Whistleblowing Policy

Following the entry into force of Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019, on the protection of persons who report breaches of Union law, companies that meet certain requirements must implement an Internal Information System (hereinafter, “IIS”) or, where appropriate, adapt their Whistleblower Channel to that IIS, in accordance with the requirements set out in the regulation.

In February 2023, Spain transposed the aforementioned regulation through Law 2/2023, of February 20, 2023, regulating the protection of persons who report regulatory infringements and the fight against corruption (hereinafter, “Law 2/2023, of February 20”), which reinforces the principles established in the European Directive and strengthens them by establishing additional requirements.

In line with the foregoing, it should be noted that Article 11 of the aforementioned Spanish legislation allows the parent company of a corporate Group to approve a general Policy in relation to its Whistleblower Channel, which must contemplate the principles of the Channel and the guarantees that must be complied with, and that the subsidiaries, with autonomy and independence, may make such modifications or adaptations as may be necessary to comply with the national regulations applicable in each case.

Therefore, following the culture of compliance that characterises the Vita Group, the purpose of this Annex is to consider the main and transcendental characteristics established by Spanish regulations that must be applied by the Group’s Spanish subsidiaries to avoid a legal infringement, without prejudice to the provisions of the Vita Group’s General Policy.

As a tool for compliance with the above, the Vita Group has set up the following Whistleblower Channel: denuncias@vitagroup.com, as a preferential channel for the submission of communications, or alternatively, by post to: Av. Diagonal, 538, 5-2, (08036) Barcelona – for the attention of the person responsible for the Whistleblower Channel.

This Annex applies to and is binding on all Spanish subsidiaries that currently, and in the future, belong to the Vita Group. That is to say, all Spanish companies majority-owned by VITA GROUP HOLDINGS LTD.

Who can file a communication through the Channel?

All managers, employees, collaborators, suppliers and customers, as well as any other third party, can communicate through Vita Group’s Channel possible breaches or violations of the provisions of any of the internal policies of the organisation, or report an irregularity that they detect in the performance of their duties, as well as any infringement or omission of which they are aware and which may involve an infringement of European Union law or its financial interests, or criminal or administrative offences in the Spanish legal framework.

In this context, communicators or informants are considered to be all those natural persons who report the infringements mentioned in the previous title, who work in the private or public sector and who have obtained information on infringements in a work or professional context, including in any case:

• Employees, including those who have terminated their employment or professional relationship.
• Self-employed.
• Volunteers.
• Interns.
• In the process of selection.
• Partners, shareholders.
• Members of the Managing Body.
• Anyone working under the supervision of contractors, subcontractors or suppliers.

Likewise, they shall also enjoy the protection established by this Policy, in accordance with the aforementioned Law 2/2023, of February 20:

• the legal representatives of the employees in the exercise of their functions of advising and supporting the informant,
• natural persons who, within the framework of the organisation in which the whistleblower provides services, assist the whistleblower in the process,
• natural persons who are related to the whistleblower and who may suffer retaliation, such as co-workers or relatives of the whistleblower, and
• legal persons, for whom he/she works or with whom he/she maintains any other type of relationship in a work context or in which he/she holds a significant shareholding. For these purposes, participation in capital or voting rights is considered significant when, due to its proportion, it allows the holder to influence the legal person in which they participate.

What can be communicated through the Channel?

By way of example, actions or omissions that constitute or may constitute violations in the following areas may be reported:

• Health Alert.
• Harassment / Discrimination.
• Public Procurement.
• Confidentiality.
• Corruption / Fraud.
• Competition.
• Corporate Offences.
• Tax / Corporate.
• Finance.
• Non-compliance with current legislation.
• Non-compliance with Policies / Procedures / Internal Regulations.
• Violation of the Code of ethics, other internal Codes.
• Labour / Legal Workers’ rights.
• Environment.
• Protection against Radiation and Nuclear Safety.
• Intellectual Property / Trade secrets.
• Organisation Protocols and Standards.
• Occupational Health and Safety.
• Anti-Money Laundering Prevention.
• Consumer Protection.
• Privacy and Personal Data Protection.
• Sustainability.
• Public Health.
• Food and Feed Safety, Animal Health, and Animal Welfare.
• Network and Information System Security.
• Product Safety and Compliance.
• Transportation Safety.
• Others.

5.1. CONFIDENTIALITY AND ANONYMITY

Communications received through the Channel will be treated with the utmost confidentiality, both during processing and once the procedure has been completed, preventing access to unauthorised personnel.

