In compliance with Law 2/23 on whistleblower protection, and in accordance with the provisions of the Code of Conduct, the objective of which is to ensure professional, ethical and responsible behaviour from the agents involved in the professional activity of Ecoalf Recycled Fabrics, SL, the Company, through the Internal Information System, makes available to all its employees and interested partners (hereinafter, "Informants") an Internal Channel, as a confidential channel for:

a)Report breaches in relation to the Company's Code of Conduct, as well as any other internal rules of conduct.

b)Report on actions or omissions that (i) may constitute breaches of European Union law, as indicated by law (in terms of whistleblower protection, affect the financial interests of the European Union and/or affect the internal market), and/or (ii) may constitute a serious or very serious criminal or administrative offence.

The Ethics & Values Committee is responsible for the Internal Information System, which has delegated to one of its members, the HR Director, the powers to manage the Internal Information System and to process research files.

Refer to the rules of use of the Internal Channel and the Essential Principles of the Management Procedure

Ethical Channel

Track status of a communication

DATA PROTECTION POLICY OF THE INTERNAL WHISTLEBLOWING CHANNEL.

1. Responsible for the processing of personal data.

The data provided through the complaint form and those obtained from the development of the investigation will be processed by ECOALF RECYCLED FABRICS, SL (hereinafter, ECOALF), c/ Gran Vía nº 1, Madrid. NIF: B85910610. DPD Contact: gdpr@ecoalf.com

2. Purpose of the processing and legal basis.

Main purpose: Investigation of the Communication (complaint).

The personal data of the Informant, if provided and it is not an anonymous complaint, of the Informant and of all other persons who may have knowledge of the reported facts (witnesses, for example) will be processed for the purpose of investigating, processing and resolving the reported complaints. This processing is based on the need to comply with the legal obligation imposed by Law 2/2023, of February 20, 2023, regulating the protection of persons who report regulatory and anti-corruption breaches (article 6.1 c) of the General Data Protection Regulation).

In addition, the aforementioned data will be processed in aggregate form in order to extract metrics, statistics or information on aspects such as: Number of complaints, main facts reported, processing status, average processing time. This purpose is protected by the legitimate interest of ECOALF.

3. Category of personal data processed.

The Internal Whistleblowing Channel allows the submission and subsequent processing of anonymous communications.

However, the personal data provided by the Informant may be processed, in the form provided for this purpose, such · as identification data, name and surname, contact details and data relating to the status of employee, as well as the Respondent. · Relationship with ECOALF. · Reported breaches. · Documentation proving the reported breaches; as well as those that may result from the development of the research.

4. Communication of data.

The personal data processed in the investigation of the complaint will only be accessible by the Head of the Internal System, the head of human resources, the head of the Legal Services of the entity (if the adoption of legal measures in relation to the facts reported in the communication), the data processors who may be appointed and the Data Protection Officer may also be accessed. All of them have assumed confidentiality obligations with respect to the information accessed. Likewise, the processing of data by other people, or even its communication to third parties, will be lawful when it is necessary for the adoption of corrective measures in ECOALF or the processing of the sanctioning or criminal proceedings that, where appropriate, may be appropriate.

5. International Transfers.

The platform on which the Internal Whistleblowing Channel is managed is hosted in Spain (Europe), consequently, your data will be stored and processed in the European Union.

6. Retention period.

Personal data will be kept only for the time necessary to decide on the admissibility of initiating an investigation into the reported facts, which may last for a maximum of three (3) months from the registration of the communication. However, in the event that it is necessary to process the personal data for a longer period of time to continue the investigation or because it is decided to take legal action, the data will be retained, in an environment other than the Internal Complaints Channel, for as long as it is necessary to conclude the investigation and, where appropriate, the adoption of disciplinary measures or the processing of the appropriate legal proceedings.

Personal data that are not necessary for the knowledge and investigation of the facts communicated, that are contained in those communications that are not admitted for processing, whose relevance is not manifest to process specific information or that have been collected by accident, will not be processed and will be deleted without undue delay. If the communication received contains personal data included in the special categories of data, it will be immediately deleted.

7. Security and Confidentiality Measures.

ECOALF will ensure that all necessary technical and organisational measures are adopted to preserve the security of the data collected in order to protect them from unauthorised disclosure or access.

To this end, ECOALF has adopted appropriate measures to guarantee the confidentiality of all data, ensuring that the data relating to the identity of the Informant are not disclosed to the respondent or to any third party (except those authorized) during the investigation, respecting in all cases the fundamental rights of the individual, without prejudice to the actions that, where appropriate, may be adopted by the competent judicial authorities.

8. Rights Management.

You can exercise your right of access, rectification, opposition, deletion, limitation of processing and portability by writing to the email box gdpr@ecoalf.com. However, and without prejudice to the particular analysis carried out in each case, the application of these rights may be subject to restrictions with a view to ensuring a balance between the right to data protection and the purpose pursued by the Whistleblowing Channel itself. You also have the right to lodge a complaint with the Supervisory Authority (in Spain, the AEPD) or with our Data Protection Officer.

