Internal Reporting System Policy

Version 1.0 · October 2026 · Approved by the Administrator · Legal framework: Spanish Law 2/2023 of 20 February (transposing Directive (EU) 2019/1937).

1. Purpose

This Policy governs Exceltrop, S.L.'s Internal Reporting System: a safe, confidential and accessible way for anyone who, in a work or professional context, becomes aware of breaches to report them without fear of retaliation.

2. Who may report

Employees (permanent, temporary, on probation, interns and trainees); self-employed people and anyone providing services under a commercial relationship; shareholders and members of the administrative, management or supervisory body; anyone working for or under the supervision of contractors, subcontractors or suppliers; people whose relationship has ended or not yet begun (if the information was obtained during recruitment or pre-contractual negotiations); and workers' representatives. Protection also extends to people close to the reporter who may suffer retaliation.

3. What may be reported

Breaches of EU law within the scope of Article 2.1.a) of the Law; conduct that may constitute a criminal offence or a serious or very serious administrative offence, including harm to the Tax Agency or Social Security; breaches of Exceltrop's internal rules and principles; and conduct against the integrity, dignity or fundamental rights of people within the organisation, including workplace, sexual or gender-based harassment. Manifestly unfounded reports, or those whose only purpose is to harm others, will not be accepted.

4. Guiding principles

Confidentiality; anonymity; independence and autonomy of the System Manager; prohibition of retaliation; data protection under the GDPR, the Spanish LOPDGDD and Chapter V of the Law; and due process, including the presumption of innocence, the right of defence and the right to honour of everyone concerned.

5. Reporting channels

Online form at tropicospain.com/canal-denuncias (identified or anonymous, with attachments); post in a sealed envelope marked "CONFIDENCIAL — CANAL DE DENUNCIAS. ABRIR SÓLO POR DESTINATARIO" to the System Manager at Camino de Algarrobo, 87, 29700 Vélez-Málaga; and an in-person meeting on request, arranged within 7 calendar days, with minutes the reporter can check, correct and sign.

6. System Manager

The Administrator appoints the person responsible for Human Resources as System Manager, who acts independently and without receiving instructions. Where a report concerns the System Manager, it is handled by the Administrator, with the same guarantees of confidentiality; the System Manager has no access to it. Reporters can indicate this directly in the online form.

7. Procedure

Registration in the Logbook with a sequential number; acknowledgement within 7 calendar days (unless this would jeopardise confidentiality); decision on admission within 10 working days; investigation; hearing of the person concerned (who is told the facts but not the reporter's identity); reasoned final report proposing closure, disciplinary or organisational measures or referral to the Public Prosecutor; and response to the reporter within 3 months of acknowledgement, extendable to 6 in complex cases.

8. Prohibition of retaliation

Any retaliation, including threats and attempts, is prohibited: dismissal or suspension, disciplinary measures, demotion or denial of promotion, unjustified changes to working conditions, negative evaluations or references, coercion, intimidation, harassment or ostracism, discrimination, and reputational or financial harm. Acts of this kind are null and void.

9. Data protection

Controller: Exceltrop, S.L. Legal basis: legal obligation and public interest (Art. 6.1.c and 6.1.e GDPR). Data is kept only as long as necessary and, if no investigation is opened, no more than 3 months from receipt; never more than 10 years. See the data protection information.

10. External channels

This Policy does not limit the right to use the external channels established by the Law, in particular those of the Independent Whistleblower Protection Authority (A.A.I.) or the competent regional authorities, or to make public disclosures in the cases set out in Article 28.

11–12. Training, communication and entry into force

Exceltrop publishes this Policy on its website, communicates it to all staff with proof of receipt, includes it in onboarding and trains the System Manager. The Policy enters into force the day after its approval and is reviewed at least every two years.