In this sense, the confidentiality and anonymity of the informant and of any other third party that is or may be mentioned and/or involved in the communication, the actions carried out as a result thereof, and the processing thereof, shall be guaranteed, without it being necessary to obtain data that would allow their identification.

Therefore, all those who, for various reasons, participate in support tasks for the investigation of a specific incident, must sign a Confidentiality Agreement to that effect.

Accordingly, any proceedings carried out with third parties or other bodies, areas or departments of the Spanish subsidiaries of the Vita Group shall be conducted while maintaining the anonymity of the informant and the investigated party, as well as the reasons for the communication.

5.2. PROHIBITION OF RETALIATION

Acts constituting retaliation, including threats of retaliation and attempts to retaliate against persons submitting a communication, are expressly prohibited.

For these purposes, retaliation is understood to be any acts or omissions that are prohibited by law, or that directly or indirectly involve unfavourable treatment that places the persons who suffer them at a particular disadvantage with respect to another in the labour or professional context, solely because of their status as whistleblowers or because they have made a public disclosure.

For the purposes of Law 2/2023, of February 20, and by way of example, Article 36 of said law provides that reprisals include:

a) Suspension of the employment contract, dismissal or termination of the employment or statutory relationship, including the non-renewal or early termination of a temporary employment contract once the probationary period has expired, or early termination or cancellation of contracts for goods or services, imposition of any disciplinary measure, demotion or denial of promotions and any other substantial modification of working conditions and the failure to convert a temporary employment contract into an indefinite one, in the event that the employee had legitimate expectations that he/she would be offered an indefinite job; unless these measures were carried out as part of the regular exercise of management powers under labour legislation or the corresponding public employee statute, due to circumstances, facts or accredited infractions, unrelated to the presentation of the communication.

b) Damages, including those of a reputational nature, or economic losses, coercion, intimidation, harassment or ostracism.

c) Negative evaluation or references regarding work or professional performance.

d) Inclusion in black lists or dissemination of information in a specific sector, which hinder or prevent access to employment or the contracting of works or services.

e) Denial or cancellation of a licence or permit.

f) Denial of training.

g) Discrimination, or unfavourable or unfair treatment.

A person whose rights have been harmed as a result of a communication or disclosure after the two-year period has elapsed may request protection from the competent authority which, exceptionally and with justification, may extend the period of protection after hearing the persons or bodies likely to be affected. Any refusal to extend the protection period must be justified.

In addition, informants shall not be deemed to have violated any restriction on disclosure of information or incur any liability of any kind in connection with such disclosure, provided that they had reasonable grounds to believe that such communication or public disclosure was necessary to disclose an act or omission under this Annex.

Therefore, they shall not incur liability in respect of the acquisition of or access to information that is publicly communicated or disclosed, provided that such acquisition or access does not constitute a crime.

5.3. PRESUMPTION OF INNOCENCE AND HONOUR

At all times, the presumption of innocence and respect for the honour of all parties affected as a result of the filing of a communication are guaranteed.

Therefore, the persons concerned by a communication shall have the right to be informed of the acts or omissions attributed to them, as well as to be heard in the course of the investigation, without in any case being informed of the identity of the informant.

Consequently, the persons affected by the communication shall be guaranteed the right to the presumption of innocence, the right of defence and the right of access to the file under the terms regulated in Law 2/2023, of February 20, as well as the same protection established for informants, preserving their identity and guaranteeing the confidentiality of the facts and data of the procedure.

5.4. SUPPORT MEASURES

In accordance with Law 2/2023 of February 20, the Spanish subsidiaries of the Vita Group shall make available to the reporter or informant the appropriate support measures which, after assessing the circumstances, may be necessary. This is without prejudice to assistance that may correspond under Law 1/1996, of January 10, on free legal assistance, for representation and defence in legal proceedings arising from the filing of the communication or public disclosure.

5.5. PROTECTION OF PERSONAL DATA

The Spanish subsidiaries of the Vita Group undertake to treat the data contained in the communication in strict compliance with applicable personal data and informant protection legislation, ensuring at all times the absence of retaliation.

The processing of personal data deriving from Law 2/2023, of February 20, shall be governed by Title VI of said Law, Regulation (EU) 2016/679 of 27 April 2016, Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights, and Organic Law 7/2021, of May 26, on the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offences and enforcement of criminal penalties.

Personal data will not be collected if it is manifestly not relevant to the processing of specific information or, if collected by accident, will be deleted without undue delay.

