The approval of the Policy, and any modifications thereof, is the responsibility of the GENERAL DIRECTOR of INDUSTRIAS SOMBRERERAS ESPAÑOLAS S.A.

Likewise, the GENERAL DIRECTOR is responsible for appointing the natural person responsible for managing the Information System (hereinafter interchangeably referred to as the “Information System” or “Ethical Channel”).

The Policy of the Spanish Hat Industries S.A. (the “Entity”) in the field of Internal Information System and Defense of the Informant results from the conjunction of three elements:

The Entity's commitment to promoting a true ethical business culture

Identification of the people of SPANISH HAT INDUSTRIES S.A. with values, principles and ethical and conduct guidelines established in the Code of Conduct.

The alignment of the Entity's activity with responsible legal compliance, visible in the design and organization of processes, and in compliance procedures.

As a reflection of the above, this Policy is approved at the highest level of Government, at the proposal of the Department involved after consultation with the legal representation of the workers.

OBJECT

The objective of the Policy is to state the general principles for its implementation in terms of the Internal Information System and defence of the informant, and its ultimate goal is to promote an environment of Compliance based on the principles and values of INDUSTRIAS SOMBRERERAS ESPAÑOLAS S.A.

Following the approval and entry into force of the Policy, the obligation to report potential risks of serious or very serious administrative and/or criminal violations is reinforced as an essential element of the Entity's compliance culture, protecting people who, in this work or professional context, report it through the mechanisms regulated in the Communications Management Procedure, which is approved jointly with this Policy.

1. SUBJECTIVE SCOPE OF APPLICATION

This Policy applies to any person who has obtained information about violations in a work or professional context, regardless of the legal form that determines their employment or service relationship with the Entity, and even whether the aforementioned legal relationship is in force, terminated or not initiated.

For their part, all those persons who are subject to or linked to the authority and control of the Entity, on the basis of an employment or commercial relationship, have the capacity to be affected. In this sense, by way of example, the following may be affected: employees, including management staff, collaborating entities and suppliers, and any other person linked to the Entity's Regulatory Compliance Model.

2. OBJECTIVE SCOPE OF APPLICATION

The objective scope of application of the Communications Channel covers all those behaviors that violate the internal regulations of the Entity, its policies, and especially those that have at least one of the following characteristics:

That they are classified as constituting a crime in the Penal Code.

That constitute an administrative violation.

That may attribute responsibility or any kind of damage or discredit to the Entity.

Any information, knowledge, experience, or any other circumstance that the subject or linked person considers appropriate or convenient to bring to the attention of the Entity due to its direct relationship with ethical matters of the Entity's internal management, with relevance to regulatory compliance and/or any of the previous points.

As an additional requirement for their treatment in the Information System, these actions or behaviors must be attributable to any person or entity linked to the Entity.

3. PRINCIPLES OF ACTION

As a general principle, the Entity will scrupulously comply with current legislation (article 31 bis and related articles of the Ethical Channel) in the management of the Ethical Channel. L.O. 1/2015 and 1/2019 amending the Criminal Code), EU Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of European Union law, and Law 2/2023 of 20 February regulating the protection of persons who report regulatory breaches and the fight against corruption, as well as with current regulations on the Protection of Personal Data.

In relation to the above, the SPANISH HAT INDUSTRIES S.A. will ensure compliance with the Principles listed below.

3.1. Principle of Independence

The Head of the System will exercise his/her duties independently of the Director General of the Entity, although with access to the latter. He/she has an appropriate hierarchical position that sufficiently legitimises him/her to access the documents, information and people that he/she needs for the development of his/her duties, without this being hindered by hierarchical reasons, and at the same time reducing the possibility that the neutrality of the function in its analysis is violated.

At all times, the management of conflicts of interest will be ensured by the regulatory compliance body of INDUSTRIAS SOMBRERERAS ESPAÑOLAS S.A. so that in no case the person linked to the communication participates or can have a voice or vote in said file during its processing.

The appointment, dismissal or termination of the System Manager will be communicated to the Whistleblower Protection Authority.

3.2. Principle of Autonomy

The System Manager will have operational freedom, with the capacity to act on his own initiative, without prejudice to the establishment of annual master plans.

3.3. Confidentiality Principle

In any case, the identity of the informant and of the persons affected will be preserved, with appropriate technical and organisational measures, also allowing the possibility of presenting and processing anonymous communications.

Likewise, all personal data derived from the formulation of any communication are specially protected by the regulations in force at any given time on the protection of personal data. Exceptionally, as a measure to guarantee said confidentiality, it is expressly stated that the exercise of the right of access by the affected party does not, in any case, imply access to the data relating to the identity of the informant.

Persons who, exceptionally, due to imperative needs for investigation and decision-making, have knowledge of the communications made through the Information System are obliged to maintain professional secrecy regarding the data of the informant, in particular those relating to his or her identity. Notwithstanding the above, the protection of the confidentiality of the informant or of third parties shall not apply when their identity has been intentionally revealed by them in the context of a public disclosure.