The right of access of the respondent will be limited to his/her own personal data, not having access in any case - given the confidential nature of the Internal Whistleblowing Channel - to the data on the identity of the Informant.

Enter the details of your complaint

Which company does this complaint refer to?

Category*

Type *

Name

Surnames

E-mail

Phone

Text of the facts *

Document

Record a sound

To record an audio please use chrome or firefox.

You must select the Captcha

El identificador de tu solicitud es: jio23y4woshdfjkldf

Check complaint status

There is no request with that identifier

Internal complaints channel.

Communications shall be channelled through the Internal Whistleblower Channel available to all Whistleblowers on the Company's website. All Communications must be submitted in writing; however, at the Whistleblower's request, they may be submitted at a face-to-face meeting, which must be offered by the System Manager within a maximum period of seven days after the request has been made. In this case, the meeting may be recorded and/or transcribed to document the verbal communications. At that time, the Informant shall be informed of the processing of the personal data in accordance with the applicable regulations and consent shall be sought for the documentation method chosen. The informant shall be given the opportunity to verify, rectify and agree by signing the transcript of the conversation.

The Internal Channel ensures that Whistleblowing can be handled effectively within the Company, with the objective that the first to know about possible wrongdoing is the Company itself. In order to guarantee the rigour of the investigation and confidentiality in the treatment of the Communications, the Internal Channel is designed, established and managed in a secure manner, so as to guarantee the confidentiality of the identity of the Reporting Person and of any third party mentioned in the Communication, and of the actions carried out in the management and processing thereof, as well as the protection of data, preventing access by unauthorised personnel.

Communications must not refer to areas other than those indicated in section two of this Handbook, nor to the private lives of individuals. Reporting Parties should provide only such specific and objective information as is necessary to determine whether the subject of their Submission falls within the scope described.

Likewise, they must avoid providing personal data revealing ethnic or racial origin, political opinions, religious or philosophical convictions, trade union membership, as well as biometric data, data relating to health or data relating to the life or sexual orientation of the Informant, the Data Subject or any other natural person. The Internal Channel allows for the submission and subsequent processing of anonymous communications.

Procedimiento de gestión de informaciones

Information management procedure.

1. Receipt and admission of Communications.

The Internal Channel has been integrated into this Internal Information System so that Whistleblowers can submit queries or information on the actions or omissions provided for in section 2 of this Manual, without prejudice to the right of Whistleblowers to resort to any other extrajudicial or judicial complaint mechanisms.

Whistleblowers may also use external channels of communication (Independent Whistleblower

Protection Authority, when established), with the competent authorities and, where appropriate, with the institutions, bodies, offices or agencies of the European Union.

Communications shall be received by the Ethics and Values Committee, which shall communicate to the Reporting Person the corresponding acknowledgement of receipt, within a maximum of seven calendar days following receipt, unless this could jeopardise the confidentiality of the Communication.

The Ethics and Values Committee will verify whether the Communication falls within the scope of application of the Internal Reporting System, in which case it will open the corresponding file, and will proceed to initiate the corresponding proceedings.

Otherwise, if the Communication does not fall within the scope of application of the Internal

Information System, or if any of the grounds for inadmissibility1 provided for in Law 2/2023 are applicable, it will order its immediate closure, notifying the Informant of this.

Alternatively, to archiving, the Ethics and Values Committee may refer the Communication internally where appropriate, in order to provide a solution to the issue raised.

2. Opening of the file.

In the event that proceedings have been opened, the Ethics and Securities Committee may

simultaneously adopt additional urgent measures in order to avoid jeopardising the progress of the investigation or those necessary to protect the Whistleblowers and, where appropriate, the Affected Persons. In order to carry out such actions, the Ethics and Securities Committee shall rely on the relevant departments or functional areas within the Company.[i]

3. Internal Communication Research.

The Ethics and Securities Committee shall respond to the investigation within a maximum of three months from receipt of the Communication or, if no acknowledgement of receipt was sent to the Reporting Person, within three months from the expiry of the seven-day period after the

Communication was made; except in cases of particular complexity requiring an extension of the deadline, in which case the deadline may be extended by up to a maximum of a further three

months, of which the Reporting Person shall be duly informed.

In the development of the internal investigation, the Ethics and Values Committee, the person in charge of the company's legal services (if legal measures should be taken in relation to the facts described in the Communication) and the data protection officer will have direct and exclusive access to the information. The processing of the data by other persons, or even their

communication to third parties, shall be lawful when necessary for the adoption of corrective

measures in the Company or the processing of any sanctioning or criminal proceedings that may

be appropriate, as the case may be.

During the processing of the investigation file, those Affected by the Communication shall have the right to the presumption of innocence, the right of defence and the right of access to their data contained in the file documentation, but not to the identity of the Informant, as well as to the same protection established for Informants, preserving their identity and guaranteeing the

confidentiality of the facts and data of the procedure.

4. Communication and hearing procedures.

Through the hearing process, the Ethics and Securities Committee may communicate with the

Reporting Person and, if deemed necessary, request additional information. Likewise, the Affected Party shall have the right to defend himself/herself, provide information, documentation and make allegations.

