{"id":3961,"date":"2025-03-28T13:13:43","date_gmt":"2025-03-28T12:13:43","guid":{"rendered":"https:\/\/rubiconinternacional.com\/complaints-channel-procedure\/"},"modified":"2025-11-20T17:26:20","modified_gmt":"2025-11-20T16:26:20","slug":"complaints-channel-procedure","status":"publish","type":"page","link":"https:\/\/rubiconinternacional.com\/en\/complaints-channel-procedure\/","title":{"rendered":"Denunciations channel procedure"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Denunciations channel procedure<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

1. DENUNCIATION PROCEDURE<\/strong><\/p>

The company’s management approves and documents in writing this procedure that regulates the denunciations channel, detailing the operation of the system in all the points listed below.<\/p>

2. OBJECT<\/strong><\/p>

a) Scope of application<\/span><\/p>

The whistle-blowing channel shall apply to the entity’s employees and to all personnel who maintain a contractual relationship with the company, such as collaborators, suppliers, subcontracted companies, etc.<\/p>

b) Mandatory nature<\/span><\/p>

It is essential that the company’s management establishes the mandatory nature of the whistleblower channel, and it is also necessary that the workers’ representatives have been previously informed, as established in Article 64 of the Workers’ Statute.<\/p>

c) Disclosure<\/span><\/p>

The whistle-blowing channel shall be disclosed to all employees and persons who are linked to the company. Information about its existence must be included in all contracts entered into by the company (employees, suppliers, customers, external collaborators, etc.) as well as on the company’s website. <\/p>

Both the reporter and the accused must be informed in advance of the existence of the denunciation channel and the processing of the data involved in filing a report, as well as the consequences that such a denunciation may have for the accused.<\/p>

3. CHARACTERISTICS<\/strong><\/p>

a) Consent<\/span><\/p>

In order to implement the internal reporting system, it is not necessary to have the consent of the company’s employees. Nor is it necessary to have the consent of these employees for the communication to third parties of the data of the report, in order for them to investigate the reported facts. <\/p>

Thus, the implementation of a whistle-blowing channel does not require the consent of the interested parties as long as there is a contractual relationship with them and they are informed of the existence of such a system, and this information is incorporated into the established contractual relationship.<\/p>

b) Filing of denunciations<\/span><\/p>

The whistle-blowing channel must be available to any interested party who has a relationship with the company, using a link included in the e-mail sent to the interested party. This link will give access to the complaint form. <\/p>

It is important to bear in mind that the facts reported must have a direct implication in the relationship that exists between the complainant and the accused. In other words, not just any type of behavior can be the object of the complaint, but those facts that are related to the contractual relationship with the company. <\/p>

c) Behavior<\/span><\/p>

Criminal behavior or actions that can be reported, such as: respect for ethical values, respect for people’s dignity, manipulation of information, corruption and bribery, loyalty to the company, political neutrality, relations with customers, contractors and suppliers, etc.<\/p>

d) Penalties<\/span><\/p>

Both the complainants and the accused must have been previously warned of the consequences that this fact may entail for both, i.e. the sanctions that it entails in accordance with the disciplinary regime of the entity, without prejudice to possible responsibilities of another nature that may correspond according to the judgment of judges, courts and competent bodies.<\/p>

e) Double investigation <\/span> <\/p>

In this sense, the complaint can have a twofold aspect:<\/p>

1. On the one hand, it must be verified whether the behavior of the accused is really irregular.<\/p>

On the other hand, it must be verified whether the complainant has communicated a false report, and in this case it must be clarified whether it is a simple mistake or whether he acted in bad faith and with the intention of harming the defendant.<\/p>

f) Confidentiality<\/span><\/p>

It is essential to guarantee the confidentiality of information to the whistleblower during the entire process. In this sense, the term confidentiality refers to all aspects of the complaint, such as data on the complainant, facts, and persons whose conduct or actions may constitute a crime. Such confidentiality may be suspended when knowledge of the facts is required by judges, courts or competent authorities. <\/p>

g) Anonymous complaints<\/span><\/p>

The Spanish Data Protection Agency “does not allow” companies to accept anonymous complaints, thus guaranteeing the accuracy and integrity of the information required by data protection regulations, otherwise the “duty of quality” established in Article 4 would be violated.<\/p>

h) Retaliation<\/span><\/p>

The whistleblower must be clear that in addition to the confidentiality of his identification data, he is also guaranteed that he will not be subject to any type of reprisal for the fact of reporting. In this sense, the whistleblower must be informed that in the case of being related to the reported facts, the report made will have an attenuating character for him\/her, as a consequence of the confession prior to the discovery of the crime and by diminishing its effects. <\/p>

4. COMPLAINTS COMMITTEE<\/strong><\/p>

a) Independence<\/span><\/p>

The whistleblowing committee must enforce the whistleblowing procedure and ensure effective management of the system. It must be a fully independent body within the company, composed of the Compliance Officer and the heads of the main areas or departments of the company. <\/p>

