REGULATION OF THE INTERNAL WHISTLEBLOWING CHANNEL

Article 1

Object

The purpose of this Regulation is to define the internal Whistleblowing Channel of CRC, Car Rental Company, Lda., and to establish the appropriate procedural rules for the receipt, processing and filing of complaints submitted through it, in accordance with the legal and regulatory provisions, namely in Law no. 93/2021, of the 20^th of December.

Article 2

Offences

1. For the purposes of this Regulation, acts and omissions contrary to rules included in European Union acts, or to national rules referring to the legal areas defined in Law No. 93/2021, of the 20^th of December, are considered offences, namely:

a) Public procurement;

b) Prevention of money laundering and terrorist financing;

c) Product safety and compliance;

d) Transport safety;

e) Environmental protection;

f) Radiation protection and nuclear safety;

g) Human and animal consumption food safety, animal health and animal welfare;

h) Public health;

i) Consumer protection;

j) Protection of privacy and personal data and security of networks and information systems;

k) Financial interests of the European Union;

l) Competition rules and state aid;

m) Violent crime;

n) Corruption and related offences, namely the crimes of active and passive corruption, undue receipt and offering of an advantage, embezzlement, economic participation in business, concussion, abuse of power, prevarication, influence peddling, laundering or fraud in obtaining or diverting a subsidy, grant or credit.;

o) Code of Ethics and Conduct of CRC, Car Rental Company, Lda. and other internal regulations.

2. For the purposes of these Regulations, acts or omissions contrary to other relevant legal provisions within the scope of CRC, Car Rental Company, Lda.'s activity, as well as contrary to the Code of Ethics/Conduct and other internal regulations of CRC, Car Rental Company, Lda. are also considered offences, namely:

a) Moral or sexual harassment, bullying or discrimination;

b) Conflicts of interest and transactions with related parties;

c) Fraud;

d) Violation of occupational/environmental health and safety conduct;

e) Misappropriation of assets or theft;

f) Breach of conduct or ethics rule;

g) Violation of policy or procedure;

h) Other serious violations.

3. Complaints submitted that do not fall within the scope defined in the preceding paragraphs may not be processed under this Regulation, and this information must be conveyed to the complainant and the complaint filed.

Article 3

Complainant

Reports of offences may be made by any natural person who obtains the relevant information in the course of his or her professional activity, in particular by:

a) Employees;

b) Service providers, contractors, subcontractors and suppliers, as well as any persons acting under their supervision and direction;

c) Shareholders and persons belonging to the administrative or management bodies or to the supervisory or fiscal bodies of legal persons, including non-executive members;

d) Volunteers and trainees, whether paid or unpaid.

Article 4

Reporting Channel

1. Complaints may be submitted through the reporting channel that will be operated internally by the Regulatory Compliance Officer appointed by CRC, Car Rental Company, Lda. (hereinafter referred to as the "party responsible for handling the complaint"), after duly ensuring independence, impartiality, confidentiality, data protection, secrecy and the absence of conflicts of interest in the performance of duties.

2. Complaints can be submitted by any of the following means:

a) By letter to the following address: Avenida Severiano Falcão, 10, 2685-378 Prior Velho to the attention of the Responsible party for the Whistleblowing Channel;

b) By e-mail to the electronic address denuncias@crcrental.pt

Article 5

Object of the Complaint

1. The complaint may relate to offences committed, being committed or reasonably foreseeable to be committed, as well as attempts to conceal offences.

2. A report of offences may be based on information obtained after the termination of the employment relationship or during the recruitment process or other pre-contractual negotiation phase, even if the latter does not take place.

3. Reporting of offences is optional, and there will be no consequences for persons referred to in Article 2 above who do not report an offence.

4. The report of offences may contain the identification of the complainant or be anonymous.

5. In order for the investigation to be as quick and effective as possible, the complaints should include as many elements as possible to characterise and analyse the offence and, if possible, the submission of existing evidence.

Article 6

Processing and Assessment of the Complaint

1. The processing and analysis of a complaint submitted under this Regulation shall be the exclusive responsibility of the Regulatory Compliance Officer appointed by CRC, Car Rental Company, Lda.

2. Upon receipt of a complaint, CRC, Car Rental Company, Lda. will notify the complainant within seven days of receipt of the complaint and inform him/her in a clear and accessible manner of the requirements, the competent authorities and the form and admissibility of the external complaint, except where the complaint is anonymous.

3. Following the complaint submitted, CRC, Car Rental Company, Lda. will carry out the appropriate internal acts to verify the allegations included therein and, where appropriate, to cease the reported offence, and may even open an internal investigation, or communicate to the competent authorities for investigation of the offence, including the institutions, bodies, offices or agencies of the European Union.

