Regulatory Compliance and Crime Prevention

The Regulatory Compliance Committee is responsible for the System and the management of the Compliance Channel, with the Board of Directors of FREMAP being the legally responsible body for the implementation of the FREMAP Integrity internal Information System. The Committee is composed of the Secretary General, the Deputy Director General of Human Resources, the Deputy Director General of Media, the Director of the Internal Audit Service, and the Director of Regulatory Compliance. Its members are bound by the principles of professionalism, honorability, independence, dedication, objectivity, confidentiality, impartiality, and non-retaliation.

In the event that a member of the Regulatory Compliance Committee may be affected by the content of a communication, the reporting person, in order to avoid a conflict of interest, must make the communication by post, indicating "COMMUNICATION WITH CONFLICT OF INTEREST ADDRESSED TO [MEMBER OF THE COMMITTEE EXCLUDED FROM THE CONFLICT SO AS TO ATTEND TO THE COMMUNICATION]".​

The postal address will be:

Attn/ (MEMBER OF THE COMMITTEE EXCLUDED FROM THE CONFLICT)

FREMAP Headquarters

​Pozuelo Road No. 61, 28222, Majadahonda (Madrid)

The main purpose of the Channel is to enable any natural or legal person directly or indirectly related to FREMAP's activity to report the possible existence of indications, suspicions or facts relating to the commission of illegal acts or irregularities, with special reference to its Catalogue of Prohibited Conduct.

Specifically, the scope of this Channel covers any serious or very serious administrative violation, criminal offenses, and any actions or omissions that may constitute violations of European Union law, under the terms established in Article 2 of Law 2/2023, of February 20, regulating the protection of persons who report regulatory violations and the fight against corruption.

The following are expressly excluded from the scope of the Canal:

• Questions relating to the management of data protection rights should be sent to the following address: derechos_arco@fremap.es as well as requests for intervention by the data protection officer prior to filing a complaint with the Spanish Data Protection Agency (AEPD) against the Data Controller or Processor, which should be addressed to the following address: dpd@fremap.es.

• The formulation of queries, complaints or claims related to the rights and interests legally recognized by the status of beneficiary of Social Security benefits, in relation to the management of their benefits carried out by FREMAP or with the treatment provided in the Mutual. For communication regarding these matters, they may contact the following address: atencionclientes@fremap.es.

Likewise, any information related to claims about interpersonal conflicts or that affect only the reporting person and the persons to whom the communication refers is expressly excluded from the scope of the Channel.

Finally, the report will be rejected in the following cases:

• The content of the report does not fall within the Channel's remit. If it falls within the remit of another internal channel or area of the Mutual Society, data pertaining to the Channel will be deleted after it has been made anonymous and, if applicable, after the information reported has been referred to the relevant area, and the reporter will be kept informed.

• The reported events are clearly unfounded or there is a reasonable indication that an offence has been committed in obtaining them.

• The reported events lack plausibility.

• The reported events have already been the subject of a previous internal investigation that has already been completed, or if the events are being or have already been investigated by the authorities.

• The information provided is generic and does not refer to specific events that can be verified. In this case, prior to the report being rejected, the Regulatory Compliance Committee will ask the reporter to provide additional information, granting a period of seven (7) calendar days to do so, after which, if there has been no response to the request, the report will be rejected.

FREMAP's Regulatory Compliance Committee will acknowledge receipt of the communication to the reporting party, whenever possible, within a maximum of 7 calendar days from the date of receipt or will arrange a face-to-face meeting for its submission within 7 calendar days following the date of the request.

When making the communication, the reporting person may indicate an address, e-mail address or safe place to receive notifications. If you are submitting a communication by post, we recommend that you provide an e-mail address where you can securely receive notifications. ​

If the communication is accepted by the Committee, an investigation file will be opened by the Committee or by the internal or external third party designated, depending on the subject matter of the communication. Reports of harassment that do not have criminal implications will be processed according to the procedures established in FREMAP's protocol for actions in cases of harassment (currently in the process of approval by the State Secretariat for Public Administration, as it is linked to FREMAP's Equality Plan). During the investigation phase, additional information may be requested from the reporting person, including written statements or personal interviews with the reporting person, the person affected by the communication, and/or third parties who can provide relevant information for the resolution of the investigation. All interviews (including, where applicable, the in-person meeting) will be documented in a transcript to be signed by all parties involved, with the prior consent of the interviewee. The interviewee will be given the opportunity to verify, correct, and accept the transcript of the conversation by signing it.

The maximum period for resolving investigations will be 3 months (extendable to 3 more months in cases of special complexity).

The results of the investigation will be communicated to both the informant and the affected person, in general terms, while always safeguarding the confidentiality rights of all persons involved in the investigation.

For more information on the principles and guarantees of the Compliance Channel management procedure, you can consult the FREMAP Internal Information System Integrity Policy (also available at the top of the Channel Portal platform).

Finally, in the event that the content of the information concerns a conflict of interest disclosure that does not involve a criminal offence or a serious or very serious administrative offence, the following internal procedures shall be followed:

• Analysis and verification of the conflict situation.

• Management of the conflict situation by the Regulatory Compliance Committee, in order to end or avoid the conflict, through the relevant instructions at the operational level.

• ​Recording of the communication of conflict of interest.

Confidentiality and/or anonymity, if the reporting person chooses the latter option, the right of the affected person to be informed of the actions or omissions attributed to them and to be heard at any time, access to the file in the terms regulated by Law 2/2023, of February 20, regulating the protection of persons who report regulatory violations and the fight against corruption, to honor and the presumption of innocence. Likewise, indemnity against retaliation against the person who reports in good faith will be guaranteed.

For further information on the content of these rights and guarantees, please consult the FREMAP Internal Information System PolicyIntegrity(also available at the top of the Channel Portal).

You should use the Compliance Channel as a priority to channel the information you wish to communicate, so that FREMAP can carry out diligent and effective action to quickly prevent or eliminate the irregular conduct. However, this Channel does not prevent communications from being submitted to the relevant national or European authorities, or to the Independent Whistleblower Protection Authority or the counterpart bodies in the autonomous communities responsible for managing external information channels.

The procedure for managing communications made through the External Channel will be processed by the Independent Whistleblower Protection Authority (https://www.proteccioninformante.gob.es/) in accordance with the provisions of Title III of Law 2/2023, of February 20, regulating the protection of persons who report regulatory infringements and the fight against corruption.

Inquiries will be made through the Compliance Portal's electronic form. The Regulatory Compliance Committee will respond within a maximum period of 30 calendar days, which may be extended to an additional 10 calendar days, exceptionally. ​

FREMAP will treat your personal data confidentially. This means that if you have identified yourself, appropriate measures will be taken to ensure the protection of your personal data, that of third parties, and all actions carried out in the management and processing of the investigation, employing appropriate technical and organizational measures to guarantee and preserve the identity of individuals and the confidentiality of their data. 

The data that is subject to processing will be kept in the FREMAP Integrity internal Information System only for the time necessary to decide on the appropriateness of initiating an investigation into the reported facts. If it is proven that the information provided, or part of it, is not true, it will be deleted immediately upon becoming aware of this circumstance, unless such inaccuracy may constitute a criminal offense, in which case the information will be retained for the time necessary to process the legal proceedings.

Personal data relating to information received and internal investigations conducted will only be retained for the period necessary and proportionate to comply with Law 2/2023, of February 20, regulating the protection of persons who report regulatory violations and the fight against corruption. Under no circumstances may data be retained for a period exceeding 10 years.

The data contained in the information on which no investigation actions are initiated will be deleted from the System within a maximum period of 3 months from its receipt, or may be kept in an anonymous form to provide evidence of its operation, without the blocking obligation provided for in article 32 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantees of Digital Rights being applicable.

Enquiry

Communication