I. INTRODUCTION, PURPOSE AND APPLICATION

Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption (hereinafter, Law 2/2023) transposes Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law into Spanish law.

This policy applies to FUNDACIÓ ÒPERA A CATALUNYA with Tax Identification Number G67544643 and registered office at C/ Narcís Giralt, 40, 8202, Sabadell, Barcelona; and aims to establish an internal channel for reporting possible regulatory breaches, breaches of internal and/or ethical policies and to establish a whistleblower protection regime, in compliance with Law 2/2023 of 20 February, regulating the protection of persons who report regulatory breaches and the fight against corruption.

Law 2/2023 explains and clarifies in its preamble, Part III, that its purpose is to protect, against possible reprisals, persons who, in a work or professional context, detect serious or very serious criminal or administrative violations and report them through the mechanisms regulated in this policy.

This Channel is therefore a mechanism that allows company employees and other interested parties to report any type of illegal conduct or conduct contrary to our values and ethical principles, without fear of reprisals, strengthening the culture of information, the integrity infrastructures of organisations and the promotion of a culture of information or communication as a mechanism for preventing and detecting threats to the public interest. In this way, we seek to promote a culture of transparency, integrity and responsibility in our organisation, while protecting those employees who decide to make a report in good faith.

II. WHISTLEBLOWER CHANNEL

The entity has created a whistleblower channel (hereinafter, the CII) as the preferred channel for receiving information about actions or omissions that may constitute a serious or very serious criminal or administrative offence, and other actions provided for in Article 2 of Law 2/2023.

The channel is administered by the Internal Channel System Manager (hereinafter, the ICSM). Access to this channel shall be limited, within the scope of its powers and functions, to:

1. The Head of the Internal Channel System.
2. The administrator(s) delegated by the system manager.
3. The managers designated to process certain complaints according to the area to which they correspond.

The functions of these bodies, as appropriate, shall be:

• Receipt, registration and management of complaints received through the whistleblower channel.
• Appointment of the person or team responsible for investigating the complaints received.
• Ensuring the protection of whistleblowers and the confidentiality of complaints received.
• Evaluating the veracity and credibility of complaints received.
• AMaking decisions on appropriate measures based on the results of the investigation.
• Monitoring and periodic review of the complaint management process and the company’s internal policy.
• Preparation of reports and recommendations for senior management on complaints received and measures taken.

The CII must technically guarantee the confidentiality or, where appropriate, the anonymity of the whistleblower, in order to protect them from any leaks and subsequent reprisals to which they may be subjected.

III. SUBJECTIVE SCOPE – REPORTING PARTIES

Those who have an employment or professional relationship with the AEPD may use the internal reporting channel and benefit from the protection afforded by Law 2/2023 as whistleblowers to report information about the actions or omissions described in Article 2 of Law 2/2023. This employment or professional relationship, which entails a dependency on the AEPD, is what makes special protection against possible reprisals necessary and appropriate.

In any case, for the purposes of Law 2/2023, the AEPD considers the following to be whistleblowers:

• Persons who are employees or workers in the service of others.
• Freelancers.
• Shareholders, participants and persons belonging to the administrative, management or supervisory body of the company, including non-executive members.
• Any person working for or under the supervision and direction of contractors, subcontractors and suppliers.
• Whistleblowers who communicate or publicly disclose information about infringements obtained in the context of a terminated employment or statutory relationship, volunteers, interns, workers in training periods regardless of whether or not they receive remuneration, as well as those whose employment relationship has not yet begun, in cases where the information about infringements has been obtained during the selection process or pre-contractual negotiations.

It is important to note that reports made through the whistleblower channel must be made in good faith, i.e. they must be supported by evidence and specific facts.

IV. SCOPE – REPORTABLE FACTS

With regard to the subject matter of the information, it follows from Law 2/2023 that the internal reporting channel may be used to report serious misconduct or alleged corruption that may constitute serious or very serious criminal or administrative offences related to the entity’s activities, which the whistleblower has observed or about which they have received information in the course of their work or professional relationship.

Law 2/2023 itself and Directive (EU) 2019/1937 list as such information relating to:

1. 1. Offences falling within the scope of the European Union acts listed in the annex to the aforementioned Directive relating to the following areas:
   1. public procurement,
   2. services, products and financial markets, and prevention of money laundering and terrorist financing,
   3. product safety and conformity,
   4. transport safety,
   5. environmental protection,
   6. radiation protection and nuclear safety,
   7. food and feed safety, animal health and animal welfare,
   8. public health,
   9. consumer protection,
   10. protection of privacy and personal data, and security of networks and information systems
2. Affecting the financial interests of the European Union as referred to in Article 325 of the Treaty on the Functioning of the European Union (TFEU).
3. That affect the internal market, as referred to in Article 26(2) TFEU, including infringements of European Union rules on competition and State aid, as well as infringements relating to the internal market in connection with acts that infringe corporate tax rules or practices aimed at obtaining a tax advantage that distorts the object or purpose of the applicable corporate tax legislation.
4. Actions or omissions that may constitute a serious or very serious criminal or administrative offence. In any case, this shall be understood to include all serious or very serious criminal or administrative offences that involve financial loss to the Treasury and Social Security.
5. Violations of labour law in the area of occupational health and safety reported by workers, without prejudice to the provisions of specific regulations.

