In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 of 5 December (LOPDGDD), users are informed of the basic information relating to this online whistleblowing form:[web:43][web:44]

• IDENTIFICATION OF THE CONTROLLER: “SECRETARYBIRDS, S.L.U.” (hereinafter, “APIPANA.IO”, a registered trade name of the company), Tax ID: B‑70688361, address: Plaza Isabel la Católica, Nº 7, 2º derecha, 18009 – Granada, Spain. By signing this document, you guarantee that the data provided are true, accurate, complete and up to date. Any changes to your data must be communicated as soon as possible.
• PURPOSE OF PROCESSING: APIPANA.IO will process the data collected in this form and any data generated as a result of the investigations carried out solely for the purpose of processing and deciding on the admissibility of the reports received under the company’s crime prevention management model, analysing them, conducting the relevant proceedings and taking appropriate action. The data requested are the minimum necessary for the stated purpose; refusal to provide them or providing them only partially may mean that the report cannot be processed.*
• LEGAL BASIS: Processing will be carried out on the basis of: (i) the public interest in the prevention of criminal offences and the existence of an applicable law: Law 2/2023 of 20 February on the protection of persons who report regulatory infringements and the fight against corruption;[web:38][web:41][web:45] (ii) the legitimate interest of APIPANA.IO in preventing irregularities and/or non‑compliance with the provisions set out in its internal Protocol and in the overall management of human resources within APIPANA.IO; (iii) where the whistleblower is an APIPANA.IO employee, the entity’s authority to manage its workforce and, where appropriate, to adopt appropriate disciplinary measures under the employment contract between the parties; and (iv) the whistleblower’s explicit consent by accepting this Privacy Policy.
• DATA DISCLOSURE: The recipients of the information are the EXECUTIVE COMMITTEE, as the body designated by the company, and any other persons or entities whose cooperation may be necessary in the context of an investigation or for auditing the operation of the Whistleblowing Channel, in accordance with the Internal Regulations of the Whistleblowing Channel, which are available to users/interested parties. In order to carry out the investigations required to determine any liabilities arising from the procedure, or to implement internal organisational measures within APIPANA.IO as a result of the reported facts, your personal data may be disclosed to the various group companies that may be connected with the facts under investigation. Depending on the facts reported, APIPANA.IO may also be required to disclose or communicate your personal data, and the information provided by you, to law‑enforcement authorities, other public authorities responsible for investigating the facts reported, as well as to the courts and other judicial bodies. Notwithstanding the foregoing, if a report proves to be false, your data may be disclosed to the person or persons reported so that they may, if they so wish, bring any legal action available to them in relation to the false report, as well as to persons involved in legal proceedings brought as a result of the investigation. If the whistleblower chooses to remain anonymous, his or her identification data will not be disclosed to third parties in the management and processing of the report and subsequent investigation.
• RETENTION PERIODS: The personal data you provide will be processed for as long as is strictly necessary to decide whether to initiate an investigation into the reported facts and, where appropriate, to conduct such investigation. If the investigation ends with the closure of the case, the data will be erased. In any event, after three (3) months from the date on which the report was filed, APIPANA.IO will erase your data, without prejudice to their continued processing, where necessary, to complete the investigation and to address any irregularities detected by means of, among others, legal, administrative or employment measures. Information may also be retained, after anonymising the data, for the purpose of conducting audits on the operation of the APIPANA.IO Whistleblowing Channel.[web:38][web:45]
• EXERCISE OF GDPR RIGHTS: You may exercise your rights of access, rectification, restriction of processing, erasure, portability and objection, where applicable, in accordance with the applicable data protection regulations. You may do so by sending a dated and signed written request indicating “GDPR Rights” in the subject line, together with a copy of your ID document where necessary for correct identification (and, where appropriate, that of your representative) and an address for notifications, to APIPANA.IO’s registered office at Plaza Isabel la Católica, Nº 7, 2º derecha, 18009 – Granada, Spain, enclosing a copy of your ID card or equivalent document where strictly necessary for correct identification, or by email to: dpo@apipana.io. If you believe that your right to the protection of personal data has been violated, you may lodge a complaint with the Spanish Data Protection Agency (aepd.es). Additional (second‑layer) information on applicable privacy rules is available on our website: www.apipana.io. In this respect, the exercise of rights by the reported person is guaranteed, without this implying that the whistleblower’s identity will be disclosed.