Whistleblowing

Pignus – CréditoEconómico Popular, S.A., hereinafter referred to as "CEP",provides an Internal and External Whistleblowing Channel, through whichpotential breaches covered by the applicable legal framework may be reported ina secure and confidential manner.The CEP WhistleblowingChannel is provided through the electronic platform Integrity Log,ensuring a secure, confidential and independent means for the submission andmanagement of internal and external reports. The platform enables reports to besubmitted by employees, service providers, partners and other persons coveredby Law No. 93/2021 of 20 December, ensuring the protection of thewhistleblower’s identity and the proper handling of the information provided.Access to theWhistleblowing Channel is available at the bottom of this page.CEP ensures theappropriate protection of whistleblowers in accordance with Law No. 93/2021of 20 December, which establishes the general framework for the protectionof whistleblowers reporting breaches.Reports may concernbreaches that have been committed, are being committed, or whose occurrence mayreasonably be anticipated, as well as attempts to conceal such breaches.The following personsmay qualify as whistleblowers, among others:
‍
a) Employees;
b) Volunteers and trainees, whether paid or unpaid;
c) Service providers, contractors, subcontractors and suppliers, as well as any persons acting under their supervision and direction;
d) Shareholders and persons belonging to the management, administration, supervisory or oversight bodies of legal entities.

Employees are guaranteed the right to consult their representatives or trade unions, as well as the protection safeguards associated with exercising that right.

‍Whistleblower Protection and Confidentiality

‍A whistleblower benefits from the protection provided under Law No. 93/2021 of 20 December where, acting in good faith and having reasonable grounds to believe that the information reported is true at the time of the report or public disclosure, they report or publicly disclose a breach through the available reporting channels and in accordance with the legally established order of precedence provided for in Article 7 of that Law. The identity of the whistleblower, as well as any information that directly or indirectly allows their identification, shall be treated as confidential and access shall be restricted to persons responsible for receiving, analysing or following up on reports. The Integrity Log platform includes appropriate technical and organisational measures designed to ensure the confidentiality, integrity and security of the information submitted, ensuring that access to data is limited to duly authorised persons responsible for handling whistleblowing reports.

‍Processing of Personal Data

‍The processing of personal data carried out within the scope of the Whistleblowing Channel, including the collection, recording, retention, analysis and possible transmission of personal data to the competent authorities, complies with the provisions of the General Data Protection Regulation (GDPR) and all applicable legislation on the protection of personal data. For further information regarding the processing of your personal data, please consult the CEP Privacy Policy.

‍Recording, Retention and Handling of Reports

‍Reports received shall be recorded and retained for a minimum period of five years and, irrespective of this period, for as long as judicial or administrative proceedings relating to the report remain pending. Where a report is submitted verbally through a recorded telephone line or another recorded voice messaging system, it shall, subject to the whistleblower’s consent, be documented either by recording the communication on a durable and retrievable medium or by producing a complete and accurate transcript of the communication. CEP shall acknowledge receipt of the report to the whistleblower within a maximum period of seven days, also providing information regarding the applicable requirements, procedures and admissibility of the report. Whenever necessary, CEP may request additional clarification or supplementary information from the whistleblower in order to better assess the facts reported. Following receipt of areport, CEP shall undertake the appropriate actions to verify the allegations submitted and may, where applicable, provide the person concerned with the opportunity to comment on the facts. Within a maximum period of three months from the acknowledgement of receipt of the report, or six months in the case of an external report where the complexity of the matter so justifies, CEP shall inform the whistleblower of the measures planned or adopted to follow up on the report and the respective grounds. The whistleblower may request information regarding the outcome and conclusion of the proceedings, in accordance with applicable legal provisions. A report shall be prepared for each case in accordance with the applicable legislation.

‍Prohibition of Retaliation

‍Any act of retaliation against a whistleblower is strictly prohibited. Retaliation is considered to be any act or omission, directly or indirectly motivated by an internal report, external report or public disclosure, occurring in a professional context, which unjustifiably causes or may cause material or non-material damage to the whistleblower. Law No. 93/2021 establishes a number of situations which, occurring within two years following the report or public disclosure, are presumed to constitute acts of retaliation. Whistleblowers are entitled, under general terms, to legal protection and may benefit from witness protection measures in criminal proceedings. Whistleblowers are also guaranteed access to courts for the defence of their legally protected rights and interests.

‍Whistleblower Liability

‍A report or public disclosure of a breach made in accordance with the requirements established under Law No. 93/2021 shall not, in itself, constitute grounds for disciplinary, civil, administrative offence or criminal liability of the whistleblower. A whistleblower whoreports or publicly discloses a breach in accordance with the applicable legal requirements:

i) Shall not be heldliable for breaching any restrictions on the communication or disclosure of information contained in the report or public disclosure, except in the cases provided for by law;
ii) Shall not be heldliable for obtaining or accessing the information that forms the basis of the report or public disclosure, except where such obtaining or access constitutes a criminal offence.

The above provisions do not affect any potential liability of the whistleblower for acts or omissions unrelated to the report or public disclosure, or which were not necessary for reporting the breach in accordance with Law No. 93/2021.

Without prejudice to the reporting channels identified above, whistleblowers may also contact the National Anti-Corruption Mechanism (MENAC), in the cases and under the conditions etablished by that entity: https://mec-anticorrupcao.pt/