1. PURPOSE

BLUE TECH ZONE, in order to comply with its implemented Internal Information System - hereinafter referred to as ‘the System’ or ‘IIS’ - as well as with Law 2/2023 of 20 February, regulating the protection of persons who report breaches of regulations and the fight against corruption - hereinafter Law 2/2023 - has proceeded to set up an Information Channel so that all individuals within the personal scope of the aforementioned IIS can report the existence of breaches or conduct contrary to the rules contained within the material scope of the organisation's IIS.

Consequently, the purpose of this protocol is to regulate the functioning of the Information Channel, as well as the management and processing of the communications received and the investigation procedures that must be initiated, where appropriate.

BLUE TECH ZONE is a trademark of COSTA BELLVER, S.A. (A12102703) and operates under the regulation and framework of SII de FOMENTO URBANO DE CASTELLÓN, S.A.

2. SCOPE OF APLICATION

Material scope

The Information Channel enabled in BLUE TECH ZONE allows communications in relation to the matters described below, in compliance with Law 2/2023, as well as Law 10/2010, of 28 April, on the Prevention of Money Laundering and the Financing of Terrorism, as it is considered an obliged subject of this Law.

a) Law 2/2023:

§ Under this law, acts or omissions may be considered violations of European Union law if they meet one or more of the following criteria:

1. They fall within the scope of EU acts listed in the Annex to Directive (EU) 2019/1937, which protects individuals reporting breaches of Union law, regardless of how such breaches are classified in national law.

2. They impact the financial interests of the European Union, as outlined in Article 325 of the Treaty on the Functioning of the EU (TFEU).

3.     They affect the internal market, as referred to in Article 26(2) TFEU, including infringements of EU competition rules and aid granted by States, as well as infringements relating to the internal market in relation to acts infringing the corporate tax rules or practices intended to obtain a tax advantage that would defeat the object or purpose of the corporate tax legislation.

§ Actions or omissions that may constitute a serious or very serious criminal or administrative offence.

§ Infringements of labour law in matters of health and safety at work.

b) Law 10/2010:

§ Any infringement of the provisions contained in the current Law on the Prevention of Money Laundering and the Financing of Terrorism.

c) Criminal Compliance:

§ Any criminal offence that may entail criminal liability of the legal entity, as established in article 31.bis of the Spanish Criminal Code, as well as of the Criminal Compliance Management System of BLUE TECH ZONE.

d) Prevention of sexual and gender-based harassment:

§ Any action contrary to the current regulations on sexual harassment and for reasons of sex (Organic Law 3/2007, for the effective equality of women and men, article 48), as well as the provisions of BLUE TECH ZONE's Protocol for the prevention and tackling of sexual and gender-based harassment.

Personal scope

The protection established under Law 2/2023, as well as the regulations outlined in this document, applies to the following whistleblowers:

1. Individuals working in the private or public sector who have obtained information about violations in a work or professional context, including:

a. Public employees or other workers

b. self-employed individuals;

c. shareholders, unit holders, and members of a company’s administrative, management, or supervisory bodies, including non-executive members

d. anyone working for or under the supervision and direction of contractors, subcontractors, or suppliers.

2. Whistleblowers who report or publicly disclose information about violations obtained within the framework of an employment or statutory relationship that has already ended, including volunteers, trainees, and interns—whether or not they receive remuneration—as well as individuals whose employment relationship has not yet begun, when the information on violations was obtained during the selection process or pre-contractual negotiations.

3. Legal representatives of employees in the performance of their duties to advise and support the whistleblower.

4. Protective measures for whistleblowers shall apply, where appropriate, to:

a. individuals who, within the organization where the whistleblower provides services, assist them in the reporting process.

b. natural persons who are related to the reporting person and who may suffer retaliation, such as colleagues or relatives of the reporting person, and

c. Legal entities for which the whistleblower works, with which they have any other employment-related relationship, or in which they hold a significant shareholding. For these purposes, a capital or voting rights interest in shares or participations is considered significant when, due to its proportion, it grants the holder the capacity to influence the legal entity.

3. PERMITTED REPORTING CHANNELS

In compliance with Law 2/2023, BLUE TECH ZONE has established the following reporting channels:

Internal channel (publicly accessible): Via the online reporting tool Ovet-Auki. Managed externally.

External channel: Independent Whistleblower Protection Authority.

Public disclosure

Postal mail: Managed internally.

Face-to-face interview: Managed internally.

Telephone: Managed internally.

