Ethical code

The Code of Ethics of Grupo Puma, which was approved by the governing bodies of each of the companies that are part of the group in October 2016, reflects the reference values of the group and contains the general principles that should govern the actions of all professionals who are part of it.

Consequently, the Code of Ethics of Grupo Puma, is a key element in the integrity of our businesses and represents who we are and how we act as a company, both internally, in terms of the companies that are part of the group and all of its employees, managers and administrators, as externally, in the market and with the other competitors. All professionals of the group, regardless of their position in the organization and the place where they carry out their activity, must know the mission and values contained in the Code of Ethics, accept them and use them as guidelines and conduct guide in the performance of their daily performances.

The document, also available on the corporate intranet of the group, is periodically reviewed to incorporate the necessary changes to respond to the new internal and external requirements and ensure its continuous improvement.

The governing bodies of the companies that are part of Grupo Puma also approved a number of corporate policies aimed at encouraging company-wide performance in accordance with the ethics and regulations in force in each of the identified risk areas, through a set of procedures and actions designed to prevent, detect and respond to actions, irregularities, fraud or acts contrary to the Group's Code of Ethics or the rules in force. The set of corporate policies and action protocols, along with the Code of Ethics of the group, represent the strong commitment of the company to its employees, customers, suppliers, competitors and other interest groups with which it relates, to conduct all its activities in accordance with current rules and regulations, as well as the highest standards and ethical values.

Likewise, the Company has established a communication and complaint channel, consisting of the email address canaldedenuncias@grupopuma.com for use by employees and other stakeholders, which aims to comply with the objectives set out both in the Code of Ethics and in the set of internal policies and processes approved within it.

Likewise, a secure and anonymous channel is offered so that employees and other stakeholders can report any behaviour, actions, omissions or facts that constitute a possible criminal or administrative offence or a violation of the company's Code of Ethics or of the company's internal rules established in its corporate policies and specific action protocols, produced in the performance of the professional duties of the perpetrator of the breach, or with transcendence in the contractual relationship with customers or suppliers or in the interests and image of the company vis-à-vis third parties.

For the above purposes, it is reported that the PRINCIPLES that govern the operation of the whistleblowing channel are the following:

• i. Employees, shareholders, participants and persons belonging to the entity's administrative body may be whistleblowers and those who have been denounced.
• ii. Possibility of reporting through the internal channel, and also before the competent authority through the existing external channels.
• iii. Communications shall comply with the criteria of truthfulness and proportionality, and this mechanism may not be used for purposes other than those that seek compliance with the law or with the internal policies and protocols implemented in the company.
• iv. Possibility for the complainant to report conduct anonymously.
• v. Consideration of confidential, where appropriate, the identity of the complainant and the accused and of the information and data relating to the complaint.
• vi. Possibility of providing the data and identity of the complainant and the accused to the administrative or judicial authorities, if required by such authorities as a result of any procedure derived from the subject matter of the complaint, as well as to the persons involved in any subsequent investigation or judicial proceedings initiated as a result of the investigation. The transfer of data will be carried out in compliance with the legislation on the protection of personal data in force at all times.
• vii. The Compliance Committee, and specifically, the Channel Manager, will be responsible for managing communications sent through the whistleblowing channel and for processing investigations.
• viii. Possibility of reporting behavior, actions, omissions or facts that constitute a possible criminal or administrative infraction or a violation of the company's Code of Ethics or of the company's internal rules established in its corporate policies and specific action protocols, produced in the performance of the professional functions of the author of the breach, or with significance in the contractual relationship with customers or suppliers or in the interests and image of the Company vis-à-vis third parties.
• ix. Sending an acknowledgement of receipt of the complaint to the complainant within a maximum period of seven (7) days from receipt, unless this may jeopardize the confidentiality of the communication.
• x. Reasoned communication by e-mail, based on the factual elements provided by the complainant, of the admissibility or not of initiating the processing of the complaint made, within a maximum period of ten (10) days from receipt of the same.
• xi. Maximum period of three (3) months from the receipt of the communication to respond to the proceedings, which may be extended by an additional three (3) months if the case is particularly complex.
• xii. Possibility of requiring the complainant to provide the necessary information and/or documentation to prove the existence of the irregular conduct denounced.
• xiii. Information to the accused of the conduct attributed to him or her and of the rights to which he or she is entitled, as well as a hearing at any time during the hearing.
• xiv. Abstention, if applicable, from being part of the procedure of the subject against whom the complaint is directed.
• xv. Data processing in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, in Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights, limiting their access to the Compliance Committee and the Channel Manager, the HR Department, when disciplinary measures may be adopted, the Legal Department in the event that legal measures must be adopted, the data processors that may be appointed and the Data Protection Officer.
• xvi. Communication of the facts to the Public Prosecutor's Office immediately if they constitute a crime.

It is also informed that, in any case and without prejudice to the foregoing, actions or omissions that may constitute a serious or very serious criminal or administrative offence may be reported, as well as, acts or omissions which may constitute breaches of European Union law provided that they fall within the scope of the European Union acts listed in the Annex to Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019, affect the financial interests of the European Union and have an impact on the internal market, may be reported to the Independent Authority for the Protection of Reporting Persons, A. I.P.A., or before the corresponding regional authorities or bodies and, where appropriate, before the institutions and bodies of the European Union, through their own channels (channels external to the institution).

Download Code of Ethics PDF