PRIVACY POLICY ETHICAL CHANNEL

Important information about the Ethics Channel

1. Purpose of the Ethics Channel

Ferrer's Ethics Channel is an information system aimed at reporting conduct, facts and incidents with indications of an appearance of infringement created with the aim of promoting compliance with the Code of Ethics, Ferrer's values and principles and the regulatory framework to which Ferrer is subject. In this way, Ferrer members and third parties (suppliers, customers, patients or other interested third parties, where appropriate) who are aware of possible irregular actions that may constitute a crime or that could involve a contravention of ethical principles, will be able to submit their communications and complaints through this tool.

Through the Ethics Channel we may collect personal data (hereinafter "data" or "personal data") of various types that, on occasion, may contain sensitive information. This Data may refer to you as a complainant or as the subject of the communication or complaint, although its processing will comply at all times with the obligations established in current legislation on the protection of personal data.

2. Confidentiality and anonymity:

In the event that you provide us with your identity, it will be kept in absolute confidentiality throughout the process, not being revealed in any case to the accused, nor accessible to unauthorized persons, except as required by the Public Authorities and regulatory bodies, Judges and Courts. If you provide us with personal data of third parties, these people may have the opportunity to comment on these reports, so that they can be informed of it while maintaining their identity as a whistleblower even in these cases. We will not disclose information about your identity to those affected as long as there is no legal impediment and your anonymity does not entail the assumption of a risk for Ferrer.

However, if you wish, you can make your communication or complaint and attach the documentation you deem appropriate anonymously. In these cases, make sure that all personal information has been removed from the attachments to preserve your anonymity.

3. Abuse of the system, false reporting and commitment not to retaliate:

Users who make good faith use of the Ethics Channel will not suffer any type of retaliation as a result of using the system, and will not face any type of sanction from Ferrer.

Ferrer will guarantee the adequate protection of privacy and personal data and the preservation of the honour, the presumption of innocence and the right to defence of the persons denounced, in particular, against unfounded, false or bad faith complaints, on which the corresponding disciplinary measures will be adopted, where appropriate.

You must also ensure that the personal data provided through the Ethics Channel is true, accurate, complete and up-to-date.

Data protection

1. Contact details of the data controller and data protection officer

In accordance with the provisions of Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of your personal data (hereinafter, the "GDPR"), Organic Law 3/2018 of 5 December 2018 on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, "LOPDGDD") and Law 2/2023, of 20 February, regulating the protection of persons who report regulatory breaches and the fight against corruption ("Whistleblower Protection Law") as well as other applicable regulations on the protection of personal data, GRUPO FERRER INTERNACIONAL, S.A. (hereinafter, "Ferrer") will process the data collected through the Ethics Channel as the data controller. For this purpose, Ferrer's identification data are:

• Owner: GRUPO FERRER INTERNACIONAL, S.A.

• Registered office: Av. Diagonal nº 549, 5ª planta, 08029, Barcelona, Spain

• C.I.F.: A61738993

• E-mail: lopd@ferrer.com

   

If you have any questions or queries, you can contact our data protection officer by sending your request to dpo@ferrer.com.

2. Types of personal data to be processed

Whether you provide us with your personal data directly or if it is provided to us by a third party, we will process the following personal data:

• Nominal Whistleblower

a) Identification data: name and surnames

b) Contact details: email.

c) Evidence: photographs or documents that can prove the facts denounced, including labor information, tax information, etc.

• Anonymous Whistleblower: The complainant can provide the following information or none of them:

• Person reported:

• Witness:

• Third parties:

a) Identification data: name and surname.
b) Contact details: email, telephone, etc.
c) Data associated with the reported conduct: employment data,
fiscal data, economic data, etc.
d) Evidence: photographs or documents that may
demonstrate the facts denounced, if they are provided in
the course of the investigation.

3. Purposes of processing:

We will process your personal data, the information and documents you provide us with for the purpose of processing, investigating and proposing resolutions on communications and complaints related to possible criminal acts or regulatory and ethical breaches received through this channel, in accordance with the provisions of the Procedure and the Complaints Management System Policy, as well as in the Ferrer Code of Ethics.

