Internal Information System Policy

Grupo Empresarial Enhol, S.L. is strongly committed to maintaining ethical standards and conducting in line with applicable legal frameworks. Inappropriate behavior by a single employee, manager, or collaborator may damage the Group’s reputation.

For this reason, Grupo Enhol requires all employees, executives, directors, and collaborators acting on its behalf (hereinafter “Personnel”) to comply with current legislation, the Code of Ethics, the Sexual Harassment Policy, and all internal policies and procedures.

To ensure compliance with these ethical standards, the involvement and collaboration of all “Personnel” in identifying potential irregularities is of utmost importance.

For this reason, following prior consultation with the legal representatives of employees, on November 3, 2023, the General Management of Grupo Empresarial Enhol, S.L. has established an Internal Information Channel (hereinafter, the “Channel”), through which you may report potential breaches as set out in this Policy.

The “Channel” is accessible 24/7 through the means indicated in this document for all “Personnel” of Grupo Enhol.

The General Management of Grupo Empresarial Enhol, S.L. has approved this “Internal Information System Policy and Procedure for the Management of Received Reports”, the purpose of which is to guide the reporting person on, among other matters, the types of issues that may be reported, who may submit reports, the procedure followed by the Internal Information Channel, and the general principles governing the Channel.

The Internal Information System (hereinafter, the “IIS”) referred to in this Policy is the appropriate channel for reporting actions or omissions as set out in Section III (scope).

The IIS consists of the Communication Channel established for this purpose, the person responsible for the IIS, and the procedure to be followed for handling the corresponding reports, all as detailed in this document.

This Policy applies to all companies that form part of Grupo Enhol, as identified in the Annex. A list of the Group’s companies to which this Policy applies is included as Annex I (hereinafter, “Grupo Enhol”).

This Annex may be updated without the need for approval by the General Management of Grupo Empresarial Enhol, S.L., and this Policy shall apply to any companies that may join Grupo Enhol in the future.

Reportable facts

ETHICS AND WHISTLEBLOWING CHANNEL

a) Any actions or omissions that may constitute breaches of European Union law, such as:

1. public procurement

2. financial services, products and markets, and the prevention of money laundering and terrorist financing

3. product safety and compliance

4. transport safety

5. environmental protection

6. radiation protection and nuclear safety

7. food and feed safety, animal health and animal welfare

8. public health

9. consumer protection,

10. protection of privacy and personal data, and security of network and information systems

11. breaches affecting the financial interests of the European Union, as referred to in Article 325 of the Treaty on the Functioning of the European Union (TFEU)

12. breaches relating to the internal market, as referred to in Article 26(2) of the TFEU, including breaches of European Union competition law and State aid rules, as well as breaches relating to the internal market in connection with acts that violate corporate tax rules or practices aimed at obtaining a tax advantage that undermines the object or purpose of the applicable corporate tax legislation.

1. Actions or omissions that may constitute serious or very serious criminal or administrative offences. In any case, this includes all serious or very serious criminal or administrative offences involving financial loss to the Public Treasury and the Social Security system.

Irregularities related to the company’s Code of Ethics may also be reported.

HARASSMENT CHANNEL

Through the Harassment Channel, reports may be submitted regarding incidents occurring within a workplace context, in accordance with the provisions of Organic Law 3/2007 on Effective Equality between Women and Men, Organic Law 10/2022 on the Comprehensive Guarantee of Sexual Freedom, the Workers’ Statute, the Criminal Code, and other applicable regulations.

The Ethics and Whistleblowing Channel and the Harassment Channel may be jointly referred to as the “Internal Information Channel” or the “Channel”.

It is important to note that the “Channel” is not the appropriate means for customer complaints or suggestions, nor is it intended for “Personnel” to report matters, actions or omissions other than those listed in the preceding sections.

External Reporting Channels

The protection provided by the “Channel” does not exclude the possibility that the reporting person (you) may or should directly use the procedures established under the applicable administrative or criminal regulations.

