ALSA's Code of Ethics and Best Practices

To ensure that work is performed ethically in all its divisions, the National Express Group has prepared a document that records the Group’s Anti-fraud Policy, which was created to define the responsibilities of managers and employees regarding the prevention of fraud and the development of controls for the detection thereof. Actions such as the theft of a company’s property, forgery or the alteration of corporate documents, the unauthorised disclosure of confidential information, etc., must be identified and reported using the defined channels.

The information provided for you below presents both the Anti-fraud Policy of the National Express Group and ALSA’s Code of Ethics and Best Practices, which has been prepared to adapt the anti-fraud policy of the National Express Group to the uses and customs of the Spanish market and to legislation in force, thereby endeavouring to ensure honesty and transparency in the actions of everyone who may have a business relationship not only with the National Express Group, including employees, shareholders, consultants, sales persons, contractors, etc., but in particular with the ALSA Division. Our company is one that provides a public service, wherefore we are even more obligated to maintain a good image and reputation with respect to customers, shareholders and public administrations.

As workers of ALSA, we have the duty to act with integrity and responsibly in the entire company, the duty to be the example of ethical behaviour and the duty to continue promoting the Group's Values.

At ALSA Management, we are committed to combating fraud, not only to create a climate of transparency in management, but also to protect the Group's assets and avoid financial losses.

Kind regards,

Francisco Iglesias Campos

Chief Executive Officer of ALSA

1. INTRODUCTION

This Code constitutes the basis of our Ethics and Best Practices Programme. It has been designed to help us maintain our commitment to integrity in our daily work. It orients us in key areas, thereby helping us to perform our activities according to the ethical rules of the NATIONAL EXPRESS Group (“NEG”) and according to applicable legislation.

The purpose of this Code of Ethics and Best Practices is to regulate the behaviours, actions or events that could constitute violations of both the company's internal standards and the ethical rules or codes that govern its business activity.

ALSA’s Code of Ethics records the action principles and guidelines of good corporate governance, the values of which guide the actions of all personnel of the ALSA Division.

The ALSA Division aspires to ensure that all its personnel act according to the highest standards of behaviour and professional ethics as they perform their activities and that they comply with regulations.

2. SCOPE OF APPLICATION

This Code of Ethics is applicable to all companies, executives and employees of the ALSA Division, regardless of the geographical scope where their business activity is developed.

The Code therefore affects all employees, executives and senior management of ALSA and of the entities where companies of ALSA hold full or shared control. Given that we tend to select suppliers and other partners who share our values, it is expected that they will also become familiarised with the principles herein established.

Limiting ourselves to complying with the Code isn’t enough. We must also remember our responsibilities to others and to our communities, customers, shareholders, suppliers and all other partners. It is the obligation and responsibility of all Employees to know the Code of Ethics.

3. VALIDITY

This Code of Ethics will enter into force on 1 December 2011.

4. CODE OF ETHICS COMPLIANCE COMMITTEE

The Code of Ethics Compliance Committee is created as the body in charge of promoting the dissemination of, knowledge of and compliance with the Code.

The Compliance Committee is formed by the Corporate Legal Advising Service, the Human Resources Horizontal Department and the Economic-Financial Horizontal Department, and it will report, organically and operationally, to the Chief Executive of ALSA.

The Director of the HR Horizontal Department will perform the management and control duties of the Compliance Committee.

The Compliance Committee will have the following functions and powers:

a) It will resolve all queries that could arise within the framework of interpreting and/or applying this Code.

b) It will prepare reports on the level of compliance with this Code, as well as on any detected breaches.

c) It will evaluate eventual breaches of this Code of Ethics.

5. ETHICAL PRINCIPLES AND ESSENTIAL VALUES

This Code of Ethics is built based on the following ETHICAL PRINCIPLES, which must be complied with when performing the duties of a job:

• Principle of legality

Complying with the rule of law is a principle mandate for ALSA in all countries where it is present. All workers must comply with the regulations of the legal system within which they work, in addition to the applicable internal policies of NEG and ALSA. A violation of the law must be avoided under any circumstance.

