Checking the availability of your search:

From @@start_date@@ to @@end_date@@
EN
ES EN
2/0/0
Room 1
(3 - 17 years)
(0 - 2 years)
Room 2
(3 - 17 years)
(0 - 2 years)
Room 3
(3 - 17 years)
(0 - 2 years)
Add another room
Book here

Internal Information Channel

Approved by the Board of Directors at its meeting of May 2, 2023


Internal Information Systems are an effective tool for detecting irregularities that would go unnoticed by other controls, although they require compliance with technical and legal measures that guarantee the rights of those affected. ZT HOTELS & RESORTS SL's Internal Information System should be used primarily to channel information regarding conduct that may constitute compliance violations, especially serious or very serious criminal or administrative violations and those whose disclosure requires special protection measures for whistleblowers.

CURRENT REGULATIONS

Current legislation, and specifically the Law regulating the protection of persons who report regulatory breaches and the fight against corruption (Law 2/2023 of February 20) establishes the need to have an Internal Information Channel within the Internal Information System, which will subsume all previous reporting or information channels in a broad sense and among them, but not limited to, the Criminal Risk Prevention Model in compliance with the requirements of the Criminal Code.

Organic Law 3/2018 of December 5, on the Protection of Personal Data and Guarantees of Digital Rights, also regulates the processing of internal information systems in its Article 24. This data protection processing is also specifically regulated in Title VI of Law 2/2023.

Additionally, and as a complementary interpretation criterion, ZT HOTELS & RESORTS SL will use Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, as well as the UNE-ISO 37002 standard for Whistleblowing Management Systems.

EXTERNAL INFORMATION CHANNEL

In accordance with the provisions of Law 2/2023, which regulates the protection of persons who report regulatory violations and the fight against corruption, any natural person may inform the Independent Authority for the Protection of Whistleblowers (AAI) of the commission of any actions or omissions included within the scope of Law 2/2023, either directly to the Authority or by prior communication through the Internal Information Channel.

The reception and management of information will be carried out in accordance with the provisions of the Independent Authority for the Protection of Informants and the regulations in Title III (Articles 16 et seq.) of Law 2/2023, once said public body, which is pending as of today, is operational.

INTERNAL INFORMATION SYSTEM ZT HOTELS & RESORTS SL
ZT HOTELS & RESORTS SL is required to have an internal information system in accordance with Law 2/2023, as it is a private sector legal entity that employs 50 or more employees.

  • Scope

    The Internal Information System will bring together all the different information channels previously established in ZT HOTELS & RESORTS SL for all its employees and also for all those who maintain a contractual relationship with the company (agents, clients, suppliers, etc.) and any other citizens who may have an interest in order to report actions or omissions that may constitute serious or very serious criminal or administrative offenses.
    The Internal Information Channel is established as the preferred channel for reporting actions or omissions provided for in Article 2 of Law 2/2023, which regulates the protection of persons who report regulatory and anti-corruption violations, especially those that may constitute serious or very serious criminal or administrative violations, those that impact the internal market, including violations of competition law, as well as violations of labor law related to occupational health and safety (without prejudice to the protection established in their specific area).
    The protection provided for in Law 2/2023 will apply to whistleblowers who have provided information about violations regulated in Article 2 of Law 2/2023, in an employment or professional context, and in any case to employees, shareholders, and persons belonging to the company's administrative, management, or supervisory body, and any person who works for or under the supervision and direction of contractors, subcontractors, and suppliers of ZT HOTELS & RESORTS SL. Protection will also apply to whistleblowers who communicate or publicly reveal information about violations obtained within the framework of a terminated employment or statutory relationship, volunteers, interns, or workers in training, even if the employment relationship had not begun if the information was obtained during the selection period.
    The protection measures will also apply to individuals who, within the framework of the organization for which the informant provides services, assist the informant in the process; those related to the informant and who may suffer retaliation; and legal entities for which the informant works or maintains another type of employment relationship or has a significant stake. Communication procedures and tools, such as the communications mailbox for addressing issues related to Transparency Law 19/2013, or others outside the material scope of Law 2/2023, will be part of the Internal Information System, but will not be raised through the Information Channel nor will they benefit from the protection measures of Law 2/2023.


