Code of Ethics and Conduct

Compliance and Anti-Corruption Policy

CASALS ROSELL INICIATIVES S.L.

Tax identification number (NIF) B88837786

English translation of the Catalan original · Version 1.0

A framework for professional conduct, client relationships and cooperation with third parties.

Purpose

This document sets out the principles, prohibitions and controls that must guide the company’s activities. It combines the Code of Ethics, the An)-Corruption Policy and the commitments required of suppliers within a single framework proportionate to a consultancy business.

It is intended for the governing body, people working for the company and collaborators acting on its behalf. It may also be provided to clients and in tender procedures, identifying the version and its approval status.

Document control

Version 1.0 · Preparation date 22 September 2026

Entry into force and appointments are formalized in Annex V.

Document owner: CASALS ROSELL INICIATIVES S.L.

Scheduled review: annually and whenever risks, activities or applicable regulations change.

Approval of this Code must be accompanied by the effective application of controls, retention of evidence and monitoring of incidents. The document alone does not demonstrate implementation of a criminal compliance program or compliance certification.

1 Commitment of the governing body and purpose

CASALS ROSELL INICIATIVES S.L. regards professional integrity as a prerequisite for conducting its business and maintaining clients’ trust. The quality of its advice depends on knowledge and experience, as well as independent judgement, confidentiality and transparency in decision- making.

The governing body promotes this Code and assumes responsibility for its oversight. No commercial objective, project urgency, client instruction or revenue expectation justifies breaking the law, concealing a conflict of interest or offering an improper advantage. Turning down a transaction that is incompatible with these principles is part of responsible company management.

1.1 Purpose of the Code

The Code guides day-to-day decisions, identifies prohibited conduct and establishes controls to prevent, detect and remedy irregularities. It applies to strategic maritime and port consultancy, strategic mandates, external board director roles, business development and project support, with a predominantly international focus and participation in public procurement.

Its practical application must take account of the risks of assignments in the maritime, port and logistics sectors, particularly where public en)ties, international counterparties, intermediaries or commercially sensitive information are involved. Controls must be reviewed if different activities or executive functions on behalf of clients are introduced.

1.2 Management commitments

The governing body must allocate sufficient time, resources and advice to implement the measures, facilitate enquiries, review incidents and record significant decisions. These obligations also apply when it participates directly in an assignment or is its main financial beneficiary.

The company protects anyone who raises concerns or reports facts with a reasonable belief in their truth. Identified deficiencies must be corrected and the effectiveness of the solution verified. The response must go beyond closing a report or obtaining a signed acknowledgement.

1.3 Proportionality

Oversight is organised by function, without specifying a fixed number of shareholders, employees or departments. Growth will require a review of the CCO’s time commitment, segregation of duties and resources. One person may perform several compatible tasks; decisions in which that person has a personal interest require independent review. External support complements management but does not transfer the governing body’s own responsibilities.

2 Scope and interpretation

2.1 Persons and relationships covered

The Code is binding on the governing body, management and employees in the performance of their duties. It also applies to shareholders when acting on behalf of the company. Advisers, self-employed professionals, sub-consultants, agents and suppliers are subject to the commitments incorporated into their contracts or corresponding undertakings.

Requirements imposed on a third party must be communicated before the service begins. An equivalent code of its own may be accepted if compatibility is reviewed, differences are documented and assignment-specific obligations are agreed. Publication of this document alone does not replace contractual acceptance where required.

2.2 Territorial and professional scope

The rules apply to in-person and remote activities, travel, meetings, tenders, negotiations and digital communications. They cover actions performed directly or through third parties on behalf of, or for the benefit of, the company.

Before operating in a new jurisdiction, local obligations relating to the service, representation, taxation, permits and trade restrictions must be checked. Local business practice does not authorize prohibited conduct. Extraterritorial obligations are assessed according to the transaction’s actual connections, without assuming that all foreign laws apply.

2.3 Relationship with other obligations

Mandatory law takes precedence over the Code. Contractual commitments and clients’ codes must be observed where accepted and compatible with applicable regulations. Where standards of conduct differ, the stricter legally compatible requirement applies; legal conflicts require consultation before action is taken.

The Code does not itself extend powers of representation, alter the powers of corporate bodies or replace employment or commercial contracts. Nor does it authorize indiscriminate access to private data or communications.

2.4 Consultation and documented decisions

Where doubt arises, the person concerned must explain the facts to the designated officer and defer action if proceeding could cause a breach. The response must be documented if it concerns client acceptance, a payment, a conflict or an operational exception. No internal authorization may waive a statutory prohibition or an absolute prohibition under this Code.

