Specific protocol to regulate the procedure for managing communications (including complaints) and internal investigations (“Protocol”)
Object
In accordance with current legislation, and in order to promote a corporate culture based on ethical and regulatory compliance, as well as to prevent, discover and react to breaches of the law and other internal regulations, Mortgage Direct S.LU (hereinafter, “MD”) enables a complaints channel (“Complaints Channel”).
The Whistleblower Channel is a communication tool that allows both internal MD staff and third parties to inform MD of any situation of non-compliance with the law or internal regulations of MD by communicating situations of risk or of ethical or regulatory non-compliance.
This Protocol describes, on the one hand, the operation and requirements to which the MD Complaints Channel is subject and, on the other hand, the procedure that must be followed for its proper management, as well as for the investigation and, where appropriate, sanction of the offenses committed is developed.
2. Receiving Communications and Complaints
2.1. Whistleblowing Channel: MD establishes a Whistleblowing Channel, managed by the Whistleblower Channel and Internal Investigations Manager, to allow employees, contractors, suppliers and other interested parties to confidentially and securely report any inappropriate conduct or irregularities within the organization.
2.2. Reception and Registration: All complaints and communications will be received by the Head of the Complaints Channel and Internal Investigations. The latter will register the complaint, open a file and send proof of receipt to the complainant within a maximum period of seven (7) days.
In the event that a communication does not contain the information necessary for its processing, the reporting person will be asked to correct it, completing it or providing additional information.
3. Preliminary Resolution
3.1. Initial Analysis: The Head of the Complaints Channel and Internal Investigations will carry out an initial analysis of the complaint.
3.2. Preliminary Resolution: Based on his analysis, the Head of the Complaints Channel and Internal Investigations will make one of the following decisions:
a) File the complaint. The archiving of the communication or complaint will be agreed when, after the appropriate investigation, it considers that the facts reported have not been sufficiently substantiated, or these do not constitute an offence included in the objective scope of the Complaints Channel.
b) Adoption of such measures as are considered necessary to restore legality and to remedy or correct, as far as possible, the harmful effects that the facts reported may have produced, including, but not limited to, the following:
b.1) Modifications in MD procedures, control methods and policies.
b.2) Corrections and adjustments to reporting and information documents.
b.3) Reports to the competent authorities.
b.4) Termination of contractual relationships
b.5) Opening of disciplinary proceedings for the imposition of appropriate sanctions.
b.6) Any others that are considered necessary.
4. Internal Investigation
4.1. Designation of the Bodiy/Department. Responsible: The Head of the Complaints Channel and Internal Investigations will determine the body or department responsible for carrying out the investigation. In cases of criminal relevance, the person responsible for the investigation will be the person responsible for the Complaints Channel and Internal Investigations.
4.2. Actions and Investigation: The designated body or department will carry out all necessary actions and investigations to determine the veracity of the complaint and to assess the existence of breaches.
4.3. Final Report: Once the investigation has been completed, a final report will be generated that will contain:
There is no reasonable evidence or sufficient evidence of non-compliance.
Existence of reasonable evidence or sufficient evidence of non-compliance.
Causes of the violation (system deficiencies) and the corresponding recommendations for improvement.
5. Response and Deadlines
5.1. Response to the Complainant: MD will provide the complainant with a final report with the findings no more than thirty (30) days after the acknowledgment of receipt of the complaint. If for any reason a response cannot be sent within that period, the interested party will be informed that their request is in progress and a new deadline will be offered.
6. Final Provisions
6.1. This Protocol is in compliance with applicable laws and regulations in Spain and reflects MD's commitment to ethics and integrity in all its operations.
6.2. Any modification or revision of this Protocol will require the express approval of the MD Board of Directors.
7. Record of performances
Persons authorized for management and instruction must record, through registration, the information received and the internal investigations that have resulted in order to ensure compliance with the requirements of Law 2/2023.
8. Data protection
The Complaints Channel will have a secure and restricted access database in which all communications, information, complaints and inquiries received, date of receipt, identification code, status and measures taken in this regard will be recorded and updated.
Access to personal data provided through the Complaints Channel will be exclusive to the personnel established in article 32 of Law 2/2023. The processing of data by other people, or even their communication to third parties, will be lawful when it is necessary for the adoption of corrective measures in the entity or the processing of sanctioning or criminal procedures that, if any, may be appropriate. In any case, the personal data provided will be processed exclusively for the management and processing of the communication received and for carrying out any investigative actions necessary to determine the concurrence, if any, of the facts subject to communication, information, complaint or consultation.
The personal data that may be collected will be treated with absolute respect to the applicable data protection regulations. Through the computer application, the complainant will be informed about the processing of their data, whose basis of legitimation is a legal obligation, in accordance with the provisions of Law 2/2023, as well as the custody of these for presentation to the Spanish Data Protection Agency if necessary and public authorities for the attention of possible liabilities that arise and only during the applicable statute of limitations. The informant may exercise their rights of access, rectification and deletion with respect to their personal data at any time by means of a written communication addressed to reclamaciones@bayteca.com and, where appropriate, any rights that are in force in accordance with data protection regulations.
MD undertakes to treat personal data received through the Complaints Channel at all times in an absolutely confidential manner and in accordance with the purposes set out in this Procedure, and will adopt the necessary technical and organizational measures to guarantee the security of the data and prevent their alteration, loss, treatment or unauthorized access, taking into account the state of the art and the provisions of the legislation on the protection of personal data and in Law 2/2023. Under no circumstances will personal data that are not necessary for the knowledge and investigation of the actions or omissions reported or reported be processed, and, where appropriate, they will be immediately deleted. In addition, all personal data that may have been communicated and that refer to conduct that is not included in the scope of application of this Procedure will be deleted. The data being processed may be kept in the information system only for the time necessary to decide on the appropriateness of initiating an investigation into the facts reported. If it is proven that the information provided or part of it is not true, it must be immediately deleted as soon as such circumstance is recorded, unless such lack of veracity may constitute a criminal offence, in which case the information will be kept for the necessary time during the judicial procedure.
After three (3) months after receipt of the communication, information or complaint without any investigation being initiated, personal data must be deleted, unless the purpose of the preservation is to leave evidence of the functioning of the system. Communications that have not been processed may only be recorded in an anonymized form.