Complaints channel

What this channel is

The whistleblowing channel is Imora's internal reporting system: the route for reporting any breach of the rules, irregularity or conduct contrary to professional ethics detected in the course of our activity, in accordance with Spanish Act 2/2023 on the protection of persons who report regulatory breaches.

The system has been approved by the company's governing body, which has appointed a person responsible for running it with autonomy and independence, and it has a written internal procedure setting out how each report is handled.

Who can use it

This channel can be used by anyone with a direct relationship with Imora, including:

• Employees and staff: concierges, controllers, technicians and administrative staff.
• Clients: homeowner communities, buildings and shopping centres that receive our services.
• Suppliers and subcontractors: companies and self-employed professionals who work with Imora.
• Candidates and former employees: people who have had or will have an employment relationship with Imora.

What can be reported

This channel can be used to report matters such as:

• Legal breaches: infringements of employment, safety or environmental law.
• Harassment or discrimination: workplace, sexual or discriminatory conduct towards anyone.
• Service irregularities: serious breaches of what was agreed with a community or building.
• Misuse of data: personal data processing contrary to data protection regulations.
• Corruption or fraud: bribery, undeclared conflicts of interest or misuse of company resources.

How to report it

You can file your report in writing, through the guided wizard, describing the facts in as much detail as possible: what happened, when, who is involved and whether you have any evidence. You can do so with your name and email, so we can confirm receipt, or tick that you would rather not identify yourself.

Verbally too: you can report verbally by writing to the system manager's address to ask us to call you, or by requesting a face-to-face meeting: if you ask for one, it is held within seven days. What is discussed is recorded in writing, or by recording if you authorise it, and in both cases you are offered the chance to check, correct and sign it.

Guarantees

Managing this channel is governed by the following guarantees:

• Confidentiality: the whistleblower's identity is not disclosed to third parties without their express consent, unless disclosure is a legal obligation in the course of a judicial or administrative investigation, in which case they are told beforehand.
• No retaliation: no form of retaliation — dismissal, change of duties, exclusion from processes, reputational harm — is tolerated against anyone who reports in good faith, or against those around them. Whoever does so answers for it.
• Acknowledgement of receipt: receipt is confirmed within a maximum of 7 calendar days, unless doing so could jeopardise confidentiality.
• Response time: the investigation and the reply are completed within a maximum of 3 months from acknowledgement of receipt, extendable by a further 3 months in particularly complex cases, with notice of the extension and its reasons.
• Right to be heard: the person the facts concern is informed and can give their account, with the presumption of innocence and without being told who reported.
• Register: every report is entered in a confidential register, made available to the competent authority only on a reasoned request.

External channel

You are not required to use this channel before any other, nor to exhaust it. You may go directly to:

• The Independent Whistleblower Protection Authority (A.A.I.): the external channel provided for by Act 2/2023, which can be used with or without a prior internal report, and anonymously.
• The relevant regional authority: the autonomous communities that have set up their own whistleblower protection authority are competent within their territory.
• European Union institutions and bodies: where the breach affects Union law.

Using the external channel does not cost you any of the protections under Act 2/2023. If the facts could constitute a criminal offence, the report is forwarded to the public prosecutor.

Data protection

Processing of this channel's data is governed by Act 2/2023 and by the GDPR, with these particularities:

• Legal basis: compliance with a legal obligation (art. 6(1)(c) GDPR), not your consent. That is why it is not requested.
• Data minimisation: only data strictly necessary for the investigation is processed. Anything else is deleted immediately, and data supplied by mistake is not kept.
• Retention period: data is kept only for as long as strictly necessary. If no investigation has been opened three months after receipt, the report is deleted and only an anonymised entry remains in the register.
• Limited access: only the person responsible for the system and, where applicable, whoever conducts the investigation have access; and the head of human resources or legal counsel where measures need to be taken.
• Your rights: you may exercise the rights of access, rectification, erasure, restriction, portability and objection on the terms of the privacy policy, with the limitation that they do not give access to the whistleblower's identity.

Contact

For any question about how the channel works, or to request a face-to-face meeting: