Whistleblowing Policy

Following the entry into force of Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019, on the protection of persons who report breaches of Union law, companies that meet certain requirements must implement an Internal Information System (hereinafter, “IIS”) or, where appropriate, adapt their Whistleblower Channel to that IIS, in accordance with the requirements set out in the regulation.

In February 2023, Spain transposed the aforementioned regulation through Law 2/2023, of February 20, 2023, regulating the protection of persons who report regulatory infringements and the fight against corruption (hereinafter, “Law 2/2023, of February 20”), which reinforces the principles established in the European Directive and strengthens them by establishing additional requirements.

In line with the foregoing, it should be noted that Article 11 of the aforementioned Spanish legislation allows the parent company of a corporate Group to approve a general Policy in relation to its Whistleblower Channel, which must contemplate the principles of the Channel and the guarantees that must be complied with, and that the subsidiaries, with autonomy and independence, may make such modifications or adaptations as may be necessary to comply with the national regulations applicable in each case.

Therefore, following the culture of compliance that characterizes the Vita Group, the purpose of this Annex is to consider the main and transcendental characteristics established by Spanish regulations that must be applied by the Group’s Spanish subsidiaries to avoid a legal infringement, without prejudice to the provisions of the Vita Group’s General Policy.

As a tool for compliance with the above, the Vita Group has set up the following Whistleblower Channel: denuncias@vitagroup.com, as a preferential channel for the submission of communications, or alternatively, to the postal address: Av. Diagonal, 538, 5-2, (08036) Barcelona – to the attention of the responsible person for the Whistleblower Channel.

This Annex reaches and binds all Spanish subsidiaries that currently and, in the future, belong to the Vita Group. That is to say, all Spanish companies’ majority owned by VITA GROUP HOLDINGS LTD.

Who can file a communication through the Channel?

All managers, employees, collaborators, suppliers and customers, as well as any other third party can communicate through Vita Group’s Channel possible breaches or violations of the provisions of any of the internal policies of the organization, or report an irregularity that they detect in the performance of their duties, as well as any infringement or omission of which they are aware and which may involve an infringement of European Union law or its financial interests or criminal or administrative offenses in the Spanish legal framework.

In this context, communicators or informants are considered to be all those natural persons who report the infringements mentioned in the previous title, who work in the private or public sector and who have obtained information on infringements in a work or professional context, including in any case:

• Employees, including those who have terminated their employment or professional relationship.
• Self-employed.
• Volunteers.
• Interns.
• In the process of selection.
• Partners, shareholders.
• Members of the Managing Body.
• Anyone working under the supervision of contractors, subcontractors or suppliers.

Likewise, they shall also enjoy the protection established by this Policy, in accordance with the aforementioned Law 2/2023, of February 20:

• the legal representatives of the employees in the exercise of their functions of advising and supporting the informant,
• natural persons who, within the framework of the organization in which the whistleblower provides services, assist the whistleblower in the process,
• natural persons who are related to the whistleblower and who may suffer retaliation, such as co-workers or relatives of the whistleblower, and
• legal persons, for whom he/she works or with whom he/she maintains any other type of relationship in a work context or in which he/she holds a significant shareholding. For these purposes, it is understood that the participation in the capital or in the voting rights corresponding to shares or participations is significant when, due to its proportion, it allows the person who holds it to have the capacity to influence the legal person in which he/she participates.

What can be communicated through the Channel?

By way of example of the foregoing, actions or omissions that constitute or may constitute violations in the following areas may be reported:

• Health Alert.
• Harassment / Discrimination.
• Public Procurement.
• Confidentiality.
• Corruption / Fraud.
• Competition.
• Corporate Offences.
• Tax / Corporate.
• Finance.
• Non-compliance with current legislation.
• Non-compliance with Policies / Procedures / Internal Regulations.
• Violation of the Code of ethics, other internal Codes.
• Labour / Legal Workers’ rights.
• Environment.
• Protection against Radiation and Nuclear Safety.
• Intellectual Property / Trade secrets.
• Organization Protocols and Standards.
• Occupational Health and Safety.
• Anti-Money Laundering Prevention.
• Consumer Protection.
• Privacy and Personal Data Protection.
• Sustainability.
• Public Health.
• Food and Feed Safety, Animal Health, and Animal Welfare.
• Network and Information System Security.
• Product Safety and Compliance.
• Transportation Safety.
• Others.