Regardless of the sanctions that could be imposed by law, any worker who is liable for a breach will be subject to disciplinary consequences as a result of violating their obligations as an employee.

It is therefore expected that, when dealing with customers, public administrations, suppliers and all other partners, we will act in ALSA's interest and in accordance with the applicable laws and regulations.

• Principle of integrity and professionalism

ALSA promotes integrity and professionalism as guiding elements in business relations at the company.

Professionalism in the performance of one’s job is understood as diligent, responsible and efficient action that is focused on excellence, quality and innovation.

Integrity in the performance of one’s job is understood as action that is loyal, in good faith, objective and aligned with the interests of the Group and/or of the ALSA Division.

ALSA’s reputation is determined, to a great extent, by our actions and by how each and every one of us acts and behaves. Illegal or inappropriate behaviour by just one of our workers can cause considerable harm to the Company. Every employee must be aware of the need to maintain and promote ALSA’s good reputation in the corresponding country.

ALSA’s workers have the obligation to make business decisions in ALSA’s interests and not based on their own personal interest. Conflicts of interest arise when personnel become involved in activities outside the scope of their competencies at the company or when they give preference to their own personal interest.

Workers must therefore inform their hierarchical superiors about any personal interest that could exist in relation to carrying out their professional obligations. Therefore, when entering into personal contracts or orders, they must not use companies with which they may have commercial dealings as a part of their activities at ALSA if any advantage for the personal contract or order could be derived from such dealings.

A business relationship with or an equity holding in a competitor or customer of ALSA, or participation in additional activities, could give rise to a conflict that prevents workers from complying with their responsibilities at ALSA. It is important that we all, in the performance of our professional activities, recognise and avoid conflicts of interest or even the appearance of a conflict of interest.

• Principle of objectivity, impartiality and transparency in the contracting of suppliers.

ALSA has adapted its supplier selection and contracting processes to the criteria of objectivity, impartiality and transparency. This principle will always be applied in all stages of negotiation or in the performance of commercial contracts.

Consequently, ALSA is bound to promote the presence of a number of suppliers of goods and services whose characteristics and offered conditions adapt, at all times, to the needs and conditions of the company established in the contracting specifications, therefore always valuing the most advantageous offer.

Once a supplier has been selected, ALSA's Legal Services will prepare or supervise the corresponding contract, which must necessarily include the good behaviour clause drafted by the SC of Legal Advising.

• Principle of respect and equal opportunities

ALSA believes that diversity strengthens the Organisation. We must all –not only the companies that belong to the Group but also all workers, customers and suppliers– contribute to creating an open and inclusive work environment, as well as ensure that both our work colleagues and people who apply for a job at ALSA have equal opportunities. Therefore, we must not discriminate against anyone because of their personal traits, such as the colour of their skin or their sex, race, religion, origin, political opinion, sexual orientation, social origin, age or any physical or intellectual disability, thus following the principles set forth in our Constitution and other parts of the legal system, as well as in Conventions of the International Labour Organisation, in particular the conventions pertaining to equal pay and non-discrimination.

• Protection of human and labour rights and the fight against modern slavery It is ALSA's desire to develop its business activity according to ethics and integrity, in any event ensuring full respect for the rights of its workers in accordance with applicable national and international regulations. ALSA states its commitment to and pledge to respect human and labour rights recognized in national and international legislation, particularly in the Conventions of the International Labour Organisation on Forced Labour (No. 29), concerning Freedom of Association and Protection of the Right to Organise (No. 87), concerning the Right to Organise and Collective Bargaining (No. 98), concerning Equal Remuneration (No. 100), concerning the Abolition of Forced Labour (No. 105), concerning Discrimination (No. 111), concerning Minimum Age (No. 138) and concerning the Worst Forms of Child Labour (No. 182).

Furthermore, our parent company, the National Express Group, insofar as it is a company of English law, is subject to compliance with the Modern Slavery Act, which has been in force in the United Kingdom since 2015. Its main objective is to fight against situations of slavery, human trafficking and forced labour. As a Division of the National Express Group, ALSA undertakes to apply the necessary measures for assuring compliance with the policy adopted by the group in this regard, for the purpose of avoiding, in the exercise of its business activities and throughout the entire supply chain, any type of behaviour that could be qualified as a form of modern slavery or human trafficking.

