Whistleblowing channel

This is the internal reporting system of AxisOne Group SL, owner of attendo. It is for reporting, with guaranteed confidentiality and without retaliation, breaches you learn about in a work or professional context.

It is not the channel for sales questions, service issues or complaints about attendo: for those, write to sales@attendo.me or use the support form.

• Breaches of European Union law in the areas covered by Directive (EU) 2019/1937: public procurement, financial services and anti-money laundering, product and transport safety, environmental protection, public health, consumer protection, privacy and data protection, security of network and information systems, the EU’s financial interests and the internal market, including competition and state aid.
• Acts or omissions that may be a criminal offense or a serious or very serious administrative offense under Spanish law, including those causing financial loss to the tax authorities or Social Security.
• Breaches of employment law on occupational health and safety.

Excluded are interpersonal conflicts that only affect you and the people the report concerns, information that is already public, and mere rumors (article 35 of Spanish Law 2/2023).

Anyone who has learned the information in a work or professional context with AxisOne Group SL, including:

• employees, also after the employment relationship has ended;
• candidates in a recruitment process or pre-contractual negotiation;
• interns, volunteers and trainees, paid or unpaid;
• self-employed contractors, suppliers, contractors and subcontractors, and their staff;
• partners, shareholders and members of the board.

Protection also covers people who help you in the process, people close to you who could suffer retaliation, and companies connected to you (article 3).

In writing, through the channel:

In the channel you can also ask for an in-person meeting, which will take place within seven days at most. If you report verbally, the report will be documented by recording or transcription, with your consent, and you will be able to review it.

Describe the facts in as much detail as possible: what happened, when, where, who is involved and, if you have it, any evidence. You can give an address, an email or a safe place to receive notifications, or choose not to receive them.

You can report anonymously. If you identify yourself, your identity is confidential: only the people who manage the channel know it, and it is not disclosed to the person concerned or to third parties. It can only be disclosed to the courts, the Public Prosecutor’s Office or the competent administrative authority, in a criminal, disciplinary or sanctioning investigation, and we would tell you first unless that would compromise the investigation (article 33).

The same confidentiality protects the people mentioned in the report and any third party. If a report arrives through another route or reaches someone who should not handle it, that person must forward it immediately to the system manager and keep it secret.

Retaliation against people who report is prohibited, including threats and attempts: dismissal, suspension, demotion, changes of duties or workplace, negative evaluations, non-renewal of a contract, reputational harm, coercion, harassment, blacklisting or any unfavorable treatment (article 36).

To be protected you must have reasonable grounds to believe the information is true when you report it, even without conclusive evidence, and report it through the channels the law provides (article 35). Knowingly reporting false information is not protected and may be a very serious offense (article 63).

The people a report concerns have the right to the presumption of innocence, to their honor, to be heard and to know the facts attributed to them at the appropriate time (article 39).

• Acknowledgment of receipt: within seven calendar days of receiving the report, unless this would endanger its confidentiality.
• Response: within three months of the acknowledgment (or of the seven days, if there was none), extendable by three more months in especially complex cases.
• While it is handled we may ask you for more information through the channel.

The system is managed by a person designated by the board of AxisOne Group SL, who acts independently and autonomously (article 8). If the facts could be a crime, the information will be sent immediately to the Public Prosecutor’s Office, or to the European Public Prosecutor’s Office if they affect the EU’s financial interests.

You can also report breaches to the authorities, directly or after using this channel:

• the Independent Whistleblower Protection Authority, A.A.I. (www.proteccioninformante.gob.es), at national level;
• the Anti-Fraud Office of Catalonia (www.antifrau.cat), for breaches limited to Catalonia, or the regional authority that applies depending on where the facts took place;
• and, where appropriate, the institutions, bodies, offices and agencies of the European Union.

We recommend using the internal channel first when the breach can be handled effectively within the company and you do not fear retaliation, but the choice is yours.

Controller

AxisOne Group SL

Purpose

Handling reports, investigating the facts and taking the appropriate measures.

Legal basis

Compliance with a legal obligation or, when the channel is not mandatory, the public interest (GDPR art. 6.1.c and 6.1.e and article 30 of Spanish Law 2/2023).

Access

Only the system manager and whoever manages it directly, human resources if disciplinary measures are needed, legal services if legal action is needed, and processors such as the channel platform provider (article 32).

Retention

Only for the time strictly needed to decide whether to investigate. If no investigation starts within three months, the data is deleted, except to keep a record of how the system works. Information found to be untrue is deleted immediately, unless it may be a crime. The reports log is kept for ten years at most (articles 26 and 32).

Rights

Access, rectification, erasure, restriction and objection, at privacy@attendo.me. The person concerned will never learn the reporter’s identity this way. If they object to the processing, there is a presumption of compelling legitimate grounds to continue it (article 31).