What is it?
Law 2/2023 of 20 February on the protection of persons who report regulatory infringements and collaborate in the fight against corruption, provides a protection mechanism for persons who report facts or situations that could constitute breaches of European Union law, or that could constitute a serious or very serious criminal or administrative offence, by guaranteeing both the confidentiality and the anonymity of such persons.
Who is it intended for?
Persons working in the private or public sector who have obtained information about infringements of European Union law or which could constitute a serious or very serious criminal or administrative offence.
Public sector workers who have obtained information on infringements committed by the Regulatory Council of the Cava Protected Designation of Origin in an occupational or professional context.
This may also apply to those who publicly communicate or disclose information about infringements obtained within the framework of an employment relationship that has already ended, volunteers, trainees, workers in training periods, regardless of whether or not they receive remuneration, as well as those whose employment relationship has not yet begun, in cases where the information on infringements has been obtained in the course of the recruitment or negotiation process, or during the selection process or pre-contractual negotiation.
What situations can be reported?
The aforementioned Law 2/2023, of 20 February, protects persons who report on the following situations:
(a) Any actions or omissions that may constitute infringements of European Union Law, provided that:
(b) Actions or omissions that could constitute a criminal or serious or very serious administrative offence. In any event, all those serious or very serious criminal or administrative offences which involve financial loss for the Public Treasury and for the Social Security shall be understood to be included.
Guarantees for the informant
The informant shall be entitled at all times to confidentiality and anonymity, under the terms set out in the Law, even if the information is transmitted using channels other than those established, or to personnel other than those responsible for their management or processing, who must immediately inform the Data Controller. The identity of the informant, when he/she is not anonymous, may only be known in a strict and necessary manner by the personnel in charge of its processing.
The possibility of maintaining communication with the informant and, where appropriate, of requesting additional information from the informant, is established without prejudice to the informant's right to remain anonymous, and ensuring the confidentiality of the information at all times.
Pursuant to the provisions of Article 9.2 d) of the same Law, a maximum time limit of three months is established for responding to the investigative actions, counting from the receipt of the communication or, if no acknowledgement of receipt has been sent to the informant, three months from the expiry of the seven-day period after the communication was made, except in cases of particular complexity requiring an extension of the time limit, in which case this may be extended by a maximum of three additional months.
Internal reporting channel
Using the form below, you can send information about the committing of any of the offences referred to within the objective scope of the aforementioned Law 2/2023, of 20 February, as listed in the section "Which incidents can be reported?".
The communication must include clear and verifiable information which can be confirmed directly or by investigation. It should include specific details such as facts, dates, places, people and organisations involved, and provide, where available, documents to support the evidence, or at least the relevant indications. It is also recommended to mention persons who can assist in confirming the facts. Reports which are vague, general or lacking the necessary elements will not be considered for investigation.
*Obligatory fields
Information on personal data
With the use of this channel, the Regulatory Council of the Cava Protected Designation of Origin ensures compliance with the current regulations governing the processing of personal data, in accordance with the General Data Protection Regulation (EU) 2016/679 (RGPD) and the Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights, and Law 7/2021, of 26 May, on the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offences and the enforcement of criminal penalties, as well as with the provisions on this subject in Law 2/2023 of 20 February, regulating the protection of persons who report regulatory offences and the fight against corruption.
Data controller: Regulatory Council of the Cava Protected Designation of Origin.
CIF: Q-0871003-J.
Postal address: Av./ Tarragona, 24, 08720 Vilafranca del Penedés, Barcelona.
Telephone: (00 34) 93 890 31 04.
Email: consejo@cava.wine
Purpose of processing personal data: Personal data will be used solely for complaints received within the framework of Law 2/2023, of 20 February, which establishes the protection of those who report infringements of the law and collaborate in the fight against corruption.
Storing of personal data: The data will be stored only for the length of time needed to assess whether it is appropriate to initiate an investigation into the facts reported. In the event that the information provided is found to be incorrect, it will be deleted immediately, except in the case of a possible criminal offence, in which case it will be retained for the duration of the legal proceedings.
Legal basis for processing personal data: The processing of the data is justified in order to comply with a legal obligation under Law 2/2023 of 20 February on the protection of whistleblowers and the fight against corruption.
Use of personal data: The transfer of data to other entities or countries is not anticipated.
Confidentiality of whistleblowers: In accordance with Article 31 of Law 2/2023, the identity of persons making a public report or disclosure about regulatory breaches and the fight against corruption shall be kept strictly confidential and shall not be disclosed to the persons involved or to third parties.
You may exercise rights of access, rectification and deletion of your personal data, limitation and opposition to the processing of your data, and the right not to be subject to automated decisions, as well as making appropriate claims, at the following email address: consejo@cava.wine.
External reporting channels
In accordance with the provisions of article 16 of Law 2/2023 of 20 February, any person may report to the Independent Authority for the Protection of the Informant, A.A.I., or to the corresponding regional authorities or bodies, the commission of any actions or omissions included in the scope of application of this law, either directly or following communication through the corresponding internal channel, under the terms established in the aforementioned Law.