Whistleblowing Policy

Following the entry into force of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, companies that meet certain requirements must implement an Internal Information System (hereinafter, “IIS”) or, where appropriate, adapt their Whistleblower Channel to that IIS, in accordance with the requirements set out in the regulation.

In February 2023, Spain transposed the above regulation through Law 2/2023, of 20 February 2023, regulating the protection of persons who report regulatory infringements and the fight against corruption (hereinafter, “Law 2/2023, of 20 February”). This law reinforces the principles established in the European Directive and strengthens them by introducing additional requirements.

Article 11 of the Spanish legislation allows the parent company of a corporate group to approve a general policy in relation to its Whistleblower Channel, provided that it includes the principles of the Channel and the guarantees that must be observed. Subsidiaries, while maintaining autonomy and independence, may make any modifications or adaptations necessary to comply with the national regulations applicable in each case.

In line with the Vita Group’s culture of compliance, the purpose of this Annex is to set out the main and most important characteristics established by Spanish regulations that must be applied by the Group’s Spanish subsidiaries in order to avoid legal infringements, without prejudice to the provisions of the Vita Group’s General Policy.

To support compliance with the above, the Vita Group has established the following Whistleblower Channel as the preferred route for the submission of communications: denuncias@vitagroup.com.

Alternatively, communications may be sent by post to: Av. Diagonal, 538, 5-2, (08036) Barcelona, for the attention of the person responsible for the Whistleblower Channel.

This Annex applies to and is binding on all Spanish subsidiaries that currently belong, or in future belong, to the Vita Group. That is to say, all Spanish companies that are majority-owned by VITA GROUP HOLDINGS LTD.

Who can file a communication through the Channel?

All managers, employees, collaborators, suppliers, customers, and any other third party may use Vita Group’s Channel to report possible breaches or violations of the organisation’s internal policies, irregularities detected in the performance of their duties, or any infringement or omission of which they are aware that may involve a breach of European Union law or its financial interests, or criminal or administrative offences within the Spanish legal framework.

For the purposes of this Policy, communicators or informants are all natural persons who report the infringements referred to above, who work in the private or public sector, and who have obtained information on infringements in a work-related or professional context. This includes, in any case:

• Employees, including those whose employment or professional relationship has ended
• Self-employed workers
• Volunteers
• Interns
• Individuals in a recruitment or selection process
• Partners and shareholders
• Members of the Managing Body
• Anyone working under the supervision of contractors, subcontractors or suppliers

In accordance with Law 2/2023, of 20 February, the following persons shall also benefit from the protection established by this Policy:

• Legal representatives of employees, in the exercise of their functions of advising and supporting the informant
• Natural persons who, within the framework of the organisation in which the whistleblower provides services, assist the whistleblower during the process
• Natural persons related to the whistleblower who may suffer retaliation, such as co-workers or relatives
• Legal persons for whom the whistleblower works or with whom they maintain another type of relationship in a work-related context, or in which they hold a significant shareholding. For these purposes, a shareholding in capital or voting rights is considered significant where, by reason of its proportion, it allows the holder to influence the legal person in which they participate

What can be communicated through the Channel?

By way of example, actions or omissions that constitute or may constitute violations in the following areas may be reported:

• Health alert
• Harassment / discrimination
• Public procurement
• Confidentiality
• Corruption / fraud
• Competition
• Corporate offences
• Tax / corporate matters
• Finance
• Non-compliance with current legislation
• Non-compliance with policies / procedures / internal regulations
• Violation of the Code of Ethics or other internal codes
• Labour / legal workers’ rights
• Environment
• Protection against radiation and nuclear safety
• Intellectual property / trade secrets
• Organisation protocols and standards
• Occupational health and safety
• Anti-money laundering prevention
• Consumer protection
• Privacy and personal data protection
• Sustainability
• Public health
• Food and feed safety, animal health, and animal welfare
• Network and information system security
• Product safety and compliance
• Transportation safety
• Other similar matters

5.1. Confidentiality and anonymity

Communications received through the Channel will be treated with the utmost confidentiality, both during processing and after the procedure has been completed. Access will be restricted to authorised personnel only.

The confidentiality and anonymity of the informant, and of any other third party who is or may be mentioned and/or involved in the communication, as well as the actions carried out and the processing of the communication, will be guaranteed. It will not be necessary to obtain data that would allow identification.

