Whistle-blowing Regulations

SURFORMA, S.A.

June 2022

1. Object

1.1. SURFORMA, S.A. ("the Company") adopts these Regulations with the objective of establishing a set of internal rules and procedures for the reception, processing, and recording of whistle-blowers' reports, in accordance with the legal and regulatory provisions applicable at any given time, as well as with the rules, principles and values set out in the Code of Conduct for the Prevention of Corruption and Related Infringements, besides ensuring the fulfilment of a legal obligation.

1.2. In the pursuit of this objective, whistleblowing under the terms of these Regulations shall be subject to a quick, effective, suitable system for detection, investigation and resolution of Infringements, in accordance with the highest principles of professional ethics recognised by the Company, safeguarding the principles of confidentiality and non-retaliation in its dealings with whistle-blowers and in dealings with people and third parties, including legal persons, who assist or are connected with the Whistle-blower.

2. Scope of Application

2.1. These Regulations establish the rules for receiving, processing, and recording reports of Infringements occurring within the Company.

2.2. These Regulations do not preclude or replace any existing obligation to file a report in cases and under terms where criminal law and procedure so require.

2.3. For the purposes of these Regulations:

a. “Infringements” are acts or omissions, committed intentionally or negligently, which are covered by and described in article 2(1), of Law 93/2021, of 20 December and in article 3 of the General Corruption Prevention Framework (“Regime Geral da Prevenção da Corrupção”), or GCPF established by Decree-Law 109-E/2021, namely in the following areas:

i. Public procurement;
ii. Financial services, products, and markets and the prevention of money laundering and the financing of terrorism;
iii. Product safety and compliance;
iv. Transport safety;
v. Environmental protection;
vi. Radiation protection and nuclear safety;
vii. Food and animal feed safety, animal health, and animal welfare;
viii. Public health;
ix. Consumer protection;
x. Protection of privacy and personal data and security of network and information;
xi. Prevention of corruption and related infringements

b. The Internal Reporting Channel is the channel identified in paragraph 10 below, through which reports of Infringements must be submitted, with or without identification of the Whistle-blower;
c. The Reported Person is the person who, in the report, is referred to as the author of the Infringement or is associated with it.

3. Whistle-blower

3.1. For the purpose of these Regulations, "Whistle-blower" means a physical person who reports an Infringement on the basis of information obtained in the course of his or her professional activity, regardless of the nature or sector of that activity (even if that information was obtained in the context of a professional relationship that has since come to an end, or during the recruitment process or other 

3.2. The following may be whistle-blowers: (i) employees, (ii) service providers, contractors, subcontractors and suppliers, as well as any persons acting under the direction or supervision of such persons, (iii) shareholders, members of the management and supervisory bodies, and (iv) trainees (paid or unpaid).

4. Provenance of Internal Whistle-blowing and prohibition of public disclosure

4.1. Given that there is an Internal Reporting Channel, the Whistle-blower may not use an external reporting channel or undertake public disclosure of an Infringement, except in the cases referred to in Article 7(2) & (3) of Law 93/2021 of 20 December.

4.2. A Whistle-blower who, except as provided for by law, publicly discloses an Infringement or makes it known to the media or a journalist cannot benefit from the protection conferred by the law.

5. Reception, processing, and recording of infringement reports

5.1. Any complaints made under these Regulations and in accordance with them must be done through an Internal Reporting Channel and can be made in writing:

a. by sending a letter addressed to Surforma, SA, Lugar do Espido, Apartado 1129, 4470-177, marked “confidential”;

b. by sending an e-mail to surformacanaldenuncia@surforma.com;
The Whistle-blower may decide which method to use.

5.2. Communications received are recorded by the competent department/area, which makes a record of:

a. An identifier;
b. Date of receipt;
c. Brief description of the communication;
and, where applicable:
d. Measures adopted in view of the communication;
e. Status.

5.3. Records of communications received will be kept updated at all times.

5.4. If the Whistle-blower has provided contact details, he or she will be notified within seven days that the report has been received informed of the requirements, competent authorities, form, and acceptability of an external complaint, pursuant to Article 7(2) and Articles 12 and 14 of Law 93/2021 of 20 December.

5.5. After being recorded, communications are subject to a preliminary analysis in order to certify the degree of credibility of the communication, the irregular and/or illicit nature of the reported behaviour, the viability of an investigation, and the identification of the people involved or with knowledge of relevant facts, and who should therefore be questioned.

5.6. The preliminary analysis report will conclude whether the investigation should proceed or be closed.

5.7. If the communication is considered unfounded, abusive, contains clearly erroneous or misleading information, or was made with the sole intention of discrediting another, it will be closed, the complainant will be informed of the reasons for this (unless the Whistle-blower has not identified him/herself), the personal data involved will be immediately destroyed, and such closure will be processed for statistical purposes and reported.

5.8. If it is found that the report is consistent, plausible, and credible and that the facts reported are likely to constitute an infringement under the terms of these Regulations, an investigation will be initiated.

