Information management procedure
1. PURPOSE
The internal information channel is the internal communication channel that, as a mailbox or channel, is launched by ACMI SOLUTIONS SL (hereinafter ACMI) for the reception of information regarding the actions or omissions provided for in Law 2/2023, of February 20, regulating the protection of people who report regulatory infractions and the fight against corruption and is integrated into ACMI’s internal information system.
The purpose of this channel is to serve as a means of receiving information, provided that the infraction can be effectively dealt with internally, so that possible cases of fraud and other irregularities, within the scope of application of the Law and that affect ACMI , are known as soon as possible by those responsible for it, since it is preferable that the information about irregular practices be known by the organization itself in order to correct them or repair the damage as soon as possible, although it will be the informant who assesses what course to follow, internal or external, depending on the circumstances and the risks of retaliation that you consider.
2. MATERIAL SCOPE OF APPLICATION OF THE INTERNAL INFORMATION CHANNEL
The internal information system must, through its internal channel, allow the reception of information communications related to:
a) Actions or omissions that may constitute infringements of European Union Law provided that:
1.-They fall within the scope of application of the Union acts listed in the Annex to Directive (EU) 2019/1937, regardless of the classification that the domestic legal system makes of them. To this end, it must be kept in mind that the aforementioned Directive establishes common minimum standards for the protection of persons who report the following infringements of Union law:
I. public procurement,
I. financial services, products and markets, and prevention of money laundering and the financing of terrorism,
III. product safety and compliance,
IV. transportation security,
V. environmental Protection,
saw. radiation protection and nuclear safety,
VII. food and feed safety, animal health and animal welfare,
VIII. public health,
IX. consumer protection, x) protection of privacy and personal data, and security of networks and information systems.
2.- Affect the financial interests of the European Union as contemplated in article 325 of the Treaty on the Functioning of the European Union (TFEU); either.
3.- Affect the internal market, as contemplated in Article 26, paragraph 2 of the TFEU, including infringements of Union rules on competition and aid granted by States, as well as infringements relating to the internal market in relation to acts that infringe corporate tax rules or practices whose purpose is to obtain a tax advantage that undermines the object or purpose of the legislation applicable to corporate tax.
b) Actions or omissions that may constitute a serious or very serious criminal or administrative infraction. In any case, all serious or very serious criminal or administrative infractions that imply economic loss for the Public Treasury and Social Security will be understood to be included.
c) Violations of labor law regarding occupational health and safety reported by workers, without prejudice to the provisions of their specific regulations.
3. PERSONAL SCOPE OF APPLICATION OF THE INTERNAL INFORMATION CHANNEL
The information received from informants who have obtained information about infractions in the work or professional context related to ACM will be received, processed and monitored, including in all cases:
a) People who have the status of employed workers. b) The self-employed.
b) Shareholders, participants and persons belonging to the administrative, management or supervisory body of a company, including non-executive members.
c) Any person who works for or under the supervision and direction of contractors, subcontractors and suppliers.
d) Informants who communicate or publicly reveal information about infractions obtained within the framework of an employment or statutory relationship that has already ended, volunteers, interns, workers in training periods regardless of whether or not they receive remuneration, as well as those whose relationship employment has not yet begun, in cases where information about infractions has been obtained during the selection or pre-contractual negotiation process.
4. MANAGEMENT OF THE INTERNAL INFORMATION CHANNEL
This internal information channel will be managed by the person responsible for the Internal Information System.
In order for the channel to be effective, ACMI will ensure that said channel complies with all the requirements established in Law 2/2023, of February 20, regulating the protection of people who report regulatory infractions and the fight against corruption. . Among them it is worth highlighting:
a) Guarantee the confidentiality of the identity of the informant, as well as of any third party mentioned in the information and of the actions carried out in the management and processing of the same, as well as the protection of data, preventing access by unauthorized personnel . Unless the person communicating the information expressly requests otherwise, complete confidentiality will be maintained regarding their identity, so that it will not be revealed to anyone. To this end, in all communications, verification actions or requests for documentation carried out, data relating to the identity of the person who sent the information will be omitted, as well as any other data that could totally or partially lead to your identification, and the same will be done with those that refer to the data corresponding to any third party mentioned in the information provided.
Likewise, when the actions have to be transferred to other areas or companies related to ACMI or any public organization, the provisions of the previous paragraph will apply to the documentation that is sent to those other areas or organizations, except when it concerns the Judicial authority, the Public Prosecutor’s Office or the competent administrative authority in the framework of a criminal, disciplinary or sanctioning investigation. In these cases, prior to revealing their identity, a letter will be sent to the informant explaining the reasons for the disclosure, unless said information could compromise the investigation or the judicial procedure.
b) Allow information to be provided in writing or verbally, or both.
c) Admit the presentation and subsequent processing of anonymous information.
In the internal channel. The information may be communicated in writing, by postal mail or via email through the address provided for this purpose; or verbally, by telephone or in-person meeting.
