Whistleblower Channel

Capital Energy provides its employees, clients, suppliers, and other interested parties with a Whistleblower Channel to confidentially and securely report any possible irregularities, regulatory breaches, or conduct that is unethical or contrary to the group's values.

This channel complies with the provisions of Law 2/2023, of February 20, regulating the protection of persons who report regulatory violations and the fight against corruption, guaranteeing the confidentiality of the whistleblower's identity and the prohibition of retaliation.

When accessing the channel, you must select the corresponding company to which you wish to address your communication. Each company will internally manage the reports received in accordance with its own procedures and the applicable regulations.

Access the Whistleblower Channel: https://miportaldelempleado.personiowhistleblowing.com/

The personal data and other information you provide through this channel will be processed for the purpose of receiving communications, reviewing the content, and managing the resulting case file.

The data of the whistleblower, the reported person, or third parties, along with other information, will be retained only for the time necessary to decide whether to initiate an investigation into the reported events.

Three months after a decision is made regarding whether to open proceedings or to file the case, the information will be deleted from the system, unless it needs to be retained to demonstrate the functioning of the crime prevention model of the legal entity or if facts have emerged from the investigations that must be retained in accordance with legal statutes of limitations for potential actions or liabilities. The information will be safeguarded solely by those responsible for internal control and compliance functions.

The processing of data in internal communication channels will be deemed lawful pursuant to Articles 6.1(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, Article 8 of Organic Law 3/2018, of December 5, and Article 11 of Organic Law 7/2021, of May 26, in accordance with Articles 10 and 13 of Law 2/2023, of February 20, regulating the protection of those who report regulatory breaches and the fight against corruption.

Facts that may constitute a criminal or administrative offense, including personal data, may be communicated to the competent authorities, whether located within national territory or abroad, which may result in an international data transfer based on reasons of public interest and/or for the establishment, exercise, or defense of legal claims.

Measures have been taken to preserve the identity and ensure the confidentiality of the data related to individuals affected by the information provided, especially that of the person reporting the facts, if they have been identified.

Data subjects may exercise their rights of access, rectification, erasure, portability, and restriction or objection by writing to dpo@capitalenergy.com. Additionally, they may file a complaint with the Supervisory Authority (Spanish Data Protection Agency www.aepd.es) if they believe their rights have not been properly addressed.

Information about the Data Controller:

HELAS CONSULTORES SL; Tax ID: B83017780

Last updated: 11/24/2025