANAGEMENT PROCEDURE

1. Sending a report:

VRMS provides the following reporting channels for anyone wishing to make a report:

• Speak Up Channel, available exclusively to employees.
• Other interested parties in Spain may use:
  • Email address: canaldeinformantes@valueretail.com
  • Postal communication in a sealed envelope addressed to the System Manager at the official VRMS registered office, marked “Confidential – Whistleblower Channel”.
  • Verbal communication via an in-person meeting with the System Manager, to be held within seven (7) days from the date of the informant’s request.

The system accepts anonymous reports, in accordance with article 7.3 of Law 2/2023. In the case of verbal reports, these shall be documented by means of a secure recording or a complete transcript, offering the whistleblower the opportunity to review, amend and validate the transcript by signing it. When the report is submitted, the System Manager shall provide the whistleblower (to the extent permitted by the nature of the report) with all the information concerning the processing of personal data, their rights as a data subject, and the possibility of reporting directly to the competent external authorities (AIPI, the Anti-Fraud Office of Catalonia or OLAF, as applicable). If employees, directors, line managers, board members, shareholders or other participants in VRMS receive a report through other channels, they must also maintain the strictest confidentiality and, among other things, refrain from disclosing any information that could identify the whistleblower, the reported person or any other persons concerned, and must forward the report via the Whistleblower Channel.

2. Evaluation and assignment:

Based on the information received, the System Manager shall carry out a preliminary assessment to verify its accuracy, clarity and completeness, as well as the relevance of the reported matters. One of the following outcomes shall then be determined:

• Acceptance of the report, where the facts may constitute a breach of the law, the Code of Ethics or VRMS’s internal regulations.
• Rejection of the report, in accordance with Article 18.2 of Law 2/2023, in particular where the facts reported are manifestly implausible, do not constitute a breach of the legal system included within the scope of the Law, the report is manifestly unfounded, there are reasonable grounds to believe that the information was obtained through the commission of a criminal offence, or the facts are substantially identical to those set out in a previous report.

In all cases, the report must be immediately referred to the Public Prosecutor’s Office where the facts suggest that a criminal offence may have been committed or, where the facts affect the financial interests of the European Union, to the European Public Prosecutor’s Office.

3. Acknowledgement of receipt, notification of acceptance or rejection, and registration:

Upon receipt of a report, whether via the Whistleblower Channel or direct communication to the System Manager, an acknowledgement of receipt shall be sent to the whistleblower within seven (7) calendar days of receipt of the report (unless this would jeopardise the confidentiality of the report), and the whistleblower shall be informed whether the report has been accepted or rejected. Before answering the report or initiating the investigation, the System Manager will enter the report into the register.

4. Investigation and resolution:

The System Manager shall conduct the relevant investigation, with the support, where appropriate, of internal employees or external experts, who must maintain the confidentiality of all information relating to the report or investigation.

Initiating the investigation The purpose of the investigation shall be to establish the facts and identify the persons responsible. All persons involved in the investigation, with the exception of the System Manager, shall sign a confidentiality and conflict-of-interest contract, as required to provide adequate procedural safeguards. The human and financial resources necessary to conduct an investigation proportionate to the severity of the identified risk shall be allocated.

Precautionary measures Where a report is considered to contain indications of credibility, precautionary measures shall be determined, if considered necessary, to prevent risks that could impede the proper conduct of the investigation or to prevent retaliation against the whistleblower. Such measures may be adopted at any time during the course of the investigation.

Conduct of the investigation During the investigation, all actions considered appropriate to establish and resolve the reported breach shall be undertaken, including, but not limited to, obtaining sufficient evidence, conducting interviews and reviewing documentation. The System Manager may collect any information and documents considered necessary, as well as statements from persons whose testimony may be relevant.

Conflicts of interest If the report concerns anyone involved in the investigation, that person shall be excluded from the investigation or abstain from participating in it.

Notification to persons under investigation If, during the investigation, it is determined that the facts may be substantiated, and always respecting the presumption of innocence, the System Manager shall contact the persons under investigation and inform them of the allegations made against them. They shall also be informed of the forthcoming interview with the System Manager, without prejudice to their right to remain silent and to submit any documentation they consider appropriate.

Duration of the investigation The investigation must be completed within three (3) months from the date on which the report was received. In exceptional circumstances, the investigation may be extended by a further three (3) months (six (6) months in total) in particularly complex cases. If, following the investigation, the persons responsible for the breach have not been identified, the investigation shall continue in accordance with the provisions of the following sections concerning the measures to be taken to address the identified breach and implement appropriate actions to prevent its recurrence.

Final report The entire process shall be documented in a report prepared by the System Manager. When necessary, definitive measures shall be implemented in relation to the case, which will be monitored by the System Manager.

Conclusion of the investigation and proposed resolution by the System Manager Once the investigation has been completed and the report of a potential breach has been received, the System Manager shall issue a written resolution, which may consist of:

• Closing the case on the grounds that no breach has occurred.
• Proposal:
  • The imposition of a sanction or penalty in the event of a breach of the law, the Code of Ethics or internal regulations, or where a report has been made in bad faith.
  • The application of urgent corrective measures or the approval of provisional measures to be made permanent.

The proposed resolution shall be submitted to the relevant body

5. Disciplinary procedure:

General provisions When imposing a sanction or penalty, the following factors, among others, shall be taken into account:

• The seriousness of the facts under investigation.
• The duration or continuing nature of the breach.
• Whether the conduct was intentional or negligent.
• The presence of aggravating or mitigating circumstances, including:
  • Admission of the facts.
  • Cooperation during the investigation.
  • Remedying or mitigating the effects of the damage caused.
  • Previous breaches committed, provided that the relevant investigation has been concluded.

Employee Where, following completion of the investigation, a breach has been identified and the person responsible is a VRMS employee, they may be subject to disciplinary action in accordance with the applicable collective or sector bargaining agreement, or equivalent legislation. Directors, board members, partners and shareholders Where, following completion of the investigation, a breach has been identified and the person responsible is a VRMS director, board member, collaborator or shareholder, they may be subject to sanctions in accordance with the applicable legislation. Third parties Where, following completion of the investigation, a breach has been identified and the person responsible is a VRMS supplier or other third party, applicable legislation shall apply, including, where appropriate, the clauses of the contracts entered into with such third parties, without prejudice to the full application of this Whistleblowing Management System and VRMS’s powers under it, which may not be limited or excluded by agreement to the contrary.

6. Completion of the investigation:

Once the investigation has been completed, where the final report recommends a sanction or penalty, or corrective measures, these shall be monitored by the System Manager, and the resulting documentation shall be appended to the report. The completion of the investigation shall be reported in writing to both the whistleblower and the reported person. The notification shall contain, at a minimum, information as to whether any irregularities were identified and, where applicable, the measures planned or taken. A decision may be taken to report the matter to the relevant authorities where the facts constitute a breach of the law, taking into account the provisions of Section 2 of this Procedure.

Email: Contact via email