1. Purpose
The purpose of this Privacy Policy is to provide information on the processing of personal data carried out in the context of the management and investigation of reports and queries submitted through the Whistleblowing Channel of Grupo Azvi, as well as, where applicable, within the entities of the AZVI Group over which Grupo de Empresas Azvi, S.L. exercises control or a majority interest, in accordance with applicable regulations.
The Whistleblowing Channel is managed through a specialized technological solution (Whistleblower), designed to ensure the confidentiality, integrity, and availability of the information, as well as the protection of the identity of the reporting person and the individuals concerned.
For the proper configuration and operation of the Whistleblowing Channel, Grupo Azvi strictly complies with the applicable regulations on personal data protection, in particular:

• • Regulation (EU) 2016/679, General Data Protection Regulation (GDPR).
  • Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights.
  • Law 2/2023 of 20 February on the protection of reporting persons.
  • Organic Law 10/1995 of 23 November, Criminal Code.
  • Any other applicable European and national regulations.

2. Data Controller
The controller of the personal data processed through the Whistleblowing Channel is Grupo de Empresas Azvi, S.L. (hereinafter, “Grupo Azvi”), with tax identification number B-91164343, registered office at C/ Almendralejo, 5, 41019 Seville (Spain), contact telephone +34 954 999 320, fax +34 954 999 200, and email address protecciondedatos@grupoazvi.com
Data subjects may contact the controller through the corporate channels available or via the specific contact address established for data protection matters.

3. Categories and Origin of Personal Data
Within the framework of the Whistleblowing Channel, personal data relating to the reporting person, the reported person, and third parties who may be related to the reported facts (such as witnesses or other persons involved), as well as those to whom the applicable regulations grant specific protection measures, may be processed.
Personal data may be obtained:

• • Directly from the data subject when submitting a report or query, providing statements, or
    participating in the investigation.
  • Indirectly, through other natural or legal people involved in the facts under review or in the
    internal investigation.

Given that the content of communications depends on the information voluntarily provided by data subjects, it is not possible to determine in advance all categories of personal data that may be processed. In any event, Grupo Azvi ensures that only data that is strictly necessary, adequate, relevant, and non-excessive for the management of the Whistleblowing Channel and the verification of the reported facts will be processed.

4. Purposes and Legal Bases for Processing
Personal data collected through the Whistleblowing Channel will be processed for the following purposes and on the following legal basis:

1. 1. Compliance with a legal obligation. Management, handling, and investigation of reports and
      communications received, as well as the adoption of measures to protect against retaliation, in
      compliance with Law 2/2023.
   2. Handling of queries, based on legitimate interest. Processing of queries submitted through the
      Whistleblowing Channel to analyze and respond to them, based on the legitimate interest of both
      the reporting person and Grupo Azvi in ensuring an appropriate internal communication channel.
   3. Prevention of criminal risks, as a task carried out in the public interest. Processing data for the
      purpose of preventing, detecting, and investigating potential breaches of regulations or irregular
      conduct that may give rise to liability for the organization.
   4. Demonstrating the proper functioning of the compliance system, based on legitimate interest.
      Retention of information necessary to evidence the correct functioning of the Whistleblowing
      Channel and the crime prevention model, following the appropriate balancing of legitimate
      interest.
   5. Compliance with additional legal obligations. Processing of data to respond to requests from
      administrative or judicial authorities, the Public Prosecutor’s Office, or other competent bodies.

5. Retention Periods
Personal data will be retained:

• • For the time strictly necessary to decide on the admissibility and processing of the report.
  • Where applicable, for the duration of the investigation activities.
  • Thereafter, for the periods necessary for the establishment, exercise, or defense of legal
    claims.

In any case, after three months from the receipt of a communication, if no investigation activities have been initiated, the data will be deleted, unless their retention is necessary to provide evidence of the functioning of the Whistleblowing Channel, in which case they will be kept in anonymized or blocked form in accordance with applicable regulations.

6. Data Recipients
Generally, personal data will not be disclosed to third parties and will only be accessible to persons expressly authorized by Grupo Azvi. However, data may be disclosed to judicial or administrative authorities or the Public Prosecutor’s Office where there is a legal obligation to do so. Additionally, service providers acting as data processors, including technology, legal, or consulting providers, may have access to the data, with whom Grupo Azvi has entered into the corresponding data processing agreements in accordance with Article 28 GDPR.

7. Data Subjects’ Rights
Data subjects may exercise the rights recognized under data protection regulations. The exercise of the right of access by the reported person shall not, under any circumstances, include access to the identity of the reporting person.
If no response is received or if data subjects consider that their rights have been infringed, they
may lodge a complaint with the Spanish Data Protection Agency.

8. Information on Data Subjects
Grupo Azvi shall adopt the necessary measures to ensure that data subjects are provided with clear, accessible, and understandable information regarding the processing of their personal data. Such information will be provided at the time of the communication or, where appropriate, while
the investigation, in compliance with the limits and exceptions set out in Law 2/2023.

9. Confidentiality and Anonymity
Grupo Azvi guarantees the confidentiality of the data processed through the Whistleblowing Channel and the protection of the identity of the reporting person. Anonymous communications are permitted. The identity of the reporting person may only be disclosed to judicial or administrative authorities where there is a legal obligation to do so.
All people involved in the management and investigation of communications are subject to a strict duty of confidentiality.