The reporting person must provide, as a minimum, a reference to the subjective scope of the offence (subject matter or regulations infringed: European Union law; criminal offence; or administrative offence); and a description of the facts being reported (relevant information about what happened), as detailed as possible, attaching any documentation they may have, where applicable.

Similarly, they may provide their name and surname(s) and a contact telephone number, if they do not choose to make this report anonymously.

If you know the identity of the person responsible for the irregularity reported, or if you have reported these facts to another body or entity through an external channel, you may also provide this information.

V. REPORTING PROCEDURE

The information may be communicated to the entity anonymously. Otherwise, the identity of the whistleblower will be kept confidential and will be limited to the knowledge of the RSII, managing directors or appointed managers. These members will carry out their duties independently and autonomously from the rest of the bodies of the organisation or body and may not receive instructions of any kind in the exercise of their duties, having all the necessary personal and material resources to carry them out.

The company undertakes to investigate all reports of possible infringements or breaches received through the reporting channel. All reports will be investigated impartially and confidentially, and appropriate measures will be taken based on the results of the investigation to protect the whistleblower.

The information or report shall be communicated through the internal information channel using the specific electronic application for this purpose, identified and accessible from the website: https://operacatalunya.cat/

At the request of the whistleblower, the report may also be submitted in person at a meeting to be held within a maximum period of seven days. Where applicable, the whistleblower will be advised that the communication will be recorded and will be informed of the processing of their data in accordance with the provisions of the GDPR and the LOPDPGDD. When submitting the information, the whistleblower must provide an address, email address or secure location for the purpose of receiving notifications, unless they expressly waive the right to receive any communication regarding actions taken by the RSII as a result of the information provided.

Once the information has been submitted, it will be recorded in the information management system by assigning an identification code, which will be stored in a secure database with access restricted exclusively to duly authorised RSII personnel, in which all communications received will be recorded with the following details:

1. Date of receipt.
2. Identification code.
3. Actions taken.
4. Measures taken.
5. Date of closure.

Once the information has been received, within a period not exceeding 7 calendar days from said receipt, acknowledgement of receipt will be sent to the informant, unless they have expressly waived their right to receive communications relating to the investigation at . These complaints will be processed within a maximum period of 3 months, except in cases of particular complexity that require an extension of the deadline, in which case it may be extended for a maximum of 3 additional months.

UOnce the information has been recorded, the RSII and its team will proceed to analyse its admissibility in accordance with the material and personal scope provided for in Articles 2 and 3 of Law 2/2023.

The company undertakes to inform the complainant of the status of the investigation and the measures taken, whenever possible and without compromising the confidentiality and protection of the complainant, and may request additional information on the facts reported through the channel.

In addition, the company undertakes to follow up on all complaints received and the measures taken to ensure the effectiveness of this policy and to continuously improve the process.

Any information that could constitute evidence of a crime will be immediately forwarded to the Public Prosecutor’s Office. If the facts affect the financial interests of the European Union, they will be forwarded to the European Public Prosecutor’s Office.

VI. PROTECTION OF WHISTLEBLOWERS

The company undertakes to protect persons who report infringements or breaches, in accordance with Law 2/2023.

A. Acts constituting retaliation.

Acts constituting retaliation, including threats of retaliation and attempts at retaliation against persons who submit a report in accordance with the provisions of the law, are expressly prohibited.

Retaliation is understood to mean any act or omission that is prohibited by law or that, directly or indirectly, involves unfavourable treatment that places the persons suffering it at a particular disadvantage in relation to others in the workplace or professional context, solely because of their status as whistleblowers or because they have made a public disclosure.

For the purposes of Law 2/2023, and by way of example, retaliation is considered to be any of the following:

1. Suspension of the employment contract, dismissal or termination of the employment or statutory relationship, including non-renewal or early termination of a temporary employment contract once the probationary period has been completed, or early termination or cancellation of contracts for goods or services, imposition of any disciplinary measure, demotion or denial of promotion and any other substantial change in working conditions and the non-conversion of a temporary employment contract into a permanent one, in the event that the worker had legitimate expectations that he or she would be offered a permanent job; unless these measures were carried out in the regular exercise of management power under labour legislation or regulations governing the status of the relevant public employee, due to proven circumstances, facts or infringements, and unrelated to the submission of the report.
2. Damages, including reputational damage, or financial losses, coercion, intimidation, harassment or ostracism.
3. Negative assessment or references regarding work or professional performance.
4. Inclusion on blacklists or dissemination of information in a specific sector, which hinders or prevents access to employment or the contracting of works or services.
5. Denial or cancellation of a licence or permit.
6. Denial of training.
7. Discrimination, or unfavourable or unfair treatment.

