WHISTLEBLOWING SYSTEM

Clause A shall be provided to data subjects under investigation unless an ongoing investigation requires utmost confidentiality.

Clause B shall be provided to data subjects who file a complaint.

Clause A

PRIVACY NOTICE

In accordance with current legislation, the data subject is informed that he or she has been reported through the whistleblowing channel set up for this purpose and his or her personal data will be, or has already been, processed by TEMPRANO CAPITAL, S.L. (hereinafter, the “Data Controller”), as a Data Controller, with VAT no. B86650777, registered office in Calle Poeta Joan Maragall, 1-7, 28020, Madrid (Spain), and contact details of the Data Protection Officer dpo@tempranocp.com.

The purpose for this processing shall be carried out in order to investigate and follow up on the complaint filed and, to that end, identification data, contact details of the data subject, as well as any data strictly necessary for the investigation shall be processed. The legal obligation arising from applicable laws, and their implementation through data protection regulations, is the basis for the processing of personal data by the Data Controller to handle the complaint submitted. If, as a consequence of the above, special categories of personal data are processed, the lawful basis will be the need for the processing by the Data Controller for reasons of essential public interest, as well as its necessity for the formulation, exercise or defence of claims.

The data shall be kept for as long as necessary to carry out the investigation and, after that, for as long as required by applicable law and until the possible liabilities arising from the request expire.

The data subject's data may be communicated to the Public Administrations and to the Courts in the cases provided for by law.

The data subject has the right to:

• Access personal data.
• Correct inaccurate or incomplete data.
• Request that data be deleted when, for example, they are no longer necessary for the purposes for which they were collected.
• Obtain from the Data Controller the limitation of the processing of data when any of the conditions set out in data protection regulations are met.
• Request the portability of his or her data.
• Object to the processing of personal data, according to data protection legislation.

In order to exercise the above rights, the employee must send a written communication to the DPO at dpo@tempranocp.com or by writing to the address indicated above for the attention of the Data Protection Officer, proving his/her identity. Finally, the data subject may file a complaint with the competent Supervisory Authority when the data subject considers that the Data Controller has infringed the rights recognised by applicable data protection regulations.

Clause B

PRIVACY NOTICE

In accordance with current legislation, the data subject is informed that his or her personal data will be processed by TEMPRANO CAPITAL, S.L. (hereinafter, the “Data Controller”), as a Data Controller, with VAT no. B86650777, registered office in Calle Poeta Joan Maragall, 1-7, 28020, Madrid (Spain), and contact details of the Data Protection Officer dpo@tempranocp.com.

The data subject's personal data will be processed by the Data Controller to deal with his/her complaint or claim, carry out the pertinent steps and to be able to exhaustively follow up on its status, processing, and closure, which lawful basis lies on the compliance with a legal obligation to which the Data Controller is subject.

The data will be kept for this purpose for as long as necessary to carry out the investigation and, after that, for as long as required by applicable law and until the possible liabilities arising from your request expire and, to that end, identification data, contact details of the data subject, as well as any data strictly necessary for the investigation shall be processed.

If the data subject is not willing to reveal his or her identity, he or she can submit an anonymous message or claim.

The data subject's data may be communicated to the Public Administrations and to the Courts in the cases provided for by law.

The data subject has the right to:

• Access personal data.
• Correct inaccurate or incomplete data.
• Request that data be deleted when, for example, they are no longer necessary for the purposes for which they were collected.
• Obtain from the Data Controller the limitation of the processing of data when any of the conditions set out in data protection regulations are met.
• Request the portability of his or her data.
• Object to the processing of personal data, according to data protection legislation.

In order to exercise the above rights, the employee must send a written communication to the DPO at dpo@tempranocp.com or by writing to the address indicated above for the attention of the Data Protection Officer, proving his/her identity. Finally, the data subject may file a complaint with the competent Supervisory Authority when the data subject considers that the Data Controller has infringed the rights recognised by applicable data protection regulations.