All personnel of ALSA must keep the Group's policy in mind when performing their activities and in any negotiation with contractors or suppliers, therefore ensuring that contractors and suppliers know and comply with the policy. Likewise, personnel must report any suspicious behaviour at the company that they may become aware of, therefore using the existing channels and specifically the HELP LINE, which is referenced in section 8 of this document.

• Principle of the duty of secrecy and confidentiality

ALSA is aware of the importance of complying with the duty of secrecy and confidentiality.

ALSA's employees therefore endorse, as one of their employment obligations, compliance with the duty to keep secret all data and information that they may become aware of as a consequence of exercising their job duties.

Consequently, all employees must use said data or information solely for performing their functions, and they may not provide such data or information to anyone other than those persons who need to know it for the same purpose and must abstain from using it to their own benefit or in benefit to third parties. This obligation of secrecy will continue even after the relationship with the company has ended.

• Principle of information security Information is an essential asset of ALSA, and it consequently requires adequate protection. ALSA acknowledges the importance of having duly identified and protected its information assets. It therefore prevents the unauthorised destruction, disclosure, modification or use thereof and undertakes to develop, implement, maintain and continuously improve all organisational information security policies, procedures, controls and structures that may be necessary for such purpose and that guarantee preservation of the confidentiality, integrity and availability of information, thereby ensuring that users have access only and exclusively to the information they need in order to perform their functions.

Therefore, all employees are responsible for preserving the confidentiality, integrity and availability of ALSA's information assets, wherefore they must comply with the policies and procedures that are comprised in the Information Security Management System.

Consequently, all employees must use said data or information solely for performing their functions, and they may not provide such data or information to anyone other than those persons who need to know it for the same purpose and must abstain from using it to their own benefit or in benefit to third parties. This obligation of secrecy will continue even after the relationship with the company has ended.

• Principle of environmental safety and protection

ALSA undertakes to reach the highest levels of occupational health and safety. ALSA applies the necessary programmes, training activities and internal controls for the continuous promotion of safe work practices. Through these practices, we endeavour to avoid any risk to our work colleagues, customers and communities. In this regard, we must become familiar and comply with all occupational health and safety procedures and policies that are implemented, particularly the Driving Out Harm Programme.

ALSA acknowledges to the global community that it is responsible for protecting the environment, and it therefore aspires to be an eco-efficient company. We must promote eco-efficiency in all our business activities and make every effort to reduce our global environmental and carbon footprint. We must also comply with all applicable laws and regulations regarding the environment wherever we may conduct our business activities, and we always attempt to exceed the requirements of such provisions wherever we are present.

The concept of transport from a holistic view and ongoing customer satisfaction are the core pillars according to which ALSA develops its business activity, based on the following VALUES: EXCELLENCE, SAFETY, CUSTOMERS, PEOPLE and COMMUNITY. These principles and values, which we must use as a guide, will be adopted by all of ALSA's business lines and will be appropriately transmitted by managers to all company personnel. Identifying with the new Vision and Values will serve as a guide in all our business lines, will facilitate decision-making and will strengthen our position as a leading operator in the transport market.

6. SITUATIONS THAT ARE CONTRARY TO THE CODE OF ETHICS AND BEST PRACTICES.

The Code covers possible ethical or legal dilemmas, but it cannot envision every possible situation that could arise. If we find ourselves facing a difficult situation, it is possible that the Code and the corresponding procedures and polices will be enough to guide us. However, in more complex situations, it may be necessary to seek additional guidance. We are each responsible for seeking the necessary advice.

Therefore, any action that is contrary to the provisions set forth in the following sections must be reported to the company as soon as possible through the channels referenced in section 8 of this document.

6.1 Security and legality in operations

Any action and/or omission that, in the performance of one's job, may be in detriment to the interests of NEG and/or of the ALSA Division will be considered actions that are contrary to security and legality in operations.

