• Purpose and Scope

The Management Body of CLIKALIA, in line with its commitment to adopting the necessary decisions for the effective implementation of a Compliance Management System, establishes as one of its main pillars the implementation of the Clikalia Ethics Channel (hereinafter referred to as “the Channel”).

The purpose of this Channel is to receive and efficiently process communications concerning behaviors that may constitute violations of the legal framework, as well as breaches of the principles set forth in the Code of Ethics and other key documents forming part of the Compliance System.

This Policy sets out the rules regarding the management and processing of communications received, with the aim of incorporating, in accordance with applicable legislation, a flexible and efficient model aligned with both national and international best practices. It distinguishes between ordinary channels and alternative ones, allowing potential whistleblowers to report facts that may constitute violations of the Compliance System without fear of reprisals or adverse consequences.

Together with the internal procedure regulating the functioning of the Channel, this Policy seeks to ensure professional, confidential, impartial, and fully protective management of the entire process, thereby fostering a climate of trust among stakeholders.

• Scope

This Policy applies to all activities carried out by the organization and is binding on all its members, regardless of their position or role, the legal nature of their relationship with the company, or their geographic location.

It may also be extended to third parties, business partners, foreign subsidiaries, non-controlled affiliated entities, and, in general, to any person wishing to report to the organization the existence of possible breaches and/or violations.

• Principles Governing the Channel

The general principles governing the Channel must be respected and guaranteed by all members of the organization, with the aim of ensuring adequate protection for whistleblowers against possible retaliation for simply reporting facts that may constitute legal or internal regulatory breaches.

The Channel is governed by the following principles:

• Accessibility

The Channel must be clear, public, and easily accessible to employees and third parties wishing to submit a report, serving as the ideal medium for communication between the organization and its stakeholders.

• Good Faith

Whistleblowers must act in good faith and base their reports on facts or indications that may reasonably point to irregular, unlawful, or unethical conduct. Knowingly providing false information with intent to cause harm may result in disciplinary action.

• Confidentiality

Confidentiality will be guaranteed at all times. The identity of the whistleblower will be treated as confidential information and cannot be disclosed without their consent.

• Objectivity and Impartiality

Upon receipt of a communication, impartiality will be ensured, along with the rights to privacy, defense, and presumption of innocence of the individuals concerned.

• Transparency

The Channel serves as a tool of transparency, fostering trust within the organization.

• Authority, Independence, and Conflict of Interest

The individuals responsible for managing the Channel and the Compliance function will act with full autonomy and independence. Any person with a potential conflict of interest must abstain from participating in the investigation.

• Prohibition of Retaliatio

Use of the Channel will not give rise to any direct or indirect retaliation against individuals who, in good faith, report an alleged irregularity.

• Exclusion of Contractual Liability

The right to use the Channel cannot be restricted by contractual obligations (e.g., non-disclosure agreements or confidentiality clauses) where the whistleblower has reasonable grounds to believe that the report is necessary to reveal a breach of the law or company regulations.

• Reportable Conduct

Reports may concern actual or potential violations, past, ongoing, or likely to occur.

By way of example, the following may be reported:

• Bribery and corruption.
• Conduct endangering health and safety at work.
• Conflicts of interest.
• Discrimination, sexual harassment, or workplace harassment.
• Internal fraud.
• Cases of unfair competition.
• Violations of competition law.
• Tax, accounting, or financial integrity irregularities.
• Unauthorized disclosure of information affecting Clikalia’s interests.
• Environmental violations.
• Breaches of Clikalia’s internal regulations.

• Guarantees for Whistleblowers

The Channel provides the necessary safeguards to ensure the security of communications and the confidentiality between the whistleblower and the Compliance Body.
Those responsible for managing the Channel will review the content of each communication and handle it with due diligence, always maintaining the strictest confidentiality of the whistleblower’s identity when the report is not anonymous.
Any form of retaliation against individuals who use this Channel in good faith is strictly prohibited. If it is confirmed that such individuals have been subject to retaliation, stigmatization, or humiliation, the perpetrators will be subject to disciplinary proceedings and, where justified, appropriate sanctions.

• Guarantees for Alleged Offenders

Individuals allegedly involved in facts reported through the Channel shall never be sanctioned solely on the basis of a report or notification. In all cases, the veracity of the report must be verified, and the individuals concerned must be allowed to exercise their right to be heard.

The Compliance Body will inform the individuals concerned as soon as possible, and no later than one (1) month from the date of receipt of the report, of the following: (1) the facts reported; (2) the person responsible for handling the report; (3) the next steps in the investigation; and (4) their data protection rights.

Exceptionally, if there is a significant risk that notifying the alleged party could compromise the effectiveness of the investigation or the collection of evidence, such notification will be postponed until that risk has ceased.

The reasons justifying such risk will be documented and duly substantiated, and the maximum one-month deadline may be extended for a period not exceeding three months.

All information relating to the alleged offender will be treated with the strictest confidentiality.

