PROCEDURE FOR THE COLLECTION AND PROCESSING OF COMPLAINTS
1. INTRODUCTION The whistleblower tool https://emeis-mexico.signalement.net allows you to report any concerns related to acts that may violate the law or VILLAZUL Code of Conduct by following the procedure described below. You can also report your concerns to your line manager, the Human Resources Department or the Compliance Team. VILLAZUL values the use of the whistleblower system, as it provides the company with the opportunity to prevent or stop conduct that violates the law or VILLAZUL policy and the harm that these acts may cause to employees, residents, patients, partners, suppliers and the communities in which VILLAZUL operates. This whistleblower system is open to employees, third parties, subcontractors and suppliers of the VILLAZUL Group. Your report submitted in good faith will be received and investigated by the Compliance Team, responsible for the VILLAZUL whistleblowing tool and system in a confidential manner and without negative consequences, as described below. This whistleblowing procedure has been developed to comply with the requirements of applicable anti-corruption laws, including, among others, the French Law on Transparency, Fight against Corruption and Modernization of Economic Life ("Sapin II"), Law no. 12,846/2013 (Brazil), Law no. 20,393 (Chile), Laws no. 1474 and 1778 (Colombia), Law of the National Anticorruption System (Mexico), and Law 17,060 (Uruguay).
2. GUARANTEES FOR REPORTERS Confidentiality Your report is confidential, as is the investigation and action taken by the company, as explained below. In certain cases, your identity may be disclosed to a competent government authority, but if you remain an employee of the company, you will be informed prior to such disclosure. VILLAZUL is committed to maintaining the confidentiality of the complaint, admissibility and investigation process, as well as the action plans and measures implemented. Please note that you will only be associated with the investigation process during the fact-finding phase. The conduct of the investigation, its contents, its outcome and the final report are strictly confidential. Although you will be informed whether the investigation is continuing or has been closed, the results, the report and the measures taken cannot be shared with you to protect the rights of the persons involved. Any information collected and processed under this Whistleblower Procedure that may identify you as a whistleblower will be kept confidential, unless required by law. Managers, executives and all persons involved in the receipt, investigation or resolution of the complaint must faithfully comply with this guarantee of confidentiality. Any person who receives a whistleblowing alert must promptly report it to the Compliance Officer so that he/she can take appropriate measures to ensure confidentiality. Anonymity You may file an anonymous complaint. However, any anonymous report that does not present serious facts and/or lacks sufficient detail will not be considered and will be immediately rejected. If the facts are sufficiently serious and detailed, the reported alert will be reviewed, but your investigation will be longer and less effective, as the interaction between you and the Compliance Officer in charge of handling it is more complex. Using the reporting tool in good faith, even if the facts turn out to be inaccurate or do not result in any action, will not expose you to any disciplinary action or unwarranted negative consequences. Conversely, if the reporting tool is not used correctly and the facts reported are deliberately false or in bad faith, this could result in legal action if necessary. Due process The investigation and application of sanctions must be conducted in accordance with the concepts of due process and applicable law, including impartiality, objectivity and independence. All parties involved in the investigation must have the opportunity to be heard and to provide relevant information. Prohibition of retaliation LAR Residential will not tolerate any form of retaliation against you for making a good faith report under this whistleblower procedure. Allegations of retaliation against you for making a report will be treated seriously and resolved as soon as possible. 3. TYPES OF AUTHORIZED REPORTS What to report You can report facts that you know yourself or that you have witnessed: • Conflicts of interest; • Corruption or bribery of public or private sector officials; • Any type of theft or fraud, including, but not limited to, theft of money, fraudulent accounting in financial statements, unauthorized use of company property or services; • Influence peddling; • Activities that violate competition laws, including price fixing; • Discrimination or harassment; • Money laundering or financing of terrorism; • Serious and clear violation of an international commitment ratified by France or Brazil, including acts binding on International Organizations;
• Threat or serious harm to the public interest; • Any other criminal offense, violation of VILLAZUL Code of Conduct, policy or legislation, or serious violation of applicable law. What to avoid reporting You should not report any situation related to the following topics through the reporting mechanism: • Confidential medical or legal information protected by professional secrecy or other regulations; or • Matters related to national security. You should also avoid reports that involve: • A value judgment or biased commentary on the behavior of another person; • Facts of which you have no personal knowledge. Answering your questions about whether to file a complaint
The Compliance Team is at your disposal for any questions on whether this whistleblowing procedure applies to the facts of your case.