Any person whose rights have been infringed as a result of their communication or disclosure may, after a period of two years, request protection from the competent authority, which may, in exceptional and justified cases, extend the period of protection, after hearing the persons or bodies that may be affected. Any refusal to extend the period of protection must be justified.

Administrative acts intended to prevent or hinder the submission of communications and disclosures, as well as those that constitute retaliation or cause discrimination following the submission of such communications and disclosures under this law, shall be null and void and shall give rise, where appropriate, to corrective disciplinary or liability measures, which may include the corresponding compensation for damages to the injured party.

B. Measures to protect whistleblowers from retaliation

Persons who communicate information about the actions or omissions referred to in section FOUR, or who make a public disclosure in accordance with Law 2/2023, shall not be considered to have breached any restriction on disclosure of information and shall not incur any liability in relation to such communication or public disclosure, provided that they had reasonable grounds to believe that the communication or public disclosure of such information was necessary to reveal an action or omission under that law, without prejudice to the specific protection rules applicable in the workplace. This measure shall not affect criminal liability.

The provisions of the preceding paragraph shall extend to the communication of information by workers’ representatives, even if they are subject to legal obligations of secrecy or non-disclosure of confidential information. All of the above shall be without prejudice to the specific protection rules applicable in the workplace.

Whistleblower protection measures shall also apply, where appropriate, to:

1. natural persons assisting the whistleblower in the process;
2. natural persons who are related to the whistleblower and who may suffer reprisals, such as the whistleblower’s co-workers or family members;
3. legal persons for whom they work or with whom they have any other type of relationship in a work context or in which they hold a significant stake.

For these purposes, participation in the capital or voting rights corresponding to shares or holdings is understood to be significant when, due to its proportion, it allows the person who owns it to have the capacity to influence the legal entity in which they have a stake.

Whistleblowers shall not be liable for the acquisition of or access to information that is publicly communicated or disclosed, provided that such acquisition or access does not constitute a criminal offence.

Any other possible liability of whistleblowers arising from acts or omissions that are not related to the communication or public disclosure, or that are not necessary to disclose an infringement under Law 2/2023, shall be enforceable in accordance with the applicable regulations.

In proceedings before a court or other authority concerning damage suffered by whistleblowers, once the whistleblower has reasonably demonstrated that they have communicated or made a public disclosure in accordance with Law 2/2023 and that they have suffered damage, it shall be presumed that the damage occurred in retaliation for reporting or making a public disclosure. In such cases, it shall be incumbent upon the person who took the harmful measure to prove that the measure was based on duly justified grounds unrelated to the communication or public disclosure.

In legal proceedings, including those relating to defamation, copyright infringement, breach of confidentiality, breach of data protection rules, disclosure of trade secrets, or claims for compensation based on labour or statutory law, whistleblowers shall not incur any liability as a result of communications or public disclosures protected by Law 2/2023. Such persons shall have the right to plead in their defence and in the context of the aforementioned legal proceedings that they communicated or made a public disclosure, provided that they had reasonable grounds to believe that the communication or public disclosure was necessary to reveal a violation under Law 2/2023.

The following persons are expressly excluded from the protection provided by the law: those who communicate or disclose:

1. Information contained in communications that have been rejected by an internal information channel or for any of the reasons provided for in the law.
2. Information related to complaints about interpersonal conflicts or that only affect the whistleblower and the persons referred to in the communication or disclosure.
3. Information that is already fully available to the public or that constitutes mere rumours.

Information relating to actions or omissions not covered by the scope of the law.

C. Measures for the protection of affected persons

During the processing of the case, the persons affected by the communication shall have the right to the presumption of innocence, the right of defence and the right of access to the case file under the terms provided for in Law 2/2023, as well as the same protection established for whistleblowers, preserving their identity and guaranteeing the confidentiality of the facts and data of the proceedings.

The Independent Whistleblower Protection Authority (A.A.I.) may, within the framework of the disciplinary proceedings it conducts, adopt provisional measures under the terms established in Article 56 of Law 39/2015, of 1 October, on the Common Administrative Procedure of Public Administrations.

