Whistleblowing Policy

Following the entry into force of Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019, on the protection of persons who report breaches of Union law, companies that meet certain requirements must implement an Internal Information System (hereinafter, “IIS”) or, where appropriate, adapt their Whistleblower Channel to that IIS, in accordance with the requirements set out in the regulation.

In February 2023, Spain transposed the aforementioned regulation through Law 2/2023, of February 20, 2023, regulating the protection of persons who report regulatory infringements and the fight against corruption (hereinafter, “Law 2/2023, of February 20”), which reinforces the principles established in the European Directive and strengthens them by establishing additional requirements.

In line with the foregoing, it should be noted that Article 11 of the aforementioned Spanish legislation allows the parent company of a corporate Group to approve a general Policy in relation to its Whistleblower Channel, which must contemplate the principles of the Channel and the guarantees that must be complied with, and that the subsidiaries, with autonomy and independence, may make such modifications or adaptations as may be necessary to comply with the national regulations applicable in each case.

Therefore, following the culture of compliance that characterizes the Vita Group, the purpose of this Annex is to consider the main and transcendental characteristics established by Spanish regulations that must be applied by the Group’s Spanish subsidiaries to avoid a legal infringement, without prejudice to the provisions of the Vita Group’s General Policy.

As a tool for compliance with the above, the Vita Group has set up the following Whistleblower Channel: denuncias@vitagroup.com, as a preferential channel for the submission of communications, or alternatively, to the postal address: Av. Diagonal, 538, 5-2, (08036) Barcelona – to the attention of the responsible person for the Whistleblower Channel.

This Annex reaches and binds all Spanish subsidiaries that currently and, in the future, belong to the Vita Group. That is to say, all Spanish companies’ majority owned by VITA GROUP HOLDINGS LTD.

Who can file a communication through the Channel?

All managers, employees, collaborators, suppliers and customers, as well as any other third party can communicate through Vita Group’s Channel possible breaches or violations of the provisions of any of the internal policies of the organization, or report an irregularity that they detect in the performance of their duties, as well as any infringement or omission of which they are aware and which may involve an infringement of European Union law or its financial interests or criminal or administrative offenses in the Spanish legal framework.

In this context, communicators or informants are considered to be all those natural persons who report the infringements mentioned in the previous title, who work in the private or public sector and who have obtained information on infringements in a work or professional context, including in any case:

• Employees, including those who have terminated their employment or professional relationship.
• Self-employed.
• Volunteers.
• Interns.
• In the process of selection.
• Partners, shareholders.
• Members of the Managing Body.
• Anyone working under the supervision of contractors, subcontractors or suppliers.

Likewise, they shall also enjoy the protection established by this Policy, in accordance with the aforementioned Law 2/2023, of February 20:

• the legal representatives of the employees in the exercise of their functions of advising and supporting the informant,
• natural persons who, within the framework of the organization in which the whistleblower provides services, assist the whistleblower in the process,
• natural persons who are related to the whistleblower and who may suffer retaliation, such as co-workers or relatives of the whistleblower, and
• legal persons, for whom he/she works or with whom he/she maintains any other type of relationship in a work context or in which he/she holds a significant shareholding. For these purposes, it is understood that the participation in the capital or in the voting rights corresponding to shares or participations is significant when, due to its proportion, it allows the person who holds it to have the capacity to influence the legal person in which he/she participates.

What can be communicated through the Channel?

By way of example of the foregoing, actions or omissions that constitute or may constitute violations in the following areas may be reported:

• Health Alert.
• Harassment / Discrimination.
• Public Procurement.
• Confidentiality.
• Corruption / Fraud.
• Competition.
• Corporate Offences.
• Tax / Corporate.
• Finance.
• Non-compliance with current legislation.
• Non-compliance with Policies / Procedures / Internal Regulations.
• Violation of the Code of ethics, other internal Codes.
• Labour / Legal Workers’ rights.
• Environment.
• Protection against Radiation and Nuclear Safety.
• Intellectual Property / Trade secrets.
• Organization Protocols and Standards.
• Occupational Health and Safety.
• Anti-Money Laundering Prevention.
• Consumer Protection.
• Privacy and Personal Data Protection.
• Sustainability.
• Public Health.
• Food and Feed Safety, Animal Health, and Animal Welfare.
• Network and Information System Security.
• Product Safety and Compliance.
• Transportation Safety.
• Others.

