What is Garrido’s Internal Whistleblower Channel?

It is the channel that Garrido provides for whistleblowers to report breaches or violations.

 

Which breaches or violations can be reported?

Breaches or violations can be reported on the following matters:

-Labour in relation to Health and Safety at work.

-Protection of personal data.

-Criminal Law.

-Administrative law regarding serious or very serious infractions.

-Union Law regarding public procurement, financial services, products and markets, and prevention of money laundering and terrorist financing, product safety and compliance, transport safety, protection of the environment, radiation protection and nuclear safety, food and feed safety, animal health and welfare, public health, consumer protection, protection of privacy and personal data, and security of network and information systems.

–Garrido’s internal regulation.

 

To whom is the Internal Whistleblower Channel addressed

It is aimed at employees, self-employed workers or under the direction of third parties, such as contractors, subcontractors and suppliers, former workers, candidates, volunteers, trainees, shareholders, participants and persons of the administrative, management or supervisory body of an undertaking including non-executive members or any other third party within a labour or professional context.

 

What guarantees does Garrido’s Internal Whistleblower Channel have?

It is forbidden to take any kind of retaliation against the whistleblower, in addition to the fact that is a totally confidential procedure.

It is important to know that Garrido’s Internal Whistleblower Channel has a series of guarantees like:

-Accessibility: Breaches can be reported by any means desired, even anonymously.

-Confidentiality and data protection: It is guaranteed that confidentiality will be always preserved.

-Effectiveness: Reports received will be treated so that the organization will be the first to know about them.

-Objectivity and impartiality: Objective and impartial treatment is guaranteed. It does not matter who makes the communication and who it is about; it will be treated without privileges or differences.

-Presumption of innocence: The presumption of innocence, the right of defence and the safeguarding of the right to honour of the persons concerned are guaranteed.

-Protection: It is banned and guaranteed that no retaliations may be taken against bona fide whistleblower.

-Transparency: Information will be provided to the whistleblower when required, as well as to the persons concerned, regarding the status of the investigation.

 

What rights does a whistleblower have?

The following rights are guaranteed to the whistleblower:

-To receive acknowledgment of receipt of her/his report within no more than seven calendar days from receipt.

-To be provided feedback within a maximum period of three months, extendable by another three months depending on the complexity of the investigation.

-To request further information.

-To request to be informed or not to be informed any further on the status of the procedure.

-To report under her/his wished modality, identifying herself/himself or anonymously.

-To have her/his personal data protection rights respected.

 

What rights does the individual affected by the whistleblower’s report have?

The person involved is entitled to the following rights:

-To be informed of the progress of the investigation.

-To be informed of the facts attributed to her/him in the report in an understandable manner.

-To appear as many times as she/he wishes, upon written request, in the investigation and to provide information, testify or request investigation proceedings within the legal limits allowed.

-To be accompanied by a lawyer and/or workers’ representative.

-To have her/his personal data protection rights respected.

 

Where to report breaches?

Each of these breaches is processed through a different channel, hence:

–Labour and harassment/equality breaches will be reported to the Human Resources Department and/or the compliance channel: Click here

–Breaches in data protection matters will be reported to the data protection channel (Data Protection Officer): Click here

–The rest of the breaches will be reported to the compliance channel: Click here

 

Means of reporting breaches

Garrido’s Internal Whistleblower Channel has four different means of reporting:

–In-person or online meeting (Teams) as appropriate:

-Presential: At Garrido’s headquarters, located at 14-16 Santa Engracia Street, Madrid, Spain, 28010. To do so, please go to the reception desk and state that you wish to meet with the Internal Whistleblower Team. Our team will not ask any questions, will inform if there is any free room, and will accompany the whistleblower to it, where she/he will wait the necessary time to be able to attend her/him properly.

-Online (Teams): By sending a request to cumplimiento@garrido.es.

-In the voicemail of the telephone: + 34 91 770 31 43.

-By letter sent to: Garrido’s Internal Whistleblower Channel, 14-16 Santa Engracia Street, Madrid, Spain, 28010.

-By e-mail to each of the channels previously specified.

 

What are the rights regarding the protection of personal data?

Our Internal Whistleblower Channel complies with the Data Protection regulations, and specifically protects the identity of the whistleblower and the person concerned, which will be in any case kept confidential. The same applies to all personal data collected in the report and during the investigation.

Access to identity and personal data contained in the System shall be limited, within the scope of its responsibilities and functions, to:

-The Internal Compliance Body (OCI, for its acronym in Spanish).

-The person in charge of the System and whoever manages it.

-Human Resources Manager, only when disciplinary measures may be taken against an employee.

–Garrido’s Head of Legal Services, if the adoption of legal measures in relation to the facts reported in the report is necessary.

-Data Processors, when the system or part of it is outsourced (external tool).

-Data Protection Officer.

Nevertheless, the processing of data by other persons, or even its communication to third parties, will be lawful when necessary for the adoption of corrective measures in the entity or the processing of disciplinary or criminal proceedings, if any.

Specific information on the processing of personal data within the System is provided below:

-Controller: Garrido Asesores Fiscales, S.L. (hereinafter, Garrido), with registered office at 14-16 Santa Engracia Street, Madrid, Spain, 28010 and TIN ES-B82809914.

-Contact details of the Data Protection Officer: privacidad@garrido.es.

-Purpose: to manage whistleblowers’ reports in accordance with the same and, if applicable, to investigate those facts that may be contrary to the facts that may constitute (i) European Union Law breaches, (ii) serious or very serious criminal or administrative breaches, and (iii) Garrido’s Compliance System breaches.

-Lawfulness: legal obligation under articles 6.1.c) of Regulation (EU) 2016/679 and 8 of the Organic Law 3/2018, of December 5th, and 11 of Organic Law 7/2021, of May 26th and article 10 of Law 2/2023, of February 20th.

-Recipients: your data will not be disclosed unless legally required. In this case, data will be sent to the Law Enforcement Bodies, the Justice Administration and/or the competent Public Administration.

–Data retention period: Reports, as well as the personal data and other information provided by the whistleblower will be kept for a maximum period of three (3) months, unless the investigation is extended for a further three (3) months, accumulating a period of six (6) months, unless the purpose of the data retention is to leave evidence of the functioning of the Internal Whistleblower Channel, in which case, the blocking provided for in Article 32 of Law 3/2018 will be carried out. Reports that have not been followed up will only be recorded in anonymized form.

-Rights: the whistleblower may exercise the rights of access, rectification, erasure, object, portability and restriction of their data, as well as the right to withdraw the consent given by contacting the Data Protection Officer at the e-mail address privacidad@garrido.es. Likewise, you can file a complaint with the Spanish Data Protection Agency (www.agpd.es).

For further information please access Garrido’s Privacy Policy: https://garrido.es/en/ .

 

External Whistleblower Channel

The report can also be reported directly to the Independent Authority for the Protection of the Whistleblower Person, A.A.I., which will be in charge, in the future, of the external information channel.

Nonetheless, the Community of Madrid has set up a whistleblower channel, to which, for the time being, any report can be addressed, and which is called Canal del Informante (Whistleblower Channel):

https://www.comunidad.madrid/transparencia/canal-del-informante

The National Anti-Fraud Coordination Service. can also be used at the national level.

In addition, the Whistleblower may contact the Police Authority (CNP, Guardia Civil, Municipal Police…) or the competent Judicial Authority.