ADDITIONAL INFORMATION ON THE PROCESSING OF YOUR DATA

Submission of this form is voluntary. In order for us to be able to analyse it, you must confirm that you have read and accepted this data protection policy by ticking the relevant box. The information you provide about yourself, employees, suppliers, customers and business partners of Torytrans about whom you submit the form or any other aspect related to Torytrans, may result in decisions affecting employees and other third parties involved in the incident in question. Therefore, we ask that you provide only information that is accurate and truthful. The information you provide will be treated as confidential. Under no circumstances will the identity of the whistleblower be known to the reported person, notwithstanding the fact that you may be informed of the reported facts once the relevant investigations have been carried out or that the report may result in legal action.

Data Controller.

Torytrans S.L with CIF. B13114319 located in P.I San Jorge C/ Pitágoras, 1 CP 13270 Almagro, Ciudad Real. Contact telephone 926861449. Contact Data Protection Delegate Contact: rrhh@torytrans.com

Purposes of processing.

TORYTRANS informs you that the personal data you provide by filling in this form within the framework of the use of the internal communication and complaint system of TORYTRANS will be processed for the following purposes:

• To identify you and be able to contact you.

• To process the form you fill in in order to carry out the necessary investigations to find a solution to the problem you have raised.

• To carry out any necessary steps in relation to the matter that is the subject of the information and/or complaint.

Legitimation.

The legal basis for the processing of your data corresponds to the fulfilment of legal obligations by Torytrans S.L. (RGPD - 6.1.c), as well as the fulfilment of essential public interest missions (RGPD - art. 9.2.g), in order to manage and resolve complaints and/or queries relating to actions that constitute serious or very serious criminal or administrative offences or infringements or infringe the provisions of the Code of Conduct.

The personal data of the interested party will be processed by Torytrans in order to deal with your query and/or complaint, give it the corresponding follow-up and be able to exhaustively monitor its status, processing and closure.

In the event that the data of third parties is provided in relation to the internal complaint, the interested party affirms that the information provided is truthful and that the provision of the same is carried out within the framework of the management of the channel and monitoring of the same; likewise, in those cases in which the interested party provides data of third parties outside the complaint, he/she declares to have the consent of the same and undertakes to provide them with the information contained in this clause; likewise, in the event that the data subject provides data of third parties in relation to the internal complaint that he/she is submitting, he/she affirms that the information provided is truthful and that the provision of such data is carried out within the framework of the management of the channel and the monitoring of the same.

Data processed

Data of the informant: name, surname, e-mail, ID number, telephone number, as well as other data necessary for the resolution of the complaints.

Data of the affected persons: the data provided by the informant. Among them, name and surname, as well as other data that are necessary for the resolution of the complaints.

Witness data: data provided by the informant. This includes first and last names as well as other data necessary for the resolution of the complaints.

There may be data on criminal offences which will be processed in accordance with Organic Law 7/2021 of 26 May on the protection of personal data processed for the purposes of the prevention, detection, investigation and prosecution of criminal offences and the enforcement of criminal penalties.

Special categories of data: processed when necessary in accordance with the requirements established in the applicable regulations.

Personal data collected within the framework of the Complaints Channel will be limited to that strictly and objectively necessary to process the complaints and verify the reality of the facts reported, in accordance with the applicable data protection regulations.

Data retention: Personal data relating to information received and internal investigations shall only be retained for such period as is necessary and proportionate for the purposes of complying with this law. In any event, after three months have elapsed since the data were entered without any investigation having been initiated, they shall be deleted from the complaints system, unless the purpose of the retention is to leave evidence of the functioning of the model for the prevention of the commission of offences by the legal person. The reports that have not been followed up can only be recorded in an anonymised form, without the blocking obligation provided for in article 32 of Organic Law 3/2018, of 5 December on the Protection of Personal Data and guarantee of digital rights being applicable.

However, TORYTRANS may retain the data for the time necessary to resolve the matter that is the subject of the communication and/or complaint and in order to deal with any possible civil, criminal or any other type of liability that may arise from such processing.

In no case may data be kept for a period of more than ten years.

In the case of data that are not necessary for the processing of the complaint or for which there is no legitimisation, they shall be deleted immediately.

In the case of data contained in complaints that are not truthful or that are considered unfounded, they shall be immediately deleted from the complaints channel, unless said lack of truthfulness may constitute a criminal offence, in which case the information shall be kept for the necessary time during which the legal proceedings are being processed.

Disclosure of data.

Informants have the right not to have their identity disclosed to third parties. However, solely for the purposes of the processing, their personal data may be communicated to the competent departments. Furthermore, where appropriate, personal data and information may also be disclosed to the competent administrative authorities, including the Public Prosecutor's Office or European Public Prosecutor's Office; or the Independent Authority for the Protection of Informants; judicial bodies in the framework of a criminal, disciplinary or sanctioning investigation. The informant shall be informed before his or her identity is revealed, unless such information could jeopardise the investigation or the proceedings.

Information on the persons concerned and/or witnesses may be communicated to: the competent administrative authorities, including the Public Prosecutor's Office or European Public Prosecutor's Office; or the Independent Authority for the Protection of Whistleblowers and judicial bodies in the framework of a criminal, disciplinary or disciplinary investigation.

Rights.

You have the right to:

- To obtain confirmation as to whether or not Torytrans S.L. is processing personal data concerning them.

- To access your personal data, as well as to request the rectification of inaccurate data or, where appropriate, to request their deletion when, among other reasons, the data are no longer necessary for the purposes for which they were collected.

- The limitation of the processing of your data: in certain circumstances, you may request it, in which case it will only be kept for the exercise or defence of claims.

- In certain circumstances and for reasons related to your particular situation, you may object to the processing of your data. Torytrans will stop processing the data, except for compelling legitimate reasons, or the exercise or defence of possible claims.

- Withdraw the consent given without affecting the lawfulness of the processing based on the consent prior to its withdrawal.

The exercise of the aforementioned rights must be made in writing, signed by you and accompanied by a photocopy of your ID card, passport or NIE, which must:

- Contact the Torytrans Data Protection Delegate at RRHH@torytrans.com.

- File a complaint with the Spanish Data Protection Agency.

You can find more information about your rights or file a complaint with the AEPD www.aepd.es (901 100 099 - 912 663 517).