All persons who, for any reason, participate in support tasks relating to the investigation of a specific incident must sign an appropriate Confidentiality Agreement.

Any proceedings carried out with third parties or with other bodies, areas or departments of the Spanish subsidiaries of the Vita Group will be conducted while preserving the anonymity of the informant and the investigated party, as well as the reasons for the communication.

5.2. Prohibition of retaliation

Acts constituting retaliation, including threats of retaliation and attempts to retaliate against persons submitting a communication, are expressly prohibited.

For these purposes, retaliation means any act or omission prohibited by law, or any act or omission that directly or indirectly involves unfavourable treatment that places the affected person at a particular disadvantage in the labour or professional context, solely because of their status as a whistleblower or because they have made a public disclosure.

By way of example, Article 36 of Law 2/2023, of 20 February, provides that retaliation includes:

• Suspension of the employment contract, dismissal or termination of the employment or statutory relationship, including non-renewal or early termination of a temporary contract once the probationary period has expired, or early termination or cancellation of contracts for goods or services, the imposition of disciplinary measures, demotion or denial of promotions, substantial changes to working conditions, or failure to convert a temporary contract into an indefinite one where the employee had legitimate expectations of being offered a permanent position, unless these measures were taken as part of the regular exercise of management powers under labour legislation or the relevant public employee statute, and are unrelated to the communication
• Damages, including reputational damage, financial losses, coercion, intimidation, harassment or ostracism
• Negative evaluations or references regarding work or professional performance
• Inclusion on blacklists or dissemination of information within a specific sector that hinders or prevents access to employment or the contracting of works or services
• Denial or cancellation of a licence or permit
• Denial of training
• Discrimination, or unfavourable or unfair treatment

A person whose rights have been harmed as a result of a communication or disclosure after the two-year period has elapsed may request protection from the competent authority, which may, exceptionally and with justification, extend the period of protection after hearing the persons or bodies likely to be affected. Any refusal to extend the protection period must be justified.

In addition, informants shall not be considered to have violated any restriction on disclosure of information, nor to incur liability of any kind in connection with such disclosure, provided that they had reasonable grounds to believe that the communication or public disclosure was necessary to reveal an act or omission covered by this Annex.

They shall likewise not incur liability in respect of the acquisition of or access to information that is publicly communicated or disclosed, provided that such acquisition or access does not constitute a criminal offence.

5.3. Presumption of innocence and honour

At all times, the presumption of innocence and respect for the honour of all parties affected by the filing of a communication are guaranteed.

Persons concerned by a communication shall have the right to be informed of the acts or omissions attributed to them, and to be heard during the course of the investigation, without in any case being informed of the identity of the informant.

Accordingly, persons affected by a communication shall be guaranteed the right to the presumption of innocence, the right of defence, and the right of access to the file under the terms regulated in Law 2/2023, of 20 February. They shall also be afforded the same protection established for informants, preserving their identity and guaranteeing the confidentiality of the facts and data involved in the procedure.

5.4. Support measures

In accordance with Law 2/2023, of 20 February, the Spanish subsidiaries of the Vita Group shall make available to the reporter or informant any support measures that, having regard to the circumstances, may be necessary.

This is without prejudice to any assistance that may be available under Law 1/1996, of 10 January, on free legal assistance, for representation and defence in legal proceedings arising from the filing of the communication or public disclosure.

5.5. Protection of personal data

The Spanish subsidiaries of the Vita Group undertake to process the data contained in the communication in strict compliance with applicable legislation on personal data and informant protection, ensuring at all times the absence of retaliation.

The processing of personal data deriving from Law 2/2023, of 20 February, shall be governed by Title VI of that Law, Regulation (EU) 2016/679 of 27 April 2016, Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights, and Organic Law 7/2021, of 26 May, on the protection of personal data processed for the purposes of the prevention, detection, investigation and prosecution of criminal offences and enforcement of criminal penalties.

Personal data will not be collected where it is manifestly not relevant to the processing of specific information. If such data is collected accidentally, it will be deleted without undue delay.

6.1. Responsible person for the Whistleblower Channel

The person responsible for the Whistleblower Channel (or Channel Manager) is responsible for ensuring the correct operation of the Channel and for the diligent processing of the information received.

