Information on the Processing of Personal Data – Eurosol SAT Internal Information Channel

Eurosol SAT provides all users with an Internal Information Channel intended to communicate, with all guarantees, possible regulatory infractions or behaviors contrary to the law or the organization’s values. Below, transparent information is provided regarding the processing of personal data that may be incorporated through this channel.

---

1. Data Controller

Eurosol SAT CIF: V04324323 Address: CR SECTOR CUARTO 2755 BIS, 04738 VICAR (ALMERIA) Contact: proteccióndedatos@eurosol.es

2. Purpose of the processing

Personal data that may be incorporated into a communication made through the channel will be processed exclusively to:

• Manage and process the communication or report received.
• Analyze the facts, carry out the corresponding verifications, and adopt the necessary measures.
• Comply with the legal obligations derived from Law 2/2023, of February 20, regulating the protection of persons who report regulatory infractions and the fight against corruption.

3. Channel Characteristics and Technical Guarantees

3.1. Secure Platform (GlobalLeaks)

The channel is hosted on a secure server managed with GlobalLeaks technology, whose architecture is designed to guarantee the confidentiality, integrity, and non-traceability of information.

• No technical information that allows the user to be identified is recorded.
• Only authorized Eurosol SAT personnel can access the communications for processing.
• The platform prevents third parties, including the hosting provider, from having access to the content of the reports.

4. Nature of the processed data

4.1. Anonymous submission

• The user is not obliged to provide any personal data.
• Communications can be submitted completely anonymously.

4.2. Voluntary inclusion of personal data

If the user decides to include identifying data or any other personal data in the text fields, such data will be processed only for the indicated purposes.

5. Alternative communication via WhatsApp

In addition to the secure channel, users are offered the alternative option of communicating incidents via WhatsApp. Please note that:

• This communication is not carried out through the secure GlobalLeaks server.
• It is not a confidential route, as WhatsApp involves processing by third parties according to their own terms and policies.

Management via WhatsApp does not leave a record at Eurosol SAT:

• It is handled directly by an external company in charge of the service:
  • Company Name: Intelligence Aware S.L.
  • Contact Email: info@intelligenceaware.com
  • CIF: B23925605
  • Address: C/PEDRO PONDE, 121 1º 14 04700 (EJIDO (EL))
• Data shared through WhatsApp will be subject to the service provider’s conditions and the external company’s privacy policy.

It is recommended to preferably use the secure Internal Information Channel if confidentiality, anonymity, and reinforced protection are desired.

6. Legal basis for processing

The processing of personal data carried out in the Internal Information Channel is based on:

• Compliance with a legal obligation (Art. 6.1.c GDPR), derived from Law 2/2023 regulating the protection of persons who report regulatory infractions.
• Essential public interest (Art. 6.1.e GDPR), linked to the prevention and investigation of infractions.
• In case of including unnecessary or voluntary personal data, the processing is based on the legitimate interest of the controller (Art. 6.1.f GDPR) to investigate the reported facts.

Consent will not be requested, as the channel is based on legal obligations and public interest guarantees.

7. Data Retention

Data will be kept for the time strictly necessary to analyze the facts and resolve the investigation. In accordance with Law 2/2023:

• Communications will be deleted within a maximum of 3 months from entry if no action is initiated.
• If an investigation is opened, the information will be kept only as long as necessary to comply with legal obligations.

8. Communication of data to third parties

Data may be communicated to:

• Competent judicial or administrative authorities, when necessary for the investigation of the facts or when any liability arises.
• Service providers (processors) that require access to information, always under data processing agreements and with due guarantees (except for the WhatsApp option, which operates outside the system and is managed by an independent third party).

In no case will data be transferred to third parties without a legal basis.

9. Exercise of rights

Users may exercise their rights of:

• Access
• Rectification
• Erasure
• Restriction of processing
• Objection

However, depending on the nature of the channel and anonymity, the Controller may not be able to identify the informant; in such cases, rights will only be guaranteed when technically possible. To exercise these rights, you may contact: protecciondedatos@eurosol.es

10. Security measures

Eurosol SAT applies technical and organizational measures to protect information, such as:

• Encryption
• Access control
• Secure logs
• Investigation protocols with access restricted only to authorized personnel