• Principles of the Investigation Procedure
  • Guiding Principles of the Procedure

Taking into account the potential criminal consequences of the facts that may be reported through the Channel, its management will be aligned with the guiding principles of judicial procedures:

• Documentation: Regardless of the entry channel, the investigation procedure must be properly documented in writing.
• Conducting the investigation: Once a report of facts that may constitute a violation or infraction is received, the investigation will be carried out by decision of the organization, thereby preventing the whistleblower from misusing the Channel.
• Right to be heard: During the investigation, the alleged offender must be able to exercise their right to defense at any time.
• Sending Acknowledgment of Receipt to the Whistleblower

Within seven business days of receiving the report, except if this compromises the confidentiality of the report or if it was made anonymously, an acknowledgment of receipt will be sent to the whistleblower.

• Communication with the Whistleblower

If necessary, communication with the whistleblower (if identified) may be maintained, and additional information may be requested.

• Determination of the Maximum Response Time to Reports

The response to the whistleblower must not exceed three months from the date of receipt of the report. If an acknowledgment of receipt has not been sent to the whistleblower, the response must be provided within a maximum of three months from the end of the seven-day period after the report’s submission. Cases of particular complexity requiring an extension of the deadline are exempt, in which case the period may be extended by a maximum additional three months.

• Acceptance, Non-Acceptance, and Referral to Other Channels

A report may be rejected if it is considered irrelevant, unfounded, or unrelated to the matters that can be communicated through the Channel. Grounds for rejection include:

a) When the reported facts are not credible.

b) When they do not constitute a violation under applicable law.

c) When the report has no basis.

d) When the information does not provide new and significant insights compared to a previously concluded report.

In such cases, the whistleblower will be informed, with reasons, that the report will be archived, and if applicable, they may be redirected to the appropriate Channel if their information is relevant in other areas of activity.

If deemed relevant, a notification will be sent to the whistleblower confirming the opening of a case.

• Involvement of the Public Prosecutor’s Office

Information received will be immediately reported to the Public Prosecutor’s Office when the facts may indicate the commission of a crime.

• Opening an Internal Investigation

When it is determined that the facts constitute sufficient indications of a possible violation, an internal investigation process will be initiated.

The Compliance Body will generally be responsible for the investigation unless a conflict of interest is detected, in which case the Board of Directors will be notified and will decide to appoint an alternative investigator, who may be internal or external.

The investigator will open a case, gathering all incidents occurring within the scope of their actions. The process will be confidential and governed by Personal Data Protection regulations, and a corresponding report will be issued.

If urgent reaction or containment measures are deemed necessary, the report will be forwarded to management so that they are informed and, if applicable, decide on the proposed measures.

Similarly, the alleged offender will be provided with a summary of the facts and a preliminary analysis of the evidence presented, so they may make any defense they consider appropriate, unless it is determined at this initial stage that communication is not appropriate in order to avoid compromising the investigation or destroying evidence.

• The Internal Investigation

The Compliance Body will ensure that the investigation has all necessary resources, internal or external, and access to all relevant information, documentation, and individuals potentially related to the case, depending on the specific circumstances.

• Conclusions and Proposed Actions

Once the investigation is concluded within the established deadlines, a report will be prepared with conclusions and proposed actions.

5.10 Follow-up on Adopted Decisions

After the investigation is completed and decisions have been made, the Compliance Body will monitor whether these decisions are being properly implemented.

This follow-up contributes to the management of the Channel, the continuous improvement of the organization’s Compliance Management System, and the reinforcement of a culture of Compliance within the organization.

• Clarification of Doubts

The Channel may also be used for internal inquiries regarding reporting procedures, application of internal policies, or compliance with legal obligations.

• Recordkeeping of Communications

All information generated through the reports will be stored in the systems and with the security measures established within the scope of the organization’s data protection management system, for the retention periods that may be determined internally in accordance with the applicable principles of personal data protection, or for the periods during which, according to the law, liabilities may arise from the actions under investigation.

Personal data will be kept in the Channel for a maximum period of three months from the date of the report. After this period, if the data are necessary to continue the investigation of the facts, they may continue to be processed for the purposes of the investigation or, if applicable, from the conclusion of any disciplinary, administrative, or judicial procedure that has been initiated.

Reports that have not been processed may only remain in the system in an anonymous form.

Once the investigation is concluded, the designated responsible party may retain the information necessary to ensure traceability, compliance, and the effectiveness of the Compliance Management System.

• External Channels

Reports may also be submitted through external official channels, including::

• Inspectorate-General of Finance (IGF).
• Agency for Development and Cohesion (AD&C).
• Public Prosecutor’s Office (DCIAP).
• Judicial Police (PJ).
• Bank of Portuga.

• Entrada em vigor, divulgação e revisão

This Policy enters into force on the date of its approval, amendment, or update.

It will be published and made available for consultation through Factorial.

The content will be reviewed periodically, and whenever legal, organizational, or other relevant circumstances require its immediate update.