In this regard, the Managing Body of VITA GROUP HOLDINGS LTD has designated the Channel Manager for the Spanish subsidiaries and communicated this designation to the Anti-Fraud Office of Catalonia, in the manner and within the term established by law.

The person responsible for the Whistleblower Channel is:

• Mrs. Neus Giné Gras, Chief Financial Officer of Vita Spain Management

The Spanish subsidiaries of the Vita Group have also designated a Substitute for cases in which the responsible person is involved in a communication, or where a conflict of interest arises.

The Substitute Manager is:

• Mr. Gavin Duncan, Director of the Vita Group

6.2. Presentation of communications

Communications may be made through the Whistleblower Channel established by the Vita Group, or directly to the Independent Whistleblower Protection Authority (hereinafter also referred to as “A.A.I.”), which is an external channel established by the Public Administration. In Catalonia, where the Spanish subsidiaries of the Vita Group are headquartered, this authority is the Anti-Fraud Office of Catalonia.

If a communication is received through internal channels other than those established, or is addressed to members of staff not responsible for processing it, the organisation will preserve confidentiality and forward the communication to the Channel Manager.

6.2.1. Internal channels

Vita Group’s Whistleblower Channel is the preferred and integral channel for submitting communications. A communication may be made in writing or verbally, either anonymously or by name.

In writing:

• By email to: denuncias@vitagroup.com
• By post to: Av. Diagonal, 538, 5-2, (08036) Barcelona, for the attention of the person responsible for the Whistleblower Channel

Verbally:

• By requesting a face-to-face meeting with the person responsible for the Whistleblower Channel. This will be held within a maximum period of seven (7) days from the request, in the manner considered most appropriate by the entity, while preserving confidentiality. The information received will be recorded, and the communicator will be informed of this and of the processing of their personal data under section 5.5 of this Annex. Alternatively, it may be documented by means of a complete and accurate transcript of the conversation

All communications, whatever their form and whether anonymous or nominal, will be treated confidentially.

Where possible, they should include:

• A description of the facts
• Identification of the parties involved
• Any evidence supporting the alleged non-compliance, including the circumstances under which the informant obtained access to that information

6.2.2. External channels

Individuals may also report to the A.A.I. or to the corresponding authorities or regional bodies through duly established channels, either directly or after prior communication through the Vita Group Whistleblower Channel: denuncias@vitagroup.com.

In the Autonomous Community of Catalonia, the competent authority is the Anti-Fraud Office of Catalonia, which provides an anonymous reporting mailbox that guarantees confidentiality and anonymity. It is available via the following link: Make an anonymous report to the Anti-Fraud Office of Catalonia.

6.2.3. Public disclosure

In addition to the channels above, whistleblowers may make a public disclosure.

Public disclosure consists of making information about the facts that are the subject of a communication available to the public through this Internal Information System.

To be protected under Law 2/2023, of 20 February, public disclosure must meet one of the following conditions:

• The person has made a communication through internal and external channels, or directly through external channels, without appropriate action being taken within the established timeframe
• The person has reasonable grounds to believe that the breach may constitute an imminent or manifest danger to the public interest, or there is a risk of irreversible damage (including danger to physical integrity), or there is a risk of retaliation or a low likelihood of effective handling due to the circumstances, for example concealment or destruction of evidence, collusion, or authority involvement

6.3. Receipt of communications

Once a communication has been received, the Channel Manager will initiate the corresponding investigation, where appropriate.

An acknowledgement of receipt will be sent within seven (7) calendar days of receipt of the communication and incorporated into the file, including clear and accessible information on external channels.

Where sending an acknowledgement could jeopardise confidentiality, it may be delayed for a prudent period.

6.4. Acceptance of communications for processing

After receiving the communication, the person in charge will assign a registration number corresponding to the file and codes to anonymise the informant, the investigated party, the facts, and any affected third party.

The responsible person will record:

• Objective data: facts, dates, names, quantities, places, contacts, etc.
• Subjective data: opinions, rumours, ideas and appreciations
• An assessment of whether the communication relates to a potential violation, or instead constitutes a complaint or suggestion for improvement

If necessary and possible, the informant may be asked to provide additional information.