  • Internal Information Channel

    The Administrative Body is responsible for the implementation of the System and the Internal Information Channel. To this end, it agreed to its implementation on May 2, 2023, and a prior consultation was held with the legal representatives of the workers on May 18, 2023. The administrative body will be considered the controller of personal data, in accordance with the provisions of personal data protection regulations.

    In the agreement of the Board of Directors of May 2, 2023, Ms. Patricia Zaragoza Traver was appointed as System Manager.

    The internal information channel will be managed through a cloud-based "integrated line" IT tool hosted on private servers with double encryption based on individual cases or communications. Secure operation for reporting any incidents or information will be handled by an external third party. In our specific case, and without prejudice to the responsibility of the System Manager, Mr. Vicente E. Tirado Rico, Attorney No. 1547 of the Castellón Bar Association, has been appointed for external management.

    The Channel Manager will perform his or her duties independently and autonomously from the rest of the Company's bodies.

    For the submission of communications and subsequent information management, the Internal Information Channel tool has been enabled with the following features:

    • Whistleblowers can submit a report securely and anonymously if they wish, 24 hours a day, 7 days a week, in writing or verbally via voice message or through a face-to-face meeting.
    • Support for video/audio/image/text attachments, including automatic metadata removal and malware protection
    • Allows anonymous communication between the whistleblower and the case manager (secure communication mailbox)
    • Confirmation of a very high level of security through periodic external penetration testing
    • All data is highly encrypted to BSI standards (i.e. in transit and during storage)
    • Configurable security settings (password policy, brute force settings, IP access restrictions, two-factor authentication, etc.)
    • There is no cookie tracking or IP address storage to ensure informant anonymity.


    The Channel Manager receives and manages incoming cases in a completely secure manner for both ends of the communication, and the tool allows for anonymous communication and the receipt of verbal and written information, with complete confidentiality and traceability for management.

    The tool will ensure that the communications submitted can be effectively processed so that ZT HOTELS & RESORTS SL itself is the first to be aware of any potential irregularity.

    Accessibility will be facilitated by incorporating easy access to the intranet and the home page of the ZT HOTELS & RESORTS SL website.

    Access to information shall be lawful for any person to provide it, especially that referred to within the scope of Article 3 of Law 2/2023. The communication of the information received to third parties is authorized only when necessary for the adoption of disciplinary measures or for the processing of any applicable legal proceedings. The tool used may be enabled to receive any other information or communications outside the scope of Article 2 of Law 2/2023, in which case they may be redirected to the labor, accounting, or compliance procedures that, where applicable, are part of the Internal Information System.


  • Confidentiality

    The Internal Information Channel is designed, established, and managed securely, ensuring the confidentiality of the identity of the informant and any third party mentioned in the communication and the actions taken in the management and processing of the communication, the protection of their data, and preventing access by unauthorized personnel.

    Except as provided in the following point, information or communications may contain the informant's first and last name, and any other identifying information, as well as a contact email address. The confidentiality of the informant, the person about whom the information is received, and any other persons who may be related, as well as the content of the information, will be guaranteed.


  • Information

    The identified Informant will be informed of the following:

    • The identity and contact details of the person to whom the Internal Information System Committee has delegated, who will be responsible for the Internal Information Channel, and will also act as the Criminal Risk Prevention Officer.


    • The contact details of the Data Protection Officer.
    • The purposes of the processing for which the data will be used, if applicable, and the legal basis for the processing.
    • Data recipients. All data from the tool will be stored on servers located within the EU and will maintain high security measures.
    • Data retention period. The data of the person providing the information and of the employees and third parties affected by the information provided must be retained in the Internal Information System only for the time necessary to decide whether to initiate an investigation into the reported events. The maximum period for which data will be retained is three months from the completion of the file, unless there are other duly justified reasons.
    • Existence of the right to request access to your data.
    • The right to lodge a complaint with the supervisory authority.
    • That your identity will be kept confidential at all stages of the process and, specifically, that it will not be disclosed to third parties, neither to the person about whom the information has been provided, nor to the employee's management.
    • If strictly necessary, the need to disclose your identity to the relevant authorities involved in any subsequent investigation or legal proceedings initiated as a result of the investigation carried out.


    The employee, or the entity affected by the information received, must be informed of the following points.