In the event that a committee member is involved in a complaint, he\/she shall refrain from participating in the handling of the complaint and shall immediately inform the committee of this circumstance.<\/p>

b) Functions<\/span><\/p>

The functions of the complaints committee are as follows:<\/p>

\u25cf Receive the complaint.
\u25cf Decide whether the complaint is dismissed or processed.
\u25cf Designate for each complaint the person in charge of the investigation.
\u25cf Approve and give reasons for exceptions to the procedure.
o To ensure compliance with the obligations established by the Data Protection Law.
\u25cf Report to the board of directors.
\u25cf Appoint a secretary to keep minutes of the meetings.<\/p>

c) Responsible for training<\/span><\/p>

The person in charge of instruction must be a department director, and his\/her main functions are:<\/p>

\u25cf Designate the instructor who will conduct the investigation of each complaint.
\u25cf Setting actions, priorities and deadlines for implementation.
\u25cf Approve the report issued by the instructor with the result of the investigation.
o Verify compliance with the implementation of the security measures established by the Data Protection Law.<\/p>

d) Instructor<\/span><\/p>

The instructor shall be appointed from among the personnel forming part of the department whose director is responsible for instruction, and his\/her main duties are:<\/p>

\u25cf Document and record complaints received.
\u25cf Investigate the facts and gather evidence.
\u25cf Document and record all actions taken.
\u25cf Prepare the report under the supervision of the person in charge of instruction.
\u25cf Comply with the requirements of data protection regulations.<\/p>

5. CONSERVATION OF DATA<\/strong><\/p>

a) Deadlines<\/span><\/p>

\u25cf From the beginning of the investigation until its completion the term may not exceed 6 months.
\u25cf From the completion of the investigation:
o If the facts are not proven, the term may not exceed 2 months.
o If the facts are proven, the term may not exceed 2 months from the end of the procedure.<\/p>

b) Blocking<\/span><\/p>

After the aforementioned deadlines, the cancellation of the information implies the blocking of the information, in case subsequent liabilities may arise, which is feasible in this area. It is recommended that the information be blocked for a reasonable period of one year. <\/p>

The term “Block” means to keep the documentation separately, without any processing and in complete confidentiality. Such information may only be used at the expense of a judicial claim or other public administration with authority in the matter. <\/p>

6. INFORMATION TO INTERESTED PARTIES<\/strong><\/p>

a) Duty to inform the complainant<\/span><\/p>

The reporting channel should provide for the following information to be provided to the whistleblower:<\/p>

\u25cf Company name and address of the data controller performing the processing.
\u25cf Purpose of data processing.
\u25cf Strict confidentiality of data, except for possible communications to third parties involved (witnesses) in the investigation or judges and courts.
\u25cf Consequences of making a false or bad faith report.
\u25cf No retaliation by the company.
\u25cf Inform about how to exercise ARCO rights.
\u25cf Communicate that anonymous complaints will not be processed (Art. 4 of the LOPD).<\/p>

b) Duty to inform the defendant and third parties involved.<\/span><\/p>

The company must inform within 3 months from the day on which the complaint is received, both the person complained of and the third parties involved (affected parties, witnesses, etc.).<\/p>

This duty of information does not imply revealing the identity of the whistleblower or data allowing to deduce his or her identity, but the following information:<\/p>

\u25cf That it has been reported through the whistleblower channel.
\u25cf The facts denounced.
\u25cf Company name and address of the data controller performing the processing.
\u25cf Purpose of data processing.
\u25cf Strict confidentiality of data, except for possible communications to third parties involved in the investigation or judges and courts.
\u25cf Inform about how to exercise ARCO rights.<\/p>

An individual meeting must be held with each interested party (reported, affected and witnesses) within a maximum period of 3 months in order to draw up minutes containing the questions on the reported facts and including the information clause, so that it can be approved for compliance with any requirement that may be made by the Spanish Data Protection Agency.<\/p>

7. ARCO RIGHTS<\/strong><\/p>

a) Access<\/span><\/p>

The right of access of the defendant only allows him\/her to obtain information about his\/her personal data, and never about the identification data of the complainant or other third parties, otherwise we would be dealing with a case of transfer of data without consent.<\/p>

b) Cancellation<\/span><\/p>

The right of cancellation may not be exercised during the processing of the complaint.<\/p>

c) Opposition<\/span><\/p>

The respondent cannot exercise the right of opposition, i.e. he\/she cannot oppose the processing of his\/her data in the complaint system.<\/p>

d) Obligation to answer<\/span><\/p>

Regardless of any rights requested by the respondent, the company is obliged to reply to the interested party provided that the request has been made in due time and form.<\/p>