3 Principles and 4 Values

3.1 Integrity and legality

The company provides its services honestly and rejects public and private corruption, fraud, falsification of documents and concealment of transactions. Decisions must be capable of explanation through facts, professional criteria and consistent documentation.

3.2 Independence and professional loyalty

Advice must serve the client’s legitimate assignment, without being influenced by hidden incentives, personal interests or links with other counterparties. Loyalty does not require following improper instructions or concealing information relevant to the client’s decision.

3.3 Respect for people

Everyone must be treated with dignity, without discrimination, harassment, intimidation or retaliation. Cultural diversity and professional practices must be respected within the limits of human rights and the law. Forced labour, child exploitation and other forms of exploitation are not permitted in contracted services.

3.4 Responsibility and sustainability

Recommendations must consider foreseeable consequences for people, the environment and project continuity. Environmental or social claims must be based on verifiable information, with their scope and limitations explained.

4.1 Quality and rigour

Verified facts, estimates and opinions must be distinguished. Reports must identify the assumptions underlying their conclusions and subject higher-impact matters to proportionate review. Material errors identified after delivery must be communicated and corrected promptly.

4.2 Commitment and cooperation

The company must define realistic assignments and promptly communicate any deviation in timing, cost or scope. Cooperation with specialists is based on clear roles, mutual respect and information limited to what is necessary to perform the service.

4.3 Transparency and discretion

Transparency requires explaining fees, interests and responsibilities to the appropriate recipients. Discretion requires protecting information entrusted by clients and third parties. These values complement each other: transparency does not permit disclosure of secrets, and discretion does not permit concealment of an irregularity.

5 Standards of conduct

5.1 Governance and conflicts of interest

The governing body approves the Code and appoints the Chief Compliance Officer (CCO), who coordinates compliance and takes the decisions within the role’s remit. The CCO may be internal or external and must have direct access to the governing body, functional autonomy and proportionate resources. The CCO coordinates records, the annual review and enquiries. The person responsible for each assignment applies the controls throughout the project and retains the evidence.

A conflict of interest exists where a personal, family, professional or financial connection may affect, or appear to affect, the impartiality of a decision. Both actual and foreseeable conflicts must be disclosed before accepting an assignment or participating in a decision.

Identification and response

Checks must cover other mandates, financial interests, positions in third-party en)ties, relationships with decision-makers and remuneration from different parties to the same transaction. The disclosure must identify the counterparties, the nature of the connection and the decision concerned, without collecting unnecessary personal data.

The person concerned must refrain from deciding while the case is assessed. Measures may include segregating duties, restricting access to information, obtaining clients’ informed consent where appropriate or declining the assignment. Consent does not legitimize a conflict prohibited by law or one that prevents the service from being provided independently.

Decisions affecting management

If the conflict concerns the director or the only person with decision-making authority, an independent external assessment must be obtained and the decision formalized by the competent corporate body, with any required abstentions. If the conflict cannot be managed, the transaction must not proceed. The person concerned may not act as the sole reviewer of their own case.

Practical examples

Advising a buyer and a seller in the same transaction requires a specific prior assessment. Recommending a supplier from whom a commission is received requires disclosure of the incentive and verification that it does not compromise the assignment. Using one client’s data to benefit another is prohibited without a legitimate basis and the necessary authorization.

Decisions, measures adopted and the review date must be entered in the conflicts register. Any change to the mandate or counterparties requires the position to be checked again.

5.2 People safety and the environment

Professional treatment and working conditions

Employment and collaborative relationships are based on respect, equal opportunities and objective criteria of competence and suitability for the service. Insults, humiliation, discriminatory comments, sexual or sex-based harassment and conduct creating an intimidating environment are not permitted.

Incidents must be addressed promptly, confidentially and impartially. The company must adopt the prevention measures and specific procedures required under employment and equality legislation. This Code does not replace a harassment protocol or any applicable employment instruments.

Contracts with external professionals must reflect the actual conditions of the service and respect their independence. Contractual classifications must not be used to evade employment or social security obligations. Rest periods and the right to disconnect must be respected under the applicable rules.

Prevention and site visits

Risks must be identified and appropriate preventive measures applied to office work, remote work and travel. Visits to ports, terminals, construction sites or logistics centers require access authorization, risk information, emergency instructions and protective equipment where necessary.

No operational task may be undertaken without the necessary training or authorization. Activities must stop in the event of serious and imminent danger, and the person responsible for the facility must be notified. Relevant accidents and incidents must be reported immediately. No work may be performed under the influence of substances that compromise safety.