4. PROCEDURE TO COMMUNICATE A COMPLAINT A RESPONSIBLE COMPLIANCE OFFICER DESIGNATED BY THE COMPANY
You can report your report through emeis-mexico.signalement.net/entreprises and rest assured that only the Local Compliance Team and the Corporate Compliance Officer are the sole recipients of the information you provide, insofar as this data is necessary for the fulfillment of their mission. The Local Compliance Team is responsible for the whistle-blowing procedure and the records relating to whistle-blowing.
5. HOW IS THE COMPLAINT PROCEDURE INITIATED? You should file your complaint at https://emeis-mexico.signalement.net. You can also report it to your line manager, the Human Resources Department or the Compliance Team. When filing your complaint, you must include: • Facts that you know personally or have observed in as much detail as possible; • Place and time of the events; • Identity and role of all persons who witnessed or are involved in the facts or conduct, including any person who appears to be involved in the wrongdoing; • Relevant documents, if any (file, photo or any other useful evidence) in support of your complaint. • If possible, your identity, functions and contact information (anonymous reporting is possible, but much more difficult to investigate). If you choose to report anonymously, a contact email will be helpful in case more information is needed.
Once you submit your report, you will receive a voucher with a unique identification number to interact with the Compliance Team that received your report. You can use this code to submit more information and check the status of your report at any time. If you are submitting an anonymous report, it is important that you return to the website to check if you have been asked for additional information.
6. CLAIMS INVESTIGATION PROCESS If you use the website https://emeis-mexico.signalement.net, your report will only be received by the Local Compliance Team and the Corporate Compliance Officer. If you use another method, the person receiving it must deliver it to the Compliance Team, who will post it on the platform, if it is not already there. Preliminary verification and evaluation The Compliance Team will conduct a preliminary assessment to determine whether your report should be considered under this Whistleblowing Procedure. i. Depending on the nature of the complaint and the issue, the Compliance team may request additional information from you or others. ii. If it is evident that the reported complaint falls outside the scope of this Procedure, the complaint will be destroyed immediately, and the Compliance Team will keep you informed. iii. If the complaint is admissible, the Compliance Team will inform you that the complaint will be investigated. iv. This process to determine the admissibility of your complaint must be concluded within two months. v. National laws, collective bargaining agreements or other mandatory laws or regulations may require that certain complaints be handled under a different procedure. If this is the case with your complaint, you will be notified and informed of the process that will apply. Research: vi. When the complaint received is credible and within the scope of use of the platform, the internal investigation process will take place: vii. The Compliance Team will conduct an investigation on its own or, if necessary, with a small internal team consisting of Group employees with the necessary experience and expertise to conduct the investigation properly. All members of the internal team will be bound by a duty of confidentiality and privacy. viii. When necessary and taking into account the seriousness of the reported facts, the investigation may be conducted by professionals outside LAR, such as specialists in investigations, auditing or forensic accounting, in order to achieve greater objectivity and impartiality. In this case, these third parties will be contractually obliged to maintain confidentiality and to respect the rules of data protection. The Compliance Team will take all appropriate precautions to transmit to third parties only the data necessary for them to fulfill their respective missions.
ix. During the investigation, all legally permissible means may be used to clarify the facts. This may include interviews and examination of any documentation deemed useful to the investigation. It may also include the testimony of the person filing the complaint and any person who has the complaint against him or her. It may also include the retrieval and analysis of information contained in electronic devices using software and hardware tools, always preserving the integrity of the evidence. The investigation will take care to protect the privacy, honor, private life and image of the persons involved. x. During this process, the Compliance Team will take the necessary steps to effectively conduct the investigation and ensure the prompt cessation of the improper activities. xi. The investigation and investigation report must be completed within two (2) months, unless there is a justifiable reason to extend the investigation process for a longer period of time. xii. Neither you nor others involved in the complaint will have access to the details of the investigation, as all information is subject to confidentiality, except as necessary to comply with the principles of due process and labor law. Conclusion: i. After analyzing the results of the internal investigation, the Compliance Team and, if applicable, the internal team, will decide whether a violation of policy or law has been proven and, if so, the person responsible. ii. If no violation of policy or law is demonstrated, the Compliance Team will order the case to be closed, leaving a written record of the reasons for this decision. iii. If a false or bad faith report is made, the Compliance Team will suggest to VILLAZUL management the appropriate disciplinary or other measures with respect to the person who has made such report in violation of this procedure. iv. If a violation of policy or law is demonstrated, the team must: a. Take appropriate and permissible disciplinary action. b. If the facts have a legal implication, the Legal Department should be consulted to determine the necessary measures, including informing the authorities as soon as possible about the facts, in order to demonstrate VILLAZUL commitment to cooperate with the authorities. c. You should be informed that the investigation has been closed and, to the extent possible, the results of the investigation. Not everything may be shared with you; for example, disciplinary actions taken against other employees or third parties are often kept confidential to comply with labor law and other requirements.
