Whistleblowing Channel

At MAF Auditores, S.L.P., we understand that trust is the foundation of our work as auditors. Therefore, we maintain a firm commitment to regulatory compliance, professional integrity, independence, and respect for the ethical principles that govern our activity.

We promote an internal culture focused on the prevention and early detection of irregularities, encouraging transparency, responsibility, and respect in the workplace. We also ensure that anyone connected to our organization can safely and confidentially report conduct that may be contrary to the law or our values.

To this end, we provide employees and individuals connected to our activity with an internal reporting or whistleblowing channel, secure and confidential, to identify and correct potential irregularities in a timely manner, improve our controls, and protect both those who report in good faith and the rights of all individuals involved.

Through this channel, we comply with the requirements established by Law 2/2023 of February 20, regulating the protection of persons who report regulatory infringements and combating corruption, as well as Directive (EU) 2019/1937 of October 23, 2019, on the protection of persons who report breaches of Union law.

Who can use this channel?

In accordance with Law 2/2023 of February 20, the following persons who have obtained information about infringements in a work-related or professional context may use this channel:

• Any employee of MAF Auditores, S.L.P., whether employed or self-employed, including interns and trainees, regardless of whether they receive remuneration, whether the employment relationship has not yet started or has already ended.
• Shareholders and members of the administrative, management, or supervisory bodies of our firm, including non-executive members.
• Any person working under the supervision and direction of suppliers, contractors, and subcontractors of the organization who, within a work, commercial, or professional context, has become aware of infringements, irregularities, or non-compliance.
• Any other person who has held or is going to hold any of the positions described in this section.

Additionally, clients of our firm may also use this channel, even though they are not expressly included in Law 2/2023, particularly when communications relate to a lack of integrity, ethics, or independence of our employees in the provision of services. In such cases, the protection regime of Law 2/2023 will apply provided that the conditions within its subjective and material scope are met.

What is this channel intended for?

This channel is intended for communications regarding facts that may constitute:

• Actions or omissions that may constitute breaches of European Union law.
• Actions or omissions that may constitute criminal offenses in Spain.
• Actions or omissions that may constitute serious or very serious administrative offenses in Spain.

All of the above within the scope defined by Law 2/2023.

This channel is not intended for commercial complaints, service claims, or ordinary labor issues, which should be processed through the usual channels, unless the facts fall within the scope described above.

How to submit a report?

You can access the Whistleblowing Channel through the link available at the bottom of this page, which connects to a secure and confidential external platform where your communications will be recorded, ensuring confidentiality and integrity at all times.

To access the reporting form in the Ethical Channel for Complaints, Information, and Communications, you must first accept the Privacy Policy.

The channel allows reports to be submitted in writing or verbally. In the latter case, the reporting person may attach an audio file containing their statement. Upon request, reports may also be submitted through an in-person meeting. The time and place of such meetings will be coordinated with the reporting individuals. Verbal communications made during in-person meetings will be documented through recording, subject to the prior consent of the reporting person.

Once you have submitted your report, you will be able to track its progress using the automatically generated access password.

What information should I provide when making a report?

In order to assess a report, it should include:

• Identification details of the reporting person, unless anonymity is chosen.
• If known, identification details of the person or persons involved in the reported incident.
• A description of the reported facts, specifying as much as possible the alleged breach of regulations, the date, the persons involved, and any witnesses.
• Any available evidence supporting the reported facts.

Confidentiality

MAF Auditores uses the services of an external provider responsible for maintaining the platform used for receiving and sending communications. The platform is designed to preserve the confidentiality of the information submitted and allows anonymous reporting if desired.

The confidentiality of the Reporting Person, the communications received, the investigation carried out, and the persons affected or under investigation (the Affected Person) will be maintained. In particular, the identity of the reporting person will not be disclosed to the Affected Person. The identity may only be disclosed, where appropriate, to competent authorities when required by Law 2/2023 and with the legally established safeguards.

All internal investigations will be carried out with due respect for the rights of both the Reporting Person and the Affected Person.

Although the identity of the reporting person will be treated with enhanced confidentiality and will not be disclosed except in legally предусмотренные cases, it should be noted that during the processing and investigation of a report, it may be necessary to disclose certain facts, circumstances, and/or evidence to the affected or investigated persons to guarantee their right of defense and proper case management. Consequently, even if the firm does not disclose the identity of the reporting person, it may become apparent during the investigation, as the content, context, or level of detail provided could allow others to reasonably infer the identity. The firm will take measures to minimize this risk as far as possible.

All internal investigations will be carried out with due respect for the rights of both the Reporting Person and the Affected Person.

The person using the channel may submit the report anonymously. If you choose to do so, do not include any personal data that could identify you, such as your name, surname, corporate email address, postal address, or the nature of your relationship with our firm or with the individuals mentioned in your report.

Protection against retaliation and discrimination

All reporting persons covered by Law 2/2023 who report infringements or irregularities within its scope will benefit from the protection regime established therein, provided they have reasonable grounds to believe that the information is true.

MAF Auditores is committed to ensuring that no person who reports a concern in good faith under this policy suffers any disadvantage as a result of making such a report, regardless of whether the reported issue is ultimately proven. They will not be sanctioned or suffer any negative consequences or retaliation, nor threats or attempts thereof, for making a report or for refusing to comply with instructions contrary to the law.

This guarantee of protection against retaliation extends to individuals or legal entities associated with the Reporting Person, individuals who assist them during the reporting process, and employee representatives acting in their advisory and support roles.

If a person believes they are being discriminated against or harmed as a result of reporting a case or assisting in an investigation under this policy, they must report it immediately so that appropriate protective measures can be taken.

Protection measures will not apply to individuals who report in bad faith, provide false or unfounded information, base their report on rumors, disclose publicly available information, or obtain information unlawfully. Nor will they apply to reports related to interpersonal conflicts that only affect the reporting person and the individuals mentioned, which should not be reported through this channel.

Data protection

Personal data provided through this channel will be processed in accordance with Law 2/2023, Regulation (EU) 2016/679 (GDPR), and Organic Law 3/2018 (LOPDGDD), for legitimate and specific purposes related to the processing and investigation arising from the report. Data will not be used for incompatible purposes and will be adequate, relevant, and limited to what is necessary.

Only data and information that are relevant and necessary to manage and process the communications received and, where applicable, investigate the reported facts will be processed. Data that is not clearly relevant will be deleted without delay, without prejudice to information that may be retained to support legal actions arising from criminal offenses or false reports.

Access to personal data provided by reporting persons will be limited to the system manager, those directly responsible for handling it, and other persons authorized under Law 2/2023.

External reporting channel

This internal reporting channel is the recommended means for reporting actions or omissions covered by Law 2/2023, provided that the infringement can be effectively addressed and the reporting person believes there is no risk of retaliation.

However, there are other external and independent channels available to submit a report, either directly or after first using this internal channel. In this regard, reports may be submitted to the Independent Authority for the Protection of Whistleblowers (A.A.I.).

On the website of the Independent Authority for the Protection of Whistleblowers (A.A.I.), you can find more information about other external reporting channels.

Responsible use of the channel

All communications made through this channel must be submitted in good faith, with a truthful account based on the available knowledge, and based on information obtained within the framework of a work or professional relationship with our firm. Misuse of the channel, as well as deliberately false reports or those based on unlawfully obtained information, may result in disciplinary measures and, where appropriate, legal action.