Environmental responsibility

The company must reduce avoidable travel, use resources efficiently and properly manage waste arising from its activities. Environmental constraints affecting the viability of projects on which advice is provided must be identified, and specialist support sought when necessary.

Permits, emissions reductions or environmental benefits must not be presented as secured or achieved without supporting evidence. The company is not presumed to assume a facility operator’s operational responsibilities merely by providing advice; each assignment’s obligations must be defined in writing.

5.3 Clients markets and competition

Acceptance and performance of assignments

Before a service begins, the client must be identified, the authority to give instructions verified, and scope, deliverables, fees and responsibilities agreed. Significant extensions must be formalized before being performed. Variable or success fees must clearly define the event triggering payment and any incentives they create.

Proposals must not attribute experience, resources, certifications or representative authority to the company that it does not possess. Where professionals’ personal experience is presented, it must be distinguished from projects contracted and performed by the company. Client references and logos may only be used with sufficient authorization.

Rigour in reports and communications

Reports must identify relevant sources, assumptions and information limitations. Conclusions must not be altered to satisfy commercial expectations, and material risks must not be concealed. Where specialists are used, their competence must be assessed and the correct integration of their conclusions into the final deliverable reviewed.

Only authorized persons may bind the company or act on a client’s behalf. Attending a meeting or presenting an opportunity does not itself confer authority to sign, negotiate binding terms or give instructions to third parties.

Fair competition

Agreements with competitors to fix prices, allocate clients or territories, rig bids or unlawfully exchange commercially sensitive information are prohibited. The company’s advisory services must not be used to coordinate bids from clients competing with one another.

Discussions of future bids, individual margins or confidential compe)tive strategies must be avoided at industry meetings, associations and joint projects. If a discussion moves towards these subjects, objections must be raised, the discussion left where necessary and the facts recorded.

Collaborations, consortia and exclusivity agreements must be reviewed before execution where they could restrict compe)tion. Market information must be obtained by legitimate means, without inducing third parties to breach confidentiality duties or using improperly obtained documents.

5.4 Public authorities and international activities

Relations with the public sector

Relations with public administrations, port authorities, public enterprises and international bodies must be conducted transparently. The contact person, purpose of meetings and commitments made must be identified, and relevant file documentation retained.

Money, gifts, employment, favors or other advantages must not be offered to improperly influence a decision. The prohibition extends to relatives, connected persons and third-party proxies. Personal relationships must not be used to obtain preferential treatment, confidential information or decisions contrary to procedural rules.

Tenders and grants

Statements submitted must be accurate and verifiable. Before submitting a bid, participation requirements, incompatibilities, evidence of financial and technical standing and actual capacity to perform the service must be reviewed. Altered certificates, fic)tious experience and commitments by third parties without their consent must not be submitted.

Privileged tender information must not be accepted, and contacts intended to alter the outcome must not take place. Enquiries must follow permitted channels. For grants and subsidies, expenditure must be traceable; non-existent services or duplicated costs incompatible with the funding conditions must not be claimed.

International assignments

Before undertaking an international assignment, the jurisdiction, identity and ownership of counterparties, intermediaries, applicable restrictions and payment terms must be assessed. A sanctions-list match must be verified before a decision is made; it must not be dismissed or confirmed solely on the basis of a similar name.

Where a service or counterparty may be affected by sanctions, export controls or restrictions on certain professional services, acceptance must be suspended pending specialist review. Third countries, alternative invoicing arrangements and proxies must not be used to circumvent an applicable restriction.

Additional country or client requirements must be recorded in a project information sheet. This must identify the responsible person, registration or authorization requirements and outstanding checks. Previous market experience must not be assumed to replace a review of the specific transaction.

5.5 Information resources and intellectual property

Confidentiality

Business plans, investment opportunities, commercial data, prices, reports, credentials and any non-public information received under a duty of confidentiality are confidential. They may only be used for the authorized purpose, and access must be limited to those who need the information for their work.

Before sharing sensitive information with a collaborator, the client’s authorization must be verified and the necessary confidentiality undertakings formalized. Documents must not be forwarded to personal accounts or third parties unconnected with the assignment for convenience. In public meetings, transport and shared spaces, conversations or screens revealing project data must be avoided.

The duty of confidentiality continues after the relationship ends. It does not prevent a legitimate report to an authority or protected reporting channel, or compliance with a legal request. In such cases, only necessary information must be provided and applicable safeguards preserved.

Assets and records

Equipment, accounts, subscriptions, funds and documents must be used for authorized professional purposes. Misappropriation, misuse and destruction of evidence are prohibited. Project folders must allow contracts, approved versions, deliveries and significant decisions to be identified.