4. CRC, Car Rental Company, Lda. will register all complaints, assigning each one a sequential order number, indicating the respective date of receipt, analysis and issue of the respective report and classifying it as pending or closed.

5. Upon completion of the internal investigation, the party responsible for handling the complaint should submit to the Directorate-General/Management/Board of Directors:

a) A reasoned final report identifying the necessary and appropriate measures to correct the reported irregularity;

b) A final report justifying the non-adoption of any measures or the closure of the complaint;

c) If applicable, a reasoned proposal to initiate disciplinary proceedings and/or judicial proceedings, in compliance with the expiry and limitation periods, where applicable;

d) A proposal to report the matter to external bodies where the specific situation so warrants.

6. CRC, Car Rental Company, Lda. will inform the complainant of the measures planned or adopted to follow up on their complaint and the respective grounds, within a maximum period of three months from the date of receipt of the complaint.

7. The complainant may request, at any time, that CRC, Car Rental Company, Lda. communicate to him/her the result of the analysis carried out on the complaint within fifteen days of its conclusion.

8. The party responsible for handling the complaint shall follow up and monitor the measures taken following the complaint, in accordance with subparagraph (a) of the previous number.

9. Complaints and reports drawn up as a result of their analysis shall be filed on paper or on a non-editable electronic medium that ensures the full and unaltered reproduction of the information contained therein, for a period of 5 years, and, regardless of this period, during the pendency of disciplinary, judicial or administrative proceedings relating to the complaint.

Article 7

Data Confidentiality and Protection

1. CRC, Car Rental Company, Lda. has implemented general safeguard procedures for the entire process of receipt, registration, assessment and decision, to ensure the completeness, integrity and preservation of the complaint, the confidentiality of the identity or anonymity of the complainants, the confidentiality of third parties mentioned in the complaint, the protection of personal data of the complainant and the suspected offender in accordance with applicable laws and regulations, exemption and priority in processing, as well as to prevent access by unauthorised persons.

2. The identity of the complainant, as well as any information that directly or indirectly makes it possible to deduce his or her identity, are confidential in nature and restricted to the person responsible for handling the complaint.

3. The obligation of confidentiality referred to in the previous number extends to anyone who has received information on complaints, even if they are not the person responsible for handling the complaint.

4. The identity of the complainant may only be disclosed as a result of a legal obligation or court order. Such disclosure shall be preceded by a written communication to the complainant indicating the reasons for the disclosure of the confidential data concerned, except where the provision of such information jeopardises related investigations or legal proceedings.

5. CRC, Car Rental Company, Lda. has taken the necessary precautions to preserve the security of personal data whose processing may be carried out in the course of handling a complaint, having adopted the measures provided for in the General Data Protection Regulation, approved by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April of 2016, in Law no. 58/2019, of August 8, which ensures the implementation of Regulation (EU) 2016/679 in the national legal order, and in Law no. 59/2019, of August 8, which approves the rules on the processing of personal data for the purposes of prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties.

Article 8

Prohibition of Retaliation and Complainant's Guarantees

1. A complainant who, in good faith and having serious grounds for believing that the information is, at the time of the report or public disclosure, true, reports or publicly discloses an offence shall enjoy the protection conferred by the law.

2. Where the complainant has expressly requested his or her identity to be confidential, the identity of the complainant shall be kept confidential by the person responsible for handling the complaint, who shall ensure that the documents he or she sends do not include any information identifying the sender.

3. CRC, Car Rental Company, Lda. is directly responsible for protecting the complainant against possible retaliatory or reprisal action following the complaint. The duty of protection may not, however, extend to the participation of the complainant in the offence that is the object of the complaint, if it is proven that he or she acted in bad faith or falsely in reporting an alleged offence that he or she knew to be unfounded, or in the case of employees, when possible disciplinary measures arise from a breach of professional duties unrelated to the complaint.

4. However, complaints made under this Regulation and the applicable legal provisions may not, in themselves, serve as grounds for the initiation by CRC, Car Rental Company, Lda. of any disciplinary, civil or criminal proceedings against the complainant, unless they are deliberately unfounded.

Article 9

Employees' training

CRC, Car Rental Company, Lda. ensures the appropriate training of the person responsible for handling the complaint, as well as the company's employees and staff.

Article 10

Advertisement

This Regulation will be sent by e-mail to the company's employees and is published on CRC, Car Rental Company, Lda. website (www.crc.pt) and is also available for consultation at the company's head office.

Article 13

Validity

This Regulation shall come into force on August 4, 2023.