    • Of the people responsible for the System and the Internal Information Channel
    • Of the facts about which information has been received.
    • Of the data processed.
    • Of the departments and services that could receive the report within the entities or companies of the group, and
    • How to exercise your rights of access and rectification.


    The identity of the person who provided the information will never be communicated to the affected employee or entity.

    EXCEPTION: When there is a significant risk that such notification could jeopardize the Company's ability to effectively investigate the allegation or gather the necessary evidence, notification to the person about whom the information has been received may be delayed while such risk exists. The purpose of this exception to the rule is to preserve evidence by preventing its destruction or alteration by the incriminated person. It should be applied restrictively and should take into account the broader interests at stake, always taking into account respect for the affected person's right to defense.

    The person who provided the information will be informed in a precise and concrete manner about the decisions that have been taken.

    An Internal Information Channel Registration System will be established with the content and requirements established in Article 26 of Law 2/2023, which will be stored in the Channel's tool, maintaining the security and confidentiality conditions required by that Law.

    Information management systems will guarantee confidentiality and ensure traceability of executed actions. No records may be deleted, without prejudice to the proper erasure of data in accordance with current data protection regulations.


  • No retaliation

    There will be no retaliation of any kind for information submitted in good faith, and the informant must have reasonable grounds to support his or her submission.

    Individuals who intend to report irregularities, actions or omissions contrary to the Code of Ethics, the Internal Rules, or current legislation, especially in administrative or criminal matters, within the framework of the Internal Information System, must know:

    • That they will have the full protection and support of the entity, with regard to their action.
    • That your identity will remain confidential at all stages of the process, and in particular that your identity will not be revealed to third parties, the person incriminated, or the employee's superiors.
    • If, despite this information, the Informant wishes to remain anonymous, the information will be accepted.


    In all cases, it will be presumed—unless proven otherwise—that the information provided has been considered and reported by the Informant in good faith. Notwithstanding the foregoing, any information that is fraudulently false, malicious, or abusive may give rise to proportionate action by the Company against the Informant.

    The Internal Information Channel will be enabled to manage the reception of any other communications or information outside the scope established by Law 2/2023, although said communications or information will fall outside the scope of protection provided by said law.

    However, measures will be maintained to guarantee confidentiality and anonymity for any type of communication or information.


  • Protection of personal data

    The Information Channel management tool guarantees the exercise of the rights conferred by current data protection regulations, although under no circumstances will the informant be identified as a result of the exercise of the right of access by the person whose information is being processed.

    The nature of the System and the Internal Information Channel makes it foreseeable that specially protected data may be processed, which, if relevant, may be processed based on the essential public interest, as set out in Law 2/2023. The implementation of an internal information system, as it is a new processing activity, entails the need to analyze the risks of processing and carry out the corresponding impact assessment, where appropriate, in order to adopt the necessary security measures.

    The processing of personal data will be governed by the provisions of EU Regulation 2016/679 of the European Parliament and of the Council of April 27, 2016; Organic Law 3/2018 of December 5; and Law 2/2023 regulating the protection of persons who report regulatory breaches and the fight against corruption.

    The Internal Information Channel will not obtain data that would allow the identification of the informant, and appropriate technical and organizational measures will be in place to preserve the identity and guarantee the confidentiality of the data corresponding to the affected persons and any third party mentioned in the information provided.

    When personal data is obtained directly from the data subject, the information referred to in Article 13 of EU Regulation 2016/679 will be provided, as established in Article 11 of Organic Law 3/2018.

    These data will be processed for the purpose of managing and processing the corresponding reports of non-compliance or violations provided for in Law 2/2023. Therefore, only the data strictly necessary for the fulfillment of the aforementioned purpose will be processed.

    The processing of this data is based on compliance with a legal obligation as provided for in Article 6.1. c) of Regulation (EU) 2016/679.

    Where applicable, the data subject will be notified that he or she has the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.

    Finally, the interested party will be informed that, in any case, the interested party may, at any time, through the Data Protection Officer, exercise their rights of access, rectification, deletion, restriction, objection, as well as the right to data portability and not to be subject to automated decisions.

    Personal data relating to information received and internal investigations conducted by the Internal Information Channel Manager will only be retained for as long as necessary. In any case, after three months have passed since receipt of the information without any investigation having been initiated, it must be deleted, unless the purpose of retention is to provide evidence of the functioning of the System. Under no circumstances may data be retained for a period exceeding ten years.

