Frequently asked questions
Internal Reporting System · Whistleblowing Channel of RAO SOCIAL, SL
What is this guide for?
To answer, clearly and practically, the most common questions about who can report, what can be reported, how reports are handled and what guarantees protect both the reporting person and the person concerned.
Main legal framework
Law 2/2023 of 20 February · Directive (EU) 2019/1937 · Regulation (EU) 2016/679 (GDPR) · Organic Law 3/2018 (LOPDGDD) · Royal Decree 1101/2024 of 29 October, as currently worded. This guide is informative and must be read together with the Internal Reporting System Policy, the Report Management Procedure, the Code of Ethics and the Privacy Policy of RAO SOCIAL, SL.
A. The Channel: purpose, users and scope
01. What is the Whistleblowing Channel?
The Whistleblowing Channel is one of the routes that make up the Internal Reporting System of RAO SOCIAL, SL. It allows possible infringements known in an employment or professional context to be reported safely, and enables the organisation to analyse them, investigate them where appropriate and adopt corrective measures.
The Internal Reporting System is broader than the Channel: it also includes the System Manager, the Policy or strategy for the protection of the reporting person and the Report Management Procedure.
02. Who can use the Channel?
It can be used by persons who have obtained information in an employment or professional context related to RAO SOCIAL. Among others:
- Employees, former employees and persons in selection or pre-contractual negotiation processes.
- Self-employed persons, shareholders or participants and members of administrative, management or supervisory bodies.
- Staff of contractors, subcontractors and suppliers, as well as persons under their supervision or direction.
- Volunteers, trainees and persons in training periods, whether or not they are paid.
Legal protection may also extend, where the requirements are met, to persons who assist the reporting person, colleagues or relatives who may suffer retaliation and certain related legal entities.
03. What facts and actions can I report?
The Channel is mainly intended for facts that may fall within the scope of Law 2/2023 or that constitute significant breaches of the Code of Ethics or of the internal rules that RAO SOCIAL has decided to channel this way. As a guide, they may include:
- Serious or very serious criminal or administrative infringements, including those involving economic loss to the Public Treasury or Social Security under the terms of the law.
- Certain infringements of European Union law within the scope of Directive (EU) 2019/1937.
- Fraud, corruption, bribery, embezzlement or misappropriation of resources, money laundering or other significant economic irregularities.
- Conflicts of interest, abuse of power or actions that seriously compromise the integrity of the organisation.
- Significant breaches regarding health and safety, the environment, data protection, information security or other applicable legal obligations.
- Harassment, discrimination or other serious violations when, by their nature, they may fall within this System, without prejudice to any specific protocols that apply.
Legal scope and internal scope
The fact that RAO SOCIAL accepts other ethical or internal breaches through the same Channel does not mean that all such reports are automatically covered by the specific protection regime of Law 2/2023. Legal protection must be assessed case by case.
04. What matters should NOT, in principle, use this Channel?
It is not, as a general rule, the right route for:
- Purely interpersonal conflicts or ordinary management disagreements that affect only private interests and do not reveal an infringement covered by the System.
- Commercial complaints, customer claims, billing issues or service requests that belong to the ordinary customer service channels.
- Employment or human resources queries that do not involve a possible infringement and have a specific procedure.
- Emergencies or situations of immediate danger to life or physical integrity, which must be directed to the emergency services or the competent authority.
If a report reaches the Channel but belongs to another internal procedure, it may be safely redirected to the appropriate route, preserving its confidentiality.
05. Can I ask a question without submitting a report of an infringement?
Yes. Queries about how the System works or how best to handle a situation can be raised through the same channel. A query does not automatically become a report of an infringement, but if its content reveals facts that require action, the appropriate procedure will be applied.
B. How to submit and follow a report
06. Can I submit the report anonymously?
Yes. The Channel allows anonymous reports to be submitted and subsequently handled. RAO SOCIAL will not try to identify an anonymous reporting person. To do so, it is enough not to provide identifying data in the form of the web channel (https://codifosc3.canaletic-test.protecdatus.com) or to send the report by postal mail without a sender.
When the person identifies themselves, their identity is subject to reinforced confidentiality and is not disclosed to the person concerned by the facts. In both cases, a report made through the web channel receives a tracking code and the replies are published in the follow-up area, except for anonymous postal mail, where contact cannot be maintained.
07. What forms of reporting does the law provide for?
The Internal Reporting System must allow reports in writing or verbally, or both. A written report may be made through the electronic means provided and, if so provided, by postal mail. A verbal report may be made by telephone or voice messaging.
At RAO SOCIAL, reports can be submitted through the secure form of the web channel (https://codifosc3.canaletic-test.protecdatus.com). Where the channel has it enabled, they can also be submitted by voice recording on the same channel or by postal mail to C/BHFUIS FHIS.
At the request of the reporting person, an in-person meeting must also be possible within a maximum of seven days. If a verbal report is recorded or transcribed, the legally established guarantees of information, consent and verification must be applied.
