The whistleblowing channel of Xeridia makes available to employees, partners and any third party that collaborates with the company, so that they can make complaints or communicate information from the company about unethical or allegedly illegal behaviour. Reports will be made anonymously, or you may include contact details if you prefer. The information collected in the report will be treated securely and confidentially. This channel has been set up in accordance with Law 2/2023 regulating the protection of persons who report regulatory infringements and the fight against corruption, which transposes Directive 2019/1937 of the European Union, approved by Congress on 16th February 2023.
The Xeridia UK Ltd Whistleblowing Channel is accessible through the corporate website facilitating its use by employees, commercial agents, managers, business partners and any interested party.
The purpose of the Whistleblowing Channel is to channel and facilitate the secure formulation of any communication regarding suspicions of irregular conduct, bad business practices, and any violation of the obligations of the Code of Ethics or Conduct, fostering an environment of Compliance based on the principles and values of Xeridia UK Ltd.
In addition, the procedure seeks to ensure that throughout the process the protection of the privacy of the persons involved and the confidentiality of the data contained in the complaint is effectively guaranteed, and the complaint may be made anonymously if the complainant considers it appropriate.
Key aspects associated with the complaints channel
Duty to report
Anyone who has well-founded knowledge of any type of act or fact that could contravene the principles and values of the company’s Policy of Good Practices or involve an unlawful act or an act contrary to the regulations in force, must report it to Xeridia, through the established channel.
The Whistleblowing Channel must be understood as an instrument that allows the communication of irregularities or non-compliance. Therefore, it should not be used indiscriminately, but only for the purposes for which it was conceived.
Reportable events should focus on conduct, non-compliance or irregularities that may go against the principles and values set out in the company’s Good Practices and Corporate Social Responsibility Policies, or constitute an illegal act or an act contrary to the applicable regulations.
In this sense, Xeridia, within the management of the Whistleblowing Channel, has fully identified the principles and values that constitute the organisational culture that the company’s management wishes to promote within the Organisation, and which have been formally described in the company’s Policies of Good Practices and Corporate Social Responsibility.
Annex I lists the conduct that may be the subject of a complaint, expressly including those that refer to sexual violence and any other conduct that may be considered sexual harassment and harassment based on gender.
Rights of the whistleblower regarding communications made through the whistleblowing channel
In the life cycle of the complaint, Xeridia UK Ltd will guarantee the following rights to the complainant:
- Right to protection during the course of the investigation.
- Prohibition of retaliation
- Right to receive information
- Right to choose
- Limited information rights
- Right to anonymity
- Right to confidentiality
- The right to receive a response within a reasonable time:
- Right to data erasure
Xeridia will provide due protection to all persons who make a complaint in accordance with the guidelines of this Procedure.
In the event that the complainant makes the content of the complaint public, he/she will only be eligible for protection measures if he/she has first reported through the complaints channel and with the established deadlines and measures.
Protection is also available if the content of the report is made public either because there is a manifest risk to the public interest, such as an emergency situation or risk of irreversible damage, or because in the case of an external report there is a risk of retaliation or a low likelihood of effective handling of the report due to the specific circumstances of the case, such as concealment or destruction of evidence or the authority colluding with or being implicated in the offence.
In no case will retaliation be taken against the whistleblower, even if the result of the ensuing investigations verifies that there has been no breach of the company’s Best Practices and Corporate Social Responsibility Policies or applicable regulations, provided that the whistleblower has not acted in bad faith. This means that the perpetrator of any type of retaliation must be sanctioned. Annex II lists those actions that are considered retaliation.
Whenever the complainant provides contact details, he/she shall be informed in writing, after the complaint has been analysed, if it is deemed appropriate for analysis.
Furthermore, once the investigation has been completed, the complainant shall be informed of the follow-up measures envisaged, e.g. referral to a competent authority, as well as of the outcome of the investigations, explaining the reason for the measures or disciplinary action taken against the respondent.
The whistleblower may choose the channel of complaint that he/she considers most appropriate, and may use external channels (competent authorities), without the whistleblower being obliged to use a specific channel, especially taking into account that the person being reported may be a superior of the whistleblower, and that the latter has access to the complaint.
The complainant, in the process of making the complaint, may not be asked for information that is not strictly necessary for the processing of the complaint and, subsequently, information that is not strictly necessary for the investigation may not be requested or retained.
