Whistleblowing Channel Privacy Policy

Personal data processed through the Internal Information System, including the exchange or transmission of personal data with the competent authorities, will be processed by INBEST GPF Real Estate Management Partners SL (“INBEST GPF”), with registered office at C/ Serrano, nº 57, 4th floor, 28006, as the data controller in accordance with the provisions of the regulations on the protection of personal data.

The personal data provided through the Internal Information System will be processed for the purpose of receiving and analyzing the actions or omissions reported by the informant (the “Informant”) and, where appropriate, decide whether to initiate an investigation into the reported facts. Additionally, certain information may be processed to document the system's operation. In this latter case, INBEST guarantees that the information stored as evidence will be anonymized.

In the event of receiving information that is not necessary for the processing and investigation of the actions or omissions referred to in Law 2/2023, of February 20, regulating the protection of persons who report regulatory infringements and the fight against corruption (“Whistleblower Protection Act”), the data controller will proceed to its immediate deletion. Likewise, all personal data that may have been communicated and that refers to conduct not included within the scope of the Whistleblower Protection Act and this Policy will be deleted, as well as any information or part thereof that is proven to be untrue, unless such untruthfulness may constitute a criminal offense.

The data controller will process the personal data provided by the informant in compliance with a legal obligation, specifically, the Informant Protection Act. Furthermore, in the case of verbal communications, the informant's consent will be required to document such communication, including those made through face-to-face meetings, telephone calls, or voice messaging. The processing of specially protected data, if necessary for the intended purpose, may be carried out by the controller for reasons of substantial public interest, in accordance with Article 9.2(g) of Regulation (EU) 2016/679.

Personal data collected through the internal reporting channel will be stored in accordance with applicable law. Specifically, this data will be retained only for the time strictly necessary to determine whether to initiate an investigation into the reported incidents, which, in any case, may not exceed three months from the date the report was received. However, if it becomes necessary to process personal data for a longer period to continue the investigation or, where applicable, to initiate appropriate legal action, the data will be stored in a separate environment from the internal reporting channel for as long as necessary to conclude the investigation or for INBEST to pursue the corresponding legal action.

To fulfill the purposes described above, the data controller may provide access to personal data to:

• Third-party companies that provide services, such as external advisors and collaborators that provide support in the management or, where appropriate, investigation of complaints received through the internal complaints channel.
• Those areas or departments relevant to the processing of the complaint and, where appropriate, for the investigation and possible measures to be taken with respect to the reported conduct, whenever necessary.
• Likewise, personal data may be transferred to Judges and Courts, the Public Prosecutor's Office, as well as to the competent Public Administrations as a result of any investigation that may be launched.

In relation to the above, INBEST GPF informs interested parties that it does not carry out international transfers of the personal data provided.

Furthermore, the interested party is informed that, under the conditions established in the applicable regulations, they may exercise the rights recognized in the data protection regulations by sending, to the attention of the data controller, a regular letter to their registered office or an email to the following address: LOPDGDD@inbest.com.

However, INBEST GPF informs that, in the event that the person to whom the facts related in the communication refer or to whom the public disclosure refers exercises the right of objection, it will be presumed that, unless proven otherwise, there are compelling legitimate reasons that legitimize the processing of their personal data.

Without prejudice to the rights of the informant, in accordance with data protection regulations, if the communication was made verbally, the interested party may verify, rectify and revoke their consent through the following address: LOPDGDD@inbest.com.

Furthermore, those concerned have the right to file a complaint with the Spanish Data Protection Agency in www.aepd.es.

The data controller will periodically review the proper functioning of the internal complaints channel and the provisions of this Policy.