Introduction

Ethics are the moral principles that govern behaviour.

We take great pride in the contribution we make and the way that we conduct our business. We appreciate that our behaviour defines our reputation. As a result, our parent company, CLECE S.A. has introduced an ethical reporting channel, Navex, to assist with the effective management of compliance and whistleblowing matters and to reflect our commitment to acting ethically and in compliance with legislative and regulatory requirements. Together with the assistance of our framework of policies we seek to ensure we continue to meet the high standards expected of us as an industry leader.

The objective of the Ethics Channel is to provide an alternative channel to receive and effectively process notifications regarding any conduct or behaviour of concern that you do not consider you can report elsewhere or in accordance with our complaints or whistleblowing process or other channels.

This channel does not replace any of our existing processes, channels or reporting lines for complaints or whistleblowing. It simply provides an alternative channel for reporting where you do not consider existing reporting channels are appropriate.

This channel is open to all stakeholders and interested parties.

This Channel along with its internal investigation and response procedure, is aimed at guaranteeing impartiality, professionalism, confidentiality and maximum protection during the process to create a climate of confidence for the parties concerned. 

The Group wishes to assure all stakeholders and interested parties that it is safe and acceptable to speak up about any concerns they may have. This channel is designed to enable you to raise any concerns at an early stage.

The Ethics Channel also allows reports to be submitted anonymously although we encourage you to provide your details to enable us to follow up with you. However your concern is reported, we seek to investigate the matter confidentially, protecting the identity of the parties involved as far as possible, as well as the related information provided.

Please see the bottom of this document for details of how to access our Ethics Channel.

What happens when reporting through Navex?

1. We use a secure management server for Ethics Channel cases, to support administration in line with legislative requirements. Reports through this channel are saved directly on the server, which is extremely secure.
2. The server allows you to:
   1. To specify the place, date, company affected, as well as the persons related to the report.
   2. To opt for anonymous communication.
   3. To attach supporting documentation.

3. The server shall provide you with a case number, as well as an exclusive use password to obtain comments and/or updates on your report. It also allows you to provide additional information to amend or update your report.
4. We shall acknowledge receipt within seven days.
5. Once acknowledged and if you identified yourself, we may contact you directly to report back with any questions or updates.
6. An investigation shall be commenced pursuant to the appropriate internal procedure established for the purpose in question.
7. We shall seek to conclude our investigations within a reasonable period and in accordance with that procedure but not exceeding three months from acknowledgement of receipt, but which may be extended to six months in cases which are particularly complex or involved.
8. We shall provide you, as far as possible, the outcome of our investigation so far as we are able. In some cases however and for security reasons or for the integrity of the investigation or for the confidentiality of others, there may be limitations regarding updates or outcome that we can provide.

Data Protection & Privacy via Navex

9. It is important to emphasise that the server only transfers the reports to specific persons who are authorised to manage them. Likewise, the internal team that handles the documents produced receives training on how to manage the documents and reports effectively, as well as the way to assure their confidentiality.
10. Your personal data is protected. We undertake to maintain strict protection of privacy, security as set out in our privacy policies as published on our web.

Who are the receivers of my personal data if I submit a report?

11. The personal data recorded in the context of a report made, including the alternative reporting channels, may be processed or communicated to the following parties when necessary:
    1. Navex Global, Inc., the independent third party that manages the alternative reporting channels, as processing manager.
    2. Members of the Compliance Technical Unit, as well as the Compliance Committee.
    3. Authorised representatives who intervene in the investigation, if the nature or scope of the facts reported requires their participation.
    4. Investigators, advisors or consultants instructed to support us with the matter.
    5. The police and/or other regulatory bodies, or as otherwise required by law.

What is the legal basis for processing my personal data?

12. We process your personal data within the setting of the ethics channel in accordance with our legal obligations, legitimate interests and on the basis of substantial public interest under Article 6 and 9 of the General Data Protection Regulations, as well as to detect and prevent complaints and thus to prevent damage and risks for which we are liable. Thus, the processing of personal data is strictly necessary to comply with the aforementioned legal aims and obligations. Under no circumstances do we perform automated decisions based on the data submitted.

Purpose for which we processes the personal data

13. At all times, only the strictly necessary personal data shall be processed in order to manage, process and investigate your concerns and to carry out the necessary actions including, where appropriate, adoption of the relevant disciplinary or legal measures. The personal data shall not be used for a purpose other than that stated.

Personal data collected

14. In processing the reports made pursuant to this Policy, we collect the following personal data and information provided when submitting a report and throughout its investigation:
    1. Name and contact data (unless reported anonymously).
    2. Name and other personal data of the persons mentioned in the report, if that information is provided (that is, description of the functions and contact data).
    3. Any data or information included in the report that may identify a specific person.

Data Retention

15. We shall keep a register of all the reports received. These records and the personal data they contain shall be kept confidentially.
16. The records shall be kept for as long as necessary to meet our legal obligations.
17. In all cases, the personal data shall be deleted from the Ethics Channel within the maximum term of three (3) months from being input, except if conserved for an additional term due to being necessary to fulfil the legal and corporate obligations.