Likewise, you may report to the Independent Authority for Whistleblower Protection (A.I.P.I.) (https://www.proteccioninformante.gob.es/), or to the relevant regional authorities or bodies, any actions or omissions, either directly or after submitting a report through this Internal Channel. These include, among others:

• Financial services, products and markets, and the prevention of money laundering and terrorist financing.
  • SEPBLAC
  • Bank of Spain
  • National Securities Market Commission (CNMV)
• Transport safety (civil aviation and maritime work):
  • Transport Inspection Mailbox
• For information related to fraud, corruption or any other illegal activity affecting European funds, the National Anti-Fraud Coordination Service (SNCA) channel may be used)
• For infringements of Law 15/2007 of 3 July on the Defence of Competition, the Anonymous Competition Whistleblowing Channel (SICA) may be used.
  • Anonymous Competition Whistleblowing Channel (SICA)

Persons entitled to submit a report

“Personnel” of the Group are entitled to submit a report through the “Channel” if they have obtained information regarding potential “Breaches” in a work-related or professional context committed by any employee, manager, director, representative, service provider and/or collaborator acting in the name and/or on behalf of Grupo Enhol.

Likewise, members of Grupo Enhol who have been subject to conduct constituting sexual harassment or harassment based on sex in the workplace are also entitled to submit a report.

Within the framework of Law 2/2023 of 20 February on the protection of persons who report regulatory breaches and on combating corruption, this Policy shall also apply to reporting persons who have obtained information regarding potential “Breaches”, including in any case:

1. any person working for or under the supervision and direction of Grupo ENHOL, its contractors, subcontractors and/or suppliers

2. persons who have previously been members of Grupo ENHOL and whose employment, professional, corporate or representative relationship has already ended

3. volunteers, interns or collaborators of Grupo ENHOL, regardless of whether they receive remuneration

4. persons whose employment, professional or business relationship with Grupo ENHOL has not yet begun, where the information on “Breaches” has been obtained during the recruitment process or pre-contractual negotiations

Persons against whom a report may be submitted

Within the framework of Law 2/2023 of 20 February on the protection of persons who report regulatory breaches and on combating corruption, reports may be submitted against managers, employees, members of governing bodies or external collaborators acting in the name and/or on behalf of Grupo ENHOL who have committed a “Breach” within or in connection with the company, in a work-related or professional context involving “Personnel”.

Within the framework of Organic Law 3/2007 on Effective Equality between Women and Men, Organic Law 10/2022 on the Comprehensive Guarantee of Sexual Freedom, the Workers’ Statute, the Criminal Code and other applicable regulations, reports may be submitted against alleged perpetrators of conduct constituting sexual harassment or harassment based on sex in the workplace.

Internal Information Channel

Reports must be submitted (either in writing or verbally) through the application made available by Grupo ENHOL: CORESOL. It is important to note that any report not submitted through the aforementioned channel may be considered as not received and may not be processed.

Grupo Enhol has appointed Ms. Maribel Martínez as the “Internal Information System Officer” (hereinafter, the “IIS Officer” or “Administrator”), a single-member body responsible for supervising the IIS. The IIS Officer shall perform their duties diligently, independently and autonomously from the Group’s General Management. They shall not receive instructions of any kind in the exercise of their functions and shall be provided with all the necessary human and material resources to carry them out. The IIS Officer shall ensure that the resolution procedure is properly applied.

The resolution of any report submitted shall be the responsibility of the “Decision Committee” or “Investigating Committee”, which will be appointed depending on the nature of the report.

In the event of a conflict of interest, the IIS Officer shall appoint a substitute person or persons, unless the conflict of interest affects the IIS Officer themselves. In such cases, the General Management of Grupo Enhol shall appoint the substitute(s) who will form the Committee responsible for managing and resolving the report.

The IIS Officer shall also be responsible for maintaining the Register Book of all reports received and the corresponding investigation files, always ensuring the confidentiality of the information.

Reporting Procedure of the Ethics and Whistleblowing Channel and the Harassment Channel

The reporting procedure consists of the following phases.

