Insud Pharma S.L. (hereinafter, the "Company"), as a responsible corporate citizen, is committed to managing its affairs with the highest ethical standards, integrity and honesty and always in compliance with its Code of Ethics, ABC Book, as well as with the rest of its policies.
To help respect your commitment, any illegal, unethical, or inappropriate behavior within the Company is advised to be reported. If you observe or suspect any breach of the Code of Ethics or other corporate policies, or if you have complaints related to other regulatory, legal, or ethical issues, you may inform your supervisor, the HR department or the Compliance and Internal Audit Committee.
If you do not feel confident about where to go with these types of issues, if you do not feel comfortable reporting through the usual communication channels or if you have reported through the usual channels without receiving an effective response, you can always access the dIrectLine.
HOW DOES IT WORK? ACCESS?
dIrectLine is a whistleblowing channel:
- Internal: available to employees
- External: for third parties outside the company.
dIrectLine is an alternative communication channel, which will put you in direct contact with the Compliance and Internal Audit Committee.
dIrectLine operates 24 hours a day, seven days a week, and has been designed to protect our confidentiality.
dIrectLine offers the possibility to inform through:
In both ways, the reports will be treated with confidentiality, independence, seriousness and speed.
WHAT TO REPORT ON?
dIrectLine should be used to communicate any possible breach of the law, regulations, Code of Ethics or corporate policies.
- dIrectLine must be used in good faith The Company will protect the person using dIrectLine against any form of retaliation.
- Retaliation is defined as any "negative action" such as: dismissal, temporary suspension, blacklisting, demotion, denial of overtime or promotion, imposition of disciplinary measures, denial of benefits, failure to hire or renew contract, intimidation/harassment, threats, relocation affecting promotion possibilities or salary reduction.
- Conducting malicious communications through dIrectLine, or intentionally making a false notification, may result in disciplinary action.
- dIrectLine ensures the possibility of making anonymous complaints. However, if you prefer, you can identify yourself and provide your contact details when using dIrectLine.
- The Company will guarantee both the confidentiality of the identity and the respect of anonymity at the choice of the informant. The investigation and processing of anonymous complaints will have the same guarantees as nominative complaints, respecting in both cases the provisions of this Policy and current regulations.
- If you provide your contact details through dIrectLine the Company may contact you if necessary to follow up on the complaint, investigate the facts reported and properly analyze the situation. Your data and identity will be kept confidential at all times and will not be communicated to the people to whom the facts refer, nor to third parties outside the group responsible for the investigation.
- If you report anonymously, the Company may request your identification if necessary for compliance with a legal obligation or to respond to a court request. In these cases, the Company will also guarantee the protection and confidentiality of your identity and the absence of retaliation as indicated in this Policy.
- All communications made through dIrectLine will be treated with the strictest confidentiality. It is also recommended that you keep your report confidential. The identity of the persons using dIrectLine, and of any third party mentioned in the communication, will always be kept confidential within the Compliance and Internal Audit Committee and a very small group of persons appointed by it for the management and investigation of the related facts.
- Other compliance bodies (whether global or national) may need to be involved to support the Compliance and Internal Audit Committee (CAC) in its investigations.
- Notwithstanding the foregoing, and as a result of the investigation or inquiries carried out in relation to a report received on the dIrectLine, if the CAC considers that there is a breach of applicable law, the Company reserves the right (or may be obliged, under such legislation) to provide the authorities with all the information they need, including the identity of the persons involved.
- The person who knows of the existence of possible irregularities, improper acts and / or behaviors contrary to current legislation and / or internal regulations must report it immediately.
- Upon receipt of the complaint form, the Compliance Committee will decide whether to process the complaint or file it.
- The communication with the Complainant, in case of having provided their contact information, will be done by the same means by which the complaint letter would have been received.
- The following are grounds for filing the complaint:
- That the complaint is not formalized through the appropriate form or that, despite being formalized through said form, it does not contain the minimum contents and information requested in said form;
- That the complaint responds to facts that are not directly related to the activity of the defendant and / or the Company;
- That the facts denounced have been denounced, in turn, before any judicial or arbitral body or before any administrative authority whose competences include investigating the facts, legally qualifying them and / or attributing legal consequences to them. The closure of the file for this reason may be decided by the Complaints Committee at any time, as soon as it becomes aware of the concurrence of the same.
- The Complaints Committee may, prior to the decision to process or file the complaint, collect any information it deems necessary or appropriate for its prior assessment.