5.1. CONFIDENTIALITY AND ANONYMITY

Communications received through the Channel will be treated with the utmost confidentiality, both during the processing and once the procedure has been completed, preventing access to unauthorized personnel.

In this sense, the confidentiality and anonymity of the informant and of any other third party that is or may be mentioned and/or involved in the communication, in the actions carried out as a result thereof and in the processing thereof, shall be guaranteed, without it being necessary to obtain data that would allow their identification.

Therefore, all those who, for various reasons, participate in support tasks for the investigation of a specific incident, must sign a Confidentiality Agreement to that effect.

As a consequence, the proceedings carried out towards third parties or other bodies, areas or departments of the Spanish subsidiaries of the Vita Group shall be carried out maintaining the anonymity of the informant and the investigated, as well as the reasons for the communication.

5.2. PROHIBITION OF RETALIATION

Acts constituting retaliation, including threats of retaliation and attempts to retaliate against persons submitting a communication, are expressly prohibited.

For these purposes, retaliation is understood to be any acts or omissions that are prohibited by law, or that directly or indirectly involve unfavourable treatment that places the persons who suffer them at a particular disadvantage with respect to another in the labour or professional context, solely because of their status as whistleblowers, or because they have made a public disclosure.

For the purposes of the provisions of Law 2/2023, of February 20, and by way of example, Article 36 of said law provides that reprisals are considered to be those adopted in the form of:

a) Suspension of the employment contract, dismissal or termination of the employment or statutory relationship, including the non-renewal or early termination of a temporary employment contract once the probationary period has expired, or early termination or cancellation of contracts for goods or services, imposition of any disciplinary measure, demotion or denial of promotions and any other substantial modification of working conditions and the failure to convert a temporary employment contract into an indefinite one, in the event that the employee had legitimate expectations that he/she would be offered an indefinite job; unless these measures were carried out as part of the regular exercise of management powers under labour legislation or the corresponding public employee statute, due to circumstances, facts or accredited infractions, unrelated to the presentation of the communication.

b) Damages, including those of a reputational nature, or economic losses, coercion, intimidation, harassment or ostracism.

c) Negative evaluation or references regarding work or professional performance.

d) Inclusion in black lists or dissemination of information in a specific sector, which hinder or prevent access to employment or the contracting of works or services.

e) Denial or cancellation of a license or permit.

f) Denial of training.

g) Discrimination, or unfavourable or unfair treatment.

A person whose rights have been harmed as a result of its communication or disclosure after the two-year period has elapsed may request protection from the competent authority which, exceptionally and with justification, may extend the period of protection, after hearing the persons or bodies likely to be affected. The refusal to extend the protection period must be justified.

In addition, informants shall not be deemed to have violated any restriction on disclosure of information or incur any liability of any kind in connection with such disclosure, provided that they had reasonable grounds to believe that such communication or, as the case may be, public disclosure was necessary to disclose an act or omission under this Annex.

Therefore, they shall not incur liability in respect of the acquisition of or access to information that is publicly communicated or disclosed, provided that such acquisition or access does not constitute a crime.

5.3. PRESUMPTION OF INNOCENCE AND HONOUR

At all times, the presumption of innocence and respect for the honour of all parties affected as a result of the filing of a communication are guaranteed.

Therefore, the persons concerned by a communication shall have the right to be informed of the acts or omissions attributed to them, as well as to be heard in the course of the investigation, without in any case being informed of the identity of the informant.

Consequently, the persons affected by the communication shall be guaranteed the right to the presumption of innocence, the right of defence and the right of access to the file under the terms regulated in Law 2/2023, of February 20, as well as the same protection established for informants, preserving their identity and guaranteeing the confidentiality of the facts and data of the procedure.

5.4. SUPPORT MEASURES

In accordance with the rules established by Law 2/2023 of February 20, the Spanish subsidiaries of the Vita Group shall make available to the reporter or informant the appropriate means of support that, after assessing the circumstances, may be necessary. All of the above, regardless of the assistance that may correspond under Law 1/1996, of January 10, 1996, on free legal assistance, for representation and defence in legal proceedings arising from the filing of the public communication or disclosure.

5.5. PROTECTION OF PERSONAL DATA

The Spanish subsidiaries of the Vita Group undertake to treat the data contained in the communication with the strictest compliance with the legislation on protection of personal data and informants, ensuring at all times the absence of retaliation.

The processing of personal data deriving from the application of Law 2/2023, of February 20, on which this Annex is based, shall be governed by the provisions of Title VI of said Law, by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, by the provisions of Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights, in the Organic Law 7/2021, of May 26, on the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offenses and enforcement of criminal penalties.

Personal data will not be collected if it is manifestly not relevant to the processing of specific information or, if collected by accident, will be deleted without undue delay.

6.1. PERSONAL RESPONSIBLE FOR THE WHISTLEBLOWER CHANNEL

The Responsible person for the Whistleblower Channel (or Channel Manager) is the one who is in charge of ensuring the correct operation of the Channel and who will be responsible for the diligent processing of the information received.

In this regard, the Managing Body of VITA GROUP HOLDINGS LTD has proceeded to the designation of the Channel Manager for the Spanish subsidiaries, communicating said designation to the Anti-Fraud Office of Catalonia, in the manner and within the term established by Law.

The person responsible for the Whistleblower Channel is the following:

• Mrs. Neus Giné Gras, Chief Financial Officer of Vita Spain Management.

Likewise, the Spanish subsidiaries of the Vita Group have designated a Substitute for those cases in which the responsible person is involved in a communication, or in which a conflict of interest situation arises, in which case he/she must abstain from its management and processing.

The person holding the position of Substitute Manager is:

• Mr. Gavin Duncan, Director of the Vita Group.

6.2. PRESENTATION OF COMMUNICATIONS

Communications can be made through the Whistleblower Channel set up by the Vita Group, or directly to the Independent Whistleblower Protection Authority (hereinafter also referred as “A.A.I”), which is an External Channel set up by the Public Administration which, in Catalonia – headquarters of the Spanish subsidiaries of the Vita Group – is the Anti-Fraud Office of Catalonia.

If the communication was received through internal channels other than those established or was addressed to members of the personnel not responsible for its processing, the organization would also guarantee the preservation of confidentiality, warning that non-compliance would imply a very serious breach of the Law and that, immediately, the communication would be forwarded to the Channel Manager of the Spanish subsidiaries.

6.2.1. Internal Channels

Vita Group’s Whistleblower Channel is the preferred and integral channel for the presentation of communications.
For these purposes, the communication may be made in written form or verbally:

• In writing, anonymously or by name:
  • Sending a communication to the following e-mail address: denuncias@vitagroup.com.
  • Sending the communication to the postal address: Av. Diagonal, 538, 5-2, (08036) Barcelona – to the attention of the responsible person for the Whistleblower Channel.
• Verbally, anonymously or by name:
  • Requesting a face-to-face meeting with the responsible person for the Whistleblower Channel, which shall be held within a maximum period of seven (7) days from the request, in the manner deemed most convenient by the entity and preserving the confidentiality of the information. In this case, the information received through this meeting will be recorded, notifying the communicator about this circumstance, as well as about the processing of his personal data, in accordance with the provisions of section 5.5. of this Annex, or it may be documented through a complete and accurate transcription of the conversation.

All communications, regardless of the form in which they are made and whether anonymous or nominal, will be treated confidentially. They should also include, to the extent possible:
– A description of the facts.
– Identification of the parties involved.

If possible, it will be necessary to provide all the evidence that accredits the referred non-compliance and explaining the circumstances under which it has had access to such information.

6.2.2. External Channels

All individuals may report to the A.A.I. or to the corresponding authorities or regional bodies through the channels duly set up for this purpose, the commission of any actions or omissions referred to in the Vita Group’s Whistleblower Channel, either directly or after prior communication through the Channel: denuncias@vitagroup.com.

As mentioned above, in the Autonomous Community of Catalonia the competent authority in this matter is the Anti-Fraud Office of Catalonia, which has set up an anonymous reporting mailbox, guaranteeing at all times both the confidentiality of communications and the anonymity of the informant. This mailbox is available via the

Anti-Fraud Office of Catalonia anonymous reporting portal
.

6.2.3. Public disclosure

In addition to the aforementioned channels, the possibility of making a public disclosure is available to whistleblowers.

Public disclosure consists of making available to the public information on the facts that are the subject of communication through this Internal Information System.

In this context, in order for the protection of Law 2/2023, of February 20, to extend to persons making public disclosures, the following conditions must be met:

a) Has made the communication first through internal and external channels, or directly through external channels, without appropriate action having been taken within the established timeframe.

b) Has reasonable grounds to believe that either the breach may constitute an imminent or manifest danger to the public interest, in particular where there is an emergency situation, or there is a risk of irreversible damage, including a danger to the physical integrity of a person; or, in the case of communication through an external information channel, there is a risk of retaliation or there is little likelihood of effective handling of the information due to the particular circumstances of the case, such as concealment or destruction of evidence, collusion of an authority with the perpetrator of the breach, or that the authority is involved in the breach.

6.3. RECEIPT OF COMMUNICATIONS

Once a communication or information has been received, the Channel Manager in the Spanish subsidiaries will initiate the corresponding investigation process, where appropriate, to clarify the facts that are the subject of the communication.

An acknowledgement of receipt shall be sent to the informant within seven (7) calendar days following receipt of the communication. This acknowledgement of receipt shall be incorporated into the file including, in any case, clear and accessible information on the external channels of information before the competent authorities.

In cases where acknowledgement of receipt could jeopardize the confidentiality of the communication, in order to guarantee its confidentiality, it shall not be made until a period of time deemed prudent has elapsed.

As mentioned in previous paragraphs, alternatively to this preferential Internal Information System, any action or omission that may constitute an infringement that can be reported through the Whistleblower Channel may be reported to the A.A.I. or before the corresponding authorities or autonomous bodies, either directly or prior communication through the aforementioned Channel.

6.4. ACCEPTANCE OF COMMUNICATIONS FOR PROCESSING

After receiving the communication, the person in charge will assign a registration number that will correspond to your file and a series of codes to anonymize both the informant and the investigated, the facts, and any other third party that may be affected by the communication. Likewise, the responsible person shall record the following information:

• The objective data of the communication: facts, dates, names, quantities, places, contacts, etc., provided by the person making the communication.
• Subjective data: opinions, rumours, ideas, and appreciations that the informant considers necessary in the narration of the communication.
• Assessment by the person in charge as to whether the communication is associated with a possible or alleged violation or whether it is a mere complaint or suggestion related to improving an area of the business, work situation, etc.

If necessary and possible, it may request the informant to provide additional information necessary for the course of the investigation.

If the person in charge notices that the reported facts may be indicative of a crime, he/she shall immediately forward the information to the Managing Body.

6.5. INVESTIGATION PHASE

The investigation shall be conducted and developed mainly by the Channel Manager or, if applicable, by the substitute, for those cases in which there may be a conflict of interest.

At this stage, the person under investigation will be notified and interviewed, without being informed of the identity of the informant.

Any inquiries must be carried out maintaining anonymity.

The following actions will be carried out during this stage:

• Investigation of reported facts
• Analysis and assessment of consequences

The investigation period shall not exceed three (3) months, extendable in cases of special complexity.

6.6. TERMINATION OF ACTIONS

Following the investigation, a resolution will be prepared detailing:
– Description of facts
– Assessment of evidence
– Resolution outcome

Possible outcomes include:
– Archiving without sanction
– Archiving with sanction
– Communication to authorities

6.7. RECORD OF COMMUNICATIONS

The person in charge shall maintain a log of all communications and investigations, including dates, actions taken, and final resolutions.

Article 63 of Law 2/2023, of February 20, categorizes non-compliance with the aforementioned requirements into very serious infringements, serious infringements and minor infringements, as follows:

VERY SERIOUS INFRINGEMENTS

A) Any action that entails an effective limitation of the rights and guarantees provided for in this law introduced through contracts or agreements at individual or collective level and in general any attempt or effective action to hinder the submission of communications or to prevent, frustrate or slow down their follow-up, including the provision of false information or documentation by those required to do so.
B) The adoption of any retaliation resulting from the communication against informants or other persons included in the scope of protection set forth in Article 3.
C) Violate the guarantees of confidentiality and anonymity provided for in this law, and in particular any action or omission aimed at revealing the identity of the informant when the latter has opted for anonymity, even if the actual disclosure of the same does not take place.
D) Violate the duty to maintain secrecy on any aspect related to the information.
E) The commission of a serious infringement when the perpetrator has been sanctioned by means of a final decision for two serious or very serious infringements in the two years prior to the commission of the infringement, counted from the finality of the sanctions.
F) Communicating or publicly disclosing information knowing it to be false.
G) Failure to comply with the obligation to have an internal information system in accordance with the terms established by law.

Violations classified as very serious shall entail the imposition of the following fines, in accordance with the provisions of art. 65 of the aforementioned law:

a) If natural persons are responsible for the infringements, they shall be fined from 30,001 to 300,000 euros.
b) If they are legal entities they will be fined between 600,001 and 1,000,000 euros.

SERIOUS INFRINGEMENTS

A) Any action that entails limitation of the rights and guarantees provided for in this law or any attempt or effective action to hinder the submission of information or to prevent, frustrate or slow down its follow-up that is not considered a very serious infringement pursuant to paragraph 1.
B) Violate the guarantees of confidentiality and anonymity provided for in this law when it is not considered a very serious infringement.
C) Breach of the duty of secrecy in cases where it is not considered a very serious infringement.
D) Non-compliance with the obligation to adopt measures to guarantee the confidentiality and secrecy of the information.
E) The commission of a minor infraction when the perpetrator has been sanctioned for two minor, serious or very serious infractions in the two years prior to the commission of the infraction, counted from the finality of the sanctions.

Violations classified as serious shall entail the imposition of the following fines, in accordance with the provisions of art. 65 of the aforementioned law:

a) If natural persons are responsible for the infringements, they shall be fined from 10,001 to 30,000 euros.
b) If they are legal entities they will be fined between 100,001 and 60,000 euros.

MINOR INFRINGEMENTS

A) Deliberately submitting incomplete information to the Authority by the person in charge of the Channel, or outside the time period granted for such purpose.
B) Failure to comply with the obligation to cooperate with the investigation of information.
C) Any non-compliance with the obligations provided for in this law that is not classified as a very serious or serious infringement.

Infringements classified as minor, shall entail the imposition of the following fines, in accordance with the provisions of art. 65 of the aforementioned law:

a) If natural persons are responsible for the infringements, they shall be fined from 1,001 to 10,000 euros.
b) If they are legal entities they will be fined up to 100.00 euros.

This Annex has been approved by the Managing Body of VITA GROUP HOLDINGS LTD and may be modified in order to improve the confidentiality and effectiveness in the management of the communications sent.

Likewise, it will be reviewed and/or modified:

• Whenever there are relevant changes in the parent company or in the Spanish subsidiaries, in the control structure or in the activity carried out by them that make it advisable to do so.
• Whenever there are legal modifications that make it advisable to do so.
• Whenever there are relevant breaches of its provisions which also make it advisable to do so.

It will also be reviewed periodically, even when none of the circumstances described above occur.

In addition, this Annex will be published on the home page of the Vita Group’s website, in a separate and easily identifiable section, together with the Group Policy and access to the Channel, in accordance with the provisions of art. 25 of Law 2/2023, of February 20.