The information provided by the complainant may not be used for purposes other than the investigation. In the event that the complaint provided contains industrial or commercial secret information or other information that could affect the commercial, economic, strategic or security interests of Xeridia or third parties involved, this information must be used for what is strictly necessary in the process of investigating the complaint, and may not be disclosed or shared for purposes other than the investigation.
If the data is transferred to a third party to investigate the complaint, e.g. a law firm or an external auditor, both the complainant and the respondent must be informed in advance. Such consent is not required if the transfer of data is authorised by law.
The personal data processed as a result of the submission of a complaint through the Xeridia Complaints Channel will be processed in accordance with the General Personal Data Protection Regulation, Regulation (EU) 2016/679, and Organic Law 3/2018 of 5 December on Data Protection and the guarantee of digital rights and other related regulations in force.
Any data that is excessive or irrelevant to the investigation of a complaint or has been collected accidentally will be deleted immediately.
The complainant who submits a complaint through the Complaints Channel may maintain the anonymity of his or her identity, which is guaranteed during the process, and it is optional for the complainant to include data that allows his or her identification through the complaint form provided.
The identity of the complainant shall be confidential and may not be disclosed without their express consent to any person other than personnel competent to receive and handle complaints, with the exceptions established by EU law or Spanish regulations in the context of investigations carried out by the authorities or in the course of judicial proceedings.
Whenever the complainant provides contact details, he/she will receive an acknowledgement of receipt of his/her complaint within a maximum of seven days from the receipt of the complaint by Xeridia, unless the complainant expressly requests otherwise or the investigating body considers that such acknowledgement may compromise the protection of the identity of the complainant.
The time limit, in relation to data processing and investigation, may not exceed three month in accordance with the regulations in force.
Three months after the data have been entered, they must be deleted from the whistle-blowing system, unless the purpose is to preserve them as evidence of the functioning of the Compliance System model or if legal proceedings or investigations by the competent authorities arise from them.
Rights of the data subject regarding communications made in the complaint channel
Throughout the lifecycle of the complaint, the FNMT-RCM will guarantee the following rights to the complainant:
Right to protection during the course of the investigation
Xeridia will provide the reported person with a full guarantee of his/her rights as any other employee, and no sanctioning or legal measures will be applicable until the truthfulness of the reported facts is verified, the respective evidence is gathered, and it is concluded that a criminal act or an act contrary to Xeridia’s principles and values has been committed.
Right to receive information
The accused must be informed of the investigation process that is being carried out so that, in view of the accusation of such conduct, he/she can exercise his/her right to defence and allege everything that allows him/her to prove his/her innocence.
On the other hand, in those cases where the information in the investigation process poses a significant risk to the ability to investigate effectively, communication to the accused may be delayed for as long as this risk exists. The aim is to avoid the destruction or alteration of evidence by the defendant.
Right to confidentiality
Throughout the entire investigation of the complaint, the respondent shall be guaranteed the right to confidentiality of his or her personal data, in order to avoid any dissemination of information that could affect his or her reputation.
The information provided to the reported person must be on terms that protect the confidentiality of the complainant, and the identity of the complainant may not be disclosed without his/her express consent to any person other than personnel competent to receive and handle complaints, with the exceptions provided for by EU or Spanish law in the context of investigations carried out by the authorities or in the course of judicial proceedings.
Right to a transparent investigation
The reported person shall have the right to an investigation based on an objective analysis of the evidence gathered, ensuring an effective and transparent investigation.
Imposition of disciplinary measures
If in the resolution of the investigation it is reliably proven that the facts investigated are true and are linked to irregular or unlawful conduct, the accused may be subject to sanctions in accordance with the Collective Bargaining Agreement in force, labour legislation and the rest of the civil and mercantile obligations.
Xeridia may also bring the facts to the attention of the relevant judicial authorities if it deems it necessary.
In the event that the accused is a third party with whom there is no employment relationship (supplier, commercial agent or business partner), the applicable sanctions shall be limited to the commercial sphere (limitation of actions, unilateral contractual termination by Xeridia), without prejudice to the aforementioned communication to the competent judicial authorities.
