Code of conduct in the operation of the channel

Last updated: 30 July 2026

This is a courtesy translation. In the event of any discrepancy between versions, the Spanish text prevails, as it is the only one reviewed by a lawyer. View the Spanish version

This company operates internal reporting channels in accordance with Ley 2/2023, de 20 de febrero, and with Regulation (EU) 2016/679. This code sets out the commitments it assumes in that capacity.

It does not replace the code of ethics of any client organisation: each has its own, and it is that code —not this one— that determines which conduct may be reported through its channel. This document deals only with how the channel is operated.

1. Confidentiality of identity

The identity of the whistleblower, and that of any third party mentioned, is confidential. It is not disclosed to the person concerned by the report, nor to third parties, nor to the organisation itself beyond whoever is designated to manage the channel.

Reporting persons may report anonymously, without providing their identity at any point, and follow the status of their case by means of a receipt that only they keep.

2. Who can read a report

Day to day, the content of a report is read only by the case manager or managers designated by each organisation. Reports are encrypted with their keys, and the tool used to administer the service manages accounts and configuration, never content: it is blind to what is reported.

There is, and we say so plainly, an exceptional recovery route. If a case manager loses their access, their organisation would be left unable to read its own reports; to prevent that, a recovery copy of their key is kept in custody. Using it is an exceptional act, requires express authorisation and is recorded in the audit history. It is not an ordinary form of access, nor is it used to consult reports.

We explain it this way, rather than saying «no one else can read them», because that claim would not be true of any whistleblowing channel that allows a case manager's access to be recovered. We would rather that whoever files a report decides knowing this.

3. Only the essential data, and never for any other purpose

Of the operation of the channel, only the minimum data necessary to run it and to demonstrate compliance with the statutory time limits is kept. No profiling is carried out, no automated decisions are taken about individuals and no data from the channel is used for commercial purposes.

The automatic alerts the system sends to the operator —for example, that a report has gone unopened for days— contain only metadata (organisation, manager and dates) and never content.

4. Prohibition of retaliation

No one is to suffer any adverse consequence for having reported in good faith, or for having cooperated in the investigation. Where we become aware of possible retaliation within a client organisation, we will bring it to the attention of the person responsible for that organisation's channel.

5. Independence from the client organisation

We do not intervene in the substance of reports or in the decisions each organisation takes on them. Our role is to ensure that the channel works, that the time limits are met and that the safeguards are respected, even when that is uncomfortable for whoever contracts the service.

6. The time limits are met

Acknowledgement of receipt within seven days of receipt, and a response within a maximum of three months, in accordance with article 9 of Ley 2/2023. The channel notifies the case manager as soon as a report comes in; meeting the time limits is the responsibility of whoever handles it, not of the tool.

7. The internal channel is not the only route

Using the internal channel does not deprive anyone of any right. Whistleblowers may also, or instead, turn to the Spanish authority for the protection of whistleblowers, the Autoridad Independiente de Protección del Informante, to the competent regional authorities, or to the police and the public prosecution service.

8. Whoever operates the channel is accountable under this code

Breach of this code by any person within this company is a disciplinary matter. Questions or breaches are to be reported to the management of the company at ps@greenaudit.net.