INTERNAL CHANNEL

BLUE TECH ZONE has launched an online reporting tool called OVET AUKI, accessible to anyone via the following link: https://www.ovetauki.com/canal/grupo-fomento.

This channel is externally managed by the legal experts at TARINAS VILADRICH ADVOCATS I PROCURADORS, SLP and allows informants to choose between anonymous or confidential submissions.

How it works

The access to the information channel is done through the link https://www.ovetauki.com/canal/grupo-fomento, and it is available 24/7, from any device, all year round

Informants must follow the platform’s guided steps to submit a report, 

providing as much detail as possible, as well as attach all the evidence available, always with the aim of facilitating the subsequent investigation procedure, where appropriate.

The OVET AUKI Information Channel User Manual, attached as Annex I to this protocol, is available for reference.

During the final stage of the reporting process, the informant must explicitly choose whether they want the report to be confidential—allowing their identity to be known—or anonymous. If opting for anonymity, the informant must securely retain the communication code generated during submission. This code is required to access the OVET AUKI platform later, check the report's status, or contact channel administrators or the organization.

All details are thoroughly outlined in the OVET AUKI Information Channel User Manual.

For any questions or technical issues, you can contact the platform's support team at soporte@ovetauki.com.

EXTERNAL CHANNEL

Any individual may report to the relevant Independent Authority for the Protection of Whistleblowers. In the Valencian Community, the Agency for the Prevention and Fight against Fraud and Corruption (AVAF) is the competent authority for handling such reports. Reports can be submitted via the following link: https://www.antifraucv.es/buzon-de-denuncias-2/

PUBLIC DISCLOSURE

Public disclosure shall be understood to mean the making available to the public of information about actions or omissions provided for in Article 2 of Law 2/2023.

Individuals shall be protected provided that one of the following conditions is met:

(a) That prior to public disclosure he/she has made a communication through the above channels (internal, public and/or external), without appropriate measures within the maximum time limit set (3 months).

(b) there are reasonable grounds to believe that either the breach may constitute an imminent or manifest danger to the public interest, in particular where there is an emergency situation, or there is a risk of irreversible damage, including a danger to the physical integrity of a person; or, in the case of communication through the external reporting channel, there is a risk of retaliation or there is a low likelihood of affective treatment of the information due to the particular circumstances of the case, such as concealment, destruction of evidence, collusion of an authority with the perpetrator of the offence, or involvement in the offence.

The protection conditions outlined in the previous paragraph do not apply if the person has disclosed information directly to the press, exercising their right to freedom of expression and truthful reporting as established in the Constitution and relevant legislation.

POSTAL MAIL

Written communications may be sent by post to the following address:

BLUE TECH ZONE DE CASTELLÓN, S.A.

For the attention of Ms. Laura Moya Pascual

(Head of the Internal Information System)

C/ Rosa Maria Molas nº 6, bajo CP 12004 Castellón (Castellón)

All communications received by post will be handled in a manner that guarantees the informant's rights and ensures confidentiality. If a means of contact is provided, it will be used to update the informant on the status of the communication or for any other necessary procedures.

FACE-TO-FACE INTERVIEW

Informants have the option to communicate in person with the System Manager within a maximum period of seven days.

Such communication will be recorded and documented in one of the following ways, subject to the informant’s consent:

(a) A secure, durable, and accessible recording of the conversation, or

(b) A complete and accurate transcript of the conversation, prepared by the responsible personnel.

When making the report, the informant may provide an address, email, or secure location to receive notifications.

In all cases, data protection will be ensured in accordance with Regulation (EU) 2016/679 and Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights. The informant will also have the opportunity to review, rectify, and approve the transcript by signing it.

This channel also allows for the submission and subsequent processing of anonymous reports.

TELEPHONE INTERVIEW

The option of being able to communicate by telephone with the System Manager is enabled, upon request, by calling 964 255 000.

Said communication must be recorded and must be documented in one of the following ways, subject to the informant's consent: 

(a) by a recording of the conversation in a secure, durable and accessible format; or

(b) by a complete and accurate transcription of the conversation by the staff responsible for handling the conversation.

4. HANDLING OF COMMUNICATIONS

This section applies to communications received by the organisation.

This section applies to communications received by the organisation. The procedure for investigating reports submitted to the Independent Whistleblower Protection Authority is governed by its Statute.

Minimum Content of the Report
Whistleblowers must provide as much detail as possible, along with any relevant data and evidence at their disposal, to facilitate a potential investigation. To proceed with an investigation, the report must include at least the following information:

A description of the facts.