    The identity of the Informant may only be communicated to the judicial authority, the Public Prosecutor's Office, or the competent administrative authority within the framework of a criminal, disciplinary, or sanctioning investigation. No international data transfers will take place.

    If the interested party is not satisfied with the way in which ZT HOTELS & RESORTS SL has processed their data, they may file a complaint with the Spanish Data Protection Agency, in the "Electronic Office" section of its website www.aepd.es


  • Independence

    Independence from the Company's various decision-making bodies is guaranteed.

    The Internal Information Channel of ZT HOTELS & RESORTS SL will be managed by an external third party who will report directly to the System Manager and this in turn to the Board of Directors of ZT HOTELS & RESORTS SL

    The appointment and dismissal of the Controller shall be notified to the Independent Whistleblower Protection Authority (AAI) within ten business days. In the case of dismissal, the notification shall include the reasons for the dismissal.


  • Communication and training

    The information may be provided in writing, by postal mail, or through any electronic means available for this purpose, or verbally, by telephone, or via voicemail. At the request of the informant, it may also be provided through an in-person meeting within a maximum period of seven calendar days from the request.

    Verbal communications, including those made through face-to-face or telephone meetings, must be documented. The informant may be asked to consent to the recording of the communication and will be informed of the processing of their data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016.

    The recording will be made in a secure, durable, and accessible format, or a complete and accurate transcript of the conversation will be made. The informant will have the right to verify, correct, and accept the transcript by signing it.

    Those who communicate through the Internal Information Channel will be informed of the existence of the external information channel.

    Prior, precise, and unequivocal training must be provided on the existence and operation of the Internal Information Channel. Employees and suppliers must be specifically informed of the existence, purpose, and operation of the system, the recipients of communications, and the exercise of data protection rights (access, rectification, erasure, and objection to processing) conferred by current data protection regulations.

    The Committee Responsible for the Management of the Internal Information System and Criminal Risk Prevention will coordinate and oversee the communication and training actions necessary to ensure that everyone in the organization is aware of its existence and how it operates. Under the same criteria, concrete evidence must be obtained that all employees have received this information.

    Actions will also be taken to ensure that all ZT HOTELS & RESORTS SL employees (stakeholders) are aware of the Internal Information Channel.


  • Anonymity

    When submitting the notification, the informant may, if desired, provide an address, email address, or secure location to receive notifications. The Information Channel will allow the Informant and the entity to communicate through a mailbox within the tool, which does not require any identification from the Informant.

    In accordance with the provisions of article 17.1 of Law 2/2023 and Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights, the creation and maintenance of information systems through which the entity may be informed, even anonymously, of the commission within the entity or in the actions of third parties who contract with it, of acts or conduct that may be contrary to the general or sectoral regulations applicable to it is considered lawful.

    In accordance with the above, communications that do not contain the informant's identifying information will be accepted for processing, and will be investigated with the utmost caution and proportionality.


  • Reporting

    The person responsible for the System or internal Information Channel of ZT HOTELS & RESORTS SL will be responsible for maintaining a Register Book, which will be stored in the management tool with high security and confidentiality measures, of the information received and the internal investigations to which it has given rise, guaranteeing, in all cases, the confidentiality requirements provided for in Law 3/2023. This Register will not be public, and the contents of said Register may only be accessed in whole or in part at the reasoned request of the judicial authority and under its supervision.


  • Deadlines

    The deadlines indicated in the procedure are calendar days, unless expressly provided that they are business days according to the calendar of the company's registered office.


  • Protective Measures

    Individuals who report or disclose violations will be entitled to protection provided they have reasonable grounds to believe the information reported is true at the time of disclosure, and provided the content falls within the scope of Law 2/2023.
    Persons who have communicated information about actions or omissions anonymously, but who have subsequently been identified, will also be entitled to the protection provided for in Law 2/2023.

    Acts constituting retaliation against persons who submit a communication or information are expressly prohibited. Retaliation is considered to be any act or omission that constitutes unfavorable treatment that places the person subject to it at a particular disadvantage compared to another person in the workplace or professional context, solely because of their status as a whistleblower.

