1. Statement of Principles and Compliance Context
CCL Auditores Consultores conducts its professional activities in an environment that requires high standards of integrity, confidentiality, and responsibility. The nature of our services involves the continuous processing of tax, financial, corporate information, and personal data of clients and collaborators, whose protection constitutes an essential element of our professional value proposition.
Aware of this context, the firm has structured a comprehensive compliance system that integrates:
•A crime prevention model in accordance with Law No. 20,393.
•A data protection program aligned with Law No. 21,719.
•Internal procedures for prevention and investigation of workplace harassment, sexual harassment, and workplace violence, in accordance with Law No. 21,643 (Karin Law).
•An information security management system aligned with international standards based on ISO/IEC 27001.
The whistleblowing channel is part of this control ecosystem and does not constitute an isolated mechanism. It is a structural tool designed to strengthen early risk detection, protect individuals, and safeguard institutional integrity.
Its existence responds to a core principle: compliance systems are only effective when they provide real mechanisms to safely report irregularities.
2. Purpose of the Channel
The whistleblowing channel aims to:
•Facilitate the confidential reporting of potentially irregular situations.
•Prevent the occurrence of legal, criminal, labor, and reputational risks.
•Protect the dignity and safety of individuals in the workplace.
•Safeguard the confidentiality, integrity, and availability of information.
•Strengthen corporate governance and the internal control system.
The channel operates under a preventive and corrective approach, integrating into the firm’s overall risk management.
3. Scope
This channel may be used by:
•Current or former collaborators.
•Clients.
•Suppliers.
•External advisors.
•Any individual who maintains or has maintained a relationship with the organization or has reasonable knowledge of relevant facts.
In labor matters regulated by the Karin Law, the channel may be used by employees reporting workplace harassment, sexual harassment, or workplace violence, including situations involving third parties within the context of service provision.
4. Covered Matters
The channel allows reporting of, among others:
a) Criminal and regulatory compliance
•Conduct that may constitute crimes attributable to the legal entity.
•Tax, accounting, or financial irregularities.
•Undeclared conflicts of interest.
•Misuse of confidential information.
•Violations of personal data protection regulations.
•Improper manipulation of records or information.
b) Protection of individuals (Karin Law)
•Acts constituting workplace harassment.
•Sexual harassment behaviors.
•Workplace violence exercised by third parties.
•Conduct affecting dignity or physical or psychological integrity in the workplace.
The channel does not replace customer service mechanisms or ordinary operational procedures.
5. Guiding Principles
Structural confidentiality
Communications will be handled under strict confidentiality. Access will be limited to formally designated individuals within the compliance system.
In cases involving harassment or workplace violence by third parties, an enhanced confidentiality standard will apply, avoiding unnecessary exposure and protecting the identity of the parties when appropriate.
Protection against retaliation
The organization prohibits any retaliation against individuals who use the channel in good faith.
This protection is an essential element of the Prevention Model and obligations derived from the Karin Law.
Good faith and responsibility
Use of the channel requires honest conviction and reasonable grounds. Absolute certainty is not required, but seriousness and responsibility are.
Due process
All reviews will be conducted under principles of impartiality, respect for the presumption of innocence, and the right to defense where applicable.
Proportionality and objectivity
Measures adopted will be proportionate to the seriousness of the facts and based on verifiable evidence.
6. Processing of Personal Data
Reports may involve personal and even sensitive data, especially in labor-related matters.
Processing will be carried out in accordance with:
•Law No. 21,719 on Personal Data Protection.
•Law No. 21,643 (Karin Law).
•Law No. 20,393.
•Institutional Privacy Policy.
•Internal Data Protection Program.
The legal basis for processing may include:
•Compliance with legal obligations.
•Legitimate interest in preventing crimes and managing risks.
•Protection of fundamental rights.
•Exercise of rights in internal processes.
Data will be used exclusively for the management of the report, investigation, implementation of measures, and compliance with legal obligations.
They will not be used for commercial purposes or purposes unrelated to the channel.
7. Information Security
Information related to the whistleblowing channel is considered highly sensitive and is protected through technical and organizational measures appropriate to its criticality, including:
•Access restrictions.
•Segregation of duties.
•Enhanced internal confidentiality protocols.
•Technological safeguards consistent with the information security management system.
•Assignment of an impartial and confidential committee.
These measures aim to ensure the confidentiality, integrity, and availability of the information processed.
8. Management Procedure
Communications will be managed through a formal procedure that includes:
1. Secure registration.
2. Preliminary admissibility assessment.
3. Structured analysis of information.
4. Internal investigation when applicable.
5. Determination of corrective, disciplinary, or preventive measures.
6. Documented closure of the process.
In matters regulated by the Karin Law, the procedure will comply with the standards and deadlines required by applicable labor regulations.
9. Data Retention
Information will be retained only as long as necessary to:
•Manage the report.
•Implement measures.
•Comply with legal obligations.
•Respond to requests from competent authorities.
Once its purpose has been fulfilled, the information will be deleted or blocked in accordance with applicable regulations and internal policies.
10. Supervision and Continuous Improvement
The whistleblowing channel will be periodically reviewed within the comprehensive compliance system to assess its effectiveness, identify improvement opportunities, and ensure alignment with current regulations.
11. Effectiveness
This Policy becomes effective upon approval by Senior Management and will be published on the institutional website along with the Privacy Policy and other compliance instruments.