Personnel of the ALSA Division must always act in the interest of NEG, therefore making adequate use of the means placed at their disposal and avoiding actions that could be harmful.

Employees will protect and care for the assets of the company that they have available or to which they may have authorised access, which will be appropriately used for the purpose of performing the functions for which those assets have been delivered.

Employees are bound to comply with all regulations that may be applicable to fulfilling their occupational duties and obligations. In this regard, given that our main business activity is to provide public passenger transport services, full and strict compliance with laws that regulate road transport are especially important. Therefore, breaches of this Code will include but not be limited to the following:

- Manipulation of the tachograph or the elements thereof, of the speed limitation device or of means of control that must be installed in the vehicle when that manipulation is designed to alter the normal operation of such devices.

- Not having the tachograph, the speed limitation device or other instruments or means of control that must be installed in a vehicle.

- The falsification of record sheets, driver’s cards or other elements or means of control that must be carried in a vehicle, as well as falsification of the content thereof or alteration of the mandatory mentions of a record sheet or driver’s card.

- Not having the corresponding record sheet or driver's card inserted in a tachograph whenever it may be required, or having inserted a record sheet that does not have the name and surname of the driver recorded or having inserted record sheets or cards corresponding to another driver.

- Not having the record sheets of a tachograph, the driver’s card or the printed documents that must be carried in a vehicle. - The failure to make the manual annotations pertaining to a driver's activity that must be made by a driver whenever a tachograph may be broken.

- Using the same record sheet for several work days whenever this causes the superimposition of records that prevents those records from being read.

- Using, in the tachograph, more than one record sheet during the same work day by the same person, except when changing vehicles and the record sheet used in the tachograph of the first vehicle is officially approved for use in the tachograph of the second vehicle.

- Verbal or physical mistreatment of users by company personnel during passenger transport.

- The failure to notify the company of the loss of a driver's licence or any other necessary qualification for performing one’s professional duties.

- Showing up for work or performing one's job under the influence of alcohol or of narcotic drugs or psychotropic substances.

- Any negligent or intentional behaviour that may jeopardise the physical safety or integrity of oneself or other people (colleagues, passengers, pedestrians, other drivers or third parties in general) or the company's assets.

6.2 Corruption

Any action or omission that causes or could cause an eventual situation of corruption and/or bribery must be immediately reported to the company.

An action that is contrary to this Code includes but is not limited to bribery, trading in influence, etc. and other actions of similar characteristics that are defined in the Criminal Code.

In accordance with legislation in force, we must never offer, suggest, authorise or promise any type of bribe or favour to a public official in order to obtain or maintain a commercial operation or undue advantage. Likewise, we must never request or accept a bribe or favour from a public official. We must also never hire someone to do something that we couldn’t ethically or legally do ourselves. Involving a third party to indirectly make an improper payment constitutes a violation of anti-corruption laws.

Given the recent relevance and public importance of certain conduct or behaviours in the business arena that could generate social rejection and, in certain cases, constitute the commission of an illegal act, for the purposes of this Code, corruption, trading in influence, bribery and public official will have the meanings listed below:

>Corruption

The offer or delivery of a bribe or remuneration of any other kind to an authority, public official or person who participates in exercising a public function so that they perform an act that is contrary to the duties inherent in their position or perform an act that is not particular to their position.

Corruption between private individuals

The offer, promise or delivery of an unjustified benefit or advantage of any nature (as well as the request for and acceptance thereof) for executives, administrators, employees or collaborators of a company, association, foundation or organisation so that they favour others, thereby breaching their obligations in the acquisition or sale of merchandise or in the contracting of professional services.

Trading in influence Influencing a public official or authority, therefore taking advantage of any situation derived from a personal relationship with the same or with another public official or authority, in order to obtain a decision that can directly or indirectly generate a financial benefit for oneself or for a third party.

Bribery

The direct or indirect promise, offer or delivery of any monetary incentive or any other kind of incentive to a person so that that person, violating their obligations, acts or ceases to act for the purpose of obtaining or maintaining a commercial operation or improper advantage in the performance of a business activity.

Public official

A person who holds a legislative, administrative or court position in a certain country (including all government levels and bodies, whether national or local), and whether by appointment or election. Any person who performs a public function in a certain country, including public agencies and companies. Any agent or representative of an international public organisation. This also includes candidates for political positions and political employees or members or parties.

6.3 Financial crimes

Any action or omission that indicates or could indicate the commission of a financial crime, in accordance with the provisions of the Criminal Code and whenever it involves bad faith, must be immediately reported to the company.

For these purposes, the following are understood as financial crimes: fraud, criminal bankruptcy, crimes against Public Finance or Social Security, the forgery certificates, misappropriation and all other, similar actions defined in the Criminal Code.

Given the special features and complexity of this subject, the Compliance Committee will be at the disposal of any worker to resolve any doubts about the occurrence or not of any event listed under this category.

6.4 Anti-competition practices

Any action or omission that causes or could cause a presumed crime of unfair competition, as well as other anti-competition practices described in regulations, must be immediately reported to the company.

Only fair and complete competition allows the markets to develop freely.

All workers are bound by the rules of fair competition. The determination of whether or not a matter is subject to anti-trust legislation could create difficulties, mainly due to the fact that laws can vary between countries and from one event to another. In any case, workers must not obtain information about competitors through industrial espionage, bribery, theft or electronic eavesdropping and must not intentionally communicate false information about competitors or about their products or services.

6.5 Disclosure or revelation of secrets

Any action or omission that causes or could cause a presumed crime of disclosure or revelation of secrets (privileged information), in accordance with the provisions set forth in the Criminal Code, must be immediately reported to the company.

Privileged information is considered to be any information that is not public and that refers to ALSA. Privileged information can be acquired as a consequence of the position and responsibilities of a worker or involuntarily, and it includes non-public information such as the following: financial results and/or budgets, dividends, mergers or acquisitions, divestitures, concessions of contracts or strategic plans, information about litigation, changes of management and commercial contracts or relations.

Privileged information must not be published or be made available to third parties without proper authorisation. The publication of privileged information is prohibited whenever it may be done beyond the usual scope of one's labour functions or beyond compliance with other obligations on behalf of ALSA. This applies to information that is published both within ALSA and outside of ALSA, including journalists, financial analysts, customers, consultants, relatives and friends. Moreover, workers must also be sure that any medium that may contain privileged information is kept such that it is impossible for unauthorised persons to access it.

6.6 Intellectual and industrial property; damages derived from improper use of work tools.

Any action or omission that causes or could cause a presumed crime against intellectual property, damage to the company’s IT system, etc., must be immediately reported to the company.

Employees must respect intellectual property regulations and the right of use that corresponds to NEG and/or to ALSA in relation to licences, projects, IT programmes and systems, equipment, technology, know-how and, in general, all other works or jobs developed or created at NEG and/or ALSA.

Employees will abstain from using, to their own benefit, business opportunities that are of interest to NEG and/or ALSA.

Employees must respect the specific rules that regulate the use of e-mail, Internet access or other means placed at their disposal, wherefore in no event may they be improperly used.

Employees undertake to comply with their obligations regarding the duty of secrecy and confidentiality pertaining to all data and information that they may become aware of due to the normal development of and compliance with the employment relationship. This obligation will remain in force even after the employment relationship has ended at the company.

7. RULES APPLICABLE TO GIFTS/HOSPITALITY, POLITICAL CONTRIBUTIONS AND SPONSORSHIPS

Regarding business courtesies, gifts and hospitality that are offered to or received from customers, suppliers and other partners, they are a highly extended practice for promoting good relations and showing recognition for professional treatment. In any event, this courtesy must not have an influence on (or give the impression of influencing) any business decision.

In no event will gifts in cash and/or monetary compensation be allowed.

In such situations, we must be guided by good judgement, discretion and prudence.

Regarding the delivery and/or receipt of gifts and/or shows of hospitality, such as tickets to events, trips, lodging and others, those exceeding a value of 150 euros or the equivalent value in another currency may not be accepted and/or given. In any event, the frequency of such gifts/hospitality will be weighed. If there is any doubt, the corresponding hierarchical superior, the Compliance Committee or the Corporate Legal Advising Service must be consulted.