5.1. CONFIDENTIALITY AND ANONYMITY

Communications received through the Channel will be treated with the utmost confidentiality, both during the processing and once the procedure has been completed, preventing access to unauthorized personnel.

In this sense, the confidentiality and anonymity of the informant and of any other third party that is or may be mentioned and/or involved in the communication, in the actions carried out as a result thereof and in the processing thereof, shall be guaranteed, without it being necessary to obtain data that would allow their identification.

Therefore, all those who, for various reasons, participate in support tasks for the investigation of a specific incident, must sign a Confidentiality Agreement to that effect.

As a consequence, the proceedings carried out towards third parties or other bodies, areas or departments of the Spanish subsidiaries of the Vita Group shall be carried out maintaining the anonymity of the informant and the investigated, as well as the reasons for the communication.

5.2. PROHIBITION OF RETALIATION

Acts constituting retaliation, including threats of retaliation and attempts to retaliate against persons submitting a communication, are expressly prohibited.

For these purposes, retaliation is understood to be any acts or omissions that are prohibited by law, or that directly or indirectly involve unfavourable treatment that places the persons who suffer them at a particular disadvantage with respect to another in the labour or professional context, solely because of their status as whistleblowers, or because they have made a public disclosure.

For the purposes of the provisions of Law 2/2023, of February 20, and by way of example, Article 36 of said law provides that reprisals are considered to be those adopted in the form of:

a) Suspension of the employment contract, dismissal or termination of the employment or statutory relationship, including the non-renewal or early termination of a temporary employment contract once the probationary period has expired, or early termination or cancellation of contracts for goods or services, imposition of any disciplinary measure, demotion or denial of promotions and any other substantial modification of working conditions and the failure to convert a temporary employment contract into an indefinite one, in the event that the employee had legitimate expectations that he/she would be offered an indefinite job; unless these measures were carried out as part of the regular exercise of management powers under labour legislation or the corresponding public employee statute, due to circumstances, facts or accredited infractions, unrelated to the presentation of the communication.

b) Damages, including those of a reputational nature, or economic losses, coercion, intimidation, harassment or ostracism.

c) Negative evaluation or references regarding work or professional performance.

d) Inclusion in black lists or dissemination of information in a specific sector, which hinder or prevent access to employment or the contracting of works or services.

e) Denial or cancellation of a license or permit.

f) Denial of training.

g) Discrimination, or unfavourable or unfair treatment.

A person whose rights have been harmed as a result of its communication or disclosure after the two-year period has elapsed may request protection from the competent authority which, exceptionally and with justification, may extend the period of protection, after hearing the persons or bodies likely to be affected. The refusal to extend the protection period must be justified.

In addition, informants shall not be deemed to have violated any restriction on disclosure of information or incur any liability of any kind in connection with such disclosure, provided that they had reasonable grounds to believe that such communication or, as the case may be, public disclosure was necessary to disclose an act or omission under this Annex.

Therefore, they shall not incur liability in respect of the acquisition of or access to information that is publicly communicated or disclosed, provided that such acquisition or access does not constitute a crime.

5.3. PRESUMPTION OF INNOCENCE AND HONOUR

At all times, the presumption of innocence and respect for the honour of all parties affected as a result of the filing of a communication are guaranteed.

Therefore, the persons concerned by a communication shall have the right to be informed of the acts or omissions attributed to them, as well as to be heard in the course of the investigation, without in any case being informed of the identity of the informant.

Consequently, the persons affected by the communication shall be guaranteed the right to the presumption of innocence, the right of defence and the right of access to the file under the terms regulated in Law 2/2023, of February 20, as well as the same protection established for informants, preserving their identity and guaranteeing the confidentiality of the facts and data of the procedure.

