Ethical Channel
I. Introduction
INARI-ENSO, S.L. and its subsidiary INARI-ENSO Ltd (hereinafter, INARI-ENSO or the Company, indistinctly) in compliance with applicable laws and regulations and for any doubts and queries regarding the interpretation and application of its Compliance Model, has enabled an internal mechanism for this communications: the Ethical Channel.
1. What should be communicated?
✓ Any breach of the Code of Ethics or other internal regulations, processes and controls
set forth in the Company’s Compliance Model.
✓ Any violation of applicable legislation.
✓ Any matter that may derive in reputational risk to the Company.
✓ Any queries regarding the implementation of the Compliance Model.
In any case, the content of the communication must be related to conduct or acts committed by Members 1 and third parties with which the Company has business or professional relations or any queries regarding the Compliance Model. However, the following use is expressly excluded from the Ethical Channel: complaints, claims or other communications about interpersonal conflicts, organizational or management of the Company.
2. What does the Ethical Channel consists of?
The Ethical Channel consists of the following web form accessible from the group’s web site:
https://inari.factorialhr.es/complaints
II. Essential principles and guarantees for the use and management of the Ethical Channel
✓ Confidentiality: The Company guarantees that (i) the identity of the persons making a communication; (ii) the identity of any other person affected or mentioned in the communication; and (iii) the actions taken, will be confidential and may not be disclosed or communicated to unauthorized persons.
✓ Anonymity: communications may be made anonymously, i.e., without the need to identify oneself. Anonymous communications will be handled, to the extent possible, in the same manner as personal communications.
✓ Prohibition of reprisals: INARI-ENSO will not adopt any kind of reprisal or detrimental actions towards any person who makes a communication in good faith.
✓ Management of the communication in a diligent and impartial manner: the communication will be processed in accordance with the requirements of Law 2/2023, in an objective manner and avoiding any conflict of interest.
✓ Right to communicate through a face-to-face meeting with the Head of the Ethical Channel: it must take place within seven (7) calendar days of your request. The face-to-face meeting must be documented in any case (i) by a recording of the conversation or (ii) through a complete and accurate transcript of the conversation. The recording may be listened to and/or the transcript of the conversation may be verified, corrected and accepted by signature.
✓ Right to inform the Independent Authorities (external channel) through the mechanisms provided by them.
✓ Rights regarding personal data protection, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, in Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights and in Law 2/2023 of 20 February regulating the protection of persons who report regulatory infringements and the fight against corruption. Rights recognized by data protection laws are right of access the personal data, right to rectification of inaccurate personal data, right to erasure (right to be forgotten), right to restriction of processing, right to data portability, and right to object (and to object automated individual decision-making). More information about data subjects rights is available in section IV.8 of this Policy.
✓ Other rights set forth in Law 2/2023, of February 20, regulating the protection of persons who report regulatory violation and the fight against corruption.
III. Guide to the use of the Ethical Channel
The Ethical Channel will be managed and operated in the following manner:
✓ The Ethical Channel is managed by the Head of the Ethical Channel, the Board of Directors has appointed Mariam Bachir as the Head of this Channel who also will promote the diligent handling of any internal investigations.
✓ The following persons on a need-to-know basis will have access to communications received through the Ethical Channel: (i) the Head of the Ethical Channel; (ii) the Compliance Officer/; (iii) in case of any disciplinary measure or sanction should be imposed, the person or body competent to take disciplinary measures; (iv) in case of having to adopt legal measures, the person in charge of providing internal legal advice to the Company; (v) where appropriate, the persons in charge of data processing that may be appointed, for example, internal or external advisors or managers; and (vi) where appropriate, the data protection officer.
✓ The Ethical Channel may be only used to communicate the facts or queries referred to above (see point “What can be communicated through the Ethical Channel”).
✓ Misuse of the Ethical Channel may be sanctioned. For example, in case of reporting false facts or in bad faith.
✓ All Members of the Company have the duty to report any breaches of the Compliance Model or applicable law of which they become aware.
IV. Rights regarding personal data protection
1. Data controller
Identity: INARI-ENSO, S.L.