6.1. PERSONAL RESPONSIBLE FOR THE WHISTLEBLOWER CHANNEL

The Responsible person for the Whistleblower Channel (or Channel Manager) is the person in charge of ensuring the correct operation of the Channel and responsible for the diligent processing of the information received.

In this regard, the Managing Body of VITA GROUP HOLDINGS LTD has designated the Channel Manager for the Spanish subsidiaries and communicated said designation to the Anti-Fraud Office of Catalonia, in the manner and within the term established by law.

The person responsible for the Whistleblower Channel is:

• Mrs. Neus Giné Gras, Chief Financial Officer of Vita Spain Management.

Likewise, the Spanish subsidiaries of the Vita Group have designated a Substitute for cases in which the responsible person is involved in a communication, or where a conflict of interest arises.

The Substitute Manager is:

• Mr. Gavin Duncan, Director of the Vita Group.

6.2. PRESENTATION OF COMMUNICATIONS

Communications can be made through the Whistleblower Channel set up by the Vita Group, or directly to the Independent Whistleblower Protection Authority (hereinafter also referred to as “A.A.I”), which is an external channel set up by the Public Administration which, in Catalonia (headquarters of the Spanish subsidiaries of the Vita Group), is the Anti-Fraud Office of Catalonia.

If the communication is received through internal channels other than those established or is addressed to members of staff not responsible for processing, the organisation will preserve confidentiality and forward the communication to the Channel Manager.

6.2.1. Internal Channels

Vita Group’s Whistleblower Channel is the preferred and integral channel for submitting communications. The communication may be made in writing or verbally:

• In writing, anonymously or by name:
  • By email to: denuncias@vitagroup.com.
  • By post to: Av. Diagonal, 538, 5-2, (08036) Barcelona – for the attention of the person responsible for the Whistleblower Channel.
• Verbally, anonymously or by name:
  • By requesting a face-to-face meeting with the person responsible for the Whistleblower Channel. This will be held within a maximum period of seven (7) days from the request, in the manner deemed most convenient by the entity, while preserving confidentiality. The information received will be recorded, and the communicator will be informed of this and of the processing of their personal data under section 5.5 of this Annex. Alternatively, it may be documented through a complete and accurate transcription of the conversation.

All communications, regardless of form and whether anonymous or nominal, will be treated confidentially. They should include, where possible:
– A description of the facts.
– Identification of the parties involved.

Where possible, all evidence supporting the alleged non-compliance should be provided, including the circumstances under which the informant obtained access to such information.

6.2.2. External Channels

Individuals may also report to the A.A.I. or to the corresponding authorities or regional bodies through duly established channels, either directly or after prior communication through the Vita Group Whistleblower Channel: denuncias@vitagroup.com.

In the Autonomous Community of Catalonia, the competent authority is the Anti-Fraud Office of Catalonia, which provides an anonymous reporting mailbox that guarantees confidentiality and anonymity. It is available via the following link: Make an anonymous report to the Anti-Fraud Office of Catalonia.

6.2.3. Public disclosure

In addition to the channels above, whistleblowers may make a public disclosure.

Public disclosure consists of making available to the public information on the facts that are the subject of communication through this Internal Information System.

To be protected under Law 2/2023, of February 20, public disclosure must meet the following conditions:

a) The person has made a communication through internal and external channels, or directly through external channels, without appropriate action being taken within the established timeframe.

b) The person has reasonable grounds to believe the breach may constitute an imminent or manifest danger to the public interest, or there is a risk of irreversible damage (including danger to physical integrity), or there is a risk of retaliation or low likelihood of effective handling due to the circumstances (e.g., concealment or destruction of evidence, collusion, or authority involvement).

6.3. RECEIPT OF COMMUNICATIONS

Once a communication has been received, the Channel Manager will initiate the corresponding investigation, where appropriate.

An acknowledgement of receipt will be sent within seven (7) calendar days following receipt of the communication and incorporated into the file, including clear and accessible information on external channels.

Where acknowledgement could jeopardise confidentiality, it may be delayed for a prudent period.

6.4. ACCEPTANCE OF COMMUNICATIONS FOR PROCESSING

After receiving the communication, the person in charge will assign a registration number corresponding to the file and codes to anonymise the informant, the investigated party, the facts, and any affected third party. The responsible person will record:

• Objective data: facts, dates, names, quantities, places, contacts, etc.
• Subjective data: opinions, rumours, ideas, and appreciations.
• An assessment as to whether the communication relates to a potential violation, or is a complaint/suggestion regarding improvement.

