WHISTLEBLOWER CHANNEL AND DOCUMENTATION POLICY

NBU Interactive S.L makes available to its employees, collaborators, and third parties this reporting channel, designed for the communication of possible behaviors constituting regulatory infractions, in accordance with Law 2/2023, of February 20, regulating the protection of persons who report infractions and the fight against corruption.

This channel is established as a transparent, secure, and absolutely confidential means, intended to channel communications related to violations of the legal system or the organization’s Code of Ethics. 

1. PRINCIPLES OF USE AND GOOD FAITH

The informant must provide only information that, to the best of their knowledge and belief, is correct and relevant to detect an infraction.

Prohibition of bad faith: In the event that the communication is manifestly unfounded or there are reasonable indications that it was obtained through the commission of a crime, NBU Interactive S.L reserves the right to initiate appropriate disciplinary or legal actions.

Protection against retaliation: It is guaranteed that no measures will be taken that could be considered retaliation against those who report in good faith.

2. PROTECTION OF PERSONAL DATA

In compliance with current regulations, detailed information is provided on the processing of personal data for the three profiles involved:

          Informative Clause for the Informant (Whistleblower)

The channel allows the submission of anonymous reports. If the informant chooses to identify themselves, the following data will be processed:

• Data categories: Identifying, contact, and professional information.
• Sensitive data: If the information contains special category data, it will be immediately deleted without being recorded.
• Purpose: Receipt of the report, investigation of the facts, and communication of the progress of the process.
• Legal basis: Compliance with legal obligations (Law 2/2023).
• Retention: The data will be kept in the system for the time strictly necessary to decide on the initiation of the investigation. The maximum period is 3 months from receipt (or 3 months and 7 days if there was no acknowledgment of receipt). After this period, the data will be anonymized unless its retention is necessary for judicial or disciplinary processes.

          As Informative Clause for the Investigated (Accused)

• Purpose: To manage the received communication, carry out the internal investigation, and, if applicable, adopt corrective or disciplinary measures.
• Confidentiality: Your data will be treated confidentially and will not be communicated to third parties, except if it is essential for the investigation (Judges, Courts, or Public Prosecutor’s Office).
• Rights: Your right to be informed of the actions attributed to you is guaranteed, always preserving the identity of the complainant.

          Informative Clause for the Investigated Party (Accused)

• Purpose: Your data will be processed solely for the purpose of collecting the information necessary to clarify the reported facts.
• Security: The same confidentiality measures and deletion deadlines (maximum 3 months for the initial management in the system) applied to other participants will be applied.

3. RECIPIENTS OF THE DATA

The data may be shared with:

1. Public bodies, Judges, and Courts: When necessary for disciplinary measures or judicial proceedings.
2. Public Prosecutor’s Office: If the facts constitute a criminal offense.
3. Group Companies: If the investigation affects multiple entities or is necessary for the adoption of corrective measures.

     4. RIGHTS OF THE DATA SUBJECT

Any affected person may exercise their rights of access, rectification, deletion, objection, restriction of processing, and portability through the following channels:

Email: [email protected]

Likewise, if you consider that your rights have not been properly addressed, you have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).