The organisation is highly committed to complying with the highest standards of corporate ethics, and has had a Corporate Compliance Programme in place since 30 March 2017, which is reviewed periodically by external advisors of recognised prestige and which includes, in an organised manner, the actions implemented to establish an environment of prevention, detection and early risk management. This Programme has a specific focus on the fight against infringements, both criminal and anti-competitive, among other matters, guaranteeing the highest level of integrity in all its business practices.

The company adheres to the VINCI Code, which sets out the principles shared by all employees and business partners and whose core values are defined in the following 5 reference documents:

• The Code of Ethics and Conduct, which sets out all the principles of business ethics to be applied in different circumstances and in all countries of operation.
• It is used in conjunction with the Anti-Corruption Code of Conduct, which includes the rules relating to the prevention of all acts of corruption, in particular by identifying risks in business processes and defining conduct to be avoided.
• The Human Rights Guidance, which summarises potential risks and their implications for companies, and defines a common set of guidelines on how to deal with human rights issues. These guidelines are based on the principles of the Universal Declaration of Human Rights (UDHR), the 8 core conventions of the International Labour Organisation (ILO) and the OECD Guidelines for Multinational Enterprises.
• The Declaration on Fundamental and Essential Actions on Safety and Health at Work, which reflects the common will to achieve the goal of ‘Zero Accidents’. The declaration is the result of a constructive and regular social dialogue. As part of a policy of continuous improvement, it affirms that progress can only be made with all employees by promoting a safety culture.
• The environmental guidelines, which provide a framework designed to minimise the risks and impacts of activities on the environment. All companies must follow these guidelines so that actions and procedures can be improved and adapted to protect and preserve the environment wherever they operate. Each subsidiary is responsible for ensuring that similar efforts are made by business partners throughout the life of a project.

The Corporate Compliance Programme consists of the following documents:

Normativa de VINCI, S.A.

• Manifiesto
• Código de Ética y Comportamientos
• Código de Conducta Anticorrupción
• Guía de los Derechos Humanos
• Líneas Directrices Medioambientales
• Guía de Usuarios de los Sistemas de Información
• Política General de Ciberseguridad
• Medidas fundamentales e ineludibles en materia de Salud y Seguridad en el Trabajo

Protocolos de COBRA SERVICIOS, COMUNICACIONES Y ENERGÍA, S.L.U.

• Protocolo Marco
• Protocolo de Cumplimiento Normativo
• Protocolo de Comunicación de Hechos Supuestamente Irregulares
• Protocolo de Activación del Procedimiento de Defensa Corporativa
• Protocolo sobre Formación de los Profesionales en cuestiones de Cumplimiento Normativo
• Estatuto del Órgano de Cumplimiento Normativo – Protocolo sobre el perfil, experiencia y ubicación orgánica del Órgano de Cumplimiento Normativo, del Responsable de Cumplimiento Corporativo y del Delegado de Cumplimiento Corporativo
• Protocolo de Políticas Esenciales
• Catálogo de Conductas Prohibidas y Parámetros de Comportamientos Esperados
• Código de Conducta para Socios de Negocio
• Protocolo de Cumplimiento de la Normativa de Defensa de la Competencia
• Gestión de las relaciones con Administraciones Públicas y Funcionarios
• Pagos de Facilitación

Instrucciones de Régimen Interior de COBRA SERVICIOS, COMUNICACIONES Y ENERGÍA, S.L.U.

Plan de Prevención de Delitos del Grupo SERMICRO y sus Políticas

• Política de Cumplimiento Normativo, Antisoborno y Conductas Contrarias al derecho de Defensa de la Competencia
• Política sobre Prevención del Blanqueo de Capitales y Financiación del Terrorismo
• Política Anticorrupción
• Política sobre Cortesías Profesionales (incluida en la Política Anticorrupción)
• Política de Protección de derechos de Propiedad Industrial e Intelectual
• Política de Protección de Datos y tratamiento de Información Confidencial y Sensible
• Política de diligencia debida en materia de Derechos Humanos
• Política de prevención, detección y actuación frente al Acoso Laboral

Cualquier persona que tenga conocimiento o sospecha de alguna infracción, acción ilegal, comportamiento inadecuado, etc. podrá utilizar, además del reporte al Responsable de Cumplimiento Corporativo, los siguientes medios habilitados:

Estos medios son tanto una vía de denuncia de cualquier incumplimiento de la legislación y/o de la normativa interna, como un medio para la resolución de una consulta que se pueda plantear en el desarrollo de la actividad de la organización, asegurándose en todo momento la confidencialidad del asunto tratado y la ausencia de represalias por la presentación de una denuncia.

All persons who transmit their communications in good faith shall be protected against any form of discrimination, retaliation, or penalization on account thereof. False or defamatory reports shall be subject to disciplinary action in accordance with applicable internal procedures, collective agreements, and legal regulations. The confidentiality of the whistleblower’s identity shall be guaranteed. The whistleblower’s identity shall not be disclosed to third parties, nor to the reported person, nor to direct supervisors, unless such disclosure is necessary to the relevant persons involved in any subsequent investigation or judicial proceedings initiated as a result of the investigation carried out by the Regulatory Compliance Management System. In compliance with the applicable Personal Data Protection regulations, please be advised that any data collected through this Ethics Channel shall be processed by Grupo IMESAPI for the purpose of handling the corresponding reports and inquiries, in accordance with the provisions established in the Corporate Compliance Program and internal regulations. The legal basis for this processing is the consent of the data subject, given by voluntarily submitting the information. Data shall be retained for the duration of the investigation and as long as its deletion is not requested, and in any event, in compliance with the applicable legal limitation periods. The information received may be disclosed to the relevant Grupo IMESAPI group companies where necessary for the purposes of the investigation. The Grupo IMESAPI group companies may be consulted in any official public registry. Likewise, please be advised that the data subject may at any time exercise their rights of access, rectification, erasure, portability, restriction, or objection by writing to the following address: Calle Vía de los Poblados, 9-11, Parque Empresarial Trianón – Building C, 28033 Madrid.