The evidence supporting the informant’s suspicions.
If known, the identity of the individuals involved or those who may have concealed their actions.

If known, the location where the events took place.

The date on which the informant became aware of the facts or the period since they have known about them.

How the informant became aware of the facts (e.g., direct witness, third-party account, documentary evidence, etc.).

Procedure for Receiving, Following Up, and Investigating Reports

Acknowledgement or Proof of Receipt

The informant must receive an acknowledgement or proof of receipt of their communication within a maximum of 7 calendar days from the date of submission.

This applies to all communications made through the OVET AUKI platform and, in other cases, to communications where the informant has provided a contact method.

Initial Screening of Communications

The external managers of the information channel are responsible for conducting an initial screening of received communications. This assessment determines:

Personal Scope: Whether the informant falls within the scope of the BLUE TECH ZONE Internal Information System.

Material Scope: Whether the communication concerns matters covered by the System. For anonymous reports, only the material scope will be evaluated, as identifying the informant is not possible.

Once the initial screening has been completed, the following actions will be taken:

a) If the communication does NOT fall within the personal and/or material scope of the SII, the received communication will be archived, a report will be generated justifying the reason for the archiving, and the informant will be notified, providing them with a copy of the justificatory report.

b) If the communication DOES fall within the personal and/or material scope of the SII, it will be verified whether the communication contains the minimum required information as previously mentioned. If information is missing in order to proceed, contact will be made with the informant to request that the missing information be provided within a maximum period of 15 days.

i. If the informant fails to provide the missing information, the communication will be archived, and the corresponding notification and delivery of the justificatory report of the archiving will take place, without prejudice to the informant's right to submit a new communication regarding the same matter."

ii. If the informant has used a method other than the OVET AUKI portal and has not provided a contact method, the investigation procedure will be initiated, documenting the situation and the possible archiving of the communication due to insufficient information to carry out an investigation with all necessary guarantees.

e) If the communication DOES fall within the personal and/or material scope of the SII and contains the minimum required content, it must be verified that the facts described in the communication are not already under investigation or have not already been investigated, and that the informant does not provide new evidence or information that would justify the initiation of a new investigation procedure:

i. If the facts have already been investigated or are currently under investigation, and the informant does NOT provide new evidence or information, the communication will be archived, accompanied by a justificatory report.

ii. If the facts have already been investigated or are currently under investigation, and the informant DOES provide new evidence or information, a new investigation procedure will be initiated, to be carried out alongside any existing investigation or procedure concerning the same facts described in the communication.

 iii. If the facts have never been investigated, the investigation procedure will be initiated.

f) If the communication DOES fall within the personal and/or material scope of the SII and contains the minimum required content, and does not concern a matter that has already been or is currently being investigated, the external managers of the channel, in the case of the OVET AUKI platform, will forward the received communication to the SII Manager, so that they may, as soon as possible, initiate the corresponding investigation procedure. If the communication was received by other means, it will be received from the outset by the SII Manager themselves.

Investigation Procedure

Initiation of the Case

The person who must proceed to initiate the investigation procedure is the person in charge of the SII, by means of an Act of initiation of the investigation procedure, in which the information contained in the communication received must be attached. The same Act must detail the reasons why the communication is admitted for processing, and the level of plausibility that it implies, as well as whether or not it is considered to have been made in good faith.

Likewise, the capacity of the person in charge of the SII to carry out the investigation procedure should be analysed or, if applicable, the need to rely on other people in the organisation or external experts, always following the procedure specified below in this protocol, and respecting all the guarantees and maximum confidentiality of the communication received and of the informant. Likewise, if necessary, the IIS Manager may appoint an instructor for the investigation procedure other than him/her, either from the organisation itself or an external person, always respecting the guarantees and confidentiality.

On the other hand, investigative procedures should be established that allow for the preservation of evidence and respect for workers' rights. These procedures may include personal interviews with specific departments of the organisation or persons involved in the reported events. A professional may also be called in to assess the damage and the offence, following the procedure for inviting external parties described below.

Similarly, it should be established which departments or areas should be informed of the present investigation and at what hierarchical level, depending on: (i) the hierarchical level and number of possible persons involved and (ii) the need to involve other departments.

Finally, the need to inform the organisation's governing body of the investigation carried out should be assessed, depending on whether it may be involved in the process or whether it may be subject to possible reprisals, which should be avoided in any case.

