Whistleblower Protection Policy

Grupo Miramar is committed to promoting a culture of integrity, transparency, and legal compliance, ensuring the protection of individuals who report infringements or well-founded suspicions of irregularities obtained in a professional context.

This policy has been prepared in accordance with Law no. 93/2021 of 20 December, which establishes the General Regime for the Protection of Whistleblowers, and Decree-Law no. 109-E/2021 of 9 December, in its current wording, which establishes the General Regime for the Prevention of Corruption.

The reporting channel is managed by Serafim Silva – Actividades Hoteleiras, SA, corporate entity no. 502856564, with its registered office at Rua Abel da Silva, n.º 36, Pederneira, 2450-060 Nazaré, and covers the following units:

• Miramar Hotel Spa & Apartments;
• Hotel Miramar Sul.

1. Which situations can be reported?

Acts or omissions that have already occurred, are ongoing, or can reasonably be expected to occur, as well as attempts to conceal them, may be reported, relating in particular to:

• Corruption, undue acceptance or offering of an advantage;
• Embezzlement, economic exploitation of a business, extortion, abuse of power, misfeasance in public office, or trading in influence;
• Money laundering or terrorist financing;
• Public procurement;
• Product safety and compliance;
• Transport safety;
• Environmental protection;
• Food safety, animal health and welfare;
• Public health;
• Consumer protection;
• Protection of privacy and personal data;
• Security of network and information systems;
• Financial interests of the European Union;
• Internal market rules, competition, state aid, or corporate taxation;
• Violent, especially violent, or highly organised crime;
• Conflicts of interest, fraud, or other infringements covered by applicable legislation;
• Retaliation related to the submission of a report.

The channel may also receive communications related to serious breaches of internal policies, the Code of Conduct, or Grupo Miramar’s ethical principles. The application of the legal whistleblower protection regime will, however, depend on whether the reported situation falls within the scope of the applicable legislation.

Reports must be based on information obtained in a professional context and on serious and reasonable grounds to believe, at the time of reporting, that the facts communicated are true.

The whistleblower does not need to provide definitive proof of the infringement, but must provide sufficiently substantiated information to enable its analysis.

2. Who can submit a report?

Natural persons who have obtained information in the context of a current, former, or prospective professional relationship with Grupo Miramar may use this channel, in particular:

• Workers and former workers;
• Job applicants and persons involved in recruitment or pre-contractual negotiation processes;
• Service providers, contractors, subcontractors, and suppliers;
• Persons acting under the supervision or direction of service providers, contractors, subcontractors, or suppliers;
• Shareholders and members of administrative, management, supervisory, or oversight bodies;
• Volunteers and trainees, paid or unpaid.

3. How can a report be submitted?

A report can be submitted either identified or anonymously through the following means:

• Online form: via the form available at the bottom of this page;
• E-mail: denuncia@grupomiramar.pt;
• Telephone: 962 688 085;
• Postal mail: Rua Abel da Silva, n.º 36, Pederneira, 2450-060 Nazaré, for the attention of the Head of the Whistleblower Channel, with the outer marking “Confidential – Whistleblowing”;
• In-person meeting: upon request sent to denuncia@grupomiramar.pt or by calling 962 688 085.

To allow for proper analysis, the report should, whenever possible, include:

• A clear and detailed description of the facts;
• Relevant dates and locations;
• The identification of the individuals or entities involved;
• How the whistleblower became aware of the facts;
• Documents, messages, photographs, or other available evidence that may assist in analysing the situation.

Verbal reports made by telephone or in an in-person meeting will be documented via recording, subject to the whistleblower’s consent, or by means of accurate minutes or a transcript. The whistleblower will have the opportunity to verify, rectify, and approve the minutes or transcript.

4. Anonymity and confidentiality

Reports may be submitted anonymously.

Where the whistleblower chooses to disclose their identity, their identity and any information allowing it to be deduced will be treated confidentially and will only be accessible to the persons responsible for receiving and following up on the report.

The identity of the whistleblower may only be disclosed where required by a legal obligation or judicial decision. Whenever legally permissible, the whistleblower will be informed in advance of such disclosure and the reasons for it.

The duty of confidentiality applies equally to the identity of persons mentioned in the report and to information collected during its analysis.

Where a report is anonymous and no contact details are provided, it may not be possible to:

• Acknowledge receipt of the report;
• Request clarifications or additional information;
• Communicate the measures taken;
• Communicate the final outcome of the analysis.

5. Handling and follow-up of the report

Upon receipt of a report, Grupo Miramar:

• Acknowledges receipt within a maximum period of seven days, where contact details are available;
• Informs the whistleblower, in a clear and accessible manner, of the requirements and conditions for submitting an external report;
• Analyses the reported facts in an independent, impartial, and confidential manner;
• May request additional information or clarifications from the whistleblower;
• Adopts appropriate internal measures to verify the allegations and, where applicable, bring the infringement to an end;
• May initiate an internal investigation;
• May report the facts to the legally competent authorities;
• Communicates to the whistleblower the envisaged or adopted measures and the reasons behind them within a maximum period of three months following receipt of the report.