08. What information should I provide? What if I have no conclusive evidence?
It is advisable to explain the facts as specifically as possible: what happened, when, where, who might be involved, how you came to know about it and what documents or persons could help to verify them. Documents, images or recordings that help to verify the facts can be attached.
Conclusive evidence is not needed. To be protected under Law 2/2023, the reporting person must have reasonable grounds to believe that the information is true at the time of reporting and that it falls within the scope of the Law.
Avoid unnecessary data
Do not include personal data of third parties, especially sensitive data, unless they are necessary to understand or investigate the facts. The System should only process relevant and proportionate information.
09. Can I go directly to an external channel?
Yes. The internal channel is the preferred route when the infringement can be dealt with effectively within the organisation and the reporting person considers that there is no risk of retaliation, but it is not mandatory to use it before going to an external channel.
The reporting person may contact the Independent Authority for Whistleblower Protection (AIPI), an independent administrative authority (A.A.I.), the competent regional authority (in Catalonia, the Anti-Fraud Office of Catalonia, within its powers) or other sector-specific authorities, depending on the subject matter and territorial scope. The reference supervisory authority is: Oficina Antifrau de Catalunya. The public information of the System must clearly state the external channels available.
10. How can I check the status of my report?
When you send a report through the web channel you will be shown a tracking code. To check the status of your report or to provide clarifications or additional documents, go to the channel (https://codifosc3.canaletic-test.protecdatus.com) and enter that code.
In an anonymous report, keeping the tracking code is especially important, because it is the only way to maintain secure communication without revealing your identity.
11. What happens if I lose the tracking code?
The tracking code cannot be recovered, because it is precisely what guarantees anonymity. If you lose it, you can submit a new report referring to the previous one. If you had identified yourself, you can also contact the System Manager (Maria puig) through any other available route, who will assess what can be done without compromising confidentiality.
C. Handling, admission, investigation and deadlines
12. Who manages the Channel and who can access the reports?
Responsibility for handling lies with the Internal Reporting System Manager formally appointed by RAO SOCIAL (Maria puig), who must carry out their duties independently and autonomously. If the Manager is a collegiate body, it must delegate to one of its members the powers to manage and process the files.
Access to the data is restricted, within the legally assigned functions, to the System Manager and whoever handles it directly; to human resources where a disciplinary measure may be taken; to legal services where legal measures may be taken; to the appointed data processors; and to the Data Protection Officer. Other access is lawful only when necessary to adopt corrective measures or conduct sanctioning or criminal proceedings.
13. What happens when a report is sent?
Once received, the report is securely recorded and the System Manager makes an initial analysis to determine whether it falls within the scope of the Channel and what handling is appropriate. If it is accepted, the verification or investigation actions that are necessary and proportionate begin.
During handling, communication with the reporting person may be maintained and additional information requested. Significant decisions and actions must be documented with restricted access and respecting the confidentiality of all parties.
14. When can a report be rejected or closed?
The internal Procedure may provide for rejection or closure when the facts are manifestly outside the scope of the System, lack any plausibility, are mere opinions or rumours with no specific element, the report is manifestly abusive or made knowing the facts to be false, the information was obtained by committing a crime (in which case it will be referred to the Public Prosecutor's Office) or it provides no new and significant information compared with a previous report that was already closed.
However, the lack of conclusive evidence is not, in itself, a reason for rejection. Nor can information that is ultimately not confirmed be confused with a false or bad-faith report.
15. What deadlines apply?
As a general rule, an acknowledgement of receipt will be sent within seven calendar days of receipt, unless this could jeopardise the confidentiality of the report.
The ordinary maximum period to respond to the investigation is three months from receipt of the report. If no acknowledgement of receipt was sent, the period runs from the end of the seven days following the report. In cases of special complexity, the period may be extended by up to three additional months.
16. Will I be told the outcome of the investigation?
Where possible, and if the reporting person has provided a safe way of contact or has access to the follow-up area, they will be informed of the end of the proceedings and the main conclusions that can be shared.
This information does not require disclosing confidential third-party data, details of disciplinary measures, information protected by professional secrecy or actions that could harm ongoing investigations or proceedings.
17. What happens if the facts may constitute a crime?
When the facts may show signs of a criminal offence, the information must be sent immediately to the Public Prosecutor's Office. If they affect the financial interests of the European Union, it will be sent to the European Public Prosecutor's Office.
18. Are all reports recorded in a register?
Yes. RAO SOCIAL keeps a register of the information received and of the internal investigations to which it has given rise, with strict confidentiality guarantees. This register is not public and may only be accessed in the cases provided by law.
D. Confidentiality, protection and rights
19. Will the person concerned know who made the report?
No. The person to whom the facts refer will not be told the identity of the reporting person.
The identity of an identified reporting person may only be disclosed to the judicial authority, the Public Prosecutor's Office or the competent administrative authority in the context of a criminal, disciplinary or sanctioning investigation. Before disclosing it, the reporting person will be informed, unless this could jeopardise the investigation or the proceedings.
All persons who, because of their duties, know about the reports are obliged to keep secret the identity of the reporting person and the information they have access to. Breaching this duty is a very serious infringement of Law 2/2023.
20. What rights does the person concerned by the facts have?
The person concerned keeps the right to the presumption of innocence, the right of defence, the right to be heard and the protection of their honour. They must be informed of the acts or omissions attributed to them at the time and in the way that preserves the success of the investigation.
They may also exercise the rights recognised by data protection rules, within the limits and specific features applicable to the System. Exercising these rights never allows them to learn the identity of the reporting person.
21. Can I suffer retaliation for having reported?
Retaliation, including threats or attempted retaliation, against persons who report information under the legally protected conditions is not allowed.
Retaliation may include, among others, dismissal or a penalty motivated by the report, demotion, unjustified denial of promotion or training, intimidation, harassment, ostracism, reputational damage, financial loss, blacklisting or any unfavourable treatment linked to the status of reporting person.
22. What conditions must I meet to be protected?
Protection under Law 2/2023 essentially requires that the person has reasonable grounds to believe that the information is true at the time of reporting, even if they provide no conclusive evidence, and that the report was made in line with the legally established requirements.
Not covered, among others, are information that is mere rumour, information that affects only interpersonal conflicts outside the legal scope, or information relating to facts not covered by the Law.
23. What happens if a report is submitted knowing it to be false?
Reporting or publicly disclosing information knowing it to be false is a very serious infringement of Law 2/2023. For natural persons, very serious infringements may lead to fines of €30,001 to €300,000, without prejudice to the employment, civil or criminal liability that may apply.
Do not confuse error with bad faith
A good-faith report that ultimately cannot be proven does not automatically become a false report. Bad faith requires a conscious or abusive element that must be assessed in each case.
24. If I took part in the facts, can I still report?
Yes, having taken part in a possible infringement does not necessarily prevent reporting. In certain administrative proceedings, Law 2/2023 provides that the competent body may grant exemption from or reduction of the penalty when the person who took part in the infringement reports before being notified of the start of an investigation or sanctioning procedure and the legal requirements are met. This possibility is not automatic and does not remove any criminal liability that may exist.
E. Data protection and retention of information
25. How are the personal data of the Channel processed?
RAO SOCIAL, SL, as the organisation that implements the Internal Reporting System, is the controller of the personal data of the System. Providers that process data on behalf of RAO SOCIAL will act in the role that corresponds to the service actually provided and, when they manage the System as an external third party, they will be considered data processors under Law 2/2023 and Article 28 of the GDPR. The platform provider, PROTECDATUS Consultors, SL, acts as data processor.
Only personal data that are necessary to know and investigate the facts should be processed. Data that are manifestly irrelevant must be deleted without delay, and specific rules apply to special categories of data.
26. How long are the data kept?
Data may be kept in the receiving system only for the time strictly necessary to decide whether to start an investigation. If three months pass from receipt without any investigation having started, they must be deleted from the system, except where anonymised evidence of its operation is kept.
If it is proven that the information is not true, it is deleted immediately, unless that lack of truthfulness may constitute a criminal offence.
Data needed for an investigation that has started may be kept outside the system for the necessary and proportionate time. Personal data included in the register may in no case be kept for more than ten years.
27. Can I exercise my data protection rights?
Yes. Data subjects may exercise the rights provided for in Articles 15 to 22 of the GDPR, in line with the specific features of the Internal Reporting System. This includes the rights of access, rectification, erasure, restriction, objection and, where applicable given the nature of the processing, the other rights provided by the GDPR.
In any case, these rights do not allow the person concerned to learn the identity of the reporting person. If the person concerned exercises the right to object, the Law establishes a presumption, unless proven otherwise, that there are compelling legitimate grounds that justify the processing.
F. Other routes and additional information
28. What is the difference between an internal channel, an external channel and public disclosure?
The internal channel is the route built into the Internal Reporting System of RAO SOCIAL, SL. The external channel is the one run by the competent authorities, such as the AIPI, the Anti-Fraud Office of Catalonia or the other regional or sector-specific authorities. Public disclosure means making the information available to the public and is only protected in the specific cases and conditions set out in the Law.
The reporting person may choose the most suitable route depending on the circumstances, but public disclosure has specific requirements that must not be treated as equivalent to an internal or external report.
29. Where can I find the full information on the System?
On the website of RAO SOCIAL and in the corporate spaces provided, the following must be available, clearly and accessibly: the essential information on using the Channel, the Policy or strategy of the Internal Reporting System, the Report Management Procedure, the Privacy Policy and information on the competent external channels.
This guide is informative and educational and does not constitute individual legal advice. It must be read together with the Internal Reporting System Policy, the Report Management Procedure and the Privacy Policy of RAO SOCIAL, SL. The current version will be identified and accessible.