Privacy Policy

Data Controller

The information and/or personal data you provide us with will be processed by Forvis Mazars Financial Advisory, S.L. as Data Controller, whose identifying details are:

• Tax ID B65348088

• Postal address: C/ Diputació, 260, 08007 - Barcelona

• Contact details for the Data Protection Officer: compliants.es@forvismazars.com

Personal data we process

The data collected is that which you provide us when you communicate information through this Website or through the Communication Channels. The data that may be processed to carry out the purpose(s) upon which you have been and are being informed are:

• Name

• Surname(s)

• E-mail

• Relationship to the company

• Telephone number

• Name of the company subject to the communication

• Subsidiary or branch of the company subject to the communication

• Type of communication

• Facts subject to the communication

• Other information that may be identified in the description of the reported event.

Fields marked with an asterisk on the Website's collection forms are mandatory. These fields may vary depending on whether the communication is anonymous or not. In any case, the name of the company about which the communication is made, its subsidiary or branch, the type of communication, and the facts that are the subject of the communication are mandatory.

We may also collect personal data about you indirectly if it is provided to us by any person involved in the investigation or proceedings.

Purposes for which we process your data

At Forvis Mazars Financial Advisory, we will process your data in order to receive, respond to, and manage your communication of information, conduct the corresponding investigation into your communication if necessary, and take the appropriate decisions or actions, as applicable. Likewise, we may process personal data to comply with our legal obligations if we are required by Law to report certain matters to the relevant authorities or in the context of legal proceedings.

Personal data will be treated with due confidentiality, and the identity of the whistleblower will be kept confidential, in accordance with applicable regulations.

Legitimacy of data processing

The legal basis for processing your personal data is compliance with a legal obligation in accordance with the provisions of Article 6.1.c) of the General Data Protection Regulation (GDPR).

Recipients of the data

The data will be processed confidentially, and the identity of the whistleblower will be kept confidential, and will not be disclosed to any third party nor will they be subject to international transfers, except under legal obligation or unless (i) it is essential for the investigation of the reported facts, (ii) it is required by the State Security Forces and Corps and/or the competent judicial or administrative authorities, or (iii) it is necessary in the context of a criminal, disciplinary, or punitive investigation.

We also inform you that Forvis Mazars Financial Advisory contracts with service providers for the management of the aforementioned purposes, these being Forvis Mazars Auditores the owner of the reporting platform through which you can send information. Forvis Mazars Auditores, under the commitment of professional secrecy, shall keep your identity reserved and with the due confidentiality. Forvis Mazars Auditores shall receive your communication of information and send you an acknowledgement of receipt, and may ask you to clarify or complete the information communicated through the platform or the information channels made available to you through the platform. Likewise, you shall be provided with a reasonable follow-up on the progress of your communication and Forvis Mazars Financial Advisory shall receive the report of the communication received so to decide whether or not to open an investigation and make the corresponding decisions or actions, where appropriate.

Likewise, Forvis Mazars Financial Advisory may also engage external advisors to provide support services in the framework of the investigation, if necessary.

These companies are subject to a contract with Forvis Mazars Financial Advisory as data processors which guarantees that your data shall not be used for purposes other than those mentioned above.

Data storage

The data will be stored in the internal information system for the time necessary to decide whether to initiate an investigation into the reported events. In any case, three months after we have collected your data, we will proceed to delete it from the internal information system unless we need to retain it to demonstrate the functioning of the system or it needs to be processed by the body or person responsible for investigating the events.

In any case, as a maximum retention period, personal data relating to information received and to internal investigations will be retained for as long as is necessary and proportionate for legal purposes and for a maximum period of 10 years.

Exercising your rights

Under the terms and within the scope established by current regulations, you have the right to:

• Confirm whether in Forvis Mazars Financial Advisory we are processing personal data concerning you or not, as well as access that data and information related to its processing.

• Request the rectification of inaccurate or incomplete data.

• Request the erasure of data when, among other reasons, it is no longer necessary for the purposes for which it was collected, in which case Forvis Mazars Financial Advisory will cease to process the data except for the exercise or defense of possible claims.

• Request the restriction of the processing of your data, in which case it may only be processed with your consent, except for its storage and use for the exercise or defense of claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a specific Member State.

• Object to the processing of your data, in which case, Forvis Mazars Financial Advisory will cease processing the data, except for the defense of potential claims. If the person to whom the facts described in the communication relate exercises their right to object, it will be presumed that, unless proven otherwise, there are compelling legitimate grounds that justify the processing of their personal data.

You may exercise these rights, as applicable, by sending your request to Calle Alcalá 63, 28014 Madrid or by sending an e-mail to compliants.es@forvismazars.com.

We inform you that you may file a complaint with the Spanish Data Protection Agency if you consider that Forvis Mazars Financial Advisory has not satisfactorily exercised your rights, through its website: www.aepd.es/en

Cookie policy

Forvis Mazars Financial Advisory’ internal reporting channel, provided by our external provider, Forvis Mazars, collects information about user browsing through text files called cookies. These are first-party cookies that are sent to the user's terminal equipment from a computer or domain managed by Forvis Mazars in order to store and retrieve information. These are technical cookies used for the functioning and operation of the website and personalization cookies used to remember configuration settings or the language selected.

For more information, please consult Our Cookie Policy.

Modification of this Policy

Forvis Mazars Financial Advisory reserves the right to modify and/or update this Privacy Policy at any time, as well as any information that may appear on the Website, without prior notice.

Last updated: 12 September 2025