ETHICS AND WHISTLEBLOWING CHANNEL: Irregularities to be reported: Law 2/2023, as well as those set out in the Code of Ethics and Conduct:

Phase 1 – Submission of the report: Reports must be submitted through the “Co-resol” platform, either via the App or via the website: https://canalco-resol.com In both cases, the code Enhol must be used.

Phase 2 – Acknowledgement: Within a maximum period of 7 days, the reporting person will receive an acknowledgement of receipt of the report. If necessary, Grupo Enhol will inform the reporting person of any deficiencies that need to be corrected.

Phase 3 – Opening of the investigation and notifications: Once the report has been admitted, the internal investigation will begin, and the relevant parties and affected bodies will be notified, always respecting confidentiality and data protection requirements.

The investigation period shall be 3 months, extendable by an additional 3 months in the case of complex investigations.

Grupo Enhol may require the reporting person to provide the necessary evidence to carry out the investigation and may conduct interviews with the reporting person, the investigated individual and/or potential witnesses.

Where necessary, precautionary measures shall be adopted to protect the reporting person and, where applicable, any related persons (natural or legal) who may be subject to retaliation.

Phase 4 – Resolution of the case: Once the previous phase has been completed, the reporting procedure may conclude in one of the following ways:

1. Closure of the case (where the investigation concludes that no irregularities exist or that the reported breaches fall outside the scope of this Channel).

2. Disciplinary measures against the investigated individual (where the investigation concludes that irregularities do exist).

3. Referral to the competent authorities.

Phase 5 – Closure of the case: All documentation relating to reports (whether admitted or dismissed) must be retained and preserved for the necessary period in accordance with Article 24 of the LOPDGDD.

HARASSMENT CHANNEL: Irregularities to be reported:
Sexual harassment or harassment based on sex, moral or psychological harassment, LGBTI harassment, as well as sexual harassment in Peru.

Phase 1 – Submission of the report: Reports must be submitted through the “Co-resol” platform, either via the App or via the website https://canalco-resol.com. In both cases, the code ENHOL must be used.

The remaining phases, timelines and resolution procedures for reports of this nature are set out in the company’s “Procedure for Action in Cases of Sexual Harassment, Harassment Based on Sex and Harassment Based on Sexual Orientation and Gender Identity”, “Procedure for Action in Cases of Moral or Psychological Harassment”, “Procedure for Action Against Harassment and Violence Against LGTBI Persons”, and “Policy for the Prevention and Sanctioning of Sexual Harassment.”

The Internal Information System (IIS) is designed in accordance with the following characteristics and core principles to guarantee the rights of reporting persons and affected individuals:

Security, Confidentiality or Anonymity

The “Channel” is designed, established and managed in such a way that it allows you to submit reports anonymously and confidentially. However, if judicial proceedings are subsequently initiated, the identity of the reporting person may be disclosed upon court request.

Both the information received through the “Channel” and that generated during the investigation phase will be handled with the utmost confidentiality.

Accessibility and Omnichannel Approach

The “Channel” allows for the submission of written or oral reports. Likewise, upon request, it is possible to arrange a face-to-face or online meeting with the IIS Officer.

Transparency

Within the legally established timeframe, you will receive an acknowledgement of receipt of your report. If, following a preliminary assessment, it is determined that your report does not fall within the scope of the “Channel”, you will be notified of its closure and, where applicable, the deletion of your personal data.

Conversely, if the preliminary assessment confirms that your report falls within the scope of the “Channel”, you will be informed of the opening of the case and kept updated on its status.

Good Faith

Reports must be submitted in good faith. A reporting person shall be deemed to be acting in bad faith if they knowingly report false information with the intention of harming another person (false report).

Bad faith reporting may be sanctioned in accordance with applicable legislation, without prejudice to any disciplinary measures that Grupo Enhol may deem appropriate.

It shall not be considered bad faith to report an irregularity that is ultimately found not to exist or cannot be sufficiently proven.

