Whitlesblowing Policy

I. GENERAL
Introduction

At Sociedade Turística Vasco da Gama, SA (hereinafter, HOTEL VASCO DA GAMA ), we strive to be transparent and to have a high level of business ethics. Our whistleblower channel offers a possibility to alert the company about suspected misconduct, being an important tool to reduce risks and maintain confidence in our operations, allowing us to detect and act on possible misconduct at an early stage. The existence and implementation of this channel has, above all, the function of protecting those who denounce or publicly disclose violations of Union law, ensuring, from the outset, all conditions of secrecy, confidentiality and security to the whistleblower/whistleblower.

Thus, we encourage potential whistleblowers who are aware of potential violations or concrete violations, to manifest themselves through the available channel, as established in this Policy.

Definitions
In this Policy, unless the context or legislation clearly leads to a different meaning, these terms and expressions shall have the following meaning:

a. “Violations”: acts or omissions of an unlawful nature or that contravene the objective and/or purpose of European Union rules, in the matters indicated in heading “III. WHAT IRREGULARITIES ARE COVERED?”

b. “Internal whistleblower”: the verbal or written communication of information about violations within a legal entity in the private or public sector;

c. “External whistleblower”: the verbal or written communication of information about violations to the competent authorities;

d. “Public disclosure”: making information about violations available in the public sphere;

e. “Whistleblower”: a natural person who communicates or publicly discloses information about violations, obtained in the course of their professional activities;

f. “Targeted person”: a natural or legal person referred to in the complaint or public disclosure as the author of the violation or associated with it;

g. “Retaliation”: any act or omission, direct or indirect, that occurs in a professional context, motivated by an internal or external complaint, or by public disclosure, and that causes or may cause unjustified harm to the complainant;

h. “Competent Authority”: any national authority designated to receive reports and provide feedback to whistleblowers.

i. “Document”: a statement made in writing, or recorded on disk, recorded tape or any other technical means, intelligible to the general public or to a certain circle of people, which, allowing the issuer to be recognized, is suitable to prove a legal fact relevant, whether such destination is given to it at the time of issuance or subsequently; and also, the sign materially made, given or placed on a thing or animal to prove a legally relevant fact and that allows the recognition of the generality of people or a certain circle of people their destiny and the evidence that results from it.

II. WHO CAN BE THE WHISTLEBLOWER/WHISTLEBLOWER?

A whistleblower is a natural person who denounces an infringement based on information obtained in the context of his professional activity, which, in good faith, he considers to be true at the time of the whistleblowing. Whistleblowers may, in particular, be:
• Workers;
• Shareholders and persons belonging to administrative, management or supervisory bodies of companies, including non-executive members;
• Volunteers;
• Paid or unpaid interns;
• Service providers, contractors, subcontractors and suppliers, as well as persons acting under their supervision and direction;
• Candidates;

Whistleblowing status also applies: • When information about violations obtained in a professional relationship, such as those described above, which has ended (eg a former employee) is reported;
• When the professional relationship has not started, in cases where the complainant has obtained information about the complaint at a stage of pre-contractual negotiation.

III. WHAT IRREGULARITIES ARE COVERED?
a) The act or omission contrary to the rules of the European Union, referring to the areas of:
• Public contracting;
• Financial services, products and markets and prevention of money laundering and terrorist financing;
• Product safety and compliance;
• Transport security;
• Environmental protection;
• Radiation protection and nuclear safety;
• Safety of food for human and animal consumption, animal health and animal welfare;
• Public health;
• Consumer defense;
• Protection of privacy and personal data and security of the network and information systems;

b) The act or omission contrary and harmful to the financial interests of the European Union;
c) The act or omission contrary to internal market rules, including competition and state aid rules, as well as corporate tax rules;
d) Violent crime, especially violent and highly organized crime, as well as the crimes provided for in paragraph 1 of article 1 of Law no. economic-financial;
e) The act or omission that contradicts the purpose of the rules or norms covered by sub-paragraphs a) to c).

