PALEX’s Internal Information System

Start

Step 1/5 Categorize concern

To facilitate the further handling of your comunicaction, please help us to categorise it as best as possible.

In which category does your submission best fit?

Competition

Consumer protection

Corruption / conflict of interest

Environmental Protection

Fraud

Harassment or discrimination

Health and safety at work

Infringement of the Compliance System

Protection of personal data and privacy

Public health

Questions or queries

Others

Do you suspect any of the following people?

Corporate Compliance Officer

HR Director

I am not aware of any involvement of these persons

I have read the Terms of use and agree to them in accordance with the notice.

Information

Step 2/5 Personal information

If you prefer not to give your personal details, you can do so by indicating that you want the report to be anonymous.

What is your relationship with the company being reported?

Do you wish to report anonymously?

Yes

This channel requires the whistleblower's identification data are mandatory.

The selected category requires the identification data to be mandatory

First name

Last name

Contact telephone number

This channel is confidential. Your personal data will not be shared. If someone from the organisation needs to know your data, they will request it through the channel and they will only be able to see it if you authorise it.

Details

Step 3/5 Detailed information

Describe in as much detail as possible the event you wish to report, giving as much information and attaching evidence, if available.

Indicate which person or persons are the subject of the report

First and last name

Position

Have you discussed this with any member of management?

Yes

I do not remember

Are there any witnesses? Please indicate their names.

First and last name

Position

Tell us what you want to report in detail

Would you like to attach any additional documents?

Image (png, jpg, gif), Audio (wav, mp3), Video (ogg, mp4, mov, avi, wmv, mpg, mpeg) or PDF document up to 20Mb. Attention! If you report anonymously, make sure that the attachments do not include information in the content or metadata that could identify you.

Confirm

Step 4/5 Confirmation

As the last step of the process, you must indicate a secret code that only you will know. This password, together with the identification code that we will give you at the end of the process, will be the only way to follow the progress of your submission.
However, be aware that if you lose your password, due to privacy reasons we will not be able to recover it or create a new one, and therefore you will not be able to keep track of the communication.

Password

Password confirmation

Finish

Step 5/5 Finalize

You have already entered all the necessary information to start the communication management process.

By submitting the communication, you undertake to ensure the accuracy of the data provided in it. Otherwise, PALEX reserves the right to take legal action against you.

This is the last form of the process, clicking on Send will start the communication management process.

All information provided will be treated confidentially. Your identity, if disclosed, will not be communicated to the persons concerned or to third parties, except where required by law.

If you wish, you may indicate an address, e-mail address or a safe place to receive notifications.

In any case, you can go directly to the external channels provided by the independent authorities, both at national and regional level.

You can consult your personal data protection rights and other relevant information in the Policy on the use of the Internal Information System, accessible through the corporate website or in the FAQ section.

I have read the Data Protection and Consent Notice and agree to the processing of my personal data in accordance with the provisions of this notice.

Terms of Use

These Terms of Use regulate the download, access and use of the Report2box whistleblower channel software, which PROTECCIÓN DE DATOS DATAX, S.L. makes available to clients in order to offer them whistleblower channel software that they can implement in their companies.

1. GENERAL

In compliance with the general information obligation set out in Article 10 of Spanish Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce, we hereby inform you that PROTECCIÓN DE DATOS DATAX, S.L., registered in the Companies Register of Barcelona, in Volume 38970, Folio 52, Page Number B333543, 1st entry, with VAT (Tax Identification) Number B64334634 and address at C/ Bobinadora, 1-5 - 1r 15-17 08302 Mataró (Barcelona), is the party responsible for the Application. If you wish to contact us, please send an email to [email protected].

By accessing Report2box, you acknowledge that you have accepted and unreservedly consented to each and every provision contained in all of the terms herein.

PROTECCIÓN DE DATOS DATAX, S.L. reserves the right to modify these Terms of Use in order to adapt them to current legislation applicable from time to time, as well as to make changes and updates that will be published in the Application and will be effective from the moment of their publication. If you do not agree to any updates to the Terms of Use, you may terminate your use of the Service.

By using Report2box, you declare that you are at least 18 years of age. Likewise, PROTECCIÓN DE DATOS DATAX, S.L. reserves the right to request additional documentation from its Users in order to prove that they are of legal age. DATA PROTECTION DATAX, S.L. does not collect information from minors. On suspicion that a user of the services is under the said age (18 years old), and that he/she has falsified the data required for access, PROTECCIÓN DE DATOS DATAX, S.L. may deny the said user access to the Services offered. In any case, parents and/or legal guardians of minors must ensure compliance with this provision, being responsible for such minors' actions.

