1. INTRODUCTION:

CMP AUTOMOTIVE GROUP, with the aim of promoting a true culture of the organization in line with its values and principles, has implemented a compliance system in its organization and operation.

To fulfill this commitment, the present Protocol has been developed, which sets out the rules of operation for processing and resolving complaints received through the compliance complaints channel.

2. PURPOSE:

The purpose of this protocol is to regulate an essential mechanism to ensure compliance with rules.

It is a channel through which CMP receives and manages information or complaints about possible irregular behavior that constitutes a breach of external and internal rules, as set forth in its protocols and Codes of Conduct.

3. SCOPE OF APPLICATION:

This protocol shall apply to all individuals who are part of the organization, whether executives or employees, as well as to any other individuals, whether affiliated with the organization or not, who may be aware of any breach of legal rules or internal rules of the organization contained in its Code of Ethics and in the COMPLIANCE Program adopted by CMP.

The Board of Directors and the COMPLIANCE coordinators appointed by it must ensure that this Protocol is made available to all employees, executives, federated entities, and other individuals or legal entities with any kind of connection to CMP.

4. GUARANTEES:

For its proper functioning, the complaints channel must fulfill a series of essential guarantees for the complainant, the accused, and other individuals who may be involved.

Guarantees for the complainant: these are essential for the effectiveness of the channel, as their absence would discourage its use when there is knowledge of improper conduct in the organization that constitutes a breach of rules.

These guarantees are as follows:

- Immunity from reprisals: the complaint filed cannot lead to reprisals against the complainant. Therefore, the organization cannot impose any sanction on the employee complainant that is motivated by or related to the complaint.

- Right to be informed of the outcome and follow-up of the complaint.

- The accused has the right to know about the existence of a complaint against them.

- The accused has the right to be heard in the proceeding and to make the allegations they deem appropriate.

- The reported facts must be true, and false complaints are strictly prohibited. If the complaint turns out to be false, the company may impose a sanction on the complainant, in accordance with what is provided for in its Code of Conduct or Internal Manuals.

- Guarantees for other affected or involved parties: there may be third parties involved in the events, who may be affected, witnesses, etc., whose rights must also be protected.

Thus:

- The protection of the privacy and dignity of other individuals who may be involved is guaranteed.

- The complainant must ensure that the information provided in the complaint regarding the breach is correct, as it could affect other individuals besides the accused.

5. BODIES RESPONSIBLE FOR MANAGING THE CHANNEL:

To ensure objectivity, transparency, and impartiality of the process, an internal committee has been appointed to manage the channel, which will be responsible for receiving complaints, analyzing them, conducting investigations, and, if necessary, initiating proceedings, proposing precautionary measures, and proposing a resolution.

Complaints, as well as the procedures they may lead to, will be brought to the attention of the entity's Board of Directors and the Compliance coordinators of the entity itself, appointed by said Board with sufficient resources and necessary competencies to carry out their function.

6. PROCEDURE:

6.1. Filing of the complaint

Complaints may be filed through the organization's Channel, accessed via the following email address:

comitedeetica@cmpautomotive.es

Or the QR code:

The reported facts must be true; therefore, the complainant must ensure that the information provided in the complaint is correct.

6.2. Receipt of the complaint

Once the complaint is received, it will be registered, and within a period of seven business days, an acknowledgment of receipt will be sent to the complainant.

Subsequently, the complaint will be analyzed, and it may result in either its closure or the opening of a case file, if the complaint indicates any criminal activity, non-criminal regulatory violations, or violations of the entity's internal regulations.

6.3. Closure of the complaint

If the complaint is found to be unfounded, it will be closed, and the complainant will be informed accordingly. Any personal data that may appear in the complaint will be removed from the channel.

6.4. Opening and processing of the case file

If the complaint reveals indications of its validity, the committee responsible for managing the complaints channel will inform the Board of Directors and the Compliance Coordinators of the company about the opening of the case file.

Likewise, the complaint will be forwarded to the accused within a maximum period of ten business days so that they can make any relevant allegations within the following three business days.

During the processing of the procedure, the governing body may, on its own initiative or at the request of the investigator or the Compliance coordinators, take appropriate precautionary measures aimed at immediately ceasing the regulatory breach that may be occurring.

With due measures of transparency and confidentiality, the investigation process will be initiated, which will last for three months from the receipt of the complaint, a period that may be extended for an additional three months if the investigation requires more complex inquiries or further actions.

During this period, the necessary evidence will be gathered for an effective investigation of the facts (interviews with those involved, requests for documents, obtaining information through other individuals or external sources, etc.).

The Compliance coordinators of the entity will have sufficient authority to approach any department or person within CMP to obtain the necessary information or documentation.

The investigation process will be carried out with the utmost rigor to verify the truthfulness of the facts, respecting the presumption of innocence and other rights afforded to the accused individuals.

Upon completion of the investigation, a report of findings will be issued, duly justified, proposing to the governing body of the entity one of the following recommendations:

- Dismissal of the complaint if it is found that the regulatory breach did not occur.

- Corrective or punitive measures if the regulatory breach is proven. Depending on the outcome of the investigation and the processed file, these measures may consist of imposing sanctions in accordance with the internal manuals of the entity (Code of Ethics, Compliance Manual, collective agreement, etc.), referring the matter to the judge or prosecutor for criminal matters, and, if necessary, adopting preventive measures to prevent similar breaches from recurring.

6.5. Conclusion of the case file

Ultimately, it is the responsibility of the CMP Board of Directors to adopt measures to conclude the procedure. These may involve dismissing the complaint or imposing corrective or punitive measures.

The complainant must be informed of the outcome of the complaint within three months or within six months if an extension has been agreed upon due to the investigations to be conducted, as previously indicated.

7. DATA HANDLING IN THE COMPLAINTS CHANNEL:

In accordance with Article 24.4 of Law 3/2018, of December 5, on Personal Data Protection and Digital Rights Guarantees, the data of the complainant and of employees and third parties must be retained in the complaints system only for the time necessary to decide on the appropriateness of initiating an investigation into the reported facts.