Whistleblowing Policy

WHISTLEBLOWING POLICY
1. OVERVIEW
2. PURPOSE
3. SCOPE
4. DUTIES AND RESPONSIBILITIES
5. RIGHTS OF THE PARTIES ENVOLVED
5.1. RIGHTS OF THE REPORTING PERSON
5.2. RIGHTS OF THE AFFECTED PERSON
5.3. RIGHT TO BE GUARANTEED PROTECTION AGAINST RETALIATION
5.4. GUARANTEE OF ABSENCE OF CONFLICTS OF INTEREST
6. IMPLEMENTATION OF WHISTLEBLOWING
6.1. DEFINITION OF REPORTING
6.2. REPORTABLE CONDUCT
7. MAKING A DISCLOSURE
7.1. INTERNAL REPORTING
7.2. EXTERNAL REPORTING
7.3. PUBLIC INTEREST AND EMERGENCY DISCLOSURE
7.4. INFORMATION TO THE WHISTLEBLOWER
7.5. INFORMATION TO THE DENOUNCED PARTY
7.6. COMPLAINT’S MANAGEMENT PROCEDURE
OTHER MATTERS

At Ignion (hereinafter “the Company”) we are guided by our company values. These values are the foundation of how we conduct ourselves and interact with each other, our clients, partners, suppliers, shareholders and other stakeholders. The Company is committed to ensuring corporate compliance and promoting ethical corporate culture by observing the highest standards of fair dealing, honesty, and integrity in our business activities.

The policy has been put in place to ensure any concerns raised regarding any misconduct or improper state of affairs or circumstances in relation to the Company’s business are dealt with effectively, securely, appropriately, and in accordance with the applicable law, including without limitation the Spanish Law 2/2023, of February 20, regulating the protection of people who report regulatory infractions and fight against corruption (hereinafter altogether referred to as “Whistleblowing Law”).

The purpose of this policy is to outline the Company’s commitment to implementing an Internal Whistleblowing System and Defense of the whistleblower according to Whistleblowing Law.

The Company encourages the reporting of any instances of suspected unethical, illegal, corrupt, fraudulent or undesirable conduct involving the Company’s business and provides protection and measures to individuals who make a disclosure in relation to such conduct without fear of victimization or reprisal.

This policy will be provided to all employees and officers of the Company upon commencement of their employment or engagement and will also be available via Factorial.

The policy is also available to persons outside the organization and can be accessed on the Company website.

The Company may invite officers, senior management and employees to attend training sessions to ensure ongoing education regarding the application of the policy.

These guidelines apply to the Whistleblowing System and Defense of the Whistleblower and include the Whistleblowing Committee.  The Whistleblowing Committee, which is composed of Operations Function, Legal and Compliance Function and the HR Function, has been appointed by Company’s Board of Directors as the “Whistleblowing Committee”, ensuring that the Board of Directors is informed of any Reportable Conducts (as defined below) made within this policy according to Spanish Law 2/2023.

In addition, this policy applies to any person who is, or has been, any of the following with respect to the Company:

• Employee and ex-employee;
• Officer; Director;
• Contractor (including sub-contractors and employees of contractors); Supplier (including employees of suppliers);
• Client;
• Consultant; Auditor; Associate; and
• Relative, dependent, spouse, or dependent of a spouse of any of the above.

This policy is intended to apply to the above persons in all countries in which the Company operates a business. Furthermore, this policy applies to all processes related to employment and training and to any dealing with partners.

The Company’s Board of Directors with the support of Whistleblowing Committee will be responsible for approving, and periodically reviewing and updating this policy.

The Company, within the framework of the information received through the various internal information channels enabled, guarantees the recognition of the following rights to the whistleblowers:

Whoever presents a communication and has identified him/her-self, as well as whoever carries out a public disclosure, has the right to have his/her identity not revealed to third parties not involved in the reception, management, or resolution of the reported events.

At the same time, the Company has the appropriate organizational and technical measures that aim to preserve the identity of the informants, as well as those related to them.

To the extent that the Whistleblowing channel allows the submission of anonymous communications, the organization guarantees that, when these fall within the scope of the material application provided for in Section 3 and 6 of this Policy, the Company will diligently monitor them, and it will not be possible to identify the reporting person.

The Company guarantees the adoption of appropriate technical and organizational measures to preserve the identity of the affected people and the people involved, making it possible for only those people in charge of receiving, managing and/or resolving the incident to have knowledge of the communication.