Presumption of Innocence, Right to Honour, Right of Defence and Right of Access to the File

At all times, the right to the presumption of innocence and the right to honour of the reported person and any individuals affected by the investigation shall be respected, as well as their right of defence.

They shall be provided with clear and sufficient information regarding the facts attributed to them (excluding the identity of the reporting person, which shall remain strictly confidential).

The reported person shall have the right to be informed, within the legally established timeframes, of the report submitted against them.

Conflict of Interest

Reports shall be handled in a manner that prevents any form of internal or external interference, ensuring that no conflicts of interest arise at any stage of the process.

Prohibition of Retaliation

Any reporting person who submits a report in good faith shall be protected against any form of retaliation, discrimination or penalty. Actions such as dismissal, demotion, relocation or any discriminatory act arising from the submission of a report are strictly prohibited.

This prohibition of retaliation shall not prevent the adoption of appropriate disciplinary measures where the investigation reveals that the report was made in bad faith (false report) and that the reporting person was aware of its falsity.

When the protection conditions established by law and/or this Policy are met, the reporting person shall be entitled to a series of support measures, including protection against retaliation for reporting the infringing acts and the assurance that submitting a report shall not be considered a breach of any confidentiality obligation.

In addition, the reporting person shall be entitled to the following support measures from the competent authorities:

a) Comprehensive, independent, easily accessible and free information and advice on available procedures and remedies, protection against retaliation, and the rights of the affected person.

b) Effective assistance from the competent authorities before any relevant authority involved in their protection against retaliation, including certification that they are eligible for protection under this law.

c) Legal assistance in criminal proceedings and in cross-border civil proceedings in accordance with European Union regulations.

d) Financial and psychological support, on an exceptional basis, were so determined by the Independent Authority for Whistleblower Protection (A.A.I.), following an assessment of the circumstances arising from the submission of the report.

All the above shall be without prejudice to any assistance that may be available under Law 1/1996 of 10 January on free legal aid, for representation and defence in judicial proceedings arising from the submission of the report or public disclosure.

In relation to reports submitted through the ETHICS AND WHISTLEBLOWING CHANNEL, except in the case of infringements established under Law 15/2007 of 3 July on the Defence of Competition, where a person who has participated in the commission of the reported infringement is the one who reports its existence by submitting a report, and provided that such report has been submitted prior to the notification of the initiation of investigation or sanctioning proceedings, the competent authority responsible for resolving the procedure may, by means of a reasoned decision, exempt that person from the administrative sanction that would otherwise apply, provided that the following conditions are duly evidenced in the case file:

a) That the person has ceased their participation in the infringement at the time of submitting the report and, where applicable, has identified the other individuals who participated in or facilitated the infringement.

b) That the person has cooperated fully, continuously and diligently throughout the entire investigation procedure.

c) That the person has provided truthful and relevant information, evidence or significant data for the establishment of the facts under investigation, and has not destroyed or concealed such information, nor disclosed its content to third parties, directly or indirectly.

d) That the person has taken steps to repair the damage attributable to them.

Where these requirements are not fully met, including cases of partial reparation of the damage, the authority responsible for resolving the procedure and/or the competent authority may, after assessing the degree of contribution to the resolution of the case, decide to mitigate the sanction that would otherwise apply to the committed infringement, provided that the reporting person has not previously been sanctioned for acts of the same nature that gave rise to the initiation of the procedure.

The mitigation of the sanction may be extended to other participants involved in the commission of the infringement, depending on their level of active cooperation in clarifying the facts, identifying other participants, and repairing or mitigating the damage caused, as assessed by the authority responsible for resolving the procedure.

Grupo Enhol guarantees that appropriate technical and organizational measures will be adopted to safeguard the security and confidentiality of the data collected, to protect it against unauthorized disclosure or access.

Access to the data, particularly personal data that may be obtained through the Channel, shall be handled with the utmost confidentiality. Access shall be strictly limited to the IIS Officer, the Management System Officer, and the Decision Committee, and, where necessary, to the HR Manager and/or the Legal Officer of Grupo Enhol, as well as external advisors or third parties involved in the procedure.