Subjects not covered
Work-related personal claims, namely, interpersonal conflicts between workers and/or their superiors or the decisions of the employer relating to the worker in question are not eligible for protection under this Policy or the Whistleblowing legislation and therefore , should not be made through the reporting channels described here.

For this type of complaint, we recommend that you contact:
Vera Grape | 912739947 | verauva@vascodagamahotel.com
Martha Grape | 914790341 | marta.uva@vascodagamahotel.com

When it is verified that the content of the complaint does not fall within the scope of application of this Policy, it will be filed, and the complainant will be notified that the case has been shelved, forwarding the communication made to anyone who, within HOTEL VASCO DA GAMA , has responsibility for dealing with the matters in question.

IV. SHOULD I FILE AN INTERNAL OR EXTERNAL COMPLAINT?
We are committed to following up on all internal complaints that are presented to us, aiming to effectively resolve violations internally, whenever possible. For this reason, we encourage you, before making an external complaint to the competent authorities, to submit your complaint to us through the internal channels for this purpose.

You may use external reporting channels when: • You have reasonable grounds to believe that the breach cannot be effectively known or resolved internally, or that there is a risk of retaliation;
• Has filed an internal complaint without having been informed of the measures planned or adopted following the complaint, within the deadlines provided for that purpose;
• The offense constitutes a crime or misdemeanor punishable by a fine of more than €50,000.

External complaints may be submitted to the authorities that, according to their powers and competences, should or may be aware of the subject of the complaint, including:
• The Public Ministry;
• Criminal police bodies;
• The Bank of Portugal;
• Independent administrative authorities;
• Public institutes;
• General inspections and similar entities and other central services of the direct administration of the State endowed with administrative autonomy;
• Local authorities;
• Public associations.

You may also resort to public disclosure of the infraction , in the following circumstances:
• When it considers that the infringement may constitute an imminent or manifest danger to the public interest, which cannot be effectively known or resolved by the competent authorities, taking into account the specific circumstances of the case, or that there is a risk of retaliation even in the case of an external complaint ;
• Has filed an internal complaint and an external complaint, or directly an external complaint, without adequate measures having been taken within the legal deadlines.

V. WHAT PROTECTION DO I HAVE AS A Whistleblower?

The whistleblower who has acted in good faith , having serious grounds to believe that the information is true, at the time of the complaint, benefits from the protection provided by the Directive and by the Whistleblower Protection Act.

As for protective measures :

• Guarantee of confidentiality of the whistleblower's identity;

• Prohibition of practicing acts of retaliation against the whistleblower , with threats and/or attempts being equally considered acts of retaliation;

• Right to legal protection under general terms;

• Benefit from measures for the protection of witnesses in criminal proceedings, namely those contained in Law no. 93/99, of 14 July;

• In the event of an act of retaliation, the whistleblower can be compensated for the damage caused to him/her by that same act and can request appropriate measures in order to avoid the verification or expansion of the damages;

• Possibility of exemption from disciplinary, civil, administrative or criminal liability of the whistleblower in relation to the denunciation or public disclosure of an infraction made in accordance with the procedures of this policy and Law No. 93/2021, of 20 December, either as to the denounced facts, or as to the means of gathering evidence thereof.

This protection granted to the whistleblower is extendable , with the necessary adaptations, to:

• Person who assists the whistleblower in the whistleblowing procedure, and whose assistance must be confidential;
• A third party who is connected to the whistleblower (such as a co-worker or family member), and may be retaliated against in a professional context;
• Legal persons or similar entities, owned or controlled by the whistleblower, for which the whistleblower works or is somehow connected in a professional context.

Article 21(6) of the Whistleblower Protection Act indicates which acts are presumed to be motivated by internal whistleblowing, consisting of acts of retaliation – until proven otherwise.