5.B) Information communicated in writing by postal mail. If you choose this route, the information along with the documentation proving the facts you have must be sent in a sealed envelope to the following address:
5.C) Information communicated verbally by telephone call. It can be done from 9:00 a.m. to 2:00 p.m., Monday to Friday, excluding holidays, by calling:
+34 682666873
5.D) Information communicated verbally through a face-to-face meeting. To do this, the informant must request it through one of the aforementioned means. Said meeting must be held within a maximum period of seven business days from its request.
6. EXTERNAL INFORMATION CHANNELS
In addition to using the internal ACMI channel that is developed in this document, any natural person who wishes can present their information through the external information channel of the Independent Authority for the Protection of Informants (A.A.I.).
Apart from the above, any person who has knowledge of facts that could constitute fraud or irregularity, in relation to projects or operations financed in whole or in part with funds from the European Union, may bring such facts to the attention of the Service. National Anti-Fraud Coordination S.N.C.A. through the channel enabled for this purpose (Infofraude) at the web address: https://www.igae.pap.hacienda.gob.es/sitios/igae/esES/snca/Paginas/ComunicacionSNCA.aspx or go to the Office European Anti-Fraud Office (OLAF), at the following link: https://anti-fraud.ec.europa.eu/olaf-and-you/report-fraud_es or, finally, to the European Public Prosecutor’s Office, about which Information in this regard is available at the following link: https://www.eppo.europa.eu/en/reporting-crime-eppo.
In the case of information on possible anti-competitive practices, the external communication channels of the Competition Directorate of the National Markets and Competition Commission may be used, whose information in this regard is developed at the following link: https ://edi.cnmc.es/buzones-anonimos/sica.
7. INFORMATION MANAGEMENT PROCEDURE
7.A) RECEIPT OF INFORMATION
1.- As already indicated, the information may be provided in writing, by postal mail or via email through the address provided for this purpose; or verbally by telephone anonymously or identified. At the request of the informant, it may also be presented through a face-to-face meeting, within a maximum period of seven business days from the request.
In the event that the informant identifies himself, his identity will be preserved in the terms of article 33 of the Law, proceeding in accordance with what is indicated in section 4.1 above.
In the case of verbal communication, including those carried out through a face-to-face meeting or by telephone, the information presented will be documented, with the prior consent of the informant, in one of the following ways:
a) By recording the conversation in a secure, durable and accessible format, or
b) Through a complete and accurate transcription of the conversation carried out by the personnel responsible for processing it.
Without prejudice to the rights that correspond to them in accordance with data protection regulations, the informant will be offered the opportunity to verify, rectify and accept the message transcription by signing.
2.- Once the information is presented, it will be registered in the internal information system, being assigned an identification code. The internal information system will be contained in a secure data file with access restricted exclusively to the person responsible for the system, in which all the information received will be recorded, as a record book, by completing at least the following data:
a) Date of receipt.
b) Identification code.
c) Actions developed.
d) Measures adopted.
e) Closing date.
3.- Once the information has been received, within a period of no more than seven business days following said receipt, the informant will be acknowledged receiving it, unless he or she is anonymous, or has expressly waived receiving communications related to the investigation or that the System Controller reasonably considers that the acknowledgment of receipt would compromise the protection of the identity of the informant.
7.B) PRELIMINARY ANALYSIS AND ITS RESULT
- Once the information is registered, the System Manager must check whether it exposes facts or behaviors that are within the scope of application included in section 2 of this protocol.
- Once this preliminary analysis has been carried out, the System Manager will decide, within a period that may not exceed ten business days from the date of entry into the information registry:
a) Disallow the communication, in any of the following cases:
1. When the facts reported lack any verisimilitude, their description is excessively generic and imprecise, the information sent is scarce, or there is a lack of evidence that does not allow for reasonable verification and a minimum determination of the treatment that should be given. to these facts.
2. When the facts reported do not constitute a violation of the legal system included in the material scope of application of section 2 of this protocol.
3. When the information is manifestly unfounded or there is, in the opinion of the person responsible for the System, rational indications of having been obtained through the commission of a crime. In the latter case, in addition to the inadmissibility, the information will be immediately sent to the Public Prosecutor’s Office.
4. When the information does not contain new and significant data on infringements compared to previous information for which the corresponding procedures have been concluded, unless new factual or legal circumstances arise that justify a different follow-up. In these cases, the System Manager will communicate the result to the informant in a motivated manner.
5. When the processing of the information is not the responsibility of ACMI.
The inadmissibility will be communicated to the informant within five business days following its adoption, unless the information was anonymous or the informant had waived receiving communications from those in charge of managing it.
b) Admit the communication to processing.
The admission for processing will be communicated to the informant within five business days following its adoption, unless the communication was anonymous or the informant had renounced receiving communications related to the investigation.