Such data shall be retained only for as long as strictly necessary to determine whether an investigation should be initiated, to process, investigate and resolve the report, to implement preventive and/or disciplinary measures, and/or to comply with applicable regulations or potential requests from authorities. In any case, if no investigation proceedings are initiated within three months from receipt of the report (due to inadmissibility), personal data shall be deleted, unless retention is necessary to demonstrate the proper functioning of the system and/or to comply with legal obligations or potential requests from authorities.

Likewise, three months after the closure or decision regarding the report, personal data shall be deleted, unless retention is necessary to demonstrate the proper functioning of the system and/or to comply with legal obligations or potential requests from authorities.

This Privacy Policy explains the personal information we collect when an individual uses the “Channel” and how we use it. Grupo Enhol reserves the right to amend this Policy to adapt it to legislative or case law developments, as well as to industry practices.

9.1 Data Controller

The data controller responsible for the processing of personal data within the Channel is GRUPO EMPRESARIAL ENHOL S.L., with registered address at Calle Frauca nº13, 31500 Tudela – Navarra (Spain), and Tax Identification Number (CIF) B31227200.

For any questions related to data privacy in the “Channel”, you may contact us at the following email address info@grupoenhol.es, as well as through our Data Protection Officer (DPO) at dpo@integratecnologia.es.

9.2 Personal Data Collected

The “Channel” may be used without providing personal data. However, the reporting person may also choose to provide personal data as part of the reporting process or where required by applicable law, including, in particular, their name and surname, telephone number or email address (optional), as well as details of the report, including the names of the persons reported, dates, a description of the alleged infringement, and any evidence related to the report.

9.3 Purpose and Legal Basis for Processing

The processing of personal data arising from the application of Law 2/2023 shall be governed by the provisions of the General Data Protection Regulation (GDPR) and Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).

The information collected through the “Channel” shall be used exclusively to investigate the reported facts, including the handling, investigation and resolution of the report, the implementation of preventive and/or disciplinary measures, and/or as required to comply with applicable regulations or requests from authorities. Such information shall not be shared with third parties unless necessary for the investigation, for the enforcement of disciplinary measures against the reported person or where required by law or by the courts.

The personal data of the reporting person shall be processed on the legal basis of consent, as provided when submitting their data through the “Channel” (Article 6(1)(a) GDPR), as well as where necessary for compliance with legal obligations. This includes reports concerning matters related to criminal law, competition law or labour law (Article 6(1)(c) GDPR). Likewise, the data shall be processed on the legal basis of the performance of a task carried out in public interest (Article 6(1)(e) GDPR).

Furthermore, personal data may be processed where necessary for the purposes of the legitimate interests pursued by Grupo Enhol or by a third party (Article 6(1)(f) GDPR). Grupo Enhol has a legitimate interest in processing personal data to prevent and detect infringements within the Group, verify the legality of internal processes, and safeguard the integrity of Grupo Enhol.

If, at any time during the handling of the report, you provide personal data belonging to special categories (for example, information regarding racial or ethnic origin, religious or ideological beliefs, trade union membership or sexual orientation), such data shall be processed on the basis of your consent (Article 9(2)(a) GDPR) and in accordance with the purposes of this Policy and the Channel.

In addition, your personal data may be used in an anonymised form for statistical purposes.

9.4 Technical Implementation and Data Security

The “Channel” includes an option for anonymous communication through an encrypted connection and the anonymisation of personal data.

We implement appropriate technical measures to ensure data protection and maintain the confidentiality of the information.

9.5 Data Retention Period

We store personal data only for as long as necessary to carry out the appropriate investigations and adopt the relevant measures. Once the report has been resolved, the necessary steps will be taken to delete, block or anonymise personal data where possible.

Personal data may be obtained where required by European or national legislation to comply with legal obligations.

9.6 Rights of Reporting Persons and Reported Individuals

As a data subject, you have the right to access your personal data, as well as to request the rectification of inaccurate data or, where appropriate, to request its erasure when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

In certain circumstances, you may request the restriction of the processing of your data, in which case we will only retain it for the establishment, exercise or defence of legal claims.