5.4. SUPPORT MEASURES

In accordance with the rules established by Law 2/2023 of February 20, the Spanish subsidiaries of the Vita Group shall make available to the reporter or informant the appropriate means of support that, after assessing the circumstances, may be necessary. All of the above, regardless of the assistance that may correspond under Law 1/1996, of January 10, 1996, on free legal assistance, for representation and defence in legal proceedings arising from the filing of the public communication or disclosure.

5.5. PROTECTION OF PERSONAL DATA

The Spanish subsidiaries of the Vita Group undertake to treat the data contained in the communication with the strictest compliance with the legislation on protection of personal data and informants, ensuring at all times the absence of retaliation.

The processing of personal data deriving from the application of Law 2/2023, of February 20, on which this Annex is based, shall be governed by the provisions of Title VI of said Law, by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, by the provisions of Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights, in the Organic Law 7/2021, of May 26, on the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offenses and enforcement of criminal penalties.

Personal data will not be collected if it is manifestly not relevant to the processing of specific information or, if collected by accident, will be deleted without undue delay.

6.1. PERSONAL RESPONSIBLE FOR THE WHISTLEBLOWER CHANNEL

The Responsible person for the Whistleblower Channel (or Channel Manager) is the one who is in charge of ensuring the correct operation of the Channel and who will be responsible for the diligent processing of the information received.

In this regard, the Managing Body of VITA GROUP HOLDINGS LTD has proceeded to the designation of the Channel Manager for the Spanish subsidiaries, communicating said designation to the Anti-Fraud Office of Catalonia, in the manner and within the term established by Law.

The person responsible for the Whistleblower Channel is the following:

• Mrs. Neus Giné Gras, Chief Financial Officer of Vita Spain Management.

Likewise, the Spanish subsidiaries of the Vita Group have designated a Substitute for those cases in which the responsible person is involved in a communication, or in which a conflict of interest situation arises, in which case he/she must abstain from its management and processing.

The person holding the position of Substitute Manager is:

• Mr. Gavin Duncan, Director of the Vita Group.

6.2. PRESENTATION OF COMMUNICATIONS

Communications can be made through the Whistleblower Channel set up by the Vita Group, or directly to the Independent Whistleblower Protection Authority (hereinafter also referred as “A.A.I”), which is an External Channel set up by the Public Administration which, in Catalonia – headquarters of the Spanish subsidiaries of the Vita Group – is the Anti-Fraud Office of Catalonia.

If the communication was received through internal channels other than those established or was addressed to members of the personnel not responsible for its processing, the organization would also guarantee the preservation of confidentiality, warning that non-compliance would imply a very serious breach of the Law and that, immediately, the communication would be forwarded to the Channel Manager of the Spanish subsidiaries.

6.2.1. Internal Channels

Vita Group’s Whistleblower Channel is the preferred and integral channel for the presentation of communications.
For these purposes, the communication may be made in written form or verbally:

• In writing, anonymously or by name:
  • Sending a communication to the following e-mail address: denuncias@vitagroup.com.
  • Sending the communication to the postal address: Av. Diagonal, 538, 5-2, (08036) Barcelona – to the attention of the responsible person for the Whistleblower Channel.
• Verbally, anonymously or by name:
  • Requesting a face-to-face meeting with the responsible person for the Whistleblower Channel, which shall be held within a maximum period of (7) days from the request, in the manner deemed most convenient by the entity and preserving the confidentiality of the information. In this case, the information received through this meeting will be recorded, notifying the communicator about this circumstance, as well as about the processing of his personal data, in accordance with the provisions of section 5.5. of this Annex, or it may be documented through a complete and accurate transcription of the conversation.

All communications, regardless of the form in which they are made and whether anonymous or nominal, will be treated confidentially. They should also include, to the extent possible:
– A description of the facts.
– Identification of the parties involved.

If possible, it will be necessary to provide all the evidence that accredits the referred non-compliance and explaining the circumstances under which it has had access to such information.

6.2.2. External Channels

All individuals may report to the A.A.I. or to the corresponding authorities or regional bodies through the channels duly set up for this purpose, the commission of any actions or omissions referred to in the Vita Group’s Whistleblower Channel, either directly or after prior communication through the Channel: denuncias@vitagroup.com.