If the facts may indicate a criminal offence, the person in charge will immediately forward the information to the Managing Body so that it can assess whether referral to the Public Prosecutor’s Office is appropriate.

6.5. Investigation phase

The investigation will be conducted by the Channel Manager, or by the Substitute where there is a conflict of interest. Where advisable due to seriousness or complexity, other professionals may be appointed to assist.

The investigated person will be notified and interviewed, and may exercise the right to be heard, without being informed of the identity of the informant.

Any third parties involved may also be interviewed. All steps taken will be documented.

The following actions will be carried out during this stage:

1. Investigation of the reported facts, taking into account:

• Objective and subjective elements provided by the informant, with priority given to objective elements supported by documentation
• The reputation, seriousness and reliability of the informant
• Allegations and exonerating evidence provided by the investigated party
• Evidence obtained from third parties or from other areas or departments

2. Analysis and assessment of potential consequences.

The investigation timeframe will depend on the seriousness and potential consequences, but may not exceed three (3) months from receipt, or from the expiry of seven (7) days if no acknowledgement of receipt is sent, except in cases of special complexity where it may be extended by a further three (3) months.

Where third-party personal data is included, the responsible party will delete any data that is not necessary and will inform third parties in accordance with data protection requirements, without disclosing the informant’s identity.

6.6. Termination of actions

Following the investigation, a verdict / resolution will be prepared containing:

• A description of the facts and evidence
• An analysis and assessment of the evidence
• Recommendations, where an infringement is proven, to strengthen internal controls
• A reasoned resolution: archiving without sanction, archiving with sanction, or communication to the authorities

The possible outcomes are:

• Archiving without sanction: where the infringement is manifestly minor or where repeated communications contain no new significant information
• Archiving with sanction: the responsible person may propose a sanction, and the Managing Body will decide in coordination with HR
• Communication to the authorities: where the facts indicate a possible criminal offence, the Managing Body will be informed so that it can assess whether to report the matter to the Public Prosecutor’s Office

Where the facts are confirmed, the Spanish subsidiaries will take the necessary measures to stop the issue and, where appropriate, apply actions under the disciplinary regime and Spanish legislation.

The resolution will be notified to both the informant and the investigated party within the maximum term of three (3) months. The informant will not be notified if they have waived notification, are anonymous, or if contact information is unavailable.

6.7. Record of communications

The responsible person shall maintain a log of received information and investigations, including key dates, sources, investigation plans, interviews, pending tasks, outcomes, and the chain of custody for evidence.

Article 63 of Law 2/2023, of 20 February, categorises non-compliance with the requirements into very serious, serious and minor infringements.

Very serious infringements

• Actions that limit rights or guarantees, or hinder communications
• Retaliation against protected persons
• Breach of confidentiality or anonymity, including attempts to reveal identity
• Breach of secrecy
• Repeat serious or very serious infringements within two years
• Communicating or publicly disclosing information known to be false
• Failure to have an internal information system where this is required

Fines (Article 65):

• Natural persons: €30,001 to €300,000
• Legal entities: €600,001 to €1,000,000

Serious infringements

• Hindering communications, where the conduct is not classified as very serious
• Breach of confidentiality or anonymity, where the conduct is not classified as very serious
• Breach of secrecy, where the conduct is not classified as very serious
• Failure to adopt confidentiality or secrecy measures
• Repeat a minor infringement within two years

Fines (Article 65):

• Natural persons: €10,001 to €30,000
• Legal entities: €100,001 to €600,000

Minor infringements

• Deliberately submitting incomplete information outside the applicable deadlines
• Failure to cooperate with investigations
• Any other non-compliance not classified above

Fines (Article 65):

• Natural persons: €1,001 to €10,000
• Legal entities: up to €100,000

This Annex has been approved by the Managing Body of VITA GROUP HOLDINGS LTD and may be modified in order to improve confidentiality and effectiveness.

It will be reviewed and/or modified:

• When there are relevant changes in the parent company or the Spanish subsidiaries
• When legal changes make this advisable
• When relevant breaches of the Annex occur

It will also be reviewed periodically.

This Annex will be published on the Vita Group website home page, in a separate and easily identifiable section, together with the Group Policy and access to the Channel, in accordance with Article 25 of Law 2/2023, of 20 February.