Maximum resolution period

The maximum time limit for the resolution of the investigation procedure, counting from the notification of receipt of the communication, is as follows:

For communications received regarding the protection of European Union rights(Law 2/2023): 90 calendar days.

For communications received regarding the Prevention of Money Laundering and the Financing of Terrorism (Law 10/2010): 90 calendar days.

For communications received regarding Criminal Compliance (art. 31.bis Criminal Code): 90 calendar days.

For communications received regarding sexual or gender-based harassment (Organic Law 3/2007, for the effective equality of women and men and, specifically, according to the protocol for the prevention of and action against sexual harassment and gender-based harassment in the workplace of the Spanish Ministry of Equality, drawn up by the Subdirectorate General for Entrepreneurship, Equality in the Company and Collective Bargaining, of October 2021): 10 working days.

For communications received on LGTBI equality (Law 4/2023, of 28 February, for the real and effective equality of trans persons and for the guarantee of the rights of LGTBI persons and the Action Protocol for dealing with harassment or violence against LGTBI persons: 10 working days.

Only in cases where the complexity of the investigation can be justified expressly, in writing and with reasons, may the time limit be extended by a further 90 calendar days.

Invitation of external persons to the investigation procedure

As mentioned above, the IIS Officer must analyse the communication received and justify whether external persons should be invited to the investigation procedure to ensure its success. Some of the reasons why outsiders may be invited include:

Lack of specific or technical knowledge of the reported facts

Possible conflict of interest on the part of the IBS Officer.

Strategy in gathering evidence for the investigation, e.g. when interviewing staff it is possible that an external person may be able to obtain more information than an internal person.

In order to invite external persons to the investigation procedure, the IIS Officer must draw up minutes justifying the reasons, and the external person(s) must sign the declaration of absence of conflict of interest and the corresponding confidentiality agreement.

Resolution of the file and notification

At the end of the investigation procedure, the IBS Officer shall:

1. draw up a report of the investigation procedure carried out, developing all the phases and evidence collected, as well as any possible incidents that may have occurred and their resolution.

2.     Draw up the minutes of closure of the investigation procedure, specifying the resolution taken.

The possible outcomes of the investigation procedure are as follows:

a) Archiving of the communication.

The communication may be closed after the investigation procedure has been carried out for a number of reasons, for example:

§ Not having enough information or evidence to investigate further.

§ The cooperation of the informant is needed to carry out the investigation and the informant refuses to cooperate.

§ The outcome of the investigation is that the events described did not actually happen, or that the conduct is not contrary to the rules or legislation in force, or to the policies implemented in the organisation.

b) Forwarding the report to the competent authority.

In those cases in which it has been ascertained that these are credible facts that may constitute any kind of offence under the Spanish Criminal Code in force, the report must be immediately forwarded to the Public Prosecutor's Office.

Likewise, in those cases in which the person in charge of the SII considers it appropriate, he/she shall forward the notification to the competent authority.

c) Internal resolution of the report, with or without sanction.

In cases where the facts of the communication are proven to have occurred, a remedy should be applied. It may be that they do not constitute unlawful acts or that they are minor conduct, and immediate resolution should be applied. In the event that immediate resolution is not possible, the resolution should be planned, determining a specific timeframe for resolution and developing the remedy to be applied. Similarly, the possible sanctioning of the person(s) who have carried out the acts that are the object of the sanction must be assessed, all of this in a reasoned and express manner.

5.     RIGHTS AND OBLIGATIONS

Reporting shall be made in good faith and it shall be ensured that the reporter is not subject to retaliation. Furthermore, in order to ensure that no person reporting an alleged wrongdoing in good faith is subject to retaliation, all reports shall always be addressed to the System Administrator. However, in the event that the person who is the subject of the report is the Head of the System, the report may be addressed to Mr. Carlos Ferri Álvarez, who will assume the role of Head of the SII only with regard to the investigation procedure of the report in question, and must respect all the provisions of this protocol.

The identity of the informant shall remain anonymous or confidential, at the choice of the informant, or unless the informant consents to the disclosure of his or her identity. Likewise, the identity of the informant shall, in any case, be treated confidentially. In this regard, the System Manager shall not provide the identity of the informant under any circumstances, except - if absolutely necessary - to external (or internal) persons who may form part of the research procedure, who must first sign the corresponding confidentiality agreement to this protocol.

