The data provided by the person initiating the procedure, as well as those collected throughout its instruction, will be processed by STEN, with the exclusive purpose of fulfilling the objectives of the Ethics Channel, for cases of communication of situations or behaviors that may constitute a violation of the STEN Code of Ethics. The legal basis for the processing is the fulfillment of STEN\'s obligations to guarantee the protection of the fundamental rights of its workers. The data will be known by the Ethics and Compliance Committee, by the persons for whom knowledge is essential to investigate the reported facts and, where applicable and depending on the matter, when their knowledge is required by the competent authorities. In any case, the data will be treated with the utmost confidentiality and in accordance with current legislation on the protection of personal data. The accused will be informed as soon as possible of the reported facts and their rights regarding data protection, but the identity of the whistleblower will not be disclosed, unless expressly consented or acted in bad faith. The data will be kept during the instruction of the procedure, during the processing of any internal audit measures that may be necessary, and, at most, during the processing of judicial procedures that may arise from the investigation conducted (such as those arising from the disciplinary measures taken) and as long as possible responsibilities may arise. Once these are extinguished, the data will be deleted. The data owner can exercise their rights by addressing the President of the Ethics and Compliance Committee, by means of a written and signed request, attaching a copy of a document proving their identity. In particular, they can request access to their personal data, request the rectification of any inaccurate data, request the deletion of their personal data, request the limitation of processing, as well as request the portability of the data, always in the terms established by current legislation.

Furthermore: • When the legal basis for processing is your consent, you may exercise your right to revoke that consent at any time; • When the legal basis for processing is the legitimate interest of STEN, you may exercise your right to object to the processing of personal data. We also inform you that you have the right to lodge a complaint with the Spanish Data Protection Agency if you believe that an infringement of the legislation regarding the processing of your personal data has occurred.