As mentioned above, in the Autonomous Community of Catalonia the competent authority in this matter is the Anti-Fraud Office of Catalonia1 , which has set up an anonymous reporting mailbox, guaranteeing at all times both the confidentiality of communications and the anonymity of the informant. This mailbox is available through the following link: https://www.antifrau.cat/es/comunicaciones-anonimas

6.2.3. Public disclosure

In addition to the aforementioned channels, the possibility of making a public disclosure is available to whistleblowers.

Public disclosure consists of making available to the public information on the facts that are the subject of communication through this Internal Information System.

In this context, in order for the protection of Law 2/2023, of February 20, to extend to persons making public disclosures, the following conditions must be met:

a) Has made the communication first through internal and external channels, or directly through external channels, without appropriate action having been taken within the established timeframe.

b) Has reasonable grounds to believe that either the breach may constitute an imminent or manifest danger to the public interest, in particular where there is an emergency situation, or there is a risk of irreversible damage, including a danger to the physical integrity of a person; or, in the case of communication through an external information channel, there is a risk of retaliation or there is little likelihood of effective handling of the information due to the particular circumstances of the case, such as concealment or destruction of evidence, collusion of an authority with the perpetrator of the breach, or that the authority is involved in the breach.

6.3. RECEIPT OF COMMUNICATIONS

Once a communication or information has been received, the Channel Manager in the Spanish subsidiaries will initiate the corresponding investigation process, where appropriate, to clarify the facts that are the subject of the communication.

An acknowledgement of receipt shall be sent to the informant within seven (7) calendar days following receipt of the communication. This acknowledgement of receipt shall be incorporated into the file including, in any case, clear and accessible information on the external channels of information before the competent authorities.

In cases where acknowledgement of receipt could jeopardize the confidentiality of the communication, in order to guarantee its confidentiality, it shall not be made until a period of time deemed prudent has elapsed.

As mentioned in previous paragraphs, alternatively to this preferential Internal Information System, any action or omission that may constitute an infringement that can be reported through the Whistleblower Channel may be reported to the A. A. I. or before the corresponding authorities or autonomous bodies, of the commission of any action or omission that may constitute any of the infractions that may be reported through the Whistleblower Channel, either directly or prior communication through the aforementioned Channel.

6.4. ACCEPTANCE OF COMMUNICATIONS FOR PROCESSING

After receiving the communication, the person in charge will assign a registration number that will correspond to your file and a series of codes to anonymize both the informant and the investigated, the facts, and any other third party that may be affected by the communication. Likewise, the responsible person shall record the following information:

• The objective data of the communication: facts, dates, names, quantities, places, contacts, etc., provided by the person making the communication.
• Subjective data: opinions, rumours, ideas, and appreciations that the informant considers necessary in the narration of the communication.
• Assessment by the person in charge as to whether the communication is associated with a possible or alleged violation or whether it is a mere complaint or suggestion related to improving an area of the business, work situation, etc.

If necessary and possible, it may request the informant to provide additional information necessary for the course of the investigation to which his or her communication has given rise.

If the person in charge notices that the reported facts may be indicative of a crime, he/she shall immediately forward the information to the Managing Body, which shall decide to immediately refer it to the Public Prosecutor’s Office.

6.5. INVESTIGATION PHASE

The investigation shall be conducted and developed mainly by the Channel Manager or, if applicable, by the substitute, for those cases in which there may be a conflict of interest. However, if the seriousness, specialty, or complexity of the facts makes it advisable, the person in charge may appoint another professional manager or a third specialized person to collaborate in the investigation.

At this stage, the person under investigation will be notified and interviewed, and will be told of his right to be informed of the actions or omissions attributed to him, and may also exercise his right to be heard, without in any case being informed of the identity of the informant.

The third parties involved (if any) shall also be summoned and interviewed so that they may explain and indicate the allegations they consider. As many investigative steps as may be necessary for the parties will be carried out and a documentary record will be made of all the proceedings in the file.

Any inquiries made to third parties or other bodies, areas or departments of the Spanish subsidiaries of the Vita Group must be carried out while maintaining the anonymity of the informant and the person being investigated, as well as the reasons for the communication.

