The Internal Reporting System of HELIOPAL S.A. is the channel for confidential and effective communication of any information regarding irregular actions committed by HELIOPAL S.A. or its staff, which have been discovered in the context of a labor or professional relationship with our organization, in accordance with the provisions of Law 2/2023 of 20 February.
The organization has established the Internal Reporting System through the following channels:

In writing:
– By email: COMUNICACIONES@SONCALIU.COM
– By postal mail addressed to the Internal Reporting System Manager of HELIOPAL S.A. at: AVENIDA SON CALIU Nº 18, 07181, PALMANOVA (CALVIA), BALEARES

Verbally:
At the request of the reporting person, the information may be submitted through an in-person meeting with the System Manager within a maximum period of seven days from the submission of the request.

Aside from these channels, communications may be submitted to the external reporting channels of the competent authorities:
– Independent Authority for the Protection of Whistleblowers, through the email: canal.externo@proteccioninformante.es
– More information is available at: https://www.proteccioninformante.gob.es/

Upon receipt of the report, the Internal Reporting System Manager will acknowledge receipt to the whistleblower within a period of less than seven days, in the case of non-anonymous reports. In any case, the whistleblower will be informed of the rights and obligations established by personal data protection regulations.
The Internal Reporting System Manager will issue a reasoned report accepting or rejecting the communication submitted, justifying the decision in all cases. This report will be notified to both the whistleblower and the affected person within a maximum of three months from the end of the seven-day period following the submission of the report, except in cases of particular complexity that require an extension, which may be extended for up to an additional three months.
During the processing of the report, communication and contact with the whistleblower may be maintained, and if deemed necessary, the reporting person may be asked to provide additional information.

The organization guarantees that the person affected by the report is informed of its existence, as well as of the facts outlined in a concise manner. Additionally, they will be informed of their right to submit written statements and of the processing of their personal data. However, this information may be provided during the hearing process if providing it earlier could facilitate the concealment, destruction, or alteration of evidence.

The Internal Reporting System/whistleblowing channel Manager guarantees confidentiality to all those who use the internal reporting system/whistleblowing channel. Confidentiality is also guaranteed when the communication is submitted through channels other than those established or to staff members not responsible for its handling.

During the processing of the case, the persons affected by the communication will have the right to the presumption of innocence, the right of defense, and the right of access to the case file, as well as the same protection granted to whistleblowers, preserving their identity and ensuring the confidentiality of the facts and data of the procedure.
The processing of personal data derived from the application of this procedure will be governed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, Organic Law 3/2018 of 5 December on Personal Data Protection and Guarantee of Digital Rights, Organic Law 7/2021 of 26 May on the processing of personal data for the purposes of the prevention, detection, investigation, and prosecution of criminal offenses and the enforcement of criminal penalties.

The Internal Reporting System/whistleblowing channel Manager will immediately forward the information to the Public Prosecutor’s Office when the facts may potentially constitute a criminal offense, or to the European Public Prosecutor’s Office if the facts affect the financial interests of the European Union.
The organization guarantees the absence of retaliation against anyone who reports a possible unlawful conduct, communicates a regulatory breach, collaborates in its investigation, or helps resolve it. Persons who report or disclose violations established in Article 2 of Law 2/2023 of 20 February, as well as actions or omissions that may constitute serious or very serious criminal or administrative offenses, will be entitled to protection measures provided that the conditions established in Article 35 of the aforementioned law are met. Protection measures are set out in Article 38 of Law 2/2023 of 20 February.
The report or information will be stored on the organization’s premises in accordance with its document archiving and retention policy.

The organization maintains a register of all reports received. Reports will only be retained for the period necessary and proportionate to meet the requirements imposed by Law 2/2023 of 20 February, regulating the protection of persons who report regulatory breaches and combat corruption, and in accordance with Article 24 and other applicable articles of Organic Law 3/2018 of 5 December on Personal Data Protection and Guarantee of Digital Rights.