The identity of the informant may only be communicated to third parties to the judicial authority, the public prosecutor's office or the competent administrative authority within the framework of a criminal, disciplinary or sanctioning investigation, which will be communicated to the informant before revealing his or her identity, unless such information could compromise the investigation or the judicial procedure.

3.4. Legal Protection and Defense of the Whistleblower

Good faith, that is, the honest awareness that serious harmful events have occurred or may occur, is an essential requirement for the protection of the informant. This good faith is the expression of civic behaviour and is opposed to other actions that, on the contrary, must be excluded from protection, such as the transmission of false or distorted information, as well as information obtained illegally.

At the same time, this protection will not be lost if the informant communicates inaccurate information due to an error committed in good faith. In any case, the informant's motives for making his communication are irrelevant in relation to the proper functioning of the Channel. Protection is also granted to persons who do not provide conclusive evidence but who raise reasonable doubts or suspicions about the facts.

The Entity will actively ensure the application of support and protection measures for informants, in accordance with the circumstances at any given time. This protection is implemented in the following measures:

Guarantee of confidentiality and applicability of the Personal Data Protection Regulations.

Prohibition of retaliation and measures to support and protect whistleblowers.

The term "retaliation" expresses the close relationship (of cause and effect) that must exist between the communication and the unfavorable treatment suffered, directly or indirectly, by the informant, so that said person can enjoy legal protection against any type of retaliation, discrimination and penalization due to communications made in good faith.

The prohibition of retaliation provided for in the preceding paragraph shall not prevent the adoption of appropriate disciplinary measures when the internal investigation determines that the communication made is false and that the person who made it is aware of its falsity.

Advice to the informant

The System Manager will be responsible for providing and supplying individualized advice and precise information to the informant, in relation to the responsible exercise of his or her power to carry out a communication.

Whistleblower immunity

When the informant has legally obtained access to the communicated information or the documents containing it, he or she will have immunity in relation to civil, administrative or labour liability arising from the communication submitted.

This applies both to cases where the whistleblower discloses the content of documents to which he or she has legal access and to cases where he or she makes copies of such documents or removes them from the premises of the organization of which he or she is employed in contravention of contractual or other clauses stipulating that such documents are the property of the organization.

When the informant has obtained the information or documents through the commission of a criminal offence such as physical or computer interference, his/her criminal liability shall be governed by the legislation applicable in each case. Notwithstanding the foregoing, the informant shall be liable for actions and omissions that are not related to the communication or are not necessary to reveal an offence.

Furthermore, legal or contractual obligations of individuals, such as loyalty clauses or confidentiality and non-publicity agreements, may not be invoked to prevent communications, to deny protection or to penalize informants for having submitted them when the transmission of information contemplated in such clauses or agreements is necessary to reveal the infringement. When these conditions are met, informants may not be held liable, whether civil, criminal, administrative or labor. This exemption should not be extended to information that is superfluous or causally unconnected with the facts of the communication, which the interested party has revealed without basing himself on well-founded reasons.

Protection of legal representatives of workers

Without prejudice to the protection enjoyed by representatives of workers in their capacity as such by virtue of their specific labour regulations, they will have the corresponding protection from INDUSTRIAS SOMBRERERAS ESPAÑOLAS S.A. whether they report violations in their capacity as employees or have provided advice and support to the whistleblower.

3.5. Protection of affected parties and third parties in the procedure

The protection of the identity of the persons concerned and/or third parties referred to in the communication (for example, witnesses, etc.) at all stages of the procedure, is the best guarantee of protection.

These persons also retain all their rights to judicial protection and defence, access to the file, confidentiality and confidentiality of identity and the presumption of innocence; in short, the same rights enjoyed by the informant.

5. COMMUNICATION, DISSEMINATION AND COMMITMENT

Employees will have a copy of this policy at their disposal through the internal communication channel available at INDUSTRIAS SOMBRERERAS ESPAÑOLAS S.A.

Likewise, the Entity provides appropriate information in a clear and easily accessible manner on the use of the implemented internal information system, as well as on the essential principles of the management procedure to all its stakeholders through the website, in a separate and easily identifiable section, without prejudice to other actions of dissemination and commitment to the policy among all interested parties: suppliers, Public Administrations, etc.

The workers of the Spanish Hat Industries S.A. They are bound by the Code of Conduct and this Policy and assume compliance with it, being obliged to report possible risks and breaches to the Internal Control Body through the Ethics Channel enabled at: https://www.fernandezyroche.com/es/

6. CONTROL AND EVALUATION

The System Manager will periodically report to the GENERAL DIRECTOR of SPANISH HAT INDUSTRIES S.A. on the application of this Policy and its effective compliance, and will do so at least once a year.

The approval of this Policy is documented in the Minutes of the GENERAL DIRECTOR of SPANISH HAT INDUSTRIES S.A. dated 01/09/2024, establishing its entry into force from the day after its communication to the staff.