Who can make a report?

Reports can be made by:

• Anyone who is or has been a CELLS member or employee.
• Any natural or legal person who is or has been in contact with the CELLS by virtue of a current or past professional relationship and who has obtained information about possible offences within the scope of the institution's activities.

What issues can be reported?

The Ethics Channel can be used to report facts that may involve a breach of the legal regulations, the Code of Ethics or any other regulations in force, such as:

• Conduct concerning fraud and corruption.
• Conduct concerning information security, data protection and securities markets.
• Anti-competitive practices.
• Conduct that violates human rights or harms the environment.
• Any act and omission that may constitute a breach of European Union law.
• Acts or omissions concerning the Spanish legal system that may constitute a serious or very serious criminal or administrative offence.

Provided that the conduct is related to the activity of the CELLS.

General principles and procedure of the Internal Reporting System

The general principles of the Internal Reporting System are defined in the Policy on the Protection of Individuals. The following shall be ensured in all cases:

• Absolute confidentiality throughout the process, and protection of the identity of the whistleblower to the extent permitted by law. The ability to report anonymously is provided for.
• Fair, objective and diligent investigation in accordance with internal rules and applicable law. The rights of those involved, in particular the presumption of innocence, will be respected throughout the process.
• Protection against retaliation for bona fide whistleblowers. They may not be subject to penalties or attempted penalties, threats, unfavourable or humiliating treatment or any other action provided for in Article 36.3 of Law 2/2023, for passing on facts or omissions, provided that the information is based on good faith and ethics. However, persons who use the Internal Reporting System and its Ethics Channel to submit false, misleading or unlawfully obtained information shall not be protected. In such an event, the CELLS reserves the right to take appropriate action.
• Resolution and follow-up: Upon completion of the investigation, the necessary steps will be taken to address the issue identified and, where possible, corrective measures will be taken to prevent future violations. The whistleblower will be kept informed of the progress and resolution of his or her report, wherever possible, under applicable principles and as permitted by law.

CELLS has developed and maintains a procedure for handling the reporting of offences, in application of Law 2/2023.

CELLS has engaged an external platform and application for handling reported cases: CO-Resol. The aim is to ensure confidentiality and anonymity through a platform that does not run under the control of CELLS personnel or on internal systems. The owner of the platform, BCN RESOL ODR SOLUTIONS, S.L., is a trusted company with the best reputation among lawyers dealing with Internal Reporting Systems.

BCN RESOL ODR SOLUTIONS, S.L.
Tax ID No.: B-66682428

How can you report?

The processor of your personal data

Consortium for the Construction, Equipping and Exploitation of the Synchrotron Light Source (Hereinafter, "CELLS"), whose registered office is at Carrer de la Llum, 2-26, Cerdanyola del Vallès, Barcelona; telephone (+34) 93 592 43 00; and email dpd@cells.es

Data Protection Officer

As a public entity, the CELLS has a Data Protection Officer for any queries related to the processing of personal data. Contact: dpd@cells.es

What personal data is collected and how? What happens to the personal data provided to the CELLS?

All personal data provided will be processed in accordance with the GDPR and any other applicable laws on the matter. Specifically, your personal data will be used for the following purposes:

• To handle the processing of non-anonymous communications received and any administrative files related to them.
• To deal with and handle any queries, requests and complaints made through the channels set up for such a purpose on the website.
• To prevent fraud in the granting of public aid and subsidies as well as to handle complaints received in this regard and to comply with all regulations applicable to the CELLS regarding transparency.
• To keep a record of relations and communications.
• To handle web browsing data.

Data subjects are responsible for the truthfulness of the data provided. Consequently, the CELLS reserves the right to exclude from the registered procedures any person who has provided false data, without prejudice to any other legal action. In the event that data subjects provide the CELLS with personal data belonging to third parties, they must be duly authorised to do so, and must expressly inform the owners of such data of the rights and/or obligations contained herein, acknowledging that such data is true, accurate, valid, up to date and authentic.

Legitimacy for processing personal data

The legal basis that legitimises the CELLS to process the personal data provided to it arises mainly from:

• Consent expressed through communication channels (forms and e-mail, among others).
• Law 2/2023, of 20 February, regulating the protection of persons who report breaches of regulations and the fight against corruption.

How long will personal data be kept?

In compliance with the GDPR, the personal data collected by the CELLS will be kept for the minimum time necessary for the proper processing of the procedures, as well as to meet the responsibilities that may arise from these and any other legal requirement.

Disclosure of personal data

The CELLS will only disclose personal data to third parties when required by law or when necessary for the proper provision of its services/processing of its procedures. By accepting the privacy policy, data subjects authorise the disclosure of their personal data to the following recipients:

El CELLS únicamente comunicará los datos personales a terceros cuando así se requiera por obligación legal o bien sea necesario para la correcta prestación de sus servicios/tramitación de sus procedimientos. Al aceptar la política de privacidad, el titular de los datos de carácter personal autoriza a que sus datos personales sean comunicados a los siguientes destinatarios:

• Public Administrations and public bodies at national and European level.
• Competent national or international authorities, including judicial bodies, regulatory and supervisory bodies and law enforcement agencies.

No international transfers of data are made.

Rights of personal data subjects and how to exercise them

Personal data subjects have the right to:

• Access: to know whether the CELLS is processing their personal data and, if so, to obtain information about what data and how it is are being processed.
• Rectification: to request the rectification of inaccurate data.
• Deletion: to request the deletion of their data when it is no longer necessary for the purposes for which it was collected, among other reasons, in which case the CELLS will no longer process the data, unless required for the exercise or defence of any claims.
• Restriction: to request restriction in processing their data in certain circumstances. The CELLS will only keep and use it for the purpose of defending claims or for the protection of the rights of another natural or legal person or for reasons of public interest of the European Union or a specific Member State.
• Objection: to object to their data being processed. In this case, the CELLS will cease processing the data, unless required for the exercise and defence of any claims or for compelling reasons that override the interests and rights of the data subject.
• Portability: to receive the personal data concerning them that they have provided to the CELLS in a structured, commonly used and machine-readable format, provided that such data is processed by automated means. They may also request that CELLS transmits it directly to another data controller where technically possible.
• Revocation: to withdraw the consent they have given for the purposes included in the section "What happens to the personal data provided to the CELLS?" without affecting the lawfulness of the processing based on the consent prior to its withdrawal.

The above rights may be exercised by writing to the e-mail address dpd@cells.es, or to the postal address C/ de la Llum, 2-26, 02890, Cerdanyola del Vallès, Barcelona, with the reference "GDPR Rights". In both cases, data subjects must identify themselves by means of a copy of their ID card or similar document.

In the event data subjects are not satisfied with the response provided by the CELLS in exercising their rights, they may lodge a complaint with the Spanish Data Protection Agency or any other supervisory authority competent in the field of data protection in the European Union.

Security measures

In accordance with current law, the CELLS has adopted legal, technical and organisational measures to ensure the security and confidentiality of personal data and/or any other information provided to it.