The Ethical Channel Policy of ROBIN HAT aims to establish the operational guidelines of the Ethical Channel and other means provided by ROBIN HAT, the functions of Compliance, and the rights of informants, those being investigated, as well as the investigation procedure and actions to be taken, taking into account:

• Law 2/2023, of February 20, regulating the protection of individuals who report regulatory violations and combating corruption. 
• The UNE-ISO 37002:2021 standard on whistleblowing management systems.
• Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law.

Although it is not a subject obliged under the aforementioned regulations, ROBIN HAT, in commitment to the highest standard and dedicated to ethics both inside and outside its organization, establishes this Ethical Channel so that anyone who has concerns related to the Code of Ethics and Conduct, with the Criminal Compliance Management System (SGCPA), and generally regarding good regulatory compliance within ROBIN HAT, can:

1. Raise any doubts or questions related to the Code of Ethics and Conduct of ROBIN HAT, with the SGCPA, or about any of the policies and procedures implemented in this area.
2. Report any irregularity or suspicion of irregularity that you are aware of, and that is being committed, has been committed, or is planned to be committed by any member of ROBIN HAT.

The Ethical Channel can be used by all members of ROBIN HAT, as well as by its allies, clients, and suppliers, to raise doubts or questions; or to report irregularities or suspicions of irregularities of which they are aware.

People who report through the Ethical Channel can report on events related to the activities of ROBIN HAT, involving its personnel or representatives.

The Ethical Channel Policy will apply to all communications regarding potential irregularities in the area of regulatory compliance, regardless of the channels used for their submission, whether verbal or written.

All those individuals who participate in the process of receiving or investigating regularities must comply with the content of this policy, especially regarding the guarantee of the rights of informants and those being investigated.

ROBIN HAT makes the following contact methods available for the Ethical Channel:

• Ethical Channel: Inquiries and information regarding irregularities or suspicions of irregularities can be submitted through the Ethical Channel web of ROBIN HAT, located on its own website.
• By phone: To the phone number of the Compliance function.
• In person: Before the Compliance function.

All communication made through the Ethical Channel will be handled respecting the following principles:

All individuals who are part of ROBIN HAT as a director, employee, collaborator, partner, or have a legitimate interest in the organization may send the information they deem appropriate through the Ethical Channel.

The Compliance function is the authority responsible for managing the information received through the Ethical Channel, and for safeguarding the rights of the informant and the investigated parties. It will have the power to act independently and autonomously, carrying out all actions it deems necessary to resolve the matters it is aware of, to protect informants from any type of retaliation, and to ensure the security of the information and the integrity of the investigated.

All information sent through the Ethical Channel must be submitted in good faith and, to the extent possible, accompanied by evidence supporting any suspicion of irregularity. 

ROBIN HAT will take the necessary measures to protect the rights of anyone who reports in good faith; as well as the rights of those being investigated until the investigation is concluded, ensuring their protection against any attempts at retaliation.

Individuals who wish to report possible irregularities can do so anonymously, through the web portal made available.

In the event that the informant leaves their details, ROBIN HAT commits to protecting their identity and to contacting them to inform them about the status of the investigation, as long as the communication does not interfere with it.

All communications received through the Ethical Channel will be managed by the Compliance function or the external provider specialized in managing ethical channels that it designates.

ROBIN HAT guarantees the utmost confidentiality regarding the identity of individuals who report irregularities, as well as those being investigated while the investigation is ongoing.

All individuals who have knowledge of information regarding possible irregularities received through the Ethical Channel are obliged to maintain professional secrecy about the identity of the informant.

The data of both the individuals making the communications and those being investigated may be provided to both administrative and judicial authorities whenever required as a result of any legal proceedings arising from the received communications. Such transfer of data to administrative or judicial authorities will always be carried out in full compliance with the legislation on the protection of personal data.

ROBIN HAT will take all necessary measures to protect the data of individuals who report possible irregularities; and to take those aimed at preventing retaliation.

The Compliance function will investigate the facts and circumstances that have been communicated through the Ethical Channel, determining:

• If there are sufficient indications to consider that the reported facts require the opening of a thorough investigation.
• If, once the reported facts have been investigated, they constitute a breach in the area of regulatory compliance.

If, once the investigation is concluded, it is determined that there was no irregularity, all measures must be taken to prevent harm to both good faith informants and those being investigated.

Individuals who report in good faith any suspicion of irregularities in compliance with regulations will be protected against any type of retaliation, discrimination, and penalties due to the information provided.

Any retaliation against anyone who reports an irregularity or suspicion of irregularity known to the Compliance function may be subject to investigation and recommendations for sanctions.

The prohibition of reprisals set forth in the previous paragraph shall not prevent the adoption of disciplinary measures that are appropriate when the internal investigation determines that the communication is false and that the person who made it is aware of its falsity.

The personal data collected through the Ethical Channel will be those strictly and objectively necessary and, if applicable, to verify the reality of the reported facts. 

The data will be processed in accordance with the applicable data protection regulations, for legitimate and specific purposes related to the investigation that may arise as a result of the reported irregularity.