Likewise, the identity of the informant may be revealed by judicial request, providing the identity to the Judge, Public Prosecutor, Police or competent administrative authority so that the result of the investigation carried out may be passed on to the Judge, Public Prosecutor, Police or competent administrative authority.

The person(s) who are the object of the communication received - that is, the person(s) to whom the facts described in the communication are attributed - may exercise the right of access, the disclosure of the informant's identification data not being included in the aforementioned right.

A person shall not be penalised or retaliated against for making a disclosure, provided it is made in good faith.

6.     PROTECTION OF PERSONAL DATA

Title VI of Law 2/2023 establishes the guidelines for the processing of personal data arising from the application of Law 2/2023, whereby such data processing shall be governed by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, in Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights, in Organic Law 7/2021, of 26 May, on the protection of personal data processed for the purposes of the prevention, detection, investigation and prosecution of criminal offences and the execution of criminal penalties. Furthermore, no data shall be obtained that allows the informant to be identified and the necessary technical and organisational measures must be in place to preserve the identity and guarantee the confidentiality and/or anonymity, where appropriate, of the data of the persons concerned.

On the other hand, Article 32 covers the processing of personal data in the Internal

Information System, specifically it should be noted that access to the data in the Internal Information System is limited according to the responsibilities and competences to:

a.     The person in charge of the system and whoever directly manages it.

b.     The head of human resources or the duly designated competent body, only when disciplinary measures may be taken against an employee. In the case of public employees, the competent body for the processing of the same.

c.      The head of the legal services of the entity or body, if legal action should be taken in relation to the facts described in the communication.

d.     The persons in charge of the processing that may be designated.e.    

The data protection officer.

Finally, it must be included in the Register of Processing Activity in accordance with the provisions of Article 30 of the GDPR.

Data Controller:

DENOMINACIÓN SOCIAL

FOMENTO DE CASTELLÓN, S.A.

TIN

A12438479

LOCATION

Calle Maria Rosa Molas - Bajo 6- 12004 Castellón (Castellón)

Purpose: To manage the data of the interested party in order to process and handle the complaint submitted through the provided channel.

Legitimation:

The processing of personal data is lawful when required by an Internal Information System and in cases of internal communication, as per Articles 6.1(c) of the GDPR, Article 8 of the LOPDGDD, and Article 11 of Organic Law 7/2021, of May 26.

The processing of personal data for external communication channels is considered lawful under Article 6.1(c) of the GDPR.

The processing of personal data resulting from public disclosure is presumed lawful under Article 6(1)(e) of the GDPR.

If special categories of personal data are processed for reasons of essential public interest, the processing is lawful under Article 9(2)(g) of the GDPR.

International Data Transfers: No data is transferred to third countries outside the European Union.

Data Communication: Data processing by third parties, or its communication to them, is lawful when necessary for implementing corrective actions within the organization or for handling any applicable sanctioning or criminal procedures.

Data Retention

Data may be stored in the information system only for as long as necessary to determine whether an investigation into the reported facts should be initiated.

If it is established that the information provided, or part of it, is untrue, it must be immediately deleted as soon as this becomes evident—unless the falsehood constitutes a criminal offence, in which case the data will be retained for the duration of the legal proceedings.

In any case, if no investigation has been initiated within three months of receiving the report, the data must be deleted, unless retention is necessary to document the system’s operation. Reports that are not processed may only be stored in anonymised form, without being subject to the blocking obligation outlined in Article 32 of Organic Law 3/2018, of December 5.

Rights of Data Subjects

Data subjects have the right to access, rectify, and erase their data (right to be forgotten), as well as to request restriction of processing, data portability, and objection to data processing.

To exercise these rights, they may send a written request by post to the company’s registered office, including "Data Protection" in the subject line. Additionally, if they do not receive a satisfactory response, they may file a complaint or seek further information from the relevant supervisory authority for data protection, currently the Spanish Data Protection Agency.

7. COMMUNICATION AND TRAINING

To safeguard the rights of those subject to this protocol and ensure they understand their obligations, members of BLUE TECH ZONE must receive clear, precise, and prior information about its existence.

At a minimum, the obligation to inform about the Information Channel and how to access it will be fulfilled through publication on the website.

The System Manager is responsible for coordinating and overseeing the necessary communication and training initiatives to ensure that everyone associated with BLUE TECH ZONE is aware of the channel and how it operates.

8. APPROVAL, ENTRY INTO FORCE, AND REVISION

The Governing Body of FOMENTO URBANO DE CASTELLÓN SA approved this Information Channel Protocol by Act dated October 29, 2024.