Reporting false or bad faith reports
Xeridia’s whistle-blowing channel must be used in a responsible and appropriate manner. The reporting of false facts, with a malicious and morally dishonest attitude, is a breach of the good faith that should govern working relations within Xeridia.
If, after the appropriate analysis, it can be concluded that the facts reported are manifestly false and that the complaint has been presented with a malicious attitude and in bad faith:
- The complaint shall be closed, documenting the reasons for closing the file, thus ending the investigation.
- This shall be reported to the management for disciplinary action to be proposed.
- The proposed sanction shall be reported in writing to the Management Body, which shall decide on the disciplinary action to be applied to the complainant in bad faith.
Pprotection of personal data
In accordance with the provisions of current legislation on data protection, Xeridia UK Ltd with registered office at Av. Padre Isla 16 – 24002 León and e-mail address email@example.com, will process the personal data provided.
You are also informed that Xeridia UK Ltd has a Data Protection Delegate who can be contacted by e-mail at firstname.lastname@example.org. The processing of this data will be carried out for the sole purpose of managing and processing the corresponding complaints of non-compliance or irregularities of the principles and values of the Xeridia UK Ltd Code of Ethics.
In this way, only the data strictly necessary for the fulfilment of the aforementioned purpose will be processed. The processing of this data is based on compliance with a legal obligation. You are informed that you have the right to withdraw your consent at any time, without this affecting the lawfulness of the processing based on the consent prior to its withdrawal.
The Complaints Channel is common to all Xeridia companies and therefore the aforementioned personal data may be transferred to Xeridia UK Ltd subsidiaries if necessary for the investigation, processing and/or resolution of the complaint.
Finally, it should be noted that, in any case, the interested party may at any time, through the Data Protection Delegate, exercise the rights of access, rectification, deletion, limitation, opposition, as well as the right to data portability and not to be subject to automated decisions. You can consult additional and detailed information on Data Protection on our website.
Complaints channel investigation procedure
Xeridia, in order to carry out the investigation work, has developed this internal procedure that regulates the entire life cycle of the complaint, from its initial communication to its resolution, with the aim of verifying the veracity of the communications, the correct gathering of evidence and guaranteeing the rights of the complainant and the reported party. This procedure is divided into two phases:
- Investigation phase: This phase comprises the receipt and initial assessment of the complaint, through to the investigation of the facts reported and the gathering of evidence that provides validity to the facts reported.
- Conclusions Phase: This phase comprises the analysis of the evidence and proof provided and the subsequent drafting of the report by the Ethics Committee, with the possible proposals of sanctioning measures to the Governing Body.
Notification and receipt of the complaint
If the whistleblower chooses to use the Xeridia Whistleblowing Channel, he/she must fill in the whistleblowing form available on the Xeridia UK Ltd. corporate website: Whistleblowing Channel .
The complaint must be individual. In the event that several people have knowledge of the same fact or circumstance that must be reported to Xeridia, each of them must do so individually through the complaints channel.
The contents required in the communication form are as follows:
- Identification of the reported party (unless the report is made anonymously).
- Description of the facts by means of a free field.
On the form itself, the whistleblower is provided with the regulatory provisions in force that guarantee the protection of his/her data during the processing thereof, as well as the exercise of his/her rights (access, rectification, deletion, opposition to processing, among others).
It is important that the complainant provides sufficient detail on the facts, conduct or suspicious activities, so that the Ethics Committee can carry out a preliminary analysis of the content, even allowing the sending of files or attached documents in relation to the reported facts.
This analysis may generate the following results:
- Admission of the complaint: The facts described are reportable facts that may involve an unlawful act or an act contrary to the principles and values of Xeridia, as described in the company’s Good Practices and Corporate Social Responsibility Policies.
- Inadmission of the complaint: The facts described are of a different nature to those mentioned above (see resolution section), and therefore the complaint is either filed or referred to the most appropriate area for processing.
Initiation of the Investigation
The Ethics Committee, once the complaint has been evaluated and admitted, shall proceed to draw up a file on the complaint under investigation, which shall contain the following information:
- Descriptive information on the complaint, indicating the date of receipt.
- Data provided, differentiating between objective and subjective data.
- Assessment of the content of the complaint and the reliability of the complainant.
- Persons affected.
- Proposal of short-term emergency measures, including precautionary measures to minimise the current or imminent damage.