    During the processing of the case, the persons affected by the communication shall have the right to the presumption of innocence, the right to a defense, and the right to access the case file, while preserving their identity and guaranteeing the confidentiality of the facts and details of the procedure.

    • PROCEDURE

    I. COMMUNICATION PHASE

    Communication

    A link or entry will be enabled on the Company's homepage and intranet that will redirect to the Internal Information Channel tool for communicating information. This tool will be managed by an external third party under the supervision of the Channel Manager and, ultimately, by the Board of Directors.

    The communication or information shall include the following references:
    1. Informant's Name and ID (or similar) (Voluntary).
    2. Company to which you belong. (Voluntary)
    3. Contact information: telephone, email, etc. (Voluntary)
    4. Content of the Information, which must specifically and accurately describe the reported events, the affected company/area, the date or period of the incident, and the potential responsible parties. The informant may also include any available evidence.
    Notwithstanding the foregoing, for the purposes of the investigation, written communications in any format, as well as verbal communications, including anonymous ones, will be accepted. All requests or communications will be treated with absolute confidentiality.

    Verbal information may be documented by recording the conversation in a durable and accessible secure format, or by means of a complete and accurate transcript of the conversation. The security of the Channel and the correct recording of the communications received will be guaranteed. The Channel has been configured through a high-security tool (double encryption) with a secure communication channel, which will be hosted on private servers within the EU. The tool facilitates the secure and confidential management of information on each case, allows the data controller to communicate with the informant, and manage the processing of the information received.

    Communication- Reception

    The information will be recorded, reflecting the date of receipt, the assigned identification code, the actions taken, and the measures adopted. Within seven calendar days of receiving the information, if the informant is identified, or if anonymous, provides an email address, receipt will be acknowledged, and the informant will be notified at the address provided by the informant as contact information.

    Any information received through channels other than those established or by staff members not responsible for its processing must be immediately forwarded to the person responsible for managing the System and the Internal Information Channel. Failure to comply with this obligation or breach of the obligation to maintain confidentiality will be considered a very serious violation.

    If the information received contains a generic, imprecise, or vague description of events, before rejecting a communication for this reason, the person responsible for managing the System and the internal Information Channel of ZT HOTELS & RESORTS SL will inform the informant of the deficiencies in their communication and give them a period of 5 business days to clarify, clarify, or properly specify the facts to which they refer. If such deficiencies are not corrected within this period, the communication will be rejected.

    Anonymous information will be investigated by the System Manager and the internal Information Channel of ZT HOTELS & RESORTS SL
    Clear and accessible information will be included on the external information channels of the Independent Whistleblower Protection Authority (IWPA) and any other relevant authority.

    The maximum response time for investigative actions shall not exceed three months from receipt of the communication or, if no acknowledgment of receipt was sent to the informant, from the expiration of the seven-day period following the communication, except in cases of special complexity that require an extension of the deadline, in which case, it may be extended by up to a maximum of another three additional months.

    II. ANALYSIS PHASE

    A maximum period of seven calendar days is established from the receipt of the information for analysis in order to determine whether it is admissible for processing and management, within which period the informant must be notified of receipt of the information.

    Information analysis.

    A preliminary analysis of the communication or information will be carried out in order to assess whether it should be processed.

    To this end, the following are reasons for inadmissibility of the communication:

    1. When the content of the communication does not entail a regulatory breach or a serious or very serious criminal or administrative infraction (especially those cases related to art. 2 of law 2/2023), nor is it considered an infraction in terms of compliance, or of the principles and values defined in the Code of Ethics,
    2. Facts that are manifestly unfounded and without any accreditation.
    3. Lack of reasonable grounds to presume a legal violation of a criminal, administrative, labor, or general regulatory compliance nature.
    4. A generic, imprecise, or vague description of the facts. Before rejecting a communication for this reason, the Internal Information Channel Manager will inform the Informant of the deficiencies in their communication and give them a period of 5 business days to clarify, clarify, or properly specify the facts to which they refer. If these deficiencies are not corrected within the aforementioned period, the communication will be rejected.


      5. In any case of non-admission, the Informant will be informed in writing of the decision to non-admission, indicating and sufficiently justifying the cause of non-admission.
      A copy of this decision of inadmissibility will be sent to the Committee Responsible for the Management of the Internal Information System and Prevention of Criminal Risks. The file will be closed with the notification.