VI. WHAT PROTECTION DO I HAVE WHILE REPORTING?
The accused also has the right to protection, under the terms of the applicable legislation, being recognised:

• All procedural rights and guarantees, namely, the presumption of innocence and the guarantees of defense of criminal proceedings;

• In the event that the complaint is false or misleading , and without prejudice to the complainant's possible criminal and administrative offences, the complainant may benefit from compensation for the damages resulting therefrom, with the natural person who assists the complainant in the complaint procedure being jointly liable and whose assistance must be confidential, including union representatives or workers' representatives.

• Confidentiality guarantees applicable to your identity.

VII. CONFIDENTIALITY

The identity of the whistleblower, as well as the information that, directly or indirectly, makes it possible to deduce his identity, are confidential and access is restricted to the people who are part of the team responsible for managing whistleblowers. This protection also applies to any other information that makes it possible to directly or indirectly deduce the identity of the whistleblower.

The same principle on the confidentiality of the whistleblower's identity also applies to the identity of the accused.

VIII. HOW CAN I FILE AN INTERNAL COMPLAINT?
1. When can I file a complaint?

When you have reasonable grounds to believe that the facts to be reported are true, taking into account the circumstances and information available to you at the time, and those are covered by the scope of application of this Policy. Only when these assumptions have been met will you be able to benefit from the protection granted to the whistleblower.

If a whistleblower makes a report in bad faith, in a frivolous or abusive manner, or if he deliberately communicates information that he knows is wrong or misleading, he will not benefit from the legal protection afforded to whistleblowers.

If an employee of the employer promotes a complaint that is determined to be libelous, in bad faith and intentional, in the terms described above, he may be subject to disciplinary liability.

2. How can I file a complaint?

HOTEL VASCO DA GAMA has the following reporting channel:
Complaint online using the form provided.

Procedure: 1. Access the form through the link above;
2. Fill in the complaint form with identification of the complainant (Name, Surname and Email) or anonymously (just leave the identification fields blank);
3. Add documents as evidence, if necessary and if possible;
4. Taking into account the contact provided by the complainant in the form - email -, within a maximum period of 7 days from the receipt of the complaint, a response will be sent to the contact indicated by the complainant, with identification of the process number so that it is possible for the Complaint Handling Team to track the entire process and for the whistleblower to obtain information about it.
In the same contact, after receiving the complaint, we will also provide information to the complainant about the method and requirements for submitting complaints to the competent authorities.
5. In a period of 7 days, the preliminary analysis of the complaint is carried out and one of the following situations may occur:
- Filing and forwarding of complaints not covered by the Policy, complaints made in bad faith and others that justify it;
- Investigation opening.
6. If there is a framework for investigation, the investigation of the complaint begins, and it is necessary to verify the allegations contained in the complaint, for which it will be necessary to collect evidence.
7. At the end of the investigation and collection of evidence/evidence that corroborate the complaint, the last phase of the process, the Conclusion, takes place.
At this stage, depending on the outcome of the investigation and establishment of conclusions, the complaint can be filed, or else proceed with the adoption of corrective measures identified and necessary for the cessation of the infraction or regularization of the situation, or even proceed to the communication of irregularities to the competent authorities. .
8. Communication to the whistleblower must be made, within a maximum period of three (3) months, about the measures planned or adopted to follow up on the complaint and the respective grounds, which will be sent to the email address indicated in the complaint form.
9. Information containing personal data is confidential and may only be provided to the respective representative, provided that it is legally proven (eg authenticated power of attorney of the person). Without this confirmation, the request cannot be processed;
10. All communication will take place via email (if you have indicated).

About the whistleblower channel:

The online whistleblower channel is managed solely by HOTEL VASCO DA GAMA , and its management, monitoring and investigation of complaints is carried out solely by HOTEL VASCO DA GAMA , specifically, by the following elements:

• Assistant Director;
• Marketing Manager;
• Responsible for Food Quality Control and Safety at Work.

When the report is anonymous, those responsible for managing the reporting channel will not attempt to identify the reporting person.

We warn that the denunciation of irregularities can only be carried out through this channel.