In accordance with these guidelines, ALSA personnel are obligated to send information (using the e-mail address: buzon.compliance@alsa.es) regarding any gifts or shows of hospitality whose financial value is between 100 and 150 euros, according to the model that has been placed at their disposal. Said information includes both the gifts/shows of hospitality that may be received as workers of ALSA and those that may be offered to third parties on behalf of the company or on our own behalf as personnel of ALSA. Only Christmas gifts are excluded: the delivery thereof is organised centrally by the company.

ALSA does not make political contributions. As a responsible member of society, ALSA makes donations of money or services for education, culture and projects of social and humanitarian interest. Sponsorships from which ALSA obtains advertising are not considered donations. Contributions to employer associations and dues of organisations that serve business interests also are not considered donations. Some donations are always prohibited, including donations (1) made to for-profit persons and organisations; (2) made to private accounts; (3) made to organisations whose objectives are incompatible with ALSA’s corporate principles; or (4) that could harm ALSA's reputation.

All donations must be transparent. This means that the identity of the receiver and the planned use of a donation must be transparent and that the reason for and objective of a donation must be justified, documented and approved according to internal rules.

Sponsorship means any contribution made by ALSA, in money or in kind, to an event organised by a third party as consideration for announcing the ALSA brand.

All sponsorships must be transparent, must be in writing, must be for legitimate business objectives and must be proportionate (not excessive) to the consideration offered by the organiser of the event.

8. PROCEDURE FOR REPORTING ALERTS. “HELP LINE” CHANNEL.

Any worker of ALSA who may have a reasonable indication of the existence of any behaviour, event or omission that might violate this Code can, in first instance, resolve any doubt or question or notify any alert through their hierarchical superior or the Compliance Committee.

Likewise, if, for any reason, a worker does not feel that the help from any of these persons is adequate or possible, then the worker can pose the question and/or alert through the HELP LINE.

The HELP LINE system is at the disposal of all employees, and the use thereof can be expanded to other persons if it is thus authorised by the Board of Directors and is permitted by legislation.

To increase confidentiality in the system, ALSA has decided to outsource management of the telephone line that is going to receive alerts, and it has contracted an outside supplier that specialises in this type of service. Alerts will be treated in a secure environment by a restricted number of employees of the service provider, who will have received adequate professional training.

ALARES SOCIAL CEE, S.A. (ALARES) is the company in charge of managing the telephone number where employees can notify behaviours that are contrary to the provisions set forth in this document.

Use of the HELP LINE is completely voluntary and will be governed by the following conditions of use:

Employees who have reasonable indications that any irregularity is being committed, or any act against current laws or against the standards of behaviour of this Code of Ethics, can report said presumed irregularity by phoning the HELP LINE at 900 901 427.

The number is toll free and is available on business days from Monday through Friday, 9:00 a.m. to 2:00 p.m.

Workers must appropriately identify themselves: anonymous reports are not allowed. The system will record the data of the reporting person and of the alleged offender, the reported facts and the result of all investigations.

ALSA will do everything possible to protect the identity of any employee who resorts to the HELP LINE Channel, in accordance with the resolution of the matter and with applicable legislation. In any event, the identity of the reporting person will be considered confidential information, and in no event will their identity be reported to the alleged offender or to third parties. All reports will be investigated promptly and in detail, in accordance with applicable legislation.

The results of the investigation of any matter submitted through the system will be communicated through ALARES to the Compliance Committee.

After receiving a report from the external provider, the Compliance Committee will conduct an initial review and evaluation of the report, and it will decide who needs to know about the report, as well as the adequate and timely response that must be given.

The Compliance Committee is also responsible for supervising any corrective actions, which could include disciplinary proceedings, in accordance with national regulations.

As soon as the decision to investigate an alert has been made, the Compliance Committee will notify all persons involved in the alert in order to allow them to exercise their rights without delay, including their right of defence. However, the Compliance Committee has the right to adopt precautionary measures, such as the necessary measures for preventing the destruction of proof in relation to an alert, before notifying a person involved.

