controller: GRUPO OSBORNE S.A.U, NIF: A-11535564, Postal Address: C/ Fernán Caballero 7, 11500, El Puerto de Santa María (Cádiz), email for the exercise of rights related to the processing of personal data: [email protected] Purpose: To fulfill the business duty of surveillance and control for the prevention of crimes, compliance with the ethical culture of the organization and investigation of the facts reported through the internal system of complaints. Legitimation of treatment: We process data obtained through internal channels enabled by virtue of compliance with a legal obligation (established in the Whistleblower Protection Act), in accordance with article 6.1.c) of the General Data Protection Regulation (hereinafter, RGPD). In the event that in the communication submitted or in the processing of the communication there are special categories of data for reasons of essential public interest (for example, because the reported action or omission relates to conduct that compromises this type), the processing of such data will be carried out in accordance with the provisions of article 9.2.g) GDPR. If there are no essential public interest reasons, such special category data will be deleted immediately, without their registration and processing. In addition, personal data will be processed and, where appropriate, communicated to third parties as necessary for the formulation, exercise or defense of claims or when the courts act in the exercise of their judicial function, in accordance with 9.2.f) RGPD. Recipients: Personal data will not be transferred unless it is necessary in compliance with an established legally applicable obligation in the field of this treatment or to support the service. Specifically, data that are subject to processing in the Internal Information System may be processed by other people or communicated to third parties when necessary for the adoption of corrective measures in the entity or the processing of appropriate sanctioning or criminal proceedings. They may also be processed by the data processors who provide the information technology services that support the Internal Information System, on behalf of OSBORNE as Data Controller. Conservation: The data will be kept for the time necessary to decide on the appropriateness of initiating an investigation into the reported events. In any case, three months have elapsed from the receipt of the communication without initiating investigative actions, it will be deleted, unless it is necessary to leave evidence of the operation of the system, in which case the communications will be recorded in an anonymized form. If their conservation is necessary to continue the investigation, they may continue to be treated in an environment other than the area covered by the investigation, and may be treated by the internal body responsible for compliance and ethics control for the investigation of the facts reported and then integrated into the systems of the regulatory compliance body or the one in which it is responsible for the management of the company's human resources. If it is established that the information provided or part of it is not true, it will be immediately deleted as soon as this circumstance is known, unless such lack of veracity may constitute a criminal offence, in which case the information will be kept for the time necessary during the judicial procedure. Under no circumstances will the data be kept for a period longer than ten years. Rights: You can exercise your rights relating to the processing of your personal data by sending an email to the address [email protected] Security: The data will be treated confidentially and subject to appropriate technical and organizational security measures to prevent its alteration, loss, treatment