Whistleblowing Policy

1. INTRODUCTION
Germark, S.A., with the aim of promoting a true corporate culture aligned with its values and principles, has implemented a regulatory compliance system within its organization and operations.
To fulfill this commitment, this Protocol has been prepared, setting out the rules for the management and resolution of complaints received through the compliance channel.

2. PURPOSE
The purpose of this protocol is to regulate a key mechanism to ensure compliance with regulations, enabling the company to prevent possible breaches and to correct those that are detected.
It serves as a channel through which Germark, S.A. receives and manages information or complaints regarding potential irregular conduct that constitutes a violation of either external regulations or internal rules contained in its protocols and Codes of Conduct.

3. SCOPE OF APPLICATION
This protocol applies to all individuals who are part of the company, whether executives or employees, as well as any other person, whether or not linked to the company, who becomes aware of any breach of legal regulations or internal company rules contained in the Code of Ethics.
The Management of Germark, S.A. and the appointed Coordinator, Ignasi Puig, must ensure that this Protocol is made available to all employees and other individuals or legal entities linked to Germark, S.A.

4. GUARANTEES
To ensure proper functioning, the complaints channel upholds a series of essential guarantees for the complainant, the accused, and other potentially involved persons.

Complainant guarantees: these are essential for the effectiveness of the channel, as their absence would discourage its use when improper conduct that constitutes a regulatory breach is known. These guarantees are:

• Confidentiality: the complaints channel ensures the confidentiality of the complainant and communications.
• Protection against retaliation: complaints made cannot lead to reprisals against the complainant. Therefore, the company may not impose any sanction on the employee that is motivated by or related to the complaint.
• Right to be informed of the outcome and follow-up of the complaint.

Accused guarantees: the channel also safeguards the rights of the accused and others who may be affected. These guarantees include:

• The accused has the right to know that a complaint has been filed against them.
• The accused has the right to be heard during the proceedings and to submit any statements they deem appropriate.
• The reported facts must be true, and false complaints are strictly prohibited. If a complaint is found to be false, Germark, S.A. may impose sanctions on the complainant according to its Code of Conduct or internal manuals.

Guarantees for other affected parties: there may be third parties involved, such as affected persons, witnesses, etc., whose rights must also be protected. Therefore:

• Privacy and dignity of other individuals potentially involved will be safeguarded.
• The complainant must ensure that the information included in the complaint is accurate, as it could affect individuals other than the accused.

5. PROCEDURE
5.1. Submission of the complaint
Complaints can be submitted via the company’s channels:
https://web.germark.com/gknews/2023/12/canal_de_denuncias/ (intranet).
The facts reported must be true, and the complainant must ensure the accuracy of the information provided.

5.2. Receipt of the complaint
Once a complaint is received, it will be registered, and an acknowledgment of receipt will be sent to the complainant within seven business days.
The complaint will then be analyzed and may either be closed or result in the opening of an investigation if there are indications of criminal behavior, non-criminal regulatory violations, or breaches of internal company policies.

Closing the complaint:
If the complaint is unfounded, it will be closed, and the complainant will be informed. Personal data in the complaint will be deleted from the channel.

Opening and processing the case:
If indications of validity are found, the person responsible for the complaints channel will inform the Management of Germark, S.A. of the opening of the case.
The complaint must also be forwarded to the accused within ten business days, allowing them to submit any responses within the following three business days.
During the investigation, appropriate precautionary measures may be taken to immediately stop any regulatory violation.
With transparency and confidentiality, an investigation process will begin, lasting three months from receipt of the complaint, extendable by another three months if more complex inquiries are required.
During this time, the necessary evidence will be collected to conduct an effective investigation (interviews, documents, external or internal sources, etc.).
The person in charge will have the authority to request any information from departments or personnel within Germark, S.A.
The investigation will be conducted with utmost diligence, respecting the presumption of innocence and the rights of the accused.

Once concluded, a justified report will be issued with the following possible recommendations:

• Dismissal of the complaint if no regulatory violation is confirmed.
• Appropriate corrective or disciplinary actions if a violation is verified. These may include sanctions per internal policies (Code of Ethics, Code of Conduct, etc.), reporting the matter to judicial or prosecutorial authorities if criminal in nature, or taking preventive actions to avoid recurrence—always in accordance with the Collective Agreement for Graphic Arts, Paper and Cardboard Handling, Publishing, and Related Industries.

5.3. Conclusion of the case
The final decision on the case lies with the Management of Germark, S.A., which may opt to dismiss the complaint or apply corrective or disciplinary measures.
The complainant will be informed of the outcome within three months or six months if the investigation period was extended, as outlined above.

6. DATA PROCESSING IN THE COMPLAINTS CHANNEL
In accordance with Article 24.4 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights, the data of the complainant, employees, and third parties will only be retained in the system for the time strictly necessary to decide whether to initiate an investigation.
In any case, pursuant to Article 22.4, after three months from the data’s entry, it will be deleted from the system unless its retention is intended to provide evidence of the company’s criminal prevention model.
Unprocessed complaints will be anonymized, and the data blocking obligation of Article 32 will not apply.
After three months (or six if the investigation is extended), the data may still be used by the competent body handling the investigation, but it will no longer be stored in the internal reporting system.

Cornellà, December 1, 2024.