The following actions will be carried out during this stage:

1. Investigation of the reported facts, specifically:

• The objective and subjective elements provided by the informant, prioritizing the objective elements supported by documentation that accredits all or part of the facts reported.
• The reputation, seriousness and reliability of the informant.
• The allegations and exonerating evidence provided by the investigated party.
• The evidence practiced with third parties, or with other related bodies, areas or departments.

2. Analysis and assessment of the possible consequences that the reported facts may have.

The term to develop the investigation and give a response to the informant on the actions that have been carried out, as well as the result thereof, will depend on the seriousness of the reported facts and their potential consequences, the duration of this stage being at the discretion and risk of the responsible person for the Whistleblower Channel. However, in accordance with the provisions of Article 9.2. d) of Law 2/2023, of February 20, this period may not exceed three (3) months from receipt of the communication or, if no acknowledgement of receipt was sent to the informant, three (3) months from the expiration of the seven (7) day period after the communication was made. This, except in cases of special complexity, whose term may be extended up to a maximum of three (3) additional months.

If the communication contains personal data of third parties other than the person under investigation (e.g. witnesses, suppliers, customers, etc.), the responsible party shall provide in writing that all personal information provided that is not necessary for the investigation shall be deleted, and shall inform the third parties whose data is to be processed. The information shall comply with the informative requirements of data protection regulations, omitting from this information the identity of the informant, which shall be kept confidential.

6.6. TERMINATION OF ACTIONS

Following the investigation of communication and with the supporting documentation used to clarify the facts, a VERDICT or RESOLUTION is prepared with the following content:

• Description of the facts: communication registration number; communication date; reported facts; involved parties; documentation submitted during the investigation by both parties (informant and investigated party), other units, areas, or departments, or third parties; interviews with the investigated party and/or third parties, etc.
• Analysis and assessment of obtained evidence.
• In the event that the reported infringement is indeed proven, the person in charge will dedicate a section of the verdict to make the recommendations he/she considers necessary to implement in order to improve the internal controls and protocols that have been deficient on this occasion.
• Resolution: shall be substantiated and shall contain the reasons for ARCHIVING WITHOUT SANCTION, ARCHIVING WITH SANCTION or COMMUNICATION TO THE AUTHORITIES.

• • ARCHIVING WITHOUT SANCTION: After investigation, if it is concluded that the reported infringement is manifestly minor and does not require further follow-up, it will be closed. The case will also be closed in the case of repeated communications that do not contain new and significant information on previously reported infringements and whose investigation procedure has already been concluded, unless there are new factual or legal circumstances that justify a different follow-up. In such cases, the decision must be communicated to the informant and the reasons for the decision must be stated.
  • ARCHIVING WITH SANCTION: the responsible person may propose the application of a sanction, but the decision will be made by the Managing Body in coordination with human resources specialists, in accordance with the procedures indicated for the application of labour sanctions in the organization.
  • COMMUNICATION TO THE AUTHORITIES: If the communication received a priori appears to be related to the commission of a crime, the person in charge shall immediately inform the Management Body for the purpose of evaluating the possibility of reporting it to the Public Prosecutor’s Office.

If once the investigation of the facts has been completed the veracity of the facts is confirmed, the Spanish subsidiaries of the Vita Group will take all necessary measures to put an end to the reported fact and, if appropriate and taking into account the characteristics of the fact, will apply the actions it deems appropriate under the disciplinary regime, current Spanish labour legislation and, if applicable, in accordance with the Spanish Criminal Code.

In all cases, the resolution will be notified to both the informant and the investigated, taking into account the maximum term of three (3) months from the receipt of the communication. The informant will not be notified when he/she has renounced to do so, when there is no contact information available or when the informant is anonymous. After this, the Head of the Internal Information System will order the file to be closed, respecting in any case, the legislation in force on data protection. In case of a sanctioned file, the notification to the investigated party will contain the adoption of the contractual, disciplinary or judicial measures to be adopted.

6.7. RECORD OF COMMUNICATIONS

The person in charge shall have a log book of the information received and the internal investigations to which it has given rise, so that it serves to store and/or retrieve key information on each incident, including the date and source of the original communication, the investigation plan, results of interviews or any other investigation procedure, pending tasks, final resolution, as well as the chain of custody of any evidence or key information.

Article 63 of Law 2/2023, of February 20, categorizes non-compliance with the aforementioned requirements into very serious infringements, serious infringements and minor infringements, as follows:

VERY SERIOUS INFRINGEMENTS

A) Any action that entails an effective limitation of the rights and guarantees provided for in this law introduced through contracts or agreements at individual or collective level and in general any attempt or effective action to hinder the submission of communications or to prevent, frustrate or slow down their follow-up, including the provision of false information or documentation by those required to do so.
B) The adoption of any retaliation resulting from the communication against informants or other persons included in the scope of protection set forth in Article 3.
C) Violate the guarantees of confidentiality and anonymity provided for in this law, and in particular any action or omission aimed at revealing the identity of the informant when the latter has opted for anonymity, even if the actual disclosure of the same does not take place.
D) Violate the duty to maintain secrecy on any aspect related to the information.
E) The commission of a serious infringement when the perpetrator has been sanctioned by means of a final decision for two serious or very serious infringements in the two years prior to the commission of the infringement, counted from the finality of the sanctions.
F) Communicating or publicly disclosing information knowing it to be false.
G) Failure to comply with the obligation to have an internal information system in accordance with the terms established by law.

Violations classified as very serious shall entail the imposition of the following fines, in accordance with the provisions of art. 65 of the aforementioned law:

a) If natural persons are responsible for the infringements, they shall be fined from 30,001 to 300,000 euros.
b) If they are legal entities they will be fined between 600,001 and 1,000,000 euros.

SERIOUS INFRINGEMENTS

A) Any action that entails limitation of the rights and guarantees provided for in this law or any attempt or effective action to hinder the submission of information or to prevent, frustrate or slow down its follow-up that is not considered a very serious infringement pursuant to paragraph 1.
B) Violate the guarantees of confidentiality and anonymity provided for in this law when it is not considered a very serious infringement.
C) Breach of the duty of secrecy in cases where it is not considered a very serious infringement.
D) Non-compliance with the obligation to adopt measures to guarantee the confidentiality and secrecy of the information.
E) The commission of a minor infraction when the perpetrator has been sanctioned for two minor, serious or very serious infractions in the two years prior to the commission of the infraction, counted from the finality of the sanctions.

Violations classified as serious shall entail the imposition of the following fines, in accordance with the provisions of art. 65 of the aforementioned law:

a) If natural persons are responsible for the infringements, they shall be fined from 10,001 to 30,000 euros.
b) If they are legal entities they will be fined between 100,001 and 60,000 euros.

MINOR INFRINGEMENTS

A) Deliberately submitting incomplete information to the Authority by the person in charge of the Channel, or outside the time period granted for such purpose.
B) Failure to comply with the obligation to cooperate with the investigation of information.
C) Any non-compliance with the obligations provided for in this law that is not classified as a very serious or serious infringement.

Infringements classified as minor, shall entail the imposition of the following fines, in accordance with the provisions of art. 65 of the aforementioned law:

a) If natural persons are responsible for the infringements, they shall be fined from 1,001 to 10,000 euros.
b) If they are legal entities they will be fined up to 100.00 euros.

This Annex has been approved by the Managing Body of VITA GROUP HOLDINGS LTD and may be modified in order to improve the confidentiality and effectiveness in the management of the communications sent.

Likewise, it will be reviewed and/or modified:

• Whenever there are relevant changes in the parent company or in the Spanish subsidiaries, in the control structure or in the activity carried out by them that make it advisable to do so.
• Whenever there are legal modifications that make it advisable to do so.
• Whenever there are relevant breaches of its provisions which also make it advisable to do so.

It will also be reviewed periodically, even when none of the circumstances described above occur.

In addition, this Annex will be published on the home page of the Vita Group’s website, in a separate and easily identifiable section, together with the Group Policy and access to the Channel, in accordance with the provisions of art. 25 of Law 2/2023, of February 20.