In certain circumstances and for reasons related to your situation, you may object to the processing of your data. In such cases, we will cease processing the data unless there are compelling legitimate grounds or for the establishment, exercise or defence of legal claims.

You have the right to data portability, meaning that the personal data you have provided may be transmitted directly to another data controller in a structured, commonly used and machine-readable format, where technically feasible.

You may exercise your rights or submit any complaint regarding how we have processed your personal data by sending an email to info@enhol.es, as well as through your Data Protection Officer at dpo@integratecnologia.es. If you still consider that your personal data has not been processed in accordance with the law, you may lodge a complaint with the relevant data protection authority. In Spain, this is the Spanish Data Protection Agency (AEPD).

The reported person shall also have the rights granted under Articles 15 to 22 of the GDPR, subject to the following limitations:

• The right of access shall not include information relating to the identity of the reporting person or other individuals involved in the procedure.

• The rights of objection, rectification and erasure of personal data shall not apply during the processing of the submitted report.

In compliance with applicable legislation, Grupo Enhol’s Internal Information System (IIS) maintains a record register of all reports received and investigations carried out, which meets the required standards of confidentiality and data protection.

This record register shall not be public. Access to its content, in whole or in part, shall only be granted upon a duly justified request by the competent judicial or administrative authority, through the appropriate formal request, and within the framework of judicial or administrative proceedings and under the supervision of such authority.

Notwithstanding the obligation of all “Personnel” to be aware of and act in accordance with internal policies, the dissemination of this Policy and the existence of the reporting Channel shall be actively promoted.

The Whistleblowing Channel system shall be subject to an annual review by an external auditor, for the purpose of assessing its proper implementation in accordance with this Policy.

This Policy shall enter into force upon its approval by the General Management of Grupo Enhol.

• Grupo Empresarial Grupo Enhol, S.L.

• Innovación Verde Inver, S.L.U.

• Magma Gestión Integral de Mantenimiento, S.L.

• Liverco, S.L.U.

• Herbetec Ibérica, SL

• Verco Inversiones y Servicios, S.L.U.

• AcGrupo Enhol Energía, S.L.

• AcGrupo Enhol Energía Canarias, S.L

• Perú Energía Renovable, S.A.

• Inver Management Perú, SAC

• Comercializadora de Energía Renovable Mesoamericana, S.A

• Innovaciones Renovables Guatemala, S.A

• Inver Bulgaria EOOD

• Alimentos Naturales para Mascotas, S.L.

• Grupo Enhol Innola, S.L.

• Enhol Energía Renovable, SL

If new entities join the Group, they shall be automatically incorporated into this Policy.

Version	Date	Author	Modifications
1.0	Oct 2023	Support Unit	Initial Version
2.0	Nov2024	Support Unit	Pag.8 inclusion of ENHOL code Update of APPENDIX I
3.0	Jul 2025	Support Unit	Pages 5 y 6 update of reportable matters Page 7 update of personal scope Page 9 update of reporting procedure and URL Page 10 y 11 update of acknowledgement timelines and information to the reported person Page12 update of scenarios
4.0	Feb 2026	Support Unit	Page 4 inclusion of external reporting channels links Pages 6-7 modification of titles Page 8 inclusion of the Accessibility and Omnichannel principle Page 9 Prohibition of retaliation and inclusion of list of guarantees Pages 11 y 13 inclusion of DPO email dpo@integratecnologia.es General adaptation to Recommendation 1/2026 of the AIPPI
5.0	Sep 2026	Support Unit	Pages 6 and 7: Differentiation between the CoResol reporting channels and the applicable procedures depending on the nature of the conduct reported. Alignment with Grupo Enhol’s policies and procedures framework.

Approval Body	Entity	Date
General Management	Grupo empresarial Enhol, S.L	30 November 2023

In Tudela, on 16 September 2026,

Mr. Gonzalo Oliver Amatriain Mr. Diego Oliver Gimeno

_____________________________ _______________________