In compliance with Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption (“Law 2/2023”), the company L’ALBEREDA DE SANT JULIÀ, SL (hereinafter, “L’ALBEREDA” or “the company”) states that it has an Internal Reporting System, which is shared with the companies NANDO JUBANY, SL and CAN CARLITOS, SLU. The company NANDO JUBANY, SL is the data controller for personal data processing in accordance with the applicable legislation in this area.
With the aim of strengthening the company’s information culture and integrity infrastructures, as well as promoting a culture of reporting as a mechanism for preventing actions or omissions that may constitute infringements of European Union law, serious or very serious criminal or administrative offences, as well as labour infringements in the field of occupational health and safety, L’ALBEREDA has a Criminal Compliance Officer (RCP) who is also the Person Responsible for the Internal Reporting System (RSIIF) (hereinafter, the “RCP/RSIIF”). For these purposes, the company has appointed the person holding the position of Head of Human Resources.
Information relating to the areas described in the previous paragraph may be sent to the RCP/RSIIF through any of the following channels of the Ethics Channel (internal reporting channel):
Email to: compliance@canjubany.com
Ordinary mail to: “El Romaní” Carretera de Sant Hilari, s.n., 08506 – Calldetenes (Barcelona) (for the attention of the RCP/RSIIF).
By means of a written document delivered to the RCP/RSIIF.
Reporting persons may also request an in-person meeting with the RCP/RSIIF within a maximum period of seven days.
Information communicated verbally during the in-person meeting must be documented in one of the following ways, with the prior consent of the reporting person:
a) By recording the conversation in a secure, durable and accessible format.
In this case, the reporting person will be informed that the communication will be recorded and will be informed about the processing of their data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR or General Data Protection Regulation).
b) Through a complete and accurate transcription of the conversation made by the RCP/RSIIF.
Without prejudice to the rights to which they are entitled under data protection regulations, the reporting person will be offered the opportunity to review, correct and approve the transcription of the conversation by means of their signature.
The company’s Internal Reporting System complies with the requirements of Article 5.2 of Law 2/2023, that is:
a) It allows persons to whom Law 2/2023 applies to report information, by different means, regarding the infringements set out in its Article 2.
b) It is managed securely, ensuring that communications can be effectively handled within the aforementioned companies, as well as the confidentiality of the identity of the reporting person and any third parties mentioned in the report, and of the actions carried out in the handling and processing of such report, as well as the protection of personal data, preventing access by unauthorised personnel.
c) It has a Protocol for the use of the Ethics Channel and Internal Reporting Channel, of the Internal Reporting System and for the actions of the Criminal Compliance Officer and of the Internal Reporting System, which establishes guarantees for the protection of reporting persons, essentially:
Acknowledgement of receipt within seven calendar days following receipt of the information.
A maximum ordinary period of three months to respond to the investigative actions, under the terms of Article 9 of Law 2/2023, diligently completing and keeping a logbook of reports.
Possibility of maintaining communication with the reporting person.
Establishment of the right of the affected person to be informed of the actions or omissions attributed to them and to be heard.
Guarantee of confidentiality when the communication is submitted through reporting channels other than those established, or to personnel not responsible for its handling, as well as the obligation of the person who receives it to forward it immediately to the RCP/RSIIF.
Respect for the presumption of innocence and the honour of the persons affected.
Respect for the provisions on Data Protection (Title VI of Law 2/2023).
Commitment to forward the information to the Public Prosecutor’s Office immediately when the facts could apparently constitute a crime.
NANDO JUBANY, SL will process, as data controller, the personal data included in reports received and covered by Law 2/2023, for the purpose of being able to manage them and, where appropriate, to initiate the corresponding investigation procedure and adopt any corrective measures that may apply.
The legal basis for the processing will be compliance with the obligations imposed by Law 2/2023. If the report contains special category data, such data will only be processed when it is strictly necessary for the adoption of corrective measures and/or the initiation of the corresponding investigation procedure and/or the conduct of the corresponding sanctioning or criminal proceedings, in accordance with the applicable legislation, and in such cases, the legal basis will be essential public interest. The processing of personal data will be limited to what is indispensable, since without such data it would not be possible to comply with the objectives and obligations laid down in Law 2/2023.
Personal data may be processed by authorised personnel of NANDO JUBANY, SL, L’ALBEREDA and CAN CARLITOS, SLU only when necessary for the investigation of breaches of the company’s internal regulations, of infringements in the field of European Union law, serious or very serious criminal or administrative offences, as well as labour infringements in the field of occupational health and safety, for the adoption of corrective measures or for the conduct of the corresponding sanctioning or criminal proceedings, where applicable. Likewise, personal data may be disclosed to third parties in cases of legal obligation, and may be communicated to the judicial authority, to the Public Prosecutor’s Office or to the competent administrative authorities within the framework of the aforementioned investigation.
Personal data will be kept for the time strictly necessary to decide whether it is appropriate to initiate an investigation into the reported facts. If it is considered appropriate to adopt corrective measures, the data will be retained for as long as such measures are being applied. On the other hand, in the event that it is necessary to initiate sanctioning or criminal proceedings, the data will be retained for as long as the corresponding sanctioning or criminal procedure is ongoing.
In any case, if the decision on whether it is appropriate to initiate an investigation into the reported facts is not made within a period of three months, the personal data contained in the report will be deleted, except for those that it is strictly necessary to keep blocked in order to maintain evidence of the functioning of the company’s Internal Reporting System in accordance with Law 2/2023.
Personal data that reveal conduct not included within the scope of application of Law 2/2023 will also be deleted, as well as personal data that are not considered truthful, except where the lack of truthfulness could constitute a criminal offence, in which case the information will be kept for the necessary time while the corresponding judicial procedure is conducted.
Finally, it is noted that, at any time, the reporting person may request from the data controller access to their personal data, their rectification or erasure, restriction of processing, or object to it, as well as the right to data portability, by sending a written request accompanied by a photocopy of their identity document to the email address comunicacio@canjubany.com. In case of disagreement with the processing of their data, they may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), the supervisory authority in this matter, located at C/ Jorge Juan, 6 (28001) Madrid (www.aepd.es).
L’ALBEREDA expressly undertakes not to carry out acts constituting reprisal, including threats or attempts of reprisal, against persons who submit a report in accordance with the provisions of Law 2/2023, and to apply protection measures during the processing of a case with respect to the persons affected by the report.
In accordance with Law 2/2023, when a person who has participated in the commission of the administrative offence that is the subject of a report is the one who discloses its existence by submitting the information, and provided that this has been submitted before notification of the initiation of the investigation or sanctioning procedure, the administrative body competent to decide the procedure may, by means of a reasoned decision, exempt them from compliance with the administrative sanction that would correspond to them, provided that the requirements set out in Article 40 of Law 2/2023 are met.
(*) The Ethics Channel allows the submission of anonymous reports.
(**) Although, whenever possible, the use of the internal channel will be preferred, depending on the circumstances and seriousness of the information, reports may also be submitted, where appropriate, to the Independent Authority for the Protection of Whistleblowers, AII (in Catalonia, the Anti-Fraud Office of Catalonia), or to the corresponding regional authorities or bodies, to the Public Prosecutor’s Office, to the European Public Prosecutor’s Office, or to the competent authority, as appropriate. X60B7QF0