Spain Annex to G2's Whistleblowing Policy

Purpose and scope. Nubera Internet S.L. (Nubera) provides an Internal Information System (the “Internal Information System”) that enables any person covered by Spain's Law 2/2023 to report, in good faith, information about (i) breaches of EU law falling within the law's scope and (ii) serious or very serious criminal or administrative offenses under Spanish law. Nubera protects reporters from retaliation and preserves confidentiality. The Internal Information System is overseen by the designated Responsible Person (Responsable del Sistema) in accordance with Law 2/2023.

Who can report. Employees (including former employees), job applicants, contractors, suppliers, shareholders, members of administrative or supervisory bodies, trainees, volunteers, and persons assisting the reporter are covered by the protections of Law 2/2023.

Channels available.

• • Internal channel: Reports may be submitted in writing through the EasyLlama reporting portal or verbally (including by telephone or voice messaging). On request, Nubera will arrange an in‑person meeting within a reasonable period. Reports may be submitted confidentially and, if preferred, anonymously. Reports can be made in Spanish or English.
  • External channels: Individuals may also report externally to Spain's Independent Whistleblower Authority (AIPI) here, at any time, without prior internal reporting, or to their relevant regional whistleblowing authority, including the Anti-Fraud Office of Catalonia (here).

Acknowledgment, timeline, and communications. Nubera will acknowledge receipt within seven (7) calendar days of a report (unless the reporter opts out or acknowledgment risks confidentiality). Nubera will assess reports and determine appropriate follow-up, including investigation where applicable, and provide feedback within three (3) months from acknowledgment (extendable by up to three (3) additional months in complex cases). Two-way communication with reporters will be maintained, including with anonymous reporters through the EasyLlama portal. The investigation of the file is managed by an Associate General Counsel that, as indicated in the section below, has been appointed as the Person in Charge. Employment services will participate on a need-to-know basis where employment or disciplinary issues arise. In any event, the final decision on the whistleblowing file is adopted by the Person in Charge.

Person in charge of the Whistleblower System. The sole director (administrador único) of Nubera has designated a Senior Corporate Counsel of G2.com, parent company of its corporate group, as the person in charge of the Internal Information System (Person in Charge).

In all the matters related to the application of the provisions governing the Internal Information System, the Person in Charge will carry out its functions independently and autonomously from the Nubera bodies, may not receive instructions of any kind, and must have all the personal and material resources necessary to carry them out. As part of its responsibilities, the Person in Charge of the Internal Information System shall keep a register of the information received (see below) and the investigation files to which they give rise, always guaranteeing the confidentiality of the information.

Confidentiality and anonymity. The identities of reporters and persons named in reports are confidential and will not be disclosed except to competent judicial or prosecutorial authorities where required by law. Anonymous reports are admitted and processed.

Fair process and potential crimes. Nubera will respect fair process for persons concerned and, where facts may indicate a criminal offense, will inform the Public Prosecutor where required by applicable law.

Anti‑retaliation. Any act or omission constituting retaliation against a reporter or assisting person is prohibited and void for a period of two (2) years following the conclusion of the procedure (which may be extended by the competent authority). Prohibited retaliation includes dismissal, demotion, blacklisting, reputational harm, and denial of training, unless objectively justified and unrelated to the report.

Support and Protection Measures under Law 2/2023. Individuals who report breaches within the scope of this policy in accordance with the applicable procedures may access the support measures provided by public authorities under Law 2/2023, including: (i) free, independent information and advice on available procedures, remedies, and protections; (ii) effective assistance from competent authorities in matters relating to protection against retaliation, including certification of eligibility for protection; (iii) legal assistance in criminal and cross-border civil proceedings in accordance with EU law; and (iv) in exceptional circumstances, financial and psychological support as determined by the AIPI.

In proceedings before a court or other authority concerning the harm suffered by an individual who has reported a breach, once the individual has reasonably demonstrated that they made a report or public disclosure in accordance with Law 2/2023 and that they suffered harm, it shall be presumed that such harm was suffered in retaliation for having reported or made a public disclosure. In such cases, the burden shall lie with the person who adopted the detrimental measure to prove that the measure was based on duly justified reasons unrelated to the report or public disclosure.

Register of communications. Nubera will keep a record of all communications and queries it may receive through the Internal Information System, complying at all times with the confidentiality requirements established, and for the time strictly necessary and proportionate to comply with legal and regulatory requirements.

Data protection. Nubera processes personal data in connection with the Internal Information System to comply with legal obligations and/or perform a task in the public interest under Law 2/2023 and the GDPR. EasyLlama acts as a data processor on Nubera's behalf for the operation of the reporting portal.

Access is strictly limited to designated roles, in accordance with Law 2/2023.

Information not admitted to investigation is deleted from the internal channel within three (3) months or anonymized to evidence system functioning. However, should it be necessary to process the personal data for a longer period in order to continue the investigation or, where appropriate, because it is considered necessary to initiate the appropriate legal action, the data shall be kept but separated from the rest of data collected by the Internal Information System, for as long as it is necessary for the completion of the investigation or for the adoption of the corresponding actions by Nubera. A separate confidential register/logbook of reports and investigations may be retained for up to ten (10) years, where necessary to comply with legal obligations.

In order to fulfil the purposes described above, the data controller may provide access to the personal data to: (i) any departments of its corporate group, relevant to the processing of the communication and, where appropriate, for the investigation and adoption of possible measures with respect to the reported conduct; and (ii) judges and courts, the public prosecutor's office, as well as Public Administrations when required as a result of the investigation that may be launched.

Data subject rights. Individuals whose personal data is processed in connection with the Internal Information System may exercise their rights of access, rectification, erasure, restriction of processing, and objection, in accordance with applicable data protection laws. These rights may be subject to limitations where necessary to preserve the confidentiality of the reporting process or to protect the rights of other individuals, including the identity of the reporter. Requests may be submitted through Nubera’s standard data protection contact channels as set out in its general privacy policy.

Contact and access. Access Nubera's Internal Information System through the EasyLlama portal linked on Nubera's website homepage (Canal Interno de Información / Whistleblowing Channel). To request an in‑person meeting, use the portal to submit a request or contact the Responsible Person via the instructions provided there.