Ethical Channel Procedure Policy

1. PURPOSE AND SCOPE

1.1. INTRODUCTION

The Whistleblowing Channel Procedure (hereinafter, the “Procedure”) will be mandatory and applicable to EXOCLICK, S.L. (hereinafter, “ExoClick”) and all ExoClick’s employees and will be extended to other third parties related to the company that may report information related to infringements of internal regulations, of a criminal or a serious or very serious administrative nature –including those related to Competition Law– committed in ExoClick’s environment, regardless of their position or geographical location.

A list of the concepts that will be used frequently in this document, to this extent, reference is made to the EXOGROUP Whistleblowing Policy.

1.2. PURPOSE

The purpose of this Procedure is the essential regulation of the management and resolution of the Communications received through the internal information channels of EXOGROUP, as a preventive mechanism for the detection and management of any issue related to the scope, compliance, and interpretation of the regulations applicable to ExoClick, as well as, especially, those behaviors that may potentially involve breaches of European Union Law, or serious criminal or administrative offenses, in accordance with the definitions set out in section 1 of the Policy of Whistleblowing of EXOGROUP.

Therefore, this Procedure develops the principles governing EXOGROUP’s Whistleblowing Policy to create a procedure for reporting infringements for ExoClick, as the preferred channel for reporting actions or omissions, likewise, it will be effectively dealt with by the Organization in any case.

As a sign of its commitment to a culture of ethics and compliance, the Governing Body of ExoClick has implemented a Whistleblowing Channel Communication Procedure, in order to grant the rights of the persons involved in Communication and establish a standard of protection for Reporting persons.

This Procedure has been developed in line with the regulations established in the EXOGROUP’s Whistleblowing Policy.

1.3. SCOPE

This Procedure is mandatory and applicable to ExoClick in accordance with the definition of Whistleblowing channels from section 1 of the Whistleblowing Policy of EXOGROUP.

Therefore, it is applicable to all Members of ExoClick, regardless of the position they hold or their geographical location, according to Section 1 of the Whistleblowing Policy of EXOGROUP. Likewise, the scope of the Procedure also covers all Communications that may be raised by any Reporting Person.

In addition, this Procedure and the Whistleblowing Policy of EXOGROUP shall be applicable to all matters not expressly provided for in the specific Anti-harassment Policy or other similar protocols approved by the entities that make up ExoClick.

2. PRINCIPLES

a) PRINCIPLE OF INDEPENDENCE, OBJECTIVITY, AND IMPARTIALITY

Any decision related to the Whistleblowing Channel and the management of any investigation arising from the communications, will be governed in all cases by the principles of objectivity, independence, impartiality, and honesty.

b) GUARANTEE OF CONFIDENTIALITY AND ANONYMITY

EXOGROUP, guarantees the utmost confidentiality of the communications received, as well as the data contained therein. Thus, the confidentiality of the identity of the Reporting person and of any third party mentioned in the communication, and of the actions carried out in the management and processing of the same, as well as the protection of data, preventing access by unauthorized personnel, is guaranteed.

Likewise, it is guaranteed that the communications may be submitted both in a nominative or anonymous way.

c) ABSENCE OF REPRISALS GUARANTEE

It is absolutely forbidden to take any action against any person using the internal information channels that involves a reprisal or negative consequence, on the grounds of having made a communication in due form and subject to the conditions of use of the internal information channels.

All of these principles are duly reflected and developed in EXOGROUP’s Whistleblowing Policy.

3. WHISTLEBLOWING MANAGEMENT PROCEDURE

3.1. COMMUNICATIONS SUBMISSION

ExoClick has implemented a Whistleblowing Channel of Infringements managed from an external tool that can be accessed from any electronic device with an Internet connection. The purpose of this channel is to allow any interested party to report, anonymously or not, conducts referred to in point 2.2 of the Whistleblowing Policy.

The Whistleblowing Channel platform can be accessed from any device with an internet connection via the following link:

https://whistleblowersoftware.com/secure/9923d8ed-b258-4467-a8ed-a64d53eeb684

Upon accessing the link, the Reporting person will be asked to provide certain information about the facts he/she wishes to report, which must be provided in writing or by voice recording. Once the report has been submitted, the tool will provide a password to establish two-way communication between the reporter and the manager, even in those cases in which the report is made anonymously.