If necessary and possible, the informant may be asked to provide additional information.

If the facts may indicate a crime, the person in charge will immediately forward the information to the Managing Body to assess referral to the Public Prosecutor’s Office.

6.5. INVESTIGATION PHASE

The investigation will be conducted by the Channel Manager (or Substitute where there is a conflict of interest). If advisable due to seriousness or complexity, other professionals may be appointed to assist.

The investigated person will be notified and interviewed and may exercise the right to be heard, without being informed of the identity of the informant.

Any third parties involved may also be interviewed. All steps will be documented.

The following actions will be carried out during this stage:

1. Investigation of the reported facts, considering:

• Objective and subjective elements provided by the informant, prioritising objective elements supported by documentation.
• The reputation, seriousness and reliability of the informant.
• Allegations and exonerating evidence provided by the investigated party.
• Evidence obtained from third parties or other areas/departments.

2. Analysis and assessment of potential consequences.

The investigation timeframe will depend on the seriousness and potential consequences, but may not exceed three (3) months from receipt (or from expiry of seven (7) days if no acknowledgement is sent), except in special complexity cases where it may be extended by a further three (3) months.

Where third-party personal data is included, the responsible party will delete any data not necessary and will inform third parties in line with data protection requirements, without disclosing the informant’s identity.

6.6. TERMINATION OF ACTIONS

Following the investigation, a VERDICT/RESOLUTION will be prepared containing:

• Description of the facts and evidence.
• Analysis and assessment of evidence.
• Recommendations, where an infringement is proven, to strengthen internal controls.
• A reasoned resolution: ARCHIVING WITHOUT SANCTION, ARCHIVING WITH SANCTION, or COMMUNICATION TO THE AUTHORITIES.

• • ARCHIVING WITHOUT SANCTION: where the infringement is manifestly minor or where repeated communications contain no new significant information.
  • ARCHIVING WITH SANCTION: the responsible person may propose a sanction; the Managing Body will decide in coordination with HR.
  • COMMUNICATION TO THE AUTHORITIES: where the facts indicate a possible crime, the Managing Body will be informed to assess reporting to the Public Prosecutor’s Office.

Where facts are confirmed, the Spanish subsidiaries will take necessary measures to stop the issue and, if appropriate, apply actions under the disciplinary regime and Spanish legislation.

The resolution will be notified to both the informant and the investigated party within the three (3) month maximum term. The informant will not be notified if they renounce notification, are anonymous, or contact information is unavailable.

6.7. RECORD OF COMMUNICATIONS

The responsible person shall maintain a log of received information and investigations, including key dates, sources, investigation plans, interviews, pending tasks, outcomes, and the chain of custody for evidence.

Article 63 of Law 2/2023, of February 20, categorises non-compliance with the requirements into very serious, serious and minor infringements.

VERY SERIOUS INFRINGEMENTS

A) Actions that limit rights/guarantees or hinder communications.
B) Retaliation against protected persons.
C) Breach of confidentiality/anonymity, including attempts to reveal identity.
D) Breach of secrecy.
E) Repeat serious/very serious infringements within two years.
F) Communicating or publicly disclosing information known to be false.
G) Failure to have an internal information system as required.

Fines (art. 65):

a) Natural persons: €30,001 to €300,000.
b) Legal entities: €600,001 to €1,000,000.

SERIOUS INFRINGEMENTS

A) Hindering communications (not very serious).
B) Breach of confidentiality/anonymity (not very serious).
C) Breach of secrecy (not very serious).
D) Failure to adopt confidentiality/secrecy measures.
E) Repeat minor infringement within two years.

Fines (art. 65):

a) Natural persons: €10,001 to €30,000.
b) Legal entities: €100,001 to €600,000.

MINOR INFRINGEMENTS

A) Deliberately submitting incomplete information outside deadlines.
B) Failure to cooperate with investigations.
C) Other non-compliance not classified above.

Fines (art. 65):

a) Natural persons: €1,001 to €10,000.
b) Legal entities: up to €100,000.

This Annex has been approved by the Managing Body of VITA GROUP HOLDINGS LTD and may be modified to improve confidentiality and effectiveness.

It will be reviewed and/or modified:

• When there are relevant changes in the parent company or Spanish subsidiaries.
• When legal changes make it advisable.
• When relevant breaches of the Annex occur.

It will also be reviewed periodically.

This Annex will be published on the Vita Group website home page, in a separate and easily identifiable section, together with the Group Policy and access to the Channel, in accordance with art. 25 of Law 2/2023, of February 20.