      The Informant may include any information he or she deems necessary to reopen the file.

      Communications received through channels other than those established in this procedure (verbal, telephone, etc.) will be addressed in an attempt to comply with the requirements established in this procedure. The Internal Information Channel Manager may even submit them ex officio through the Channel if they have received a communication that contains clear and sufficient evidence of the commission of a crime or serious infraction. In all cases, the file must include a prior report from the Internal Information Channel Manager regarding the decision to admit or reject the case when dealing with potential criminal or administrative infractions pursuant to Law 2/2023.

      If the submission meets the defined requirements, it will be considered accepted and the review process will begin.

      If the admitted communication is related to another file already open in which substantially identical or related facts are being investigated, it may be agreed to consolidate it for processing and decision in a single procedure, provided that the confidentiality and protection of the data of the informants and the persons affected by the information are respected.

      Information to the Informant

      During the information analysis phase, the System and Internal Information Channel Manager of ZT HOTELS & RESORTS SL will inform the Informant of the acceptance of the communication received within a period of no more than seven calendar days from the decision to proceed with its analysis. The maximum timeframe for responding to investigative actions will be determined, which may not exceed three months from receipt of the information, except in cases of special complexity that require an extension of the deadline, in which case it may be extended by up to a maximum of three additional months.

      The person responsible for managing the Internal Information Channel must provide the possibility of maintaining communication with the informant and, if deemed necessary, of requesting the informant to provide clarifications or additional information.

      Information to the person about whom the information received is about.

      During the information analysis phase, the Channel Management Officer will proceed to inform the person potentially responsible for the violation of the reported incident, unless he or she considers that such notification should be delayed to the person concerned by the information received in order not to thwart the investigation and preserve evidence by preventing its destruction or alteration. In any case, the alleged person responsible for the violation who is affected will be informed as soon as possible so that they may exercise their right of defense. This notification will be made in the time and manner deemed appropriate to ensure the successful completion of the investigation.

      The notification will state the affected person's right to be informed of the actions or omissions attributed to them and to be heard at any time. The affected person may exercise their data protection rights, subject to the limitations set forth in Law 2/2023, regarding the right to access and erasure.

      The presumption of innocence and the honor of the affected individuals will be respected at all times, and the confidentiality of their personal data will be guaranteed.

      The person responsible for managing the System and the internal Information Channel of ZT HOTELS & RESORTS SL will immediately forward the information to the Public Prosecutor's Office when the facts could indicate a crime. If the facts affect the financial interests of the European Union, the information will be forwarded to the European Public Prosecutor's Office.

      III. RESEARCH PHASE

      A maximum period for conducting the investigation is set at three months from the receipt of the information. This period may be exceptionally extended by another period of equal duration in cases where the facts under investigation are complex or require special technical, accounting, or computer expertise, as well as in cases where communications or information accumulate in a single case.

      This phase will include all actions aimed at verifying the plausibility of the reported facts.

      Investigation

      Those involved in the investigation will be subject to enhanced confidentiality obligations, as well as a declaration of absence of conflict of interest. They will be required to abstain from speaking if such a conflict could be deemed to exist.
      The collaboration of employees of any of the Group Companies whose knowledge or involvement is required for the completion of said study will be guaranteed.

      The person responsible for managing the ZT HOTELS & RESORTS SL Internal Information System or Channel will act as the case or file instructor and will conduct or coordinate the investigation into the content of the information received.
      It will be ensured that the person affected by the information is informed of it, as well as of the facts described in a concise and sufficient manner. They will also be informed of their right to submit written allegations and of the processing of their personal data. This information may be provided during a hearing if it is considered that providing it beforehand could facilitate the concealment, destruction, or alteration of evidence. Under no circumstances will the identity of the informant be disclosed, nor will access to their communication be granted.

      Under the direction of the Internal Information Channel Manager and depending on the content of the communication received, an Investigation Team may be established to participate in or conduct the investigation. Without prejudice to the right to submit written allegations, the affected person, with full respect for the presumption of innocence, may present their version of the facts and provide any evidence they deem relevant.