RULES OF USE AND USER CONDITIONS WHEN USING REPORT2BOX

In order to use Report2box, you agree to use it correctly and lawfully.
You shall use Report2box for the purposes for which it was designed and at no time shall you use it for purposes contrary to the law.
The Report2box reporting channel is not an emergency service; in case of an emergency please contact the authorities.
You must fill in all the information defined as mandatory in order to be able to submit it.
This service is not designed for submitting information that may be considered secret or strictly confidential.
You should review the information you submit to ensure whether or not you want to disclose your identity.
You may choose to send the submission with or without indicating your contact details. In both cases the platform will provide you with a unique identification number and a password. It is important that you write this information down and keep it in a safe place, as you will only be able to check the status of the submission once you have provided these details. If you lose this information, you will no longer be able to access it. For security reasons PROTECCIÓN DE DATOS DATAX, S.L. will not be able to provide access to lost passwords or access codes.
If the organisation establishes that there has been bad faith in making the submission, it reserves the right to take legal action if the whistleblower has been identified.
The user will be able to download a certificate issued by PROTECCIÓN DE DATOS DATAX, S.L. in which he/she will have all the information sent to the company, as well as the result once the investigation has been completed.
The query system has built-in tracking features to help users identify unauthorised access to their query.
The whistleblower expressly understands and agrees that PROTECCIÓN DE DATOS DATAX, S.L. shall not be liable for any direct, indirect, foreseen or unforeseen damage, including but not limited to moral damage, resulting from the use or impossibility of use of this service.
The whistleblower is responsible for the veracity of the information communicated, assuming the consequences of having acted in bad faith or having sent false information or documentation.
The user shall be liable for any damage or harm of any kind that PROTECCIÓN DE DATOS DATAX, S.L. may suffer, directly or indirectly, as a result of any improper use of the product, any breach of the terms and conditions of use or any breach of the law by the user.

PROTECCIÓN DE DATOS DATAX, S.L. will make all reasonable efforts to make the application available at all times. However, the user accepts that the availability of the Report2box application may be affected by factors beyond the reasonable control of the software.

PRIVACY POLICY

PROTECCIÓN DE DATOS DATAX, S.L. is responsible for the processing of the personal data of the client company and will not process the data of the end user (whistleblower). Only in the event that the client company contracts the services of PROTECCIÓN DE DATOS DATAX, S.L. to manage the complaints, it will be able to process the data of the end user (whistleblower) as the Data Controller and on behalf of the client company.

PROTECCIÓN DE DATOS DATAX, S.L. may also collect and automatically generate information from other areas of use, such as service metadata, login data, device information, IP addresses, third party data and information obtained from cookies.

In compliance with Regulation (EU) 2016/679 of 27 April 2016 and Spanish Organic Law 3/2018 of 5 December, by means of this document DATA PROTECTION DATAX, S.L. as Data Controller informs that it will process the data provided by the client company to activate the whistleblower channel and execute the contractual relationship between the parties. With respect to the data of the end users (whistleblowers), it will only process such data, if applicable, for the purpose of carrying out the assignment given by the client company consisting of the management of the reports. For this purpose, it shall process the data entered by the whistleblower, which may include data of a special nature.

The data will be processed and kept only for the time necessary to decide whether or not to open an investigation into the reported facts. In any case, three months after the data have been entered, they shall be deleted from the internal compliance system. The data may continue to be processed by the competent authority and body in the event of an investigation into the reported facts, but will not be retained in the internal compliance system itself. Any reports which have not been acted upon shall be kept anonymous.

PROTECCIÓN DE DATOS DATAX, S.L. shall adopt the necessary measures to preserve the identity and guarantee the confidentiality of the data corresponding to the persons affected by the information provided, especially that of the person who has brought the facts to the attention of the organisation, in the event that he/she has identified him/herself.

The user's data will not be communicated or transferred to third parties except by legal obligation or those providers linked to the Controller who act as data processors with whom the corresponding contract has been signed in accordance with the terms of the legislation in force.

Our servers are located in the European Union, and we generally engage service providers that are also located within the European Economic Area or in countries that have been declared to have an adequate level of protection.

If we need to use external service providers that require the transmission of personal data outside the European Union or in countries that have not been declared to have an adequate level of protection, we will ensure that we guarantee the security and lawfulness of the processing of your data by means of adequacy decisions, standard clauses, binding corporate rules, exemptions or any other instrument approved by the supervisory authority that provides adequate safeguards for the implementation of the international data transfer.

The legitimate basis for the processing of your data is the public interest.

You guarantee that the personal data provided is truthful, guaranteeing that all the information provided corresponds to the actual situation, that it is up to date and accurate.