Any employee of HOTEL VASCO DA GAMA who receives a complaint by means other than the identified channel, must refer the complainant to the same, in order to centralize all occurrences in it, and to facilitate the flow of information, as well as the subsequent investigation.

3. Can I file an anonymous report?

Yes. The implemented reporting channel allows you to make an anonymous report by filling in the report form without your identification. You will also enjoy the protection given to you as a whistleblower, if you are later identified.

4. What should the complaint contain?

The complaint must contain as much information as is available to the complainant and that he/she deems necessary for further investigation.

The following information is considered relevant, by way of example: • Date, time and place of the events and/or violation;
• Identification of the people involved (name, function, company...);
• Nature of the complaint (description of the facts);
• How the complainant became aware of the facts;
• Indication of possible witnesses.

Only information relevant to the treatment of the complaint should be included in the complaint. Personal data that are clearly not relevant for the treatment and analysis of the complaint will not be kept, being eliminated by the team responsible for the management of complaints.

5. How can evidence be obtained?
All documents containing information on the reported offenses and to which the whistleblower has legally accessed or obtained, namely in the exercise of their duties, are admissible.

The whistleblower may reveal, reproduce or remove the documents from the premises of the organization where he works, even if in violation of contractual clauses, policies, regulations or others that apply to him and that stipulate that the documents are the property of the organization.
The whistleblower may also reveal, reproduce or withdraw documents from the organization to which he does not have direct and immediate access and provided that it does not imply improper access or illegitimate interception of the same.

Obtaining information or documents relevant to the proof of the complaint presented, through conduct that may constitute the practice of a crime does not remove the criminal responsibility of the complainant.

IX. COMPLAINT PROCESSING

1) Complaint

a. Reception of the complaint through the implemented internal channel.

2) Preliminary analysis

a. Acknowledge receipt of the complaint to the complainant within 7 days from the receipt of the complaint;
b. Preliminary analysis of complaints;
c. Screening and categorization of complaints by the nature of the irregularity;
d. One of the following situations may occur:
i. Filing and forwarding of complaints not covered by this Policy, complaints made in bad faith and others that justify it;
ii. Investigation opening.

3) Investigation

a. Investigation of the complaint;
b. Practice of internal acts necessary to verify the allegations contained in the complaint;
c. Collection of evidence (eg interviews with witnesses named by the whistleblower).

4) Conclusion a. The final outcome of the investigation will condition the following steps, which may include:
i. archiving;
ii. Adoption of the corrective measures identified and necessary for the cessation of the infraction or regularization of the situation, or
iii.Communication of irregularities to the competent authorities;
iv. Communication to the complainant, within a maximum period of three (3) months, about the measures planned or adopted to follow up on the complaint and the respective grounds.

1. Who is responsible for receiving and investigating reports?

Complaints are handled by the team responsible for handling and managing complaints , made up of the elements mentioned in point VIII 2.

The team receives all complaints, carrying out a preliminary analysis so that, if necessary, and with a view to safeguarding any conflicts of interest that may exist, forward their follow-up to the team member or members who ensure greater impartiality.

The people who are part of the team responsible for handling and managing complaints are subject to a special duty of confidentiality.

Access to complaints made is restricted to the team responsible for handling and managing complaints. When necessary, people who add specialized knowledge may have access, and in this way they may be included in the investigation process. These people can access relevant information, duly anonymized, excluding data relating to the identity of the whistleblower and other stakeholders, and are also bound by the duty of confidentiality. If, from the information intended to be transmitted to these people, it is possible to determine the identity of the whistleblower, they will not be communicated.

2. Return of information to the whistleblower.

• Within seven (7) days from the receipt of the complaint, HOTEL VASCO DA GAMA will acknowledge receipt of the same by email, informing you, in a clear and accessible way, of the requirements, of the competent authorities, of the form and admissibility of the external complaint;

• Within a maximum period of three (3) months from the date of receipt of the complaint, HOTEL VASCO DA GAMA will inform you of the measures planned or adopted to follow up on the complaint and the respective grounds.