The Compliance Committee can respond to and communicate with the person who gave an alert through the external provider. The Compliance Committee will notify promptly the results of an investigation to the employee who gave the alert through the external provider. In turn, the external provider will obtain the employee's reaction regarding the information communicated by the Compliance Committee.

In cases in which the identity of the reporting person cannot be verified due to using a false name, the complaint that is made will be immediately invalidated.

The Human Resources Horizontal Department will be responsible for deciding whether or not disciplinary proceedings will be initiated against the violating party based on the result of the investigation. If an investigation shows that a complaint was unjustified or was made for improper reasons or in bad faith or without reasonable and probable cause, then the Compliance Committee may take disciplinary measures against the reporting party.

9. DISCIPLINARY POLICY. CONSEQUENCES.

Without prejudice to the legal effects of practices whose existence has been proved as certain, when the Compliance Committee identifies behaviours that are defined under applicable labour regulations (Statute of Workers’ Rights, Collective Bargaining Agreement or Award, etc.) as subject to sanction, then Human Resources Management will initiate the pertinent disciplinary process against the person or persons regarding which their involvement in said behaviours has been proved.

This process will begin with the opening of disciplinary proceedings, when necessary in accordance with the law of reference, and after the processing thereof (if applicable) a labour sanction will be applied according to laws in force and internal organisational criteria.

In any event, Human Resources Management will respect all legal guarantees.

10. PROTECTION OF EMPLOYMENT.

The company values the assistance of employees who decide to warn of possible irregularities. It will therefore take the necessary measures to protect any employees who, in good faith, use the Internal Alert Process (HELP LINE) to report a possible illegal situation or irregular action that is protected by this Code, even if their declarations or revelations are imprecise.

ALSA will not tolerate any reprisals against those employees who may report any problem in good faith and/or who help to investigate possible violations of the Code. Good faith means reporting a matter without malice, without seeking personal benefit and with well-founded reasons to believe the veracity of a report.

11. INFORMATION PROCESSING. DUTY OF SECRECY AND CONFIDENTIALITY

The company assures compliance with the Organic Law on Personal Data Protection (LOPD) that is in force at any given time and with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), and specifically, compliance with the obligation of the duty of secrecy and confidentiality. It therefore incorporates the appropriate technical and organisational measures to assure a level of security that is adequate to the risk, all for the purpose of avoiding the alteration, loss or accidental or illegal modification of data or unauthorised access to said data, thereby considering the state of technology, the nature of the stored personal data and the risks to which they are exposed, whether those risks come from human actions or from the physical or natural environment, and observing, at all times, the duty of confidentiality and professional secrecy that is imposed by legislation in force on data protection.

The collection, use, processing and storage of the personal data of customers takes place while assuring, at all times, the right to privacy and compliance with legislation in force on personal data protection. In order to duly defend the interests of an alleged offender, they will be informed in the briefest possible period of time about the reported events, about the recipients of the information, about the department that is responsible for the system and about their data protection rights.

Data will be cancelled within the maximum period of two months after the end of any investigations if the facts are not proved. If legal actions are taken, the data will be stored to the extent necessary so that the company may exercise its rights in court.

To exercise the rights of access, rectification, erasure, restriction of processing or objection, as well as the right to the portability of data (if applicable), you may contact ALSA GRUPO, S.L.U. in writing by sending a letter to Calle Miguel Fleta, 4, 28037, Madrid, or by sending an e-mail to asesoria@alsa.es. In any event, to exercise the requested right, you must attach a photocopy of your DNI [Identity Document] or valid legal equivalent that allows proving your identity. Moreover, if you believe that your data have been inappropriately processed, you may contact the Data Protection Officer (dpo@alsa.es) or file a complaint before the Spanish Data Protection Agency at Calle Jorge Juan, 6, 28001, Madrid. The company guarantees compliance with Organic Law 15/1999 of 13 December, on Personal Data Protection, and specifically compliance with the obligation of the duty of secrecy and confidentiality, therefore incorporating the security measures provided for in Royal Decree 1720/2007 of 21 December, which approves the implementing regulations of the LOPD.