5.9. On completion of the investigation stage referred to above, a report shall be drawn up containing an analysis of the complaint, a description of the internal acts performed, the facts established during the investigation, any conclusions reached, and the properly reasoned decision. This report will also state any measures adopted (or to be adopted) to mitigate the risk identified and prevent the recurrence of the Infringements reported.

5.10. If deemed necessary and appropriate, i.e., where the type and nature of the Infringement so require, the Infringement will be reported to the relevant authorities.

5.11. The Whistle-blower will be informed within a maximum of three months from the date of receipt of the complaint of the measures envisaged or taken in response to the complaint and the underpinning reasons.

5.12. Whenever it sees fit, the body, commission, or person responsible for handling complaints may be assisted by other internal or external persons, namely external auditors or other experts who can assist in the investigation, especially when the matters at issue warrant it. These persons shall also be bound by the confidentiality requirement of these Regulations.

5.13. Whenever necessary for the fulfilment of the provisions of these Regulations, any person deemed relevant to the investigation of the complaint may be interviewed.

6. Confidentiality

6.1. Any report of Infringements covered by these Regulations shall be treated as confidential.

6.2. Access to information relating to any report of an Infringement, including the identity of the Whistle-blower, where known, and information that would allow his or her identification, is restricted to the person(s)/body(ies) responsible for receiving and handling reports under these Regulations. The duty of confidentiality extends to all persons who have received information on complaints, even if they are not the persons responsible for receiving and/or handling them.

6.3. The identity of the Whistle-blower may only be disclosed in response to a legal obligation or court decision, preceded by written communication to the Whistle-blower stating the reasons for disclosure, unless providing that information would compromise related investigations or court proceedings.

7. Guarantees for Whistle-blowers

7.1. The Company may not engage in acts of retaliation against the Whistle-blower.

7.2. Acts of retaliation are any acts or omissions (even threatened or attempted) that, directly or indirectly, occurring in a professional context and motivated by an internal or external accusation or public disclosure, causes or may cause economic or non-economic damages to the Whistle-blower who, in good faith, and having serious grounds to believe that the information is true at the time of whistleblowing or public disclosure, reports or publicly discloses an Infringement.

7.3. The following acts shall be presumed to be motivated by (internal or external) whistle-blowing or public disclosure when practiced within two years after such a report or public disclosure, until proven otherwise:

a. Changes in working conditions, such as duties, hours, place of work or remuneration, non-promotion of the employee, or failure to fulfil work-related duties;
b. Suspension of the employment contract;
c. Negative performance evaluation or a negative reference for employment purposes;
d. Non-conversion of a fixed-term employment contract to a permanent contract, whenever the worker had legitimate expectations that such conversion would happen;
e. Non-renewal of a fixed-term employment contract;
f. Disciplinary sanctions, including dismissal;
g. Inclusion on any list, on the basis of an industry-wide agreement, which may lead to the Whistle-blower not being able to find a job in the sector or industry concerned in the future;
h. Termination of a supply or service contract.

8. Persons aiding Whistle-blowers

The guarantees referred to in the previous paragraph extend, with the necessary adjustments, to:
a. A physical person who aids a Whistle-blower in the complaint procedure and whose aid must be confidential, including trade union representatives or workers' representatives;
b. A third party connected to the Whistle-blower, such as a work colleague or family member, who could become a target of retaliation in a work context; and
c. Legal persons or similar entities that are owned or controlled by the Whistle-blower, for whom the Whistle-blower works or is otherwise connected with in a work context.

9. Whistle-blower's Duties

9.1. A Whistle-blower may not be held liable from a disciplinary, civil, misdemeanour, or criminal point of view for reporting or publicly disclosing an Infringement made in accordance with these Regulations, nor may he or she be held liable for obtaining or accessing the information that motivated the report or public disclosure, unless such action(s) constitute(s) a criminal offence.

9.2. SWithout prejudice to the provisions of the preceding paragraph, the conduct of those who make reports of irregular practices or Infringements that are clearly false or made in bad faith, as well as disregard of the duty of confidentiality associated with the report, shall constitute an offence liable to disciplinary action or contractual penalty/resolution, as applicable, that is adequate and proportional to the offence, without prejudice to any civil and/or criminal liability that may arise for the perpetrator of such conduct.

10. Processing of personal data and storing of complaints

10.1. The Personal Data collected in this context will be processed by the Company, and this body shall be responsible for processing it within the meaning of the term under the General Data Protection Regulation.

10.2. The purpose of processing information communicated under this Policy is to receive and follow up on complaints submitted to the Internal Reporting Channel.

10.3. Whistle-blowers are guaranteed right of access, rectification (of inaccurate, incomplete, or wrong data) and deletion of data communicated by him/her—unless such rights conflict with overriding rights—through the means of communication provided for in the following paragraph.

10.4. ÉWhistle-blowers are also guaranteed the right to access information on facts reported which concern them, except where they conflict with overriding rights.

10.5. Personal data which are clearly not relevant will not be stored for the handling of the complaint and will be deleted immediately.

10.6. Complaints lodged pursuant to these Regulations shall be subject to registration and retention for a period of 5 years and, regardless of this period and when applicable, while judicial or administrative proceedings relating to the complaint are pending.

11. Duration

This Regulation shall enter into force immediately following approval.