4. Basis of legitimacy of the processing:

The legal basis that legitimises the processing of your data lies in compliance with a legal obligation, under the provisions of Article 30 of the Whistleblower Protection Act. In the event that the data is considered to be of a special category, its processing is exempted in accordance with the provisions of article 30 of the Whistleblower Protection Law, in relation to article 9.2.g) of the GDPR, as it is necessary for reasons of an essential public interest.

5. Data retention period in the Ethics Channel

The personal data processed for this purpose will be kept in the Ethics Channel only for the time necessary to decide on the appropriateness of initiating an investigation into the facts reported. In any case, after three months have elapsed since the data is entered, it must be removed from the Ethics Channel. If it is decided to initiate an investigation, personal data will be kept outside the whistleblowing channel for the duration of the investigation of the facts. In the event that the investigation shows that certain measures have been taken against the persons under investigation, the data will be kept as long as the appropriate legal actions persist.

Once the corresponding storage period has expired, the data will be duly blocked and kept in order to prove compliance with the regulations regarding the provision of a Ferrer ethics and compliance model in accordance with the requirements of article 31 bis of the Criminal Code.

6. Recipients of personal data

In general, access to the data will be limited exclusively to those who are part of governing bodies related to compliance functions (members of Ferrer's Corporate Ethics and Compliance Committee and, where applicable, the Ethics and Compliance Advisory Board), and/or to internal or external research managers (the latter as data processors) who may be appointed. Likewise, when disciplinary measures are taken against Ferrer personnel, such access will also be allowed to personnel with management and control functions in the People area of Ferrer.

Your data will not be transferred, sold, rented or made available in any other way to any third party, except to those service providers for the reception of communications on the channel and, where appropriate, management and carrying out of the necessary investigations, which in no case will process the data for their own purposes.

Notwithstanding the foregoing, the personal data of the complaints may be communicated to the security forces and bodies, Judges or Courts, as well as any other competent body if required in compliance with current legislation.

In particular, in the case of people from Ferrer companies located outside the European Economic Area, international data transfers may be made provided that it is strictly necessary to resolve the case reported through the Ethics Channel. Where appropriate, Ferrer will take appropriate measures to ensure that your personal data remains protected as set out in this document and applying the appropriate mechanism in each case in accordance with the GDPR when transferred outside the EEA. We also ensure that any third party receiving your personal data has appropriate security measures in place to protect such data.

7. Automated Decisions and Profiling

Under no circumstances will Ferrer make automated decisions with your data or create profiles.

8. International transfers

Ferrer has different subsidiaries, so it is possible that, if necessary in the specific case and after the corresponding investigation, your data may be processed outside the European Union or the European Economic Area.

In any case, Ferrer will ensure that such data processing is always protected with the appropriate guarantees, which may include, among others, the signing of standard contractual clauses approved by the European Commission. These clauses consist of contracts approved by the Commission that provide sufficient guarantees to ensure that the processing complies with the requirements set out by the GDPR. If you would like to obtain a copy or obtain more information about the appropriate or appropriate safeguards for the specific case, you can address your request to lopd@ferrer.com.

9. Exercise of rights

You can exercise, at any time and free of charge, your rights of access, rectification, deletion, limitation of processing, data portability and opposition, expressly indicating which right among those listed above you wish to exercise. You can send your request to the following addresses:

• By sending an email to lopd@ferrer.com.
• By post addressed to Ferrer, with address at Av. Diagonal nº 549, 5th floor, 08029, Barcelona (Spain).

We will consider all requests and provide our response within the time period set by applicable law. Please note, however, that the rights of deletion and opposition may be limited while the investigation of the facts denounced is ongoing or judicial or extrajudicial actions are being taken against them, and the identity of the complainant must be preserved for the satisfaction of Ferrer's interests or for compliance with a legal obligation.

In any case, you have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es), located at C/Jorge Juan no. 6 de 28001 Madrid, in the event that you consider that Ferrer has violated the rights that are recognized by the applicable legislation.