The Company will also take the following measures to protect one’s identity:

• All paper and electronic documents and other materials relating to disclosures will be stored securely;
• Access to all information relating to a disclosure will be limited to those directly involved in managing and investigating the disclosure.
• Only a restricted number of people who are directly involved in handling and investigating a disclosure will be made aware of his/her identity (subject to their consent) or information that is likely to lead to the person’s identification;
• Communications and documents relating to the investigation of a disclosure will not be sent to an email address or to a printer that can be accessed by other staff and
• Each person who is involved in handling and investigating a disclosure will be reminded about the confidentiality requirements, including that of unauthorized disclosure of one’s identity may be a criminal offence.

If the person is concerned that their identity has been disclosed in relation to a disclosure, and without their consent, they should inform the Whistleblowing Committee or eligible recipient immediately.

If he/she makes a disclosure under this policy, their identity (or any information which would likely to identify them) will only be shared if:

• He/she gives their consent to share that information; or
• The disclosure is allowed or required by law (for example where the concern is raised with a lawyer for the purposes of obtaining legal advice).

In order to recognize the inherent right of defense in favor of any person affected by the content of the received communication, the Company guarantees that the alleged offender will have access to the investigation file, although the Company must not reveal any information that could identify the reporting person.

In accordance with the foregoing and when the affected person so wishes, he or she may present the allegations that he or she deems appropriate, supporting them with the presentation of the evidence/means of proof that he or she could provide in relation to the alleged infringement reported. To do this, you will be advised of the possibility of appearing assisted by a legal advisor.

Thus, the person affected by the communication may be heard at any time during the preliminary analysis and/or instruction phase by the investigator of the report, a body that will respect at all times and under any circumstances the right to the presumption of innocence that corresponds to the person reported.

Only when, through the fulfillment of the guarantees endorsed during the process detailed in the following section, it is proven that the affected person or persons by the communication have committed an offense or a crime, they may be subject to:

• Disciplinary sanction when they are employees or dependents acting on behalf of any of the Ignion Companies.
• Referral of their acts or omissions constituting an offense to the competent authorities for the purpose of initiating the relevant judicial proceedings. Likewise, the Company may also disassociate itself from any legal relationship linking it to the offender.

The affected person has the right to a process without undue delay and with all guarantees. Regardless of this, the organization may adopt certain measures proportionate to the gravity of the facts and adjusted to the applicable regulations in each case.

Given that one of the purposes of this procedure is also to provide adequate protection to whistleblowers (as well as those individuals associated with them) and affected individuals, the Company prohibits any action that constitutes unfavorable treatment that places the aforementioned subjects at a disadvantage compared to others in the context of an employment or professional relationship solely for having reported the possible commission of an offense.

In this sense, the Company will understand retaliatory acts to include, for example:

• Suspension of the employment contract, dismissal, or termination of the employment or statutory relationship, including non-renewal or early termination of a temporary employment contract once the probationary period has been completed.
• Early termination or cancellation of contracts for goods or services.
• Imposition of any disciplinary measure, demotion, or denial of promotions.
• Any substantial modification of working conditions, as well as failure to convert a temporary employment contract into a permanent one if the worker had legitimate expectations of being offered permanent employment.
• Damages that have had reputational and/or economic consequences.
• Coercion, intimidation, harassment, or ostracism (isolation from the business environment).
• Negative evaluations or references regarding work performance or professionalism.
• Inclusion in blacklists or dissemination of information within a certain sector, which makes it difficult or impossible to access employment or contract for works or services.
• Denial or cancellation of a license or permit.
• Denial of training.
• Discrimination, or unfavorable or unfair treatment.

The existence of reprisals will not be perceived when the aforementioned measures are carried out within the regular exercise of management authority under labor legislation due to circumstances, facts, or proven infractions, and unrelated to the submission of the communication.

In any case, any person who has made a communication in bad faith will not have their situation protected by the protective measures implemented by Ignion to protect individuals from possible reprisals.

If it is proven that the information provided or part of it is not truthful or has been modified in whole or in part, this will be immediately deleted from the moment such lack of truthfulness is known. However, the information may be stored when the lack of truthfulness may constitute a criminal offense, for the purpose of processing the corresponding criminal procedure before the judicial authorities.

The Company guarantees the absence of conflicts of interest on the part of the people who must manage the information communicated. To this end, the members of the Whistleblowing Committee will assess the existence of possible conflicts of interest in relation to the reported facts.

