I. INTERNAL INFORMATION SYSTEM
In compliance with Law 2/2023 of 20 February on the protection of individuals who report regulatory infringements and the fight against corruption (hereinafter “Law 02/2023”), INDUSTRIAS CÁRNICAS MONTRONILL, S.A.U. states that it has an Internal Information System in place and acts as the data controller for the personal data processed, in accordance with current legislation.
With the aim of strengthening the information culture and integrity structures of INDUSTRIAS CÁRNICAS MONTRONILL, S.A.U., and promoting a communication culture as a mechanism for preventing actions or omissions that may constitute criminal or serious/very serious administrative offences, the company has appointed a Criminal Compliance Officer (RCP). The company’s current Financial Manager holds this role and is also designated as the Internal Information System Officer (RSII). Additionally, an alternate responsible person is appointed in case the reported information concerns the conduct of the RCP/RSII. This alternate is currently the company’s HR Manager.
Reports may be submitted through any of the following channels:
Email: compliance1@montronillsau.com
(for reports directed to the RCP)
Email: compliance2@montronillsau.com
(for reports directed to the alternate RCP)
Postal mail: Pol. Industrial Les Casasses, C/ Cantonigròs 10-12 (08500) Vic (Barcelona), addressed to the RCP/RSII or alternate.
A written document delivered directly to the RCP/RSII or, where appropriate, the alternate.
At the informant’s request, a communication may also be submitted through an in-person meeting with the RCP/RSII or, where appropriate, the alternate, within a maximum period of seven days.
Verbal reports made during these meetings must be documented by one of the following methods, with the informant’s prior consent:
a) Audio recording of the conversation in a secure, durable, and accessible format.
(The informant will be notified that the conversation will be recorded and informed of the data processing terms in accordance with Regulation (EU) 2016/679—GDPR.)
b) A full written transcript of the conversation prepared by the person responsible for the report.
(The informant will be allowed to review, correct, and formally accept the transcript with their signature.)
The Internal Information System complies with the requirements of Article 5.2 of Law 02/2023:
a) It allows individuals covered by the Law to submit reports through various channels regarding infringements described in Article 2.
b) It is managed securely, ensuring effective internal handling, confidentiality of the informant’s identity and third parties mentioned in the report, as well as protection of data and prevention of unauthorised access.
c) It includes an Internal Information System Protocol governing the use of the reporting channel and the actions of the Criminal Compliance Officer and the RSII, ensuring protections for informants:
Acknowledgement of receipt within seven calendar days.
A maximum of three months to provide feedback on the investigation, in accordance with Article 9 of the Law, while maintaining a secure Information Logbook.
Possibility of ongoing communication with the informant.
Right of the affected person to be informed of the allegations and to be heard.
Confidentiality even when reports are submitted through non-official channels, with immediate transfer to the appropriate responsible person.
Respect for presumption of innocence and personal honour of those involved.
Compliance with Data Protection rules (Title VI of Law 02/2023).
Commitment to report immediately to the Public Prosecutor if the facts may constitute a criminal offence.
II. PROCESSING OF PERSONAL DATA
INDUSTRIAS CÁRNICAS MONTRONILL, S.A.U. will process the personal data contained in reports submitted under Law 2/2023 as the data controller, for the purpose of managing the reports, initiating investigations where necessary, and applying corrective measures.
The legal basis for the data processing is compliance with the obligations established under Law 02/2023.
If the report contains special category data, these will only be processed when strictly necessary to implement corrective measures, initiate investigations, or process administrative or criminal proceedings. In such cases, the legal basis is essential public interest, and processing will remain strictly limited to what is indispensable.
Personal data may be accessed by authorised staff only when necessary to investigate infringements under EU Law, serious or very serious criminal or administrative offences, or workplace safety infringements, or to implement corrective or legal measures. Personal data may also be shared with third parties when required by law, including judicial authorities, the Public Prosecutor’s Office, or competent administrative authorities.
Personal data will be stored only for the time needed to decide whether an investigation should be initiated. If corrective measures are required, data will be stored for the duration of those measures. If administrative or criminal proceedings must be initiated, data will be stored for the duration of those proceedings.
If no decision is made within three months, the personal data in the communication will be deleted, except those strictly necessary to remain blocked as evidence of the functioning of the Internal Information System in compliance with Law 02/2023. Personal data related to matters outside the scope of the law or considered false will also be deleted, unless such falsity could constitute a criminal offence—in which case the data will be retained for the duration of the legal proceedings.
The informant may exercise their rights of access, rectification, deletion, limitation, objection, and data portability at any time by writing to:
Pol. Industrial Les Casasses, C/ Cantonigròs 10-12 (08500) Vic (Barcelona)
or emailing info@montronillsau.com
If the informant disagrees with the processing of their data, they may file a complaint with the Spanish Data Protection Agency (AEPD), located at C/ Jorge Juan, 6 (28001) Madrid (www.aepd.es
).
III. NON-RETALIATION
INDUSTRIAS CÁRNICAS MONTRONILL, S.A.U. explicitly undertakes not to commit any acts of retaliation—including threats or attempted retaliation—against individuals who make good-faith reports under Law 2/2023, and to apply protective measures during the handling of any case affecting individuals involved.
IV. EXEMPTION AND MITIGATION OF SANCTIONS
If a person involved in the commission of an administrative offence is the one who reports it through this system before being notified of the initiation of an investigation or sanctioning procedure, the competent authority may, through a reasoned resolution, exempt them from the corresponding administrative sanction, provided the conditions in Article 40 of Law 02/2023 are met.
(*) Anonymous reporting is permitted through the Internal Information Channel.
(**) Although internal reporting is preferred, reports may also be submitted to the Independent Informant Protection Authority, regional authorities, the Public Prosecutor’s Office, the European Public Prosecutor’s Office, or other competent authorities.