      Research - Report

      The Internal Information Channel Manager will prepare a report on the content of the information received, which will include the following conclusions:
      • Infractions detected.
      • Possible perpetrators.
      • Defined risks.
      • Controls established.
      • Loss quantification.
      • Action plans.
      • Allegations from the person affected by the information, who will have been given a reasonable and sufficient period, and no less than 10 business days, to make allegations and provide any evidence they deem appropriate.


      The report of the person responsible for managing the Internal Information Channel must be referenced to the evidence or proof that may exist or the absence thereof.

      IV. RESOLUTION PHASE

      A maximum period of 20 business days is established for the resolution of the case from the receipt of the report on the investigation of the case or file.

      Actions

      The person responsible for managing the System and the internal Information Channel of ZT HOTELS & RESORTS SL may request an exceptional extension of the investigation and may indicate other details or suggest further investigation elements when they believe the investigation is manifestly insufficient or inconclusive. To this end, they will set a deadline of no more than 10 business days for the investigation to be completed, issuing a supplementary report within the same period.

      The Head of the System and Internal Information Channel of ZT HOTELS & RESORTS SL will prepare a report on the conclusions of the investigation, assessing the steps taken and informing the company and, where appropriate, the corresponding director of the affected area, the HR Director, in order to initiate the implementation of the corresponding actions based on the conclusions of the study carried out.

      Along with issuing the Report, the following will be adopted: (a) the decision to close the case, notifying the informant and the affected person, stating the special protection that, where applicable, the informant has, or (b) the referral to the Public Prosecutor's Office if indications of a crime are found and/or (c) the adoption of a sanctioning procedure for the person who violated the compliance rules. The Head of the System and the Internal Information Channel of ZT HOTELS & RESORTS SL may, at any time, ignore the information to any middle management and directly submit the report to the Board of Directors.

      Legal actions

      If necessary, complaints will be filed with the Public Prosecutor's Office or the corresponding lawsuits will be filed, in accordance with the applicable legal system.

      Information to the Informant

      The outcome of the investigation will be communicated in writing to the person who provided the information using the Internal Information Channel.
      Such communication must be secure and have the appropriate protection and confidentiality measures.

      Information to the person about whom the information received is about

      The results of the investigation will be communicated in writing to the person concerned by the information received, in accordance with current legislation, using a document that includes security and confidentiality measures.

      Record

      A record will be kept in the Internal Information Channel tool of all requests and communications received, as well as the decisions made, in order to ensure the traceability of the actions carried out.

      Risks - Control Actions

      The corresponding negative event will be established. The risk map will be adjusted, modifying the impact or probability of said risk if necessary. Control actions will be reviewed.

      PUBLIC REVELATION

      Public disclosure is understood as the provision to the public of information about actions or omissions under the terms provided for in Law 2/2023. Persons who make public disclosure of the actions or omissions provided for in the Law will be subject to the protection regime provided for in said law, provided that:

      1. They have communicated first through internal and external channels, or directly through external channels, without appropriate measures being taken within the established timeframes.
      2. There are reasonable grounds to believe that the violation may constitute a danger to the public interest, an emergency situation, or there is a risk of irreversible damage, including the physical integrity of persons; or
      3. In the event of communication through the external channel, there is a high risk of retaliation or there is little likelihood of effective treatment of the information due to the particular circumstances of the case.


      Such conditions will not be enforceable when the person has disclosed information directly to the press in accordance with the exercise of freedom of expression and truthful information.

INTERNAL INFORMATION CHANNEL: PROCEDURE DEADLINES
I. Communication phase
"Acknowledgment of receipt" 7 calendar days from the communication of the information
Referral to other areas 7 calendar days from the communication of the information
II. Analysis phase
"Analysis of the information to determine if it is admissible" 7 calendar days from the communication of the information
"Correcting deficiencies in the information" 5 business days from the communication of said deficiencies
Communication to the affected person As soon as possible considering the circumstances
III. Research phase
"Research Report" 3 months + 3 months from receipt of information
"Allegations of the affected person" 10 business days from the communication of the results of the investigation
IV. Resolution Phase
Resolution of the file 20 days
Report to the governing body During the month following the end of the financial year


Report a violation through the Internal Information System
Read more Read less

Self-consumption photovoltaic installation

This project has been funded by the European Union through the Next Generation EU European Recovery Fund, within the framework of the Recovery, Transformation, and Resilience Plan, promoted by the Ministry for Ecological Transition and the Demographic Challenge.