• The complainant may request, at any time, that the obliged entities communicate the result of the analysis carried out on the complaint within fifteen (15) days after the respective conclusion.

3. How is the investigation done?

All complaints will be carefully analyzed to determine whether they fall within the scope of this Policy and whether an investigation is necessary, determining whether there is sufficient evidence to support the reported facts. If applicable, HOTEL VASCO DA GAMA will take the necessary actions to put an end to the reported violation.

The management of each complaint will be carried out by the team responsible for handling and managing complaints.

Whenever it is necessary to hear witnesses , indicated by the complainant or that HOTEL VASCO DA GAMA deems relevant for the investigation, a minute of the witness' statements will be drawn up. After the meeting with the same, the minutes will be made available to you for validation by sending an email to that effect, and, after being validated by the witness's response email, the final document will be filed, together with the witness validation email, in the respective complaint process.

The identity of the whistleblower will not be disclosed by HOTEL VASCO DA GAMA to any witnesses, unless the whistleblower has given his prior explicit consent to do so.

4. In what situations can the whistleblower's identity be disclosed? And to whom?

The identity of the whistleblower is only disclosed by HOTEL VASCO DA GAMA if one of the following circumstances occurs:

• Legal obligation;
• Judicial decision.

Without prejudice, whenever this occurs, HOTEL VASCO DA GAMA will previously inform the complainant, indicating the reasons for disclosing the confidential data in question, unless the provision of this information compromises the investigations or related legal proceedings.

X. CONSERVATION OF RECORDS

HOTEL VASCO DA GAMA will keep the complaints for the legal period of five (5) years , defined by Law No. or administrative matters relating to the complaint. After this period, the records will be permanently deleted / anonymized.

XI. PERSONAL DATA

HOTEL VASCO DA GAMA is responsible for the processing of personal data.

All personal data processed under this Policy will be treated with respect for the confidentiality guarantees provided for in the legislation applicable to Whistleblowing and the protection of personal data.
Only personal data considered necessary for the analysis and follow-up of complaints will be processed, so excessive data will be eliminated.
The basis for the processing of your data is based on compliance with legal obligations.
The data collected will be kept for the same period of conservation of complaints - five (5) years -, after which it may be deleted or anonymized.
The personal data of the different parties involved in a whistleblowing process will be stored confidentially and securely, with access limited to the team responsible for managing the whistleblowers. Without prejudice, said data may be communicated to the competent authorities for the purpose of investigating complaints. In addition to this communication, personal data may also be disclosed to other entities, when there is a legal obligation to do so or by judicial decision.

HOTEL VASCO DA GAMA has implemented all the technical and organizational security measures considered appropriate for the conservation of your personal data.

You can exercise your rights under the legislation (access, rectification, erasure, limitation, opposition, portability) through written contact to the following email:
protecaodedados@vascodagamahotel.com, without prejudice to the right to file a complaint with the competent control authority (www.cnpd.pt). However, we warn that the exercise of these rights may be limited based on the protection of stakeholders and the prevention, investigation, detection or prosecution of criminal offences.

For further questions regarding the processing of data in this context, you can contact HOTEL VASCO DA GAMA through the email protecaodedados@vascodagamahotel.com.

CLARIFICATIONS ABOUT THIS POLICY
For additional information about this policy or other clarifications, you may contact:
Vera Grape | 912739947 | verauva@vascodagamahotel.com
Martha Grape | 914790341 | marta.uva@vascodagamahotel.com

Without prejudice, if you need legal advice regarding your obligations and/or rights, you should contact a lawyer for this purpose.

XII. POLICY APPROVAL AND CONTROL
Approved on 07/26/2022 by:
• Vera Uva
• Marta Grape
• Carlos Viegas

Version: 1.0
Date: 07/26/2022
Description: N/A
Author: Hotel Vasco da Gama
Approved by: Vera Uva, Marta Uva and Carlos Viegas