REGULATION OF OFFENSE COMMUNICATION

1. Objective

a) GNS – Georgina Neto dos Santos, Lda., adopts this regulation with the aim of not only ensuring compliance with a legal obligation but also establishing a set of rules and internal procedures for the reception, registration, and processing of reports of infractions, in accordance with legal and regulatory provisions, as well as the rules, principles, and values outlined in GNS’s Policy for the Prevention of Corruption and Related Offenses.

b) Pursuant to this objective, communications of infractions under this regulation shall be submitted to an efficient, swift and equipped system for their detection, investigation, and resolution, in accordance with the highest ethical principles recognized by society, safeguarding the principles of confidentiality and non-retaliation in relationships with the authors of the communication, as well as in relationships with individuals and third parties, including legal entities, who assist or are connected to the whistleblower.

2. Scope of Application

a) The regulation establishes the rules for the reception, registration, and processing of communications regarding infractions occurring within society.

b) The regulation does not preclude or replace the obligation to report in cases and under the terms determined by criminal and procedural law.

c) For the purposes of this regulation:

• They constitute infractions, acts, or omissions, committed intentionally or negligently, which are provided for and described in Article 2, paragraph 1, of Law No. 93/2021, of December 20, as well as in Article 3 of Decree-Law No. 109-E/2021, namely in the following areas:

i. Public procurement;
ii. Financial services, products, and markets, and the prevention of money laundering and terrorist financing;
iii. Product safety and compliance;
iv. Transportation safety;
v. Environmental protection;
vi. Consumer protection;
vii. Protection of privacy and personal data and security of networks and information systems;
viii. Prevention of corruption and related offenses.

• The Internal Reporting Channel is the channel identified in Condition 10, through which reports of infractions should be submitted, with or without the identification of the whistleblower;
• The accused, the person who, in the accusation, is referred to as the perpetrator of the offense or who is associated with it.

3. Subjective Scope of Application

a) For the purposes of the regulation, the informant is considered to be the individual who reports an infringement based on information obtained in the scope of their professional activity, regardless of the nature or sector of that activity.

b) Whistleblowers may include workers, service providers, contractors, subcontractors and suppliers, as well as individuals acting under their direction or supervision, shareholders, members of management and supervisory bodies, and volunteers and interns.

4. Precedence of Internal Reporting and Prohibition of Public Disclosure

a) Considering the existence of an Internal Reporting Channel, the whistleblower cannot resort to external reporting channels or public disclosure of an offense beforehand, except in the cases referred to in the No. 2 and 3 of Article 7 of Law 93/2021, of December 20th.

b) The whistleblower who, outside of legally established cases, publicly discloses an offense or knowledge thereof to the media or a journalist, does not benefit from the protection provided by law.

5. Confidentiality

a) Any communication regarding infractions covered by the regulation will be treated as confidential.

b) Access to information regarding any reports of misconduct, including the identity of the whistleblower when known, and any information that could lead to their identification, is restricted to individuals / entities within society responsible for receiving and handling reports made under the regulation.

c) The identity of the whistleblower may only be disclosed in compliance with a legal obligation or court decision, provided that it is preceded by written communication or even with an indication of the reasons for disclosure, unless providing this information compromises related investigations or judicial processes.

6. Whistleblower Protections

a) Any act or omission occurring in a professional context, directly or indirectly, and motivated by an internal, external report or public disclosure, causing or capable of causing material or non-material harm to the whistleblower who, in good faith and with serious grounds to believe that the information is true, is considered an act of retaliation. The following acts are presumed to be motivated by the denunciation or public disclosure, until proven otherwise, when committed within two years after such denunciation or disclosure:

• Changes in working conditions, such as job roles, hours, workplace location or compensation, failure to promote the worker or breach of employment duties;
• Work contract suspension;
• Negative performance evaluation or negative job reference;
• Non-renewal of a fixed-term employment contract;
• Disciplinary sanctions, including dismissal;
• Inclusion on a list, based on sectoral scale agreement, that may lead to the impossibility, in the future, of the whistleblower finding employment in the relevant sector or industry;
• Termination of a supply contract or service provision.

7. Whistleblower Assistants

The guarantees referred to in the preceding article are extendable, with the necessary adaptations, to:

a) Person who assists the complainant in the complaint procedure and whose assistance must be confidential, including union representatives or worker representatives.

b) Third party connected to the whistleblower, such as a coworker or family member, who may be subjected to retaliation in a professional context.

c) Legal entities or equivalent entities that are owned or controlled by the whistleblower, for which the whistleblower works or with which they are somehow associated in a professional context.

8. Whistleblower Responsibility

a) The whistleblower cannot be held accountable disciplinarily, civilly, in terms of administrative penalties, or criminally for reporting or publicly disclosing an offense in accordance with regulations, nor can they be held accountable for obtaining or accessing information that prompts the report or public disclosure, except if such obtaining or access constitutes a crime.

b) Without prejudice to the provisions of the preceding clause, the conduct of those who report indications of irregular practices or infractions with falsehood or bad faith, as well as the disregard for the duty of confidentiality associated with the report, shall constitute an offense subject, as applicable, to disciplinary sanction or contractual penalty, appropriate and proportional to the offense, without prejudice to any civil and criminal liability that may arise for the perpetrator of said conduct.

9. Personal Data Treatment and Preservation of Complaints

a) The personal data collected in this context will be processed by GNS, which is the entity responsible for processing under the General Data Protection Regulation.

b) The purpose of processing information communicated under this policy is to receive and follow up on reports submitted through the Internal Reporting Channel.

c) Within this scope, whistleblowers are ensured the right to access, rectify and delete data they have communicated, except when conflicting with prevailing rights, through the means of communication provided for in the following article.

d) Whistleblowers are equally guaranteed the right to access information about reported facts concerning them, except when it conflicts with prevailing rights.

e) Data that is manifestly irrelevant to the processing of the complaint will not be retained and will be promptly deleted.

f) The complaints submitted under the terms of the regulations are subject to registration and preservation for a minimum period of 5 years, and regardless of this period and when applicable, during the pendency of judicial or administrative proceedings related to the complaint.

10. Reception, Registration and Processing of Infringement Communications

a) The communication of any complaints under and in accordance with the regulation shall be made through an Internal Complaint Channel, which may be done in writing:

• Through the letter sent to the address (Whistleblower Channel company address);
• By sending an email to the address (Whistleblower Channel Email Address).

b) The received communications are the target of registration by the relevant department / area, which should contain:

• Identification number;
• Reception date;
• Brief description of the nature of communication;
• Measures taken regarding communication;
• Status of the process.

c) The record of received communications will be permanently kept updated.

d) If a contact has been provided, the whistleblower shall be notified within seven days of the receipt of the report, and informed of the requirements, competent authorities, procedure and admissibility of the external report, in accordance with the No. Article 7, and Articles 12 and 14 of Law No. 93/2021, of December 20th.

e) After being registered, communications undergo a preliminary analysis to ascertain the degree of credibility of the communication, the irregular or unlawful nature of the reported behavior, the feasibility of the investigation and the identification of individuals involved or knowledgeable of relevant facts who should therefore be questioned.

f) The preliminary analysis report will conclude whether to proceed with or archive the investigation.

g) If it is deemed that the communication is unfounded, abusive, contains clearly erroneous or misleading information, or has been made with the intent to harm others, its filing will be promoted, with a summary of the reasons communicated to the author of the communication. If appropriate, in accordance with legal terms, immediate destruction of the involved personal data, statistical treatment and information from this archive will be carried out.

h) If it is deemed that the communication is consistent, plausible and credible, and that the reported facts are likely to substantiate the commission of an offense as provided for in the regulation, an investigation process will be initiated, conducted and supervised by the competent authority according to the reported issue.

i) Upon completion of the investigation phase outlined in the preceding section, a report will be prepared detailing the analysis conducted on the complaint, describing the internal actions taken, summarizing the findings of the investigation and presenting the duly substantiated decision. In this report, any measures taken to mitigate the identified risk and prevent the recurrence of reported infractions will also be indicated.

j) If deemed necessary and appropriate, particularly considering the type and nature of the offense, the offense will be reported to the competent authorities, namely those listed in the list of No. 1st of Article 12 of Law 93/2021, dated December 20th.

k) Within three months from the receipt of the complaint, the complainant shall be informed of the measures planned and taken to follow up on the complaint and its respective rationale.

l) The entity, commission or person responsible for handling complaints may, whenever deemed necessary, be assisted by other internal or external individuals, including external auditors or other experts, to aid in the investigation, particularly when the matters at hand warrant it. These individuals are equally covered by the confidentiality obligation provided for in this regulation.

m) Whenever deemed necessary for compliance with the provisions set forth in the regulation, any individuals whose inquiry is relevant to the investigation of the complaint may be interrogated.

11. Effectiveness

The present regulation comes into effect immediately upon its approval.