- Action and research:
- The Compliance Committee, once it has obtained all the relevant information from the Complainant on the facts denounced, if it considers that there are reasonable indications of the existence of possible irregularities, improper acts and / or behaviors contrary to current legislation and / or the internal regulations of the Company, will initiate an investigation procedure.
- Once the investigation file has been examined, the Compliance Committee will issue a report of conclusions containing a clear list of the facts, decisions and recommendations.
- The report will avoid all those mentions that allow the identification of the Complainant and the denounced, as well as the specific workplace in which the facts under analysis have been developed.
- The Compliance Committee will guarantee at all times the confidentiality of the investigation and its content, as well as the confidentiality of the people involved in the investigation.
- The report must be completed, as far as possible, within three (3) months of receipt of the complaint, or (6) months in the case of a particularly complex investigation.
- If the Compliance Committee considers that the facts reported do not constitute an irregularity, improper act and/or behaviour contrary to current legislation and/or the Company's internal regulations, it will proceed to dismiss the complaint, archiving the case.
- The Compliance Committee will inform the Complainant about the measures taken and if the facts could constitute a crime, they will be reported to the Police, the Prosecutor's Office or the Investigating Judge, suspending at that time any investigation initiated.
PROTECTION OF PERSONAL DATA
Who is responsible for processing your data and what personal data may we collect and process from you?
- The personal data that we may process about you are those that, voluntarily, you can provide through the corresponding dIrectLine form or include in your communication, as well as those that may be collected during the investigation.
- In the event that the communication contains specially protected data (i.e. health data), the Company will proceed to its immediate deletion, without being subject to registration or processing.
- The Company guarantees, on the occasion of the processing of personal data that may take place as a result of the execution of the provisions of this document, that it will act with full subjection and respect for the regulations on the protection of personal data.
- In this sense, the Company undertakes that the personal data collected through the dIrectLine, and therefore, subject to processing, will be limited to those strictly necessary to investigate the facts communicated, thus ensuring that the data subject to treatment are adequate, relevant and not excessive in relation to the scope and purposes determined, explicit and legitimate for which they have been obtained and which are those detailed in this document.
- In accordance with the provisions of Organic Law 3/2018, of December 5, on the protection of personal dataand guarantee of digital rights, the data provided or those generated as a result of the use of the dIrectLine, will be incorporated into a file called "DirectLine" owned and under the responsibility of Insud Pharma S.L. with address at C / Manuel Pombo Angulo 28, 28050-Madrid (Spain), and will be treated solely and exclusively for the management of communications made through the dIrectLine and the investigation of the facts object of communication in accordance with the provisions of this document.
- The Complainant and the person to whom the facts refer, as holders of the personal data that may be collected, may exercise the rights of access, rectification, opposition, deletion, portability or limitation by writing to Insud Pharma S.L. at the address indicated above or by sending an email to: firstname.lastname@example.org
- In the event that the person to whom the reported facts refer exercises their right of opposition, the Company may reject their request when there are compelling reasons that legitimize continuing with the processing of their data within the framework of the investigation.
- The CAC will communicate to those persons whose behavior has been reported as inappropriate, this circumstance as soon as the situation allows it and, in any case, within a maximum period of 3 months from when the alleged breach was notified. Persons who have been informed may always raise any questions about it and present any arguments in their defence that they consider necessary. Notwithstanding the foregoing, in no case may the person about whom information has been informed have access to the data of the person who has carried out the communication through the dIrectLine nor, therefore, will be able to identify him.
- The personal data that you may provide when you send a query through Directline will be kept for the period necessary to resolve it and, in any case, one year from receipt. After this period, they will remain duly blocked, until the prescription of the possible legal actions involved.
- The personal data that you may provide when you send a report through Directline will be kept for the time necessary to decide whether an investigation should be initiated and will be deleted in any case, 3 months after its introduction, unless its anonymized conservation is necessary to leave evidence of the operation of Insud Pharma's crime prevention model.
- Without prejudice to the fact that the data must be deleted from the whistleblowing channel, or other possible internal reporting systems, the data may continue to be processed by the relevant body when necessary for the adoption of disciplinary measures or for the conduct of judicial proceedings.
- You can report on dIrectLine in any language. The questions on the website appear mainly in English and Spanish, but if you need help you can ask the CAC to appoint a translator.
- If a violation of the Code of Ethics or corporate policies is demonstrated, the Human Resources department will be informed of the corresponding disciplinary measures in accordance with the applicable formalities in the relevant jurisdiction.