When the reported facts may indirectly constitute a crime, the information will be immediately sent to the Public Prosecutor’s Office or to the European Public Prosecutor’s Office in the event that the facts affect the financial interests of the European Union.
7.C) RESEARCH
- Once the information has been admitted, all actions aimed at verifying the verisimilitude of the reported facts will be carried out, being able to maintain communication with the informant and, if considered necessary, request additional information, using the means of communication selected by the informant, if applicable.
- It will be guaranteed that the person affected by the information has knowledge of it, as well as the facts reported succinctly. Additionally, you will be informed of your right to be heard and to present allegations along with the documents and justifications that you deem relevant in writing within a period of ten business days from receiving the communication of the information, as well as the processing of your personal data. . However, this communication may be delayed until it is considered that it will not affect the concealment, destruction or alteration of evidence that affects the successful completion of the investigation.
- Without prejudice to the right to make allegations in writing, the instruction will include, whenever possible, an interview with the affected person in which, always with absolute respect for the presumption of innocence, they will be invited to present their version of the case. the facts and to provide those means of proof that it considers appropriate and pertinent. In order to guarantee the right of defense of the affected person, he or she will have access to the file without revealing information that could identify the informant, and may be heard at any time, and will be warned of the possibility of appearing assisted by a lawyer.
7.D) TERMINATION OF ACTIONS
1.- Once all investigative actions have been completed, the System Manager will issue a report that will contain at least:
a) A statement of the facts reported along with the identification code of the communication and the date of registration.
b) The classification of the communication in order to know its priority or not in its processing.
c) The actions carried out in order to verify the verisimilitude of the facts.
d) The conclusions reached in the investigation and the assessment of the proceedings and the evidence that supports them.
2.- Once the report has been issued, the System Manager will propose the adoption of one of the following decisions:
a) The file of the file, which will be notified to the informant and, where appropriate, to the affected person. In these cases, the informant will have the right to the protection provided for in the Law, unless, as a consequence of the actions carried out in the investigation phase, it is concluded that the information, in view of the information collected, should have been inadmissible. .
b) Referral to the Public Prosecutor’s Office if, despite not initially seeing indications that the facts could have the character of a crime, this results from the course of the investigation. If the crime affects the financial interests of the European Union, it will be referred to the European Public Prosecutor’s Office.
c) The transfer of all actions taken to the authority or organization that is considered competent for processing.
d) The adoption of an agreement to initiate a disciplinary procedure.
3.- The period to complete the actions and respond to the informant, if applicable, may not exceed three months from the receipt of the information, or, if acknowledgment of receipt was not sent to the informant, three months. from the expiration of the period of seven business days after the information is provided, except in cases of special complexity that require an extension of the period, in which case, it may be extended up to a maximum of another three additional months.
Whatever the decision, it will be communicated to the informant, unless they have waived it or the communication is anonymous.
8. INFORMATION ON PERSONAL DATA PROTECTION
The processing of personal data arising from the application of Law 2/2023 will be governed by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, in Organic Law 3 /2018, of December 5, on the Protection of Personal Data and guarantee of digital rights, in Organic Law 7/2021, of May 26, on the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offenses and execution of criminal sanctions. The personal data provided by the informant and those obtained from the internal investigation procedures will be processed by the System Manager to be incorporated into the internal information system.
The purpose of the treatment: is the protection of people who, in a work or professional context, detect possible violations and report them through the mechanisms regulated in the aforementioned legal standard. The identity of the informant will in all cases be reserved, and will not be communicated to the people to whom the reported events refer or to third parties. It may only be communicated to the judicial authority, the Public Prosecutor’s Office or the competent administrative authority within the framework of a criminal, disciplinary or sanctioning investigation. Disclosures made under this section will be subject to safeguards established in applicable regulations. In these cases, prior to revealing their identity, a letter will be sent to the informant explaining the reasons for the disclosure, unless said information could compromise the investigation or the judicial procedure.
The personal data obtained from the information received and those that originate from the internal investigations referred to in the previous section will only be kept for the period that is necessary and proportionate in order to fulfill the purpose for which they were collected. In particular, the provisions of sections 3 and 4 of article 32 of Law 2/2023, of February 20, will be taken into account. In no case may the data be kept for a period of more than ten years.
Category of data subject to processing: identification, contact, financial, economic and professional data of the informant, affected party and investigated third parties. Data subject to special categories may also be processed for reasons of essential public interest, in the terms provided for in art. 30.5 of Law 2/2023.
Origin of the data: the informant, who makes a communication reporting facts within the scope of Law 2/2023 and who provides information in the course of the investigation to clarify the reported facts.
The rights of access, rectification and deletion of your data, of limitation and opposition to its processing, as well as not to be subject to decisions based solely on the automated processing of your data, when applicable, can be exercised before ACMI by writing to:
ACMI SOLUTIONS SL
Attn. HR/Data Protection Directorate
C/ Castrobarto 10, 3rd floor, Office 16
28042 Madrid