In the event that any of the members of the Whistleblowing Committee has a possible conflict of interest, they shall immediately inform the other member and Whistleblowing Committee shall then immediately inform the Board of Directors who appoints a person responsible for managing the report.

A report or communication is defined as a concern communicated anonymously of any suspected unethical, illegal, corrupt, fraudulent or undesirable conduct involving the Company’s business. If the complaints refer to differences of professional opinion in the organizational or operational actions of any area of the business and do not have ethical implications of any kind, they shall be referred to the person responsible for the corresponding area.

Complaints referring to service deficiencies by clients or users shall be sent to the competent area for management, acknowledging receipt.

“Whistleblower” is defined by this policy as a person who reports, to one or more of the parties specified in this policy, an activity that is considered to be illegal, dishonest, unethical, or otherwise improper.

You may make a report or disclosure under this policy if you have reasonable grounds to believe that a Company director, officer, employee, contractor, supplier, consultant, or other person who has business dealings with the Company has engaged in a Reportable Conduct[1].

In this sense, whistleblower can report the allegations of misconduct made within the Company indicated below (“Reportable Conduct”):

• Competence.
• Public procurement.
• Corporation tax.
• Financial interests of the Union (expenses, collection of income and funds).
• Prevention of money laundering / financing of terrorist activities.
• Radiation protection and nuclear safety.
• Environmental protection.
• Consumer protection.
• Protection of personal data and privacy.
• Public health.
• Security of networks and information systems.
• Food safety.
• Transport safety.
• Product safety.
• Sexual harassment (as defined under the Prevention Harassment Protocol).
• Workplace harassment (as defined under the Prevention Harassment Protocol).
• Any serious and/or very serious infringement of administrative and criminal regulations.

Any disclosures that do not fall within the definition of Reportable Conduct, will not qualify for protection under this Policy. It will be at the Committee’s discretion whether it considers there is a reasonable suspicion that the Reportable Conduct is occurring and/or whether the conduct constitutes “misconduct or improper state of affairs” under the Policy.

For the avoidance of doubt, Reportable Conduct does not include personal work-related grievances. A personal work-related grievance is a grievance about any matter in relation to a staff member’s current or former employment, having implications (or tending to have implications) for that person personally and that do not have broader implications for the Company. Examples of personal work-related grievances are as follows:

• An interpersonal conflict between the staff member and another employee.
• A decision relating to the engagement, transfer, or promotion of the staff member.
• A decision relating to the terms and conditions of engagement of the staff member.
• A decision to suspend or terminate the engagement of the staff member, or otherwise to discipline the staff member.

Personal work-related grievances should be reported to your manager or in accordance with the applicable collective bargaining agreement, or the applicable law in each region.

[1] “Reportable Conduct” can also be defined as “allegations of misconduct”.

The Company relies on its employees to maintain a culture of honest and ethical behavior. Accordingly, if you become aware of any Reportable Conduct, you are expected to make a disclosure under this policy.

There are several ways in which you may report or disclose any issue or behavior which you consider to be Reportable Conduct.

In accordance with applicable regulations, the Company has implemented the following whistleblowing channels:

From through Ignion’s website:

A whistleblower can submit a communication of an infringement (Reportable Conduct or complaint) through the Factorial platform via the following link:

https://ignion.factorialhr.es/complaints.

The online channel will be accessible via Ignion´s website.

Whistleblowing allows employees, collaborators, suppliers, partners to anonymously inform of reportable Conduct of which they become aware through the channels mentioned above.

The whistleblowing channel has the appropriate security measures to ensure the protection of personal data, the confidentiality of the whistleblower and guarantees access only to authorized personnel.

Face to face reports

In addition, a report may be made through a face-to-face meeting with any of the members of the Whistleblowing Committee.

In the case of a verbal communication, the conversation may be recorded if the whistleblower authorizes it. Personal data will be processed according to Regulation (EU) 2016/679 of the European Parliament and of the Council, dated April 27, 2016.

On the other hand, and without exclusion, in addition to the internal channels provided by the organization, whistleblowers may make use of the external information channels implemented by national or regional authorities, as well as by the institutions, bodies or agencies of the Union when the alleged infringements may affect the interests of the EU.

However, the internal channels enabled by Ignion are preferred for reporting such violations.

In the cases provided for by art. 28 of Spanish Law 2/2023 and comparable regulations in other jurisdictions that might be applicable, a public disclosure may be made to benefit from the protection and guarantees provided for by law. Therefore, a public disclosure may be made in the following cases:

(a) there has been a first communication through internal and external channels, or directly through an external channel.