At the end of an assignment or collaboration, access must be withdrawn, assets recovered and the return, deletion or retention of information agreed in accordance with applicable obligations. A preservation duty arising from litigation or an investigation suspends routine deletion of the documents concerned.

Intellectual property and know-how

Rights to reports, models, methodologies and other deliverables must be specified in the contract. Pre-existing materials, work created during the assignment and third-party content must be distinguished. Materials produced by an external professional are not presumed to belong automatically to the company.

Only software, images, databases and texts covered by sufficient rights or licenses may be used. Reuse of a model must not incorporate another client’s confidential information. Copies and quotations must comply with legislation and terms of use. Opportunities learned of through the service must not be used for personal benefit contrary to the mandate.

5.6 Personal data and digital security

Processing of personal data

Before collecting or sharing data, the purpose, legal basis, recipients and retention period must be defined. Only necessary data may be processed. Professional contacts, CVs, identification details and bank details may also be subject to data protection legislation.

The company must determine whether it acts as controller or processor for each service. Where it processes data on a client’s instructions, the relevant agreement must be formalized, instructions followed and subcontractors controlled. Requests to exercise data protection rights must be forwarded immediately to the person responsible for handling them.

The appointment of a Data Protection Officer must be assessed against applicable obligations. This Code does not presume that the role exists. International transfers and cloud services must be reviewed before use with personal data or confidential documents.

Security measures

Individual accounts, strong passwords, mul)-factor authentication where available, updated equipment and backups must be used. Permissions must be tailored to each project and reviewed when a collaboration ends. Credentials must not be shared, nor controls disabled to facilitate third-party access.

Any change to a supplier’s bank account must be verified through an independent channel using previously verified contact details. An urgent email is not sufficient evidence. Suspicious messages, lost devices and unrecognized access must be reported without delay.

Incidents and artificial intelligence tools

In the event of a breach, the incident must be contained, evidence preserved and its effects assessed. Where required, the controller must notify the authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach; a high risk may require informing the individuals affected. Where the company acts as processor, it must notify the controller without undue delay.

Confidential information or personal data must not be entered into artificial intelligence tools without checking their safeguards and authorization for use. Outputs must be reviewed before inclusion in reports. Responsibility for delivered content remains with the person who validates it.

6 Legal compliance and financial control

6.1 Legal and professional obligations

The company must maintain an overview of the corporate, tax, accounting, employment and sector-specific obligations affecting its activities. Support from an administrative services firm or adviser does not remove the duty to provide complete information and review documents being approved or signed.

If an assignment involves a reserved activity, authorization or specific qualification, that part must not be performed without meeting the requirements. Any expansion into company management, financial services, asset transactions or other regulated activities requires a prior review of the obligations it may trigger.

6.2 Invoicing and payments

Every payment must correspond to a genuine obligation, an identified beneficiary and a substantiated service. The contract or engagement, invoice, service acceptance and payment evidence must be retained. Fic)tious invoices, deliberately vague descriptions, hidden accounts and splitting transactions to evade controls are prohibited.

Payments must be made by traceable means. As an internal rule, fees, commissions and donations must not be paid in cash. Small travel expenses exceptionally paid in cash must be justified and comply with current statutory limits. Personal expenses presented as business expenses must not be reimbursed.

The director’s own expenses and related-party transactions require an additional documentary review by an internal or external person who is not a beneficiary. The review must be retained and does not replace any required corporate approvals.

6.3 Prevention of misuse of services

Requests to collect or make payments involving third parties outside the contract, opaque beneficiaries, disproportionate commissions and transactions without an understandable economic purpose must be examined. Where a significant red flag arises, the transaction must be suspended until clarified, and advice sought if necessary.

Status as an obliged entity under an)-money laundering legislation must be assessed according to the services actually provided, particularly the corporate services referred to in Article 2 of Law 10/2010. If applicable, the specific regime must be implemented; these general controls do not replace it.

Document retention must be organized by category and applicable retention period, with restricted access. Documents relating to ongoing inspections, litigation or investigations must not be deleted.

7 Subcontracting and third-party due diligence

7.1 Risk-based selection

Before engaging a collaborator, their identity, activities, capacity to perform the service and potential incompatibilities must be checked. Selection must be based on quality, experience, availability and reasonable cost. Alternatives must be compared where feasible; where a sole specialist is selected, the reason must be documented.

For routine services involving limited risk, tax details, a proposal, professional references and acceptance of applicable commitments may suffice. Commercial agents, intermediaries, representatives before public bodies and third parties receiving success-based remuneration require enhanced checks before approