These Terms of Use regulate the download, access and use of the Report2box whistleblower channel software, which PROTECCIÓN DE DATOS DATAX, S.L. makes available to clients in order to offer them whistleblower channel software that they can implement in their companies.

1. GENERAL

In compliance with the general information obligation set out in Article 10 of Spanish Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce, we hereby inform you that PROTECCIÓN DE DATOS DATAX, S.L., registered in the Companies Register of Barcelona, in Volume 38970, Folio 52, Page Number B333543, 1st entry, with VAT (Tax Identification) Number B64334634 and address at C/ Bobinadora, 1-5 - 1r 15-17 08302 Mataró (Barcelona), is the party responsible for the Application. If you wish to contact us, please send an email to [email protected].

By accessing Report2box, you acknowledge that you have accepted and unreservedly consented to each and every provision contained in all of the terms herein.

PROTECCIÓN DE DATOS DATAX, S.L. reserves the right to modify these Terms of Use in order to adapt them to current legislation applicable from time to time, as well as to make changes and updates that will be published in the Application and will be effective from the moment of their publication. If you do not agree to any updates to the Terms of Use, you may terminate your use of the Service.

By using Report2box, you declare that you are at least 18 years of age. Likewise, PROTECCIÓN DE DATOS DATAX, S.L. reserves the right to request additional documentation from its Users in order to prove that they are of legal age. DATA PROTECTION DATAX, S.L. does not collect information from minors. On suspicion that a user of the services is under the said age (18 years old), and that he/she has falsified the data required for access, PROTECCIÓN DE DATOS DATAX, S.L. may deny the said user access to the Services offered. In any case, parents and/or legal guardians of minors must ensure compliance with this provision, being responsible for such minors' actions.

1. RULES OF USE AND USER CONDITIONS WHEN USING REPORT2BOX

• In order to use Report2box, you agree to use it correctly and lawfully.
• You shall use Report2box for the purposes for which it was designed and at no time shall you use it for purposes contrary to the law.
• The Report2box reporting channel is not an emergency service; in case of an emergency please contact the authorities.
• You must fill in all the information defined as mandatory in order to be able to submit it.
• This service is not designed for submitting information that may be considered secret or strictly confidential.
• You should review the information you submit to ensure whether or not you want to disclose your identity.
• You may choose to send the submission with or without indicating your contact details. In both cases the platform will provide you with a unique identification number and a password. It is important that you write this information down and keep it in a safe place, as you will only be able to check the status of the submission once you have provided these details. If you lose this information, you will no longer be able to access it. For security reasons PROTECCIÓN DE DATOS DATAX, S.L. will not be able to provide access to lost passwords or access codes.
• If the organisation establishes that there has been bad faith in making the submission, it reserves the right to take legal action if the whistleblower has been identified.
• The user will be able to download a certificate issued by PROTECCIÓN DE DATOS DATAX, S.L. in which he/she will have all the information sent to the company, as well as the result once the investigation has been completed.
• The query system has built-in tracking features to help users identify unauthorised access to their query.
• The whistleblower expressly understands and agrees that PROTECCIÓN DE DATOS DATAX, S.L. shall not be liable for any direct, indirect, foreseen or unforeseen damage, including but not limited to moral damage, resulting from the use or impossibility of use of this service.
• The whistleblower is responsible for the veracity of the information communicated, assuming the consequences of having acted in bad faith or having sent false information or documentation.
• The user shall be liable for any damage or harm of any kind that PROTECCIÓN DE DATOS DATAX, S.L. may suffer, directly or indirectly, as a result of any improper use of the product, any breach of the terms and conditions of use or any breach of the law by the user.

PROTECCIÓN DE DATOS DATAX, S.L. will make all reasonable efforts to make the application available at all times. However, the user accepts that the availability of the Report2box application may be affected by factors beyond the reasonable control of the software.

1. PRIVACY POLICY

PROTECCIÓN DE DATOS DATAX, S.L. is responsible for the processing of the personal data of the client company and will not process the data of the end user (whistleblower). Only in the event that the client company contracts the services of PROTECCIÓN DE DATOS DATAX, S.L. to manage the complaints, it will be able to process the data of the end user (whistleblower) as the Data Controller and on behalf of the client company.

PROTECCIÓN DE DATOS DATAX, S.L. may also collect and automatically generate information from other areas of use, such as service metadata, login data, device information, IP addresses, third party data and information obtained from cookies.

In compliance with Regulation (EU) 2016/679 of 27 April 2016 and Spanish Organic Law 3/2018 of 5 December, by means of this document DATA PROTECTION DATAX, S.L. as Data Controller informs that it will process the data provided by the client company to activate the whistleblower channel and execute the contractual relationship between the parties. With respect to the data of the end users (whistleblowers), it will only process such data, if applicable, for the purpose of carrying out the assignment given by the client company consisting of the management of the reports. For this purpose, it shall process the data entered by the whistleblower, which may include data of a special nature.

The data will be processed and kept only for the time necessary to decide whether or not to open an investigation into the reported facts. In any case, three months after the data have been entered, they shall be deleted from the internal compliance system. The data may continue to be processed by the competent authority and body in the event of an investigation into the reported facts, but will not be retained in the internal compliance system itself. Any reports which have not been acted upon shall be kept anonymous.

PROTECCIÓN DE DATOS DATAX, S.L. shall adopt the necessary measures to preserve the identity and guarantee the confidentiality of the data corresponding to the persons affected by the information provided, especially that of the person who has brought the facts to the attention of the organisation, in the event that he/she has identified him/herself.

The user's data will not be communicated or transferred to third parties except by legal obligation or those providers linked to the Controller who act as data processors with whom the corresponding contract has been signed in accordance with the terms of the legislation in force.

Our servers are located in the European Union, and we generally engage service providers that are also located within the European Economic Area or in countries that have been declared to have an adequate level of protection.

If we need to use external service providers that require the transmission of personal data outside the European Union or in countries that have not been declared to have an adequate level of protection, we will ensure that we guarantee the security and lawfulness of the processing of your data by means of adequacy decisions, standard clauses, binding corporate rules, exemptions or any other instrument approved by the supervisory authority that provides adequate safeguards for the implementation of the international data transfer.

The legitimate basis for the processing of your data is the public interest.

You guarantee that the personal data provided is truthful, guaranteeing that all the information provided corresponds to the actual situation, that it is up to date and accurate.

You have the right to access your data and to obtain confirmation of its processing, as well as a copy of the personal data being processed. You have the right to request the rectification of data that is inaccurate or to request deletion when the data is not necessary for the purposes for which it was collected. You can request the limitation of the processing of your personal data. Similarly, you have the right not to be subject to decisions based solely on automated processing of your personal data. You can exercise your rights by contacting us at C/ Bobinadora, 1-5 1r 15-17 - 08302 Mataró (Barcelona). Email: [email protected]

If you feel that your rights have not been properly addressed, you have the right to lodge a complaint with the supervisory authority at www.aepd.es

1. INTELLECTUAL AND INDUSTRIAL PROPERTY RIGHTS

The intellectual and industrial property rights over the Report2box are owned by PROTECCIÓN DE DATOS DATAX, S.L., which has exclusive rights to exploit them in any form and, in particular, the rights of reproduction, distribution, public communication and transformation.

Third-party holders of intellectual and industrial property rights over photographs, logos and any other symbols or content included in Report2box have granted the corresponding authorisations for their reproduction, distribution and making them available to the public.

You acknowledge that the reproduction, modification, distribution, commercialisation, decompilation, disassembly, use of reverse engineering techniques or any other means to obtain the source code, transformation or publication of any unauthorised benchmark test results of any of the elements and utilities integrated within the development constitutes an infringement of the intellectual property rights of PROTECCIÓN DE DATOS DATAX, S.L., and consequently undertake not to carry out any of the aforementioned actions.

1. EXCLUSION OF LIABILITY

PROTECCIÓN DE DATOS DATAX, S.L. reserves the right to edit, update, modify, suspend, eliminate or terminate the services offered, including all or part of their content, without prior notice, as well as to modify the form or type of access to the same.

The reasons for modification may include the need to adapt to possible legislative developments and changes in the Application itself, as well as those that may arise from existing standard codes on the subject, or for strategic or corporate reasons.

PROTECCIÓN DE DATOS DATAX, S.L. may not be held liable for the use of Report2box by a minor, the downloading and use of Report2box being the sole responsibility of the user.

The responsibility for the use of Report2box lies solely with the user. Except as set out in these Terms and Conditions, PROTECCIÓN DE DATOS DATAX, S.L. is not responsible for any loss or damage that may occur in relation to the download or use of Report2box, such as those produced as a result of failures, breakdowns or blockages in operation (for example, and without limitation: error in communications lines, defects in hardware or software or failures in the Internet network). Likewise, PROTECCIÓN DE DATOS DATAX, S.L. may not be held liable for any damage caused as a result of improper or inappropriate use by users.