8. SECURITY MEASURES<\/strong><\/p>

a) On access security<\/span><\/p>

\u25cf Permission to access complaints should be granted to a small group of people who need it.
\u25cf There must be an up-to-date list of users with access.
\u25cf User IDs and passwords must be changed at least once a year.
\u25cf From each access attempt the system will store for at least 2 years the following information:
\u25cf The identification of the accessing user.
\u25cf The date and time at which you performed the access.
\u25cf The file you are accessing and whether you have been authorized.
\u25cf The confidentiality commitment must be signed by the persons in charge of managing the whistleblowing channel and access permission.<\/p>

b) About information<\/span><\/p>

\u25cf The complaints committee should be informed of any anomalies or nonconformities that appear.
\u25cf A record should be kept of incoming and outgoing information sent to judges, courts, etc.
\u25cf The audit required by the Data Protection Law must be carried out on the internal complaints file at least every 2 years, reporting the result to the company’s management.
\u25cf All information regarding internal complaints should be in the information system, including e-mails as well.
Backups should be performed at least once a week
\u25cf Data cannot be stored on portable devices, USB, and\/or flash drives.
\u25cf The safety officer, or person delegated by him\/her, shall be responsible for reviewing at least once a month the recorded control information and shall prepare a report regarding such reviews and the problems detected.<\/p>

9. PENALTIES FOR NON-COMPLIANCE<\/strong><\/p>

a) Data Protection Law<\/span><\/p>

The implementation of a whistleblower channel without complying with the requirements established by the Data Protection Law may result in the following sanctions:<\/p>

\u25cf Accepting and handling anonymous complaints: This is a serious offense ranging from 40,001\u20ac to 300,000\u20ac.
\u25cf Failure to remove (block) the data of the complaint in due time: This is a serious offense ranging from 40,001\u20ac to 300,000\u20ac.
Failure to inform the complainant: This is a minor offense ranging from 600 \u20ac to 40,000 \u20ac.
Failure to inform the defendant or affected third parties: This is a serious offense ranging from 40,001 \u20ac to 300,000 \u20ac.
\u25cf Failure to comply with the required security measures: This is a Serious infraction ranging from 40.001\u20ac to 300.000\u20ac or Very Serious ranging from 300.001\u20ac to 600.000\u20ac.
\u25cf Failure to obtain authorization for TID: This is a Very Serious infraction ranging from 300.001\u20ac to 600.000\u20ac. <\/p>

b) Internal disciplinary regime<\/span><\/p>

Independently of the above sanctions, the company may apply the sanctions established in the internal disciplinary regime as a consequence of faults committed by employees or collaborators. The amounts established in these sanctions will be applied according to various criteria, such as the continued nature of the infraction, recidivism and degree of intentionality. <\/p>

10. GROUP OF COMPANIES<\/strong><\/p>

a) Location<\/span><\/p>

In the case of a group of companies, the parent company or the company that manages the processing of the complaint channel must take into account whether the transfer of data is carried out with another company of the group, which is located:<\/p>

\u25cf In a country belonging to the European Economic Community.
\u25cf In a country whose data protection level is comparable to the European level.<\/p>

Well, it is a U.S. entity that adheres to the “safe harbor” principles.<\/p>

b) Authorization<\/span><\/p>

In case of not being in any of the above assumptions will be producing what we call an International Data Transfer (TID), which requires that prior authorization is requested and obtained from the director of the Spanish Data Protection Agency. Taking into account that the procedure to obtain such authorization may take up to a maximum of 3 months from the date of application. <\/p>

11. EXTERNAL MANAGEMENT<\/strong><\/p>

a) Justification<\/span><\/p>

The external management of the whistleblowing channel is justified by the possible weaknesses that may arise from the fact that the company’s personnel may not be confident about the confidentiality of their data and, consequently, may be afraid to report.<\/p>

On the other hand, there can be no assurance that the company’s management of the whistleblower channel provides objective and independent handling of complaints.<\/p>

And finally, the company’s personnel who receive the complaints are not experts in detecting crimes and criminal conduct.<\/p>

b) Image<\/span><\/p>

These circumstances make it advisable in many cases to outsource the internal complaint management service, since poor or inefficient management of this service can be counterproductive for the company’s image.<\/p>

c) Procedure<\/span><\/p>

You can file a complaint with the Compliance Officer by following the link below: Canaldenuncia@rubicon interacional.com<\/a> complaints page. <\/a> <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Denunciations channel procedure 1. DENUNCIATION PROCEDURE The company’s management approves and documents in writing this procedure that regulates the denunciations channel, detailing the operation of the system in all the points listed below. 2. OBJECT a) Scope of application The whistle-blowing channel shall apply to the entity’s employees and to all personnel who maintain a […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-3961","page","type-page","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/rubiconinternacional.com\/en\/wp-json\/wp\/v2\/pages\/3961","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rubiconinternacional.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/rubiconinternacional.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/rubiconinternacional.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rubiconinternacional.com\/en\/wp-json\/wp\/v2\/comments?post=3961"}],"version-history":[{"count":3,"href":"https:\/\/rubiconinternacional.com\/en\/wp-json\/wp\/v2\/pages\/3961\/revisions"}],"predecessor-version":[{"id":4145,"href":"https:\/\/rubiconinternacional.com\/en\/wp-json\/wp\/v2\/pages\/3961\/revisions\/4145"}],"wp:attachment":[{"href":"https:\/\/rubiconinternacional.com\/en\/wp-json\/wp\/v2\/media?parent=3961"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}