7. PROCEDURE FOR CLAIMING GRADUATES French legislation relating to the claims The French Sapin II law establishes a specific whistleblower procedure for employees who report wrongdoing. To benefit from the protection of the law, you will have to comply with the whistleblowing procedure in three degrees: i. First, you must submit the complaint to the compliance officer(s) designated by the company. Once your complaint has been received, the compliance officer(s) must verify its admissibility within two months. If you do not receive confirmation that the report is admissible, you can proceed to the second step. If you have decided to report anonymously, it is up to you to return to the reporting platform with your unique identification number to follow up on the processing of your report. If the Compliance Officer notifies you that your report is admissible, but does not inform you of the measures implemented, this does not mean that you can proceed to the second step. The confidentiality of the measures implemented is guaranteed, as are the contents of the complaint and the information provided. ii. You can file your complaint with the courts, the public prosecutor's office or an administrative agency. These authorities have three months to respond to your complaint. If you do not receive a response, you can move on to the third phase. iii. You can make your complaint public. However, in case of imminent and serious danger or if there is a risk of irreversible damage, your complaint may be transmitted directly to the agencies mentioned in the second step above or made public. Saying or stating in bad faith with the intent to cause harm or knowing that the facts made public or disclosed are partially inaccurate (that they are facts relating to a conflict of interest situation or about any fact likely to give rise to disciplinary action) may subject you to criminal and disciplinary action. In France, you cannot benefit from the protection granted to whistleblowers if you do not comply with the graduated procedure described above and if the disclosure of information was neither necessary nor proportionate to safeguard the interests involved. The French Sapin II law allows you to send your complaint to the French Ombudsman, who can forward it to the body competent to receive it. This procedure is different from the one described above and does not fall within the scope of the gradual complaint procedure described above. Mexico whistle-blowing legislation National laws may protect persons filing complaints under this Complaint Procedure under constitutional, labor, civil and administrative laws. Generally, these national laws do not require or permit a tiered complaint procedure for obtaining protection or exercising the right to file complaints with the appropriate authorities.
8. TREATMENT AND PRESERVATION OF DATES Date processing The Emeis Group is responsible for the processing of personal data provided on the alert platform https://emeis-mexico.signalement.net, as well as other complaints and inquiries and those collected subsequently as part of this complaint procedure. The processing of personal data is for the sole purpose of processing your complaint. The processing of personal data may vary from country to country, but will be in accordance with national legislation. The person filing the complaint will be informed as soon as possible of the processing of his or her data. However, he/she will only be informed of the processing of his/her data once precautionary measures have been taken in case of risk of destruction of evidence, to ensure the success of the internal investigation and to avoid any negative consequences for VILLAZUL Group or its employees and customers. Both you and any person included in the complaint and investigation always have the right to request access, rectification or suspension of the processing of your personal data, as well as to object to the processing as established in the national legislation and the company's policy. To exercise this right, requests should be addressed to your company's data protection officer and/or to Marcia Salgado, data protection officer for Latin America, e-mail: dpolatam@bslsaude.com.br or to Juliette Aubert, responsável pela proteção de dados da Orpea, dpo@emeis.net. All requests must be signed, include a copy of a legally accepted means of identification and provide a postal or e-mail address to receive a response. Retention Data relating to any complaint received that does not fall within the scope of the procedure shall be destroyed immediately after anonymization. Data relating to a complaint shall be anonymized within two months of the end of the investigation process if the complaint is not followed by legal proceedings or disciplinary measures or other action plans. The data relating to a complaint shall be kept until the final closure of the procedure, in the event that disciplinary or judicial proceedings are initiated against the person against whom the complaint was made or against the author of an abusive complaint. In the event that the alert relates to a violation of applicable law or is to be retained by a relevant authority, such as the labor authority, the alert and related personal data may be retained for five (5) years from the date of the alert.
9. CLARIFICATIONS OR QUESTIONS Any clarification or questions regarding this procedure may be addressed to the Compliance Team, the Emeis Compliance Director or the Emeis Group Head of Risk, Compliance and Internal Control.
10. ORPEA GROUP COMPLAINT PROCEDURE This procedure complements the Whistleblowing Procedure of the BSL Group, a member company of the Emeis Group, which has governed the whistleblowing process in Latin America until the publication of this procedure.