You have the right to access your data and to obtain confirmation of its processing, as well as a copy of the personal data being processed. You have the right to request the rectification of data that is inaccurate or to request deletion when the data is not necessary for the purposes for which it was collected. You can request the limitation of the processing of your personal data. Similarly, you have the right not to be subject to decisions based solely on automated processing of your personal data. You can exercise your rights by contacting us at C/ Bobinadora, 1-5 1r 15-17 - 08302 Mataró (Barcelona). Email: [email protected]

If you feel that your rights have not been properly addressed, you have the right to lodge a complaint with the supervisory authority at www.aepd.es

INTELLECTUAL AND INDUSTRIAL PROPERTY RIGHTS

The intellectual and industrial property rights over the Report2box are owned by PROTECCIÓN DE DATOS DATAX, S.L., which has exclusive rights to exploit them in any form and, in particular, the rights of reproduction, distribution, public communication and transformation.

Third-party holders of intellectual and industrial property rights over photographs, logos and any other symbols or content included in Report2box have granted the corresponding authorisations for their reproduction, distribution and making them available to the public.

You acknowledge that the reproduction, modification, distribution, commercialisation, decompilation, disassembly, use of reverse engineering techniques or any other means to obtain the source code, transformation or publication of any unauthorised benchmark test results of any of the elements and utilities integrated within the development constitutes an infringement of the intellectual property rights of PROTECCIÓN DE DATOS DATAX, S.L., and consequently undertake not to carry out any of the aforementioned actions.

EXCLUSION OF LIABILITY

PROTECCIÓN DE DATOS DATAX, S.L. reserves the right to edit, update, modify, suspend, eliminate or terminate the services offered, including all or part of their content, without prior notice, as well as to modify the form or type of access to the same.

The reasons for modification may include the need to adapt to possible legislative developments and changes in the Application itself, as well as those that may arise from existing standard codes on the subject, or for strategic or corporate reasons.

PROTECCIÓN DE DATOS DATAX, S.L. may not be held liable for the use of Report2box by a minor, the downloading and use of Report2box being the sole responsibility of the user.

The responsibility for the use of Report2box lies solely with the user. Except as set out in these Terms and Conditions, PROTECCIÓN DE DATOS DATAX, S.L. is not responsible for any loss or damage that may occur in relation to the download or use of Report2box, such as those produced as a result of failures, breakdowns or blockages in operation (for example, and without limitation: error in communications lines, defects in hardware or software or failures in the Internet network). Likewise, PROTECCIÓN DE DATOS DATAX, S.L. may not be held liable for any damage caused as a result of improper or inappropriate use by users.

6. LEGISLATION AND JURISDICTION
The applicable law in case of dispute or conflict of interpretation of the terms that make up the legal texts, as well as any question related to the services of this website, will be Spanish law.

Data protection and consent to PALEX

Privacy Notice

In order to receive and process your complaint, you must confirm that you have read this Privacy Notice. If you do not accept the terms and conditions as set out in the notice, you will not be able to file a report.

Remember that this channel is not intended for reporting emergencies.

Here is some basic information about how we treat your personal data:

Data controller	PALEX MEDICAL S.A . with VAT A58710740 is responsible for the processing of the personal data of the data subject and informs you that it will be processed in accordance with the provisions of current legislation on personal data protection, namely Regulation (EU) 2016/679 of 27 April 2016 (GDPR).
Purpose of the processing	We will process the personal contact details and the facts reported in order to manage and resolve the complaint received.
Legitimacy of the processing	The basis for the legitimacy of the processing of the data is the fulfilment of a task carried out in the public interest, as well as the fulfilment of a legal obligation.
Data retention	The data will be kept only for the time necessary to decide whether or not to open an investigation into the reported facts. In any case, three months after the data have been entered, they shall be deleted from the internal compliance system. The data may continue to be processed by the competent authority and body in the event of an investigation into the reported facts, but will not be retained in the internal compliance system itself.
Data disclosure	Your data may be disclosed to service providers linked to the controller, who act as Data Processors. You are hereby informed that the data may be processed by data processors located outside the European Economic Area and that they guarantee an adequate level of protection under standard contractual clauses, so that there are no risks in the processing and secure communication is guaranteed. The data will only be disclosed to third parties when it is necessary for the adoption of disciplinary measures or for the processing of any legal proceedings that may be necessary, without prejudice to the notification to the competent authority of facts constituting a criminal or administrative offence.
Rights of the Data Subject	You are hereby informed that you may exercise your rights of access, rectification, suppression and opposition of your data at PALEX MEDICAL S.A. , Jesús Serra Santamans, 5, 08174 Sant Cugat del Vallès (Barcelona) E-mail: [email protected].You can also lodge a complaint with the supervisory authority at www.aepd.es if you consider that the processing does not comply with the regulations in force.