The Compliance function may retain recordings of the information that has been provided to it verbally, as long as it deems necessary to proceed with the investigation or to preserve evidence required for it. Informants will be informed about the processing of their data in accordance with the provisions of the relevant legislation.

The procedure for managing communications received through the Ethical Channel consists of the following phases:

• Reception of information regarding the irregularity.
• Determination of the need for research.
• Investigation of the facts.
• Conclusions.
• Recommendation for sanction or filing.
• Communication to interested parties.

All information communicated through the Ethical Channel will be received by the Compliance function or the provider designated by it, who will be responsible for conducting a preliminary analysis of the facts, their fit within regulatory compliance, and will decide whether or not to initiate an investigation.

• If the information provided indicates that the facts are outside the scope of the Ethical Channel, the investigation will be deemed inadmissible. 
• If the information provided suggests indications of a possible regulatory compliance irregularity that falls within the scope of the Ethical Channel, an investigation will be initiated.

In both cases, the informant will be informed of the action taken, provided that it does not interfere with the ongoing investigation. From this moment on, necessary protective measures should be anticipated to prevent retaliation against the informant.

At the start of the investigation, the following will take place:

The notification to the person being investigated, informing them about:

• The reception of the information.
• The fact of which he is accused.
• How to exercise your rights of access, rectification, cancellation, and opposition, in accordance with data protection regulations.

If in the opinion of the Compliance function There is a risk that notifying the investigated party may compromise the investigation; such communication may be postponed until this risk disappears. In any case, the deadline to inform the investigated party shall not exceed one (1) month from the time the information about the possible irregularity has been received.

The Compliance function will initiate the appropriate investigations to verify the truthfulness of the reported facts and will assess all necessary measures to prevent retaliation against the informant and also to protect the rights of the investigated while the investigation is ongoing.

Once the investigation is concluded, and based on the results obtained, the Compliance function... will decide if:

1. Archive the information because either (i) the actions taken have not sufficiently substantiated the reported facts, or (ii) they do not constitute a violation of regulatory compliance.
2. Inform the investigated party of the irregularities they are allegedly involved in and give them the opportunity to present their arguments and defense. If, after the arguments, it is considered that an irregularity has indeed been committed, the Compliance function will formulate a proposal for the possible sanction to be applied if the reported facts have been sufficiently substantiated and, furthermore, constitute a violation of regulatory compliance. The Compliance function will prepare a written proposal for resolution, duly justified, of the possible disciplinary measures to be adopted and will send it to the administrators of ROBIN HAT for the execution of the measures.

In either of the two scenarios outlined in the previous section, once the Compliance function concludes the investigation, it must:

1. Document the results of the research in writing.
2. Establish a proposal of recommendations.

The Compliance function may take the measures it deems appropriate to protect the identity of informants or those being investigated when the facts have not been substantiated. 

The decision must be communicated to both the investigated party and the person who reported the irregularities. Any measures taken to prevent retaliation must also be notified.

The measures to prevent retaliation must be maintained for as long as the Compliance function deems necessary to avoid harm to the reporting individuals.

1. Personal data

The personal data collected within the framework of the Ethical Channel will be processed solely for the purpose of handling the information and, if appropriate, investigating the reality of the reported facts, thus complying with the legally established requirement in Organic Law 3/2018, of December 6, on the Protection of Personal Data and the guarantee of digital rights. 

The personal data collected within the framework of information that leads to the opening of the corresponding investigation will be integrated into the "Ethical Channel" file, which will have the computer security measures required by legislation and taking into account the sensitivity of the matter.  

It is expressly stated that the data contained in those pieces of information that are not accepted for processing will not be included in any file and will be immediately deleted. 

In cases where data is retained for statistical and control purposes, possible measures will be taken to anonymize the data and avoid the retention of data that is not strictly necessary.

The personal data collected in the context of an investigation may be communicated to the administrators of ROBIN HAT, as well as to the person or persons responsible for executing the corresponding sanction, and to external providers who collaborate in the investigation. 

Finally, interested parties will be able to exercise their rights of access, rectification, cancellation, and opposition through the email address info@robinhat.com

The right of access for the investigated party will be limited to their own personal data, not having access to the data regarding the identity of the informant, given the confidential nature of the Ethical Channel.

2. Confidential information

All confidential documents to which the Compliance function has access, whether supplied by the informant, collected during the investigation, generated in the course of it, or obtained by any means, must be destroyed once the investigation is concluded.

If any document or fragment of a document must be retained by legal obligation, or because the information was decisive for the outcome of the investigation, it may be kept for a period of no more than 10 years from the fiscal closing of the year in which the investigation was conducted. 

The Compliance function must take all necessary information security measures regarding the safeguarding of any confidential information that is under its protection.

Once the Ethical Channel Policy was concluded, it came into effect in March 2023, and its oversight corresponds to the Compliance function.

The Ethical Channel Policy may be updated and reviewed when there are legislative changes or when circumstances arise that warrant its review.