Registered Office: Carrer de Tuset 8 – 8º 1º, 08006 Barcelona (Spain)
CIF: B67016469
Telephone: +34 93 797 59 70
2. Purpose of processing
The personal data provided in the communication will be processed to attend and analyse the communication, investigate the facts reported and take appropriate measures, whether disciplinary or contractual, to comply with the due diligence and control of the Company.
3. Categories of personal data
The personal data that the Company will process are those provided by the individual through the communication, as the rest of the data that may be collected as a result of the investigation that may be launched in accordance with the procedure indicated of this Ethical Channel.
4. Anonymous and confidential character
The individual may disclose any personal data, but may also communicate any fact anonymously. In either case, both personal data and information will be treated confidentially.
Although the individual’s identity is not mandatory and this person may choose not to provide any identification or contact details, these may help the satisfactory development of the investigation. The individual may decide to disclose any personal data at a later stage.
The interventions of witnesses and affected persons shall be strictly confidential.
5. Legal basis of the processing
The legal basis for the processing of personal data by the Company is the public interest (art.6.1.e GDPR) and compliance with a legal obligation (art.6.1.c GDPR).
6. Retention
The information provided through the Ethical Channel will be kept for the time necessary to decide whether to initiate an investigation into the facts reported and, where appropriate, for the additional period necessary to comply with legal or internal applicable regulations.
The personal data of the person making the communication and of all the parties involved shall be kept in the Ethical Channel platform only for the time necessary to decide whether to initiate an investigation into the facts reported, which shall never exceed three (3) months from the receipt of the communication. Once this maximum period has elapsed, the data will be deleted from the Ethical Channel, without prejudice to the storage and processing of such data that may continue to be carried out by the investigating team in order to follow up on the investigation.
After deletion, the data will be blocked for the legally stipulated periods.
7. Data Communication
a) Authorities that may be involved in the investigation or possible legal proceedings.
b) Persons who may be involved in the investigation itself.
c) Law Enforcement Bodies and competent Courts.
d) Third parties that the Company may have retained to carry out the tasks of the Ethical Channel, for example: data hosting platform, tool that supports the Ethical Channel, people to whom the investigation may be delegated in detail, lawyers or other advisors, among others.
8. Exercise of rights
a) Rights of the reporting individual: The reporting individual may at any time exercise the rights of access (to any personal data provided or acquired, but not to those of other possible participants or those affected by the investigation), rectification, suppression, opposition, limitation and portability with respect to the personal data provided, by mail to the address indicated or by e-mail to: pdp@inari.io identifying him/herself as a user of the Ethical Channel service, within the limits established in the applicable regulations.
b) Rights of the person involved in the communicated facts: The right to be informed as soon as possible that this person is involved in an investigation process, as a result of a communication concerning him/her or his/her actions. The aforementioned communication shall have the following minimum content: the body in charge of the management, the facts communicated, the rights to which he is entitled and the procedure for processing the communication, as well as all the information relating to the processing of his data listed in the previous section. The right of access to the recorded data, except for the identity of the communicating party and the personal data of other persons affected by the file, and the right to rectify any inaccurate or incomplete personal data. It shall also have the right to be informed of the resolution or closure of the alert, as the case may be. When communication to the person involved in the reported facts that he or she has been the subject of a communication would jeopardize the ability of the Company to investigate or gather evidence effectively, because of the risk of destruction or alteration of evidence by the person affected by the communication, it may delay such duty to inform.
The data subject may exercise the other rights provided for in the Data Protection regulation: suppression (in accordance with the time limits for the retention of personal data provided for by the legislation in force), restriction and portability of his/her personal data, by sending a letter to the above address or to the following e-mail address: pdp@inari.io, stating that he/she is the subject of an internal investigation, provided that this is compatible with the legitimate aim of the said investigation.
In case you consider you do not receive a satisfactory answer, you can contact the Spanish Data Protection Agency, to file a complaint or obtain further information regarding any of these rights. (www.aepd.es).
1 The members of the Company’s Board of Directors, Managers, employees, temporary staff or staff under a cooperation agreement, and any other person who is hierarchically subordinate to any of the above.