D. Cases of exemption and mitigation of the sanction

When a person who has participated in the commission of the administrative offence that is the subject of the report is the one who reports its existence by submitting the information, and provided that the information has been submitted prior to notification of the initiation of the investigation or disciplinary proceedings, the body competent to resolve the proceedings may, by means of a reasoned decision, exempt them from the administrative penalty that would otherwise apply, provided that the following points are proven in the case file:

1. That they have ceased to commit the offence at the time of submission of the communication or disclosure and, where appropriate, identified the other persons who participated in or facilitated it.
2. They have cooperated fully, continuously and diligently throughout the investigation procedure.
3. You have provided truthful and relevant information, evidence or significant data to support the facts under investigation, without destroying or concealing them, or directly or indirectly disclosing their content to third parties.
4. Have repaired the damage caused that is attributable to them.

Where these requirements are not fully met, including partial repair of the damage, it shall be at the discretion of the competent authority, after assessing the degree of contribution to the resolution of the case, to mitigate the penalty that would have corresponded to the infringement committed, provided that the informant or author of the disclosure has not been previously penalised for acts of the same nature that gave rise to the initiation of the proceedings.

The reduction in the penalty may be extended to the other participants in the infringement, depending on the degree of active cooperation in clarifying the facts, identifying other participants and repairing or mitigating the damage caused, as assessed by the body responsible for the resolution.

Law 2/2023 excludes from the provisions of this section the offences established in Law 15/2007 of 3 July on the Defence of Competition.

VII. CONFIDENTIALITY AND DATA PROTECTION

The processing of personal data shall be carried out in compliance with Law 2/2023 of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights, and Organic Law 7/2021, of 26 May, on the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offences and the enforcement of criminal penalties.

The personal data being processed, the documents provided and any other information provided in the complaint that contains personal information will be treated confidentially by those responsible for the channel, as well as by the administrators and possible managers, for the purpose of complying with the obligation to investigate and manage the report submitted, as well as to comply with the legal obligations established in Law 2/2023, of 20 February, regulating the protection of persons who report regulatory offences and the fight against corruption.

The internal reporting system must prevent unauthorised access and preserve the identity and guarantee the confidentiality of the data corresponding to the persons concerned and any third party mentioned in the information provided, especially the identity of the whistleblower if they have been identified . The identity of the whistleblower may only be disclosed to the judicial authority, the Public Prosecutor’s Office or the competent administrative authority in the context of a criminal, disciplinary or sanctioning investigation, and these cases shall be subject to the safeguards established in the applicable regulations.

If the information received contains special categories of personal data subject to special protection, it shall be deleted immediately, unless processing is necessary for reasons of substantial public interest in accordance with Article 9.2.g) of the GDPR, as provided for in Article 30.5 of Law 2/2023.

In any case, personal data whose relevance is not evident for the processing of specific information will not be collected or, if collected by accident, will be deleted without undue delay.

Communications that have not been processed may only be recorded in anonymised form, without the blocking obligation provided for in Article 32 of the LOPDPGDD being applicable.

Access to personal data contained in the internal information system shall be limited to:

1. The Internal Channel System Manager.
2. The administrator(s) delegated by the system manager.
3. The managers designated to process certain complaints according to the area to which they correspond.
4. The data may be disclosed to the Legal Department, lawyers, judicial bodies and state security forces and bodies if any of the information received is likely to be considered a crime or legal offence of any kind.

Legal basis for processing: The processing of personal data, in cases of internal communication, shall be understood to be lawful by virtue of the provisions of Articles 6.1.c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, 8 of Organic Law 3/2018 of 5 December, and 11 of Organic Law 7/2021 of 26 May, when, in accordance with the provisions of Articles 10 and 13 of the law, it is mandatory to have an internal information system. If it is not mandatory, the processing shall be presumed to be covered by Article 6.1.e) of the aforementioned regulation. The processing of personal data in cases of external communication channels shall be understood to be lawful by virtue of the provisions of Articles 6.1.c) of Regulation (EU) 2016/679, 8 of Organic Law 3/2018, of 5 December, and 11 of Organic Law 7/2021, of 26 May.

Rights of the data subject: access, rectification, erasure, restriction, portability and objection, free of charge, by email to: arico@osvalles.com in the cases provided for by law.

Retention: The data will be retained for the legal period established for the processing of the file and for the time necessary to take legal action or, if necessary, to leave evidence of the management of the channel. The data subject also has the right to lodge a complaint with the AEPD at www.aepd.es to request the protection of their rights.

VIII. COMMUNICATION AND REVIEW OF POLICIES AND PROCEDURES

The company will conduct regular training and awareness campaigns to promote a culture of integrity and transparency and to inform employees and other stakeholders about the reporting channel. It will also provide information on the rights and protections afforded to whistleblowers under Law 2/2023.

The company undertakes to disseminate this policy to all employees and stakeholders, and will update, at least every three years and, where appropriate, amend this internal channel policy, taking into account the experience gained and the recommendations of the Competent Authority.