(b) there are clear and reasonable grounds to believe that the breach may constitute either an imminent or manifest danger to the public interest, in particular in an emergency situation, or there is a risk of irreversible damage, including a risk to the physical integrity of a person; or, in the case of a communication through an external reporting channel, there is a risk of retaliation or that the information is unlikely to be dealt with effectively due to the particular circumstances of the case, such as the concealment or destruction of evidence, the collusion of a public authority with the perpetrator of the breach, or the involvement of the public authority in the breach.

The Company guarantees the confidentiality and security of the information provided through the Whistleblower managing channel. The Reportable Conducts received through whistleblowing channels shall include at least the following information:

• Acceptance of the whistleblowing Policy.
• Acceptance of the privacy policy.
• Relationship with the company.
• Description of the facts.
• Supporting documentation, if applicable.

The Whistleblowing platform will include an acceptance box to be ticked by the whistleblower confirming that he/she has read and is aware of Ignion’s privacy policy (this clause will be updated from time to time according to the legislation in force).

Once the communication has been sent, the informant shall receive acknowledgement of receipt within a maximum period of seven (7) days.

In order to comply with the obligation to inform the reporter, the reported party shall be informed in accordance with the requirements established in the applicable labor regulations and the penalties regime, of the facts reported against him/her so that it may exercise his/her right of defense.

The Whistleblower Committee may justify, in a reasoned manner, the non-communication of the facts to the reported party at first instance, as it considers that evidence could be concealed, or the investigation could be prejudiced.

If the facts constitute a crime or a serious or very serious infringement or sanction, after analysis by the Whistleblowing Committee, the reported employee will be sent a communication informing of the report made and the data processing regime, personally and before the Head of Human Resources, his/her immediate superior or any colleague who agrees to act as witness, informing him/her of the report made and the data processing regime.

The accused shall be informed of his/her rights and obligations:

• The denounced may have access to the investigation and his/her active intervention in the investigation procedure by proposing the evidence he considers.
• The respondent is expressly prohibited from deleting or modifying documents or data of any kind in his/her possession or in the possession of third parties, whether in physical or electronic format.
• The respondent is expressly prohibited from contacting internal or external Ignion personnel to discuss any matters related to the ongoing investigation, with the express obligation to maintain confidentiality. Without prejudice to the outcome of the investigations, the violation by the employee of the precautions warned in this report will give rise, where appropriate, to the corresponding disciplinary measures, without prejudice to the filing of the appropriate complaint with the Security Forces, the Public Prosecutor’s Office or the corresponding Court of Investigation, for the destruction of evidence in the most serious case.
• The accused will be required to hand over the computer, external memories, internal and removable hard disks, cell phone or any other device owned by the company that has been provided to him/her.
• The complainant will be informed that he/she is provided with paid leave and will always remain at the disposal of Ignion depending on the facts that are the subject of the complaint.
• The reported person will be informed that an investigation is being carried out into the unlawful or illegal acts of which he/she may be accused. As soon as possible, he/she shall be informed of the facts under investigation and shall ensure that his/her rights of defense and presumption of innocence are legitimately respected.
• The reported person will be informed that his/her data has been obtained through Whistleblowing, the purpose of which is to investigate, process and resolve the complaints received. Only if necessary for the purpose of investigation, processing and/or resolution, the information may be disclosed to third parties in compliance with the appropriate legal obligations.
• The reported party may exercise their rights of access, rectification, suppression, limitation of processing and opposition, by sending a document with the reference “Data Protection”, specifying the corresponding request to the following email address: yourdata@ignion.io.

The personal data obtained and/or generated as a result of the operation of Whistleblowing shall be eliminated from said system within a period not exceeding three (3) months from the incorporation of such data therein, unless the reported facts are of criminal relevance, in which case they may be kept as evidence of the operation of the Criminal Compliance Management System, always anonymizing those data that are not necessary for such purpose.

Complaints that have not been followed up may only be recorded in anonymized form in the whistleblowing system.

If, after the three-month period has elapsed, the investigation of the complaint has not been concluded, the personal data may continue to be processed by the authority responsible for the investigation but must be deleted from the whistleblowing system itself.

Custody of the physical documents is entrusted to the Whistleblowing Committee.

If the reported facts constitute an infringement, the investigation procedure shall be initiated, offering the persons under investigation all the guarantees and constitutional rights, sending them the aforementioned information through which their full and complete cooperation is required, with the possibility of even benefiting from a certain leniency program.

The opening of the investigation procedure entails the implementation of all the Company’s mechanisms for the clarification of the facts, and all employees are obliged to collaborate with Whistleblowing Committee of Ignion, whenever it so requires.

The Whistleblowing Committee shall be responsible for receiving and assessing reports received through the Communication Channels. However, other areas of the company could also be involved in the evaluation and will participate in the investigation of complaints that may lead to breaches of internal regulations and the imposition of labor sanctions.

During this phase a risk level will be assigned to each report, which may be: LOW, MEDIUM, HIGH or CRITICAL,

Once the complaint has been received, the person making the complaint shall receive acknowledgement within a maximum of seven (7) days and it shall be immediately analyzed and verified.

The Whistleblowing Committee, after analyzing and verifying the complaint, may:

• Not admit the complaint: if it does not consider the conduct or the fact that could lead to breaches of internal regulations with criminal amplifications.
• Admit the complaint: if it considers that the conduct or the fact could lead to breaches of internal regulations with criminal repercussions.

All open proceedings shall constitute a file which shall be duly classified and kept in safe custody.

The Whistleblowing Committee shall draw up a timetable for the investigation of the procedure, which may not exceed three (3) months from receipt of the complaint, and the corresponding documentation shall be collected, and statements shall be taken from those involved in the communication (informant, witnesses, the reported party), and minutes shall be drawn up.

The statements shall be put in writing, and recorded on audiovisual support, if possible, and signed by the person under investigation, who may also propose the evidence he/she considers appropriate for his/her best possible defense and if needed in accordance with applicable law, can also be assisted by a lawyer. In accordance with national laws, the person concerned has the right to access data concerning him/her and the right to request its rectification or erasure. The subject of the data may not contain information about third parties, such as the identity of the person who made the communication, based on these access rights.

Exceptionally, due to the complexity of the investigation, the time limit may be extended to six (6) months.

The procedure for obtaining evidence by the Whistleblowing Committee shall be carried out in accordance with the law and shall be set out in a written report.

Once all the evidence has been obtained, and in any case, within three (3) months from the start of the investigation, the Whistleblowing Committee shall conduct the necessary interviews to reach a conclusion, among them:

• To the complainant.
• To the accused, so that he/she may provide the evidence in his/her defense that he/she deems appropriate.
• Witnesses.

Once the investigation has concluded, the Whistleblowing Committee shall draw up a final report with a proposed resolution for approval within a maximum period of three (3) months from the date on which the communication entered the Whistleblowing Channel, in which the following actions shall be proposed.

• Archive of the file.
• Evaluation of compliance with external or internal regulations (if necessary, with the support of the External Compliance Officer) for the correction of non-compliant procedures, and if appropriate, the opening of disciplinary proceedings (by Human Resources) for the imposition of one of the sanctions provided for in the sanctioning regime of the applicable labor agreement.
• Immediate transfer to the corresponding police or judicial authorities, without prejudice to the intervention of the Public Prosecutor’s Office in those cases where it is considered that the facts constitute a criminal offence.

• False complaint: If it appears from the investigation that the facts reported are false, and that they were committed by the complainant knowing them to be false and for spurious motives, the complainant shall be sanctioned.
• True complaint: If the investigation establishes that the facts are true and the person responsible can be identified, appropriate measures will be taken on the complainant.
• Complaint that does not identify the offending party: If the investigation has established the veracity of the facts, but the person responsible for them cannot be determined, the Whistleblowing Committee shall inform the corresponding Department of the situation. Once all possible investigative actions have been carried out, and the offender has not been identified, the file shall be registered and archived.

The typology of penalties shall in all cases coincide with the applicable Collective Bargaining Agreement, or the applicable law in each region, with the aim of respecting workers’ rights and social peace as far as possible.

In any case, if the result of the investigation concludes that the accused has perpetrated an unlawful act for which the company may be criminally liable, the result of the report shall be brought to the attention of the State Security Forces and Corps, taking immediate precautionary disciplinary measures.

Any breach of this policy will be taken seriously and may result in disciplinary action, up to and including termination of employment.

In so far as this policy imposes any obligations on the Company, those obligations are not contractual and do not give rise to any contractual rights. To the extent that this policy describes benefits and entitlements for employees, they are discretionary in nature and are also not intended to be contractual. The terms and conditions of employment that are intended to be contractual are set out in an employee’s written employment contract.

The Company may unilaterally introduce, vary, remove, or replace this policy at any time.

Employees are encouraged to read this policy in conjunction with other relevant Company policies.