The objective of the opening file is to obtain maximum traceability of the investigation process, in case the complaint may be required by any competent judicial authority.
The investigative team is made up of the members of the Ethics Committee or persons delegated by them with the due guarantees of confidentiality and the rest of the principles of action applicable to the Ethics Committee, who will be in charge of the investigation and the collection of evidence of the complaint.
During the course of the investigation, recourse may be had to other areas of the Organisation to effectively develop the claim for evidence and analysis that allows the facts denounced to be contrasted.
The Governing Body and the People and Culture Department may be called upon at any time by the Ethics Committee to complement, in a coordinated manner, the investigative actions carried out by the latter, always with the utmost confidentiality and discretion.
Finally, in the event of any incompatibility of a member of the Ethics Committee or the Management Body with the investigation in progress, that member shall be excluded from the investigation in order to prevent possible conflicts of interest.
The Ethics Committee shall, if it deems it necessary, take action to investigate the facts and gather additional information in order to make a proper decision, in an objective manner, on the basis of the evidence gathered. Investigation actions may include:
- Requesting new evidence and/or proof from the complainant to improve the investigation process.
- Arranging interviews with the persons involved.
- Reviewing all information relating to the professional relationship of those involved with the Organisation, always respecting the data protection and privacy laws of those involved.
- Forensic analysis by an independent external expert.
- Any other action deemed necessary to continue with the investigation process, respecting current Data Protection regulations.
The investigation will consist, at all times, of an objective analysis of the available documentation, the gathering of evidence, the collection of evidence and the analysis of the same.
The investigation process will last a maximum of 3 months from the day on which the Ethics Committee received the complaint. After the 3 months have elapsed, the data may continue to be processed for the investigation of the facts reported and, where appropriate, by the competent authorities or in legal proceedings, but shall not be kept in the internal whistleblowing information system itself.
Once the evidence has been gathered and analyzed by the Ethics Committee, the investigation phase is closed and a decision is taken on the communication analyzed, proposing to the Governing Body the measures to be adopted.
The Governing Body may adopt the following measures:
- Complaint not admissible: In the event that the investigation of the facts reported reveals the absence of non-compliance. The Ethics Committee shall inform the complainant and the reported person of this decision, together with the reasons for the decision.
- Complaint is admissible: In the event that the alleged facts are proven to be true, the actions supporting such a conclusion shall be detailed. The sanctioning regime will be applied in accordance with the Xeridia Collective Agreement, the labor legislation and the rest of the civil and mercantile obligations, without prejudice to the criminal responsibilities that may derive from the commission of crimes. The Ethics Committee shall inform the whistleblower and in particular the accused in order to offer him/her the possibility of defense.
Report of conclusions
The Ethics Committee shall prepare a report of conclusions reflecting the outcome of the entire research phase. The report of conclusions will contain:
- Technical aspects: title, author, date, date, purpose, level of confidentiality (who has access to it).
- Background of the file: Facts that produced the communication, persons or departments subject of the investigation.
- Object of the investigation and its purpose.
- Actions, relevant facts investigated and detected, evidence and proofs analyzed.
- Conclusions determined, based on the objective and scope of the investigation.
- Proposals of sanctioning measures to be adopted by the Administrative Body, in accordance with Xeridia’s Collective Agreement, the labor legislation and the rest of the civil and mercantile obligations contracted by the member of Xeridia’s staff or the Administrative Body, without prejudice to the criminal liabilities that may arise from the commission of crimes.
The Ethics Committee shall state such conclusions in a clear and concise manner. In addition, should there be any limitation in the course of the investigation, it must be reflected in the report.
The reports resulting from the complaints received and the possible measures adopted shall be reported to the Board of Directors through the Annual Activities Report
Conflict of interest
The presentation of a complaint that directly affects persons who may actively participate in the management and investigation of the same, i.e. one or more members of the Ethics Committee and, if required, of the Administrative Body, shall be automatically excluded throughout the process of investigation and analysis until its resolution, in order to avoid any type of conflict of interest and incompatibility, and thus guarantee the objectivity and independence of the actions carried out by the Ethics Committee itself.
The excluded members of the Ethics Committee and, if required, of the Governing Body, shall be obliged to maintain the utmost confidentiality of the complaint, being forbidden direct or indirect access to any information on the identity of the complainant and of the investigation process in progress.