In addition, it is possible for the Reporting person to request through the Communication Channel of Infringements a face-to-face or telematic meeting for the communication of the facts. In this case, the manager of the Communication Channel of Infringements will have to appoint a meeting within a maximum period of seven (7) days.

Communications submitted through a face-to-face meeting will receive the same treatment and procedure as those submitted through the Communication Channel of Infringements.

3.2. COMMUNICATION RECEIPT

Once the communication has been made, the Responsible of the Whistleblowing Channel will first send a receipt of acknowledgement of the communication to the Reporting person, within seven (7) calendar days following its receipt.

The Responsible for the System, independently or with the support of an external advisor, will analyze the content of the communication and, once the possibility of it being a clearly false or unsubstantiated communication has been ruled out, will classify the communication according to the type and seriousness of the associated infringement.

3.3. COMMUNICATION FORMAL ANALYSIS

Once the communication has been categorized, it will be carefully analyzed, and it will be verified that it contains all the necessary fields to initiate the corresponding investigation. If this is not the case or if the communication has a formal defect, a request for information will be made to the Reporting person through the tool.

The essential information that all communications must contain is the following:

  • Location where the reported conduct takes place (work center, displacement, or any other place where it has been possible to verify the performance of the reported conduct within the scope of its professional activity).
  • Description of the reported conduct.
  • Time at which the conduct took place.
  • Categorize whether the conduct is punctual or recurrent.
  • Identification of the alleged perpetrator(s).
  • Detail on how the infringement came to your attention.
  • Documentation attached to the communication (evidence or clues).
  • Relevant comments that provide detail and clarify the facts reported.

After one (1) month has elapsed without a response to such a request without these essential elements having been provided, the Reporting person will be considered to have abandoned his or her desire to submit a communication, except for those that have been categorized as having a high impact.

In cases where a judicial decision or administrative proceedings are pending, the process shall be suspended, without prejudice to the investigation of the facts raised in the communication and the issuance of the pertinent generic recommendations.

After analyzing the formality of the communication, it is appropriate to review whether its content is adequate, relevant, and justified. It will be considered that it does not meet the above requirements, being unfeasible or inadequate, when it has unlawful or impossible content, or when it is totally outside ExoClick’s competencies.

In case, the communication is not admissible, the Responsible persons will receive a reply stating the reasons for its non-admissibility.

At the end of this phase, the Responsible for the System or, where appropriate, the external consultant, will issue a report detailing the actions taken, the data collected and a recommendation to file, investigate, or instruct the reported facts.

3.4. INFORMATION TO THOSE AFFECTED BY THE COMMUNICATION

At the time the communication is formally admitted, ExoClick’s Ethics and Compliance Committee will inform the people affected by the communication of the following points:

  • Details of the Body responsible for managing the Communication Channel of Infringements.
  • The facts reported, safeguarding the confidentiality and anonymity of the Reporting person, and related third parties.
  • The person responsible for processing the communication.
  • The information relating to the processing of your personal data.

Exceptionally, if there is a significant risk that notifying the person concerned by the communication would jeopardize the effectiveness of the investigation or collection of evidence, the notification will not be made until this risk has ceased to exist. The reasons for the existence of such risk will be documented and sufficiently reasoned.

The Legal and Privacy Representative will inform the person/s affected by the Communication within one (1) month, starting from the submission of the communication by the Reporting person, in addition to the processing of his/her personal data.

In any case, the person concerned will have the right to be heard at any time.

Likewise, information regarding the person concerned will be treated with strict confidentiality, and the right to the presumption of innocence, the right of defense, and the right to a fair trial are guaranteed by this procedure.

3.5. INVESTIGATION PHASE

If the communication is appropriate, pertinent, and justified, an investigation will be opened to determine the causes, as well as the immediate measures to be taken, therefore any evidence or proof deemed appropriate may be requested.

The period of the investigations may not exceed three months from receipt of the Communication or, if no acknowledgment of receipt was sent to the informant, three months from the expiry of the seven-day period following the Communication, except in cases of particular complexity requiring an extension of the time limit, in which case the time limit may be extended by a maximum of a further three additional months.

In accordance with the abovementioned, the Legal and Privacy Representative will be responsible for directing and promoting the internal investigations carried out and may request all the information and documentation deemed appropriate from any area or department, in order to conduct the investigations.

3.6. CONCLUSION AND WRITTEN REPORT

Once the investigation is completed, the Legal and Privacy Representative:

  • Will issue a report in which a documented and objective statement of the facts will be contemplated, followed by a subjective statement and assessment of the situation.
  • Will propose actions to be carried out and will present a proposed resolution to the communication that, based on his/her knowledge and experience, should be carried out.
  • Will send the corresponding report to the Ethics and Compliance Committee.

In accordance with the principles governing the Whistleblowing channel’s procedure, the Legal and Privacy Representative shall obtain sufficient evidence in order to be able to prove the reality of the facts reported; respecting, in any case, the right to the presumption of innocence and the honor of the person affected by the communication.

In those cases, in which the investigation carried out reveals the truthfulness of the facts reported, and the application of measures (punitive and/or of other nature) is appropriate, the report will be sent, when necessary, to the Management Body responsible for its execution.

When the events could allegedly constitute a criminal offense, ExoClick will inform the Public Prosecutor’s Office and/or the European Public Prosecutor’s Office.

4. COMPLIANCE MONITORING AND AVOIDANCE OF RETALIATIONS

The Responsible for the ExoClick’s System will avoid any kind of retaliation against those who have raised in good faith their queries, communications or complaints. If it is confirmed that such persons have been subjected to any form of retaliation, stigmatization, or harassment, the perpetrators will be investigated and, if appropriate, sanctioned accordingly.

The violation by an employee or professional of any of the rules set forth in the Procedure may result in significant damages to ExoClick’s professional interests and to its reputation.

For all the aforementioned, with the ultimate purpose of monitoring and verifying the compliance by employees or professionals of the obligations regarding the aspects established by this Procedure, ExoClick will have access to all the necessary systems and means, complying with the applicable Law in force at all times.

When there are sufficient grounds or when a real and effective infringement of any of the stipulations set forth in the channel’s procedure has been demonstrated, ExoClick will request the party involved to cease the infringement and, if applicable, it will adopt the corresponding disciplinary measures, proportional to the infringement.

When there is sufficient evidence or when it has been proved that a communication has been made based on false facts, deliberately misrepresented or with the intention of damaging the image, credibility, honorability, and/or professional reputation of any employee, it shall be understood as a serious infringement of this procedure.

Without prejudice to the measures established in this protocol for its infringement, whoever has made a communication in the terms described in the preceding paragraph may be criminally liable as a perpetrator of slander as defined in Article 205 of the Criminal Code.

In such cases, ExoClick may take all disciplinary measures that are applicable to the specific case, considering the type of communication that has occurred and the consequences arising from it, being constitutive of disciplinary dismissal, without prejudice to the damages incurred as a result of such breach.

ExoClick is entitled to initiate any legal action it deems appropriate, in accordance with the applicable law, arising from the employee’s failure to comply with these terms and conditions and/or ExoClick’s procedures and policies.

Based on the foregoing, ExoClick may apply the appropriate control measures of the Communication Channel of Infringements, review and management measures that may apply.

5. PERSONAL DATA PROTECTION

This Procedure has been carried out in application of the personal data protection provisions of the Spanish Act 2/2023 of February 20th, regulating the protection of people who report regulatory infringements and the fight against corruption.

In addition, it is in line with applicable data protection regulations (Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27th, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, and Spanish Organic Act 3/2018 of December 5th, 2018, on Personal Data Protection and guarantee of digital rights).

Thus, personal data processed as a result of communications will be kept for the period necessary for the purposes for which they were collected or for which they are to be further processed and, in any case, to ensure the principle of proportionality of the processing of personal data. In any case, the data may not be kept for a period longer than ten (10) years.

Under all circumstances, personal data processed because of the processing of a communication will be deleted within a maximum period of three (3) months after the end of the procedure for processing the communication or, where appropriate, from the end of the disciplinary, administrative or judicial procedure to which they had given rise.

In the case of communications that have not initiated an investigation phase because they are manifestly unfounded or do not have the minimum essential content, the personal data relating to the same will in any case be anonymized. The data will be kept in the external software for a maximum period of three (3) months from the submission of the communication. After this time, if the data are necessary to continue the investigation of the facts, they may continue to be processed for the purposes of the investigation carried out.

Once the communication has been concluded, the Responsible for the System may keep the personal data necessary to guarantee the traceability, compliance, and effectiveness of the Criminal Risk Prevention system implemented at ExoClick. The rights of access, rectification, cancellation, portability and, if applicable, opposition, may be exercised by the interested parties by sending an e-mail to the following address: whistleblowing@exogroup.com. In any event, the rights of cancellation or opposition will be limited as long as the facts communicated are being investigated or, as the case may be, the facts communicated are subject to judicial or extrajudicial action, and the identity of the Reporting person must be preserved.

6. PUBLICITY AND COMMUNICATION REGISTRATION

This Procedure is available to all Members of the Organization and Third Parties through its publication on the website, in a separate and easily identifiable section of the homepage:

https://www.exoclick.com

The Ethics and Compliance Committee will keep an updated register, preferably in digital format, with the communications made and the proceedings conducted in relation to them.

7. PROCEDURE INFRINGEMENT CONSEQUENCES

For the power of control assumed by ExoClick through the Procedure to be considered effective in achieving its intended purpose, it is necessary to determine the consequences of non-compliance with the rules, measures, and recommendations established in the Procedure by the employees or professionals to whom the Procedure is addressed.

Based on the above, when there are sufficient indications or when a real and effective breach of any of the stipulations contained in the Procedure has been demonstrated, ExoClick will be entitled, in compliance with the Workers’ Statute and the applicable collective bargaining agreement in the case of workers and the contracts signed in the case of professionals, to take any of the actions listed below, with the ultimate aim of auditing compliance with the Procedure:

i. ExoClick may request to the employee the definitive termination of the professional activity through which the non-compliance with the Procedure has occurred.

ii. ExoClick is entitled to access, block access, interrupt the connection, and recover the devices, equipment, and other technological means of the corporate network that have been used or are being used by employees or professionals for the development of their work activity or for the provision of their professional services. ExoClick reserves the right to carry out reviews, without prior notice, of the e-mail messages of the users of the corporate network and the LOG files of the server, in order to verify compliance with both legislation and internal procedures and to prevent such activities may affect ExoClick as a subsidiary civil liability.

iii. ExoClick may terminate the employment or service contract signed with the professional, in accordance with the regulations in force and without prejudice to the claim for damages incurred as a result of such breach.

iv. ExoClick may adopt any disciplinary measures that may be applicable to the specific case, taking into account the type of infringement that has occurred and the consequences arising from such infringement for ExoClick, which may constitute disciplinary dismissal, without prejudice to the damages incurred as a result of such infringement.

v. ExoClick is entitled to initiate any legal action it deems appropriate, in accordance with current legislation, arising from the employee’s or professional’s failure to comply with the Procedure.

The knowledge, observance, and respect of the Procedure is binding for all ExoClick’s employees when they are directly or indirectly involved in the development of ExoClick’s activity.

8. EXTERNAL INFORMATION CHANNELS

Without prejudice to the preferential nature of ExoClick’s Whistleblowing Channel Procedure for reporting the infringements that constitute the objective scope of application of this Procedure, the interested parties have the right, if they deem it appropriate, to submit the appropriate communications to the competent authorities on the matter in their territory.

For the purpose of complying with Spanish regulations on Whistleblower protection, all potential Reporting persons are informed of the existence of external information channels, including, but not limited to:

  • Law Enforcement Agencies: the Civil Guard, the National Police, or the Local or Regional Police.
  • Public Prosecutor’s Office.
  • independent authority for whistleblower protection (A.A.I.).
  • Catalan anti-fraud office (OAC).
  • Spanish Data Protection Agency (AEPD).
  • National Commission on Markets and Competition (CNMC).
  • Ombudsman (Defensor del Pueblo).

9. APPROVAL, ENTRY INTO FORCE AND AMENDMENTS

The Whistleblowing Channel Procedure will enter into force on the following day after its approval by ExoClick’s Board of Directors. In addition, and to show its commitment to the regulations it will be reviewed in the event that possible improvements are identified or regulatory, organizational, or any other changes occur that justify them.