Any decision to close or archive a report will be made by means of a reasoned decision.

The whistleblower may request, at any time, to be informed of the outcome of the analysis carried out. This information will be provided within 15 days following the conclusion of the procedure, without prejudice to confidentiality duties and legally applicable restrictions.

6. Protection against retaliation

Any form of retaliation against a whistleblower who, in good faith and having serious grounds to believe that the information is true, submits a report under the legally applicable terms, is strictly prohibited.

Retaliation is considered any act or omission that, directly or indirectly, occurs in a professional context, is motivated by the report, and causes or may cause the whistleblower, in an unjustified manner, financial or non-financial damage.

The prohibition also extends to threats and attempts of retaliation.

Protection may also cover:

• Persons who assist the whistleblower confidentially;
• Colleagues or relatives who may be subject to retaliation;
• Legal entities owned or controlled by the whistleblower;
• Entities for which the whistleblower works or with which they are professionally linked.

Any person who considers themselves to be a victim of retaliation related to a report should immediately communicate the situation through the reporting channel.

7. External reporting

In cases provided for in Law no. 93/2021, the whistleblower may submit an external report to the authority that, according to its powers and responsibilities, should or can handle the matter in question.

Potentially competent authorities include:

• Public Prosecution Service (Ministério Público);
• Criminal police bodies;
• Independent administrative authorities;
• Inspectorates-General and equivalent entities;
• Public institutes;
• Local authorities;
• Public professional associations;
• National Anti-Corruption Mechanism.

Direct recourse to an external channel is permissible, in particular, when:

• There is no applicable internal channel;
• The internal channel only accepts reports from workers and the whistleblower is not a worker;
• There are reasonable grounds to believe that the infringement cannot be effectively handled or resolved internally;
• There is a risk of retaliation;
• An internal report was submitted without measures being communicated within the statutory timeframes;
• The infringement constitutes a crime or administrative offence punishable by a fine exceeding 50,000 euros.

The choice of external authority must take into account the nature of the infringement and the statutory powers assigned to each entity.

8. Personal data protection

Serafim Silva – Actividades Hoteleiras, SA is the data controller responsible for the processing of personal data collected through the whistleblower channel.

Personal data is processed to:

• Receive and log reports;
• Analyse and investigate the communicated facts;
• Request clarifications and communicate with the whistleblower;
• Adopt necessary measures to prevent, stop, or sanction infringements;
• Comply with applicable legal obligations;
• Exercise or defend rights in administrative, judicial, or disciplinary proceedings.

The primary legal basis for processing is compliance with legal obligations provided for under Law no. 93/2021 and Decree-Law no. 109-E/2021.

When communications not directly covered by these legal obligations are analysed, processing may be based on Grupo Miramar’s legitimate interest in preventing, detecting, investigating, and correcting illegal conduct or behaviour contrary to its internal policies.

When necessary, the following data may be processed:

• Identification and contact data;
• Information regarding the professional relationship;
• Description of the reported facts;
• Identification of individuals involved or mentioned;
• Documents, messages, photographs, recordings, and other provided evidence;
• Information collected during analysis or investigation.

Access to data is restricted to persons authorized to receive and handle reports.

When necessary, data may be communicated to:

• Legally competent public authorities;
• Legal advisers;
• Auditors;
• Specialists or service providers necessary for the investigation, subject to confidentiality and data protection duties.

The whistleblower’s identity, as well as information allowing it to be deduced, is confidential and restricted to the persons responsible for receiving and following up on reports.

Personal data that is manifestly irrelevant to the handling of the report will not be retained and will be deleted as soon as its irrelevance is confirmed.

Reports and corresponding records will be retained for at least five years and, regardless of that period, for the duration of any pending judicial or administrative proceedings relating to the report.

The data subject may, under legally applicable terms, request access to, rectification, erasure, restriction of, or opposition to the processing of their personal data.

The exercise of these rights may be restricted where necessary to:

• Protect the identity and rights of the whistleblower or other individuals;
• Preserve the confidentiality of the report;
• Prevent the investigation from being compromised;
• Comply with legal obligations or court orders;
• Exercise or defend rights in administrative, judicial, or disciplinary proceedings.

For matters related to personal data protection, you may contact the Data Protection Officer via dpo@grupomiramar.pt.

The data subject also has the right to lodge a complaint with the National Data Protection Commission (CNPD) via www.cnpd.pt.

9. Documentation

For further information, the following documents may be consulted:

• Prevention Plan for Corruption and Related Infringements Risks;
• Code of Conduct for the Prevention of Corruption and Related Infringements and its Annex of Acknowledgement;
• Internal Whistleblower Channel Regulations;
• Declaration of Absence of Conflict of Interest;
• Declaration of Disqualification.

Each designation must maintain the link to its currently published PDF document.

10. Submit your report

You can submit your report using the form below.

Identification and contact details are optional, allowing for anonymous reports.

If you wish to receive acknowledgement of receipt, provide subsequent clarifications, or be informed of the follow-up, you should provide an e-mail address or another contact method.

Before submitting the report, please confirm that the information provided is true to the best of your knowledge and that you have serious grounds to believe in its accuracy.

Last updated: August 2026.