The Ethics and Securities Committee shall be obliged to inform the Affected Party of the actions or omissions attributed to it, and of its right to be heard, presenting in writing the arguments,

allegations and evidence that may be appropriate to its rights as soon as the status of the

procedure so permits and, in any event, within a maximum period of one (1) month from receipt

of the Communication. The aforementioned period may be extended, with reasons being given,

when this is deemed advisable.

The Ethics and Values Committee guarantees confidentiality, in any case, and in particular if the

Communication is sent through other reporting channels or to staff members who are not

responsible for its treatment.

5. Conclusions and resolution of the investigation.

On the basis of the proceedings of the internal investigation, the Ethics and Values Committee shall prepare a report and a resolution, which shall contain, at least:

• Brief description of the research.

• Facts established by the investigation.

• Conclusions, which may include, as appropriate:

- The declaration of the existence of non-compliance, in which case it may take the

following measures:

o The immediate correction of the non-compliance and the adoption of measures to

remedy the breached right and prevent future breaches, as appropriate.

o Disciplinary measures, which may range from a simple warning or reprimand to

dismissal.

o The transfer to the competent department of the resolution for the adoption, and in

any case application, of the remediation measures that may be necessary, which will

be duly reported to the Ethics and Values Committee.

- The closing of the case, in the event that it is concluded that there has been no noncompliance.

- Referral of the communication to the Public Prosecutor's Office immediately when the

facts could be indicative of an offence or referral to another authority or body that could

be competent to process the communication.

6. Preservation, custody and archiving of the Communication.

The Ethics and Values Committee shall keep an updated record of all Communications received, as well as, if applicable, of internal investigations carried out and actions taken, for the periods of time that, in accordance with applicable data protection regulations, are legally permitted in each case.

Once the Communications have been resolved, the records shall be anonymised as far as possible and, in any case, shall be kept for a maximum of 10 years.

The Internal Reporting System shall not obtain data allowing the identification of the Reporting

Person and shall have appropriate technical and organisational measures in place to preserve the identity and guarantee the confidentiality of the data corresponding to the persons concerned and to any third party mentioned in the information provided, especially the identity of the Reporting Person in case he/she has identified himself/herself.

As regards the Communication covered by the register, it shall be kept up to date at all times and shall include at least the following data:

• Date of receipt of the Communication.

• Means by which the Communication was received.

• Data, if applicable, on the Informant and the Affected Party.

• Summary of the nature of the Communication and the facts on which non-compliance is

found.

• Dates of communication to the Informant and the Affected Party.

• Documentation used in communication research.

• State of research.

The data undergoing processing may be kept in the System only for the time necessary to decide

whether to initiate an investigation into the reported facts.

If it is established that the Communication provided or part of it is not truthful, it shall be

immediately deleted as soon as this circumstance comes to light, unless such untruthfulness could constitute a criminal offence, in which case the Communication shall be kept for the time necessary during the legal proceedings.

In any case, if three months have elapsed since receipt of the Communication and no investigation has been initiated, the Communication shall be deleted, unless the purpose of the retention is to leave evidence of the functioning of the System.

Personal data relating to Communications that do not fall within the scope of the System and are not necessary for the conduct of the investigation and/or are not subject to investigation shall be deleted without delay, with the exception of making them available to Public Administrations or Jurisdictional Bodies, in case they might be necessary for the attention of possible liabilities during the relevant prescription periods. After this, the data shall be physically deleted.

7. Measures for the protection of informants.

Retaliation, including threats of retaliation and attempts of retaliation against individuals submitting a Communication is strictly prohibited.

Retaliation means any acts or omissions which are prohibited by law, or which, directly or indirectly, result in unfavourable treatment that places the persons subjected to them at a particular disadvantage compared to another in the employment or professional context, solely because of their status as whistleblowers, or because they have made a public disclosure.

Actions that constitute retaliation or cause discrimination and are taken within two years of the

completion of investigations shall be null and void and shall give rise, where appropriate, to

corrective disciplinary or liability measures, which may include compensation for damages to the injured party.

A person whose rights have been harmed by its communication or disclosure may, after the expiry of the two-year period, apply to the competent authority for protection, which may, exceptionally and in a justified manner, extend the period of protection, after hearing the persons or bodies likely to be affected. Reasons shall be given for any refusal to extend the period of protection.

Reporting Persons shall not be deemed to have violated any restriction on disclosure of a

Communication and shall not incur any liability of any kind in connection with such Communication or public disclosure, provided that they had reasonable grounds to believe that the Communication or public disclosure of such Communication was necessary to disclose an act or omission relating to violations of occupational safety and health law

[i] 1 Among others: when the facts reported lack any credibility; when they do not fall within the scope of this Manual; when the communication is manifestly unfounded; when the communication contains no new or significant information on violations in comparison with a previous communication; when the information refers to mere matters related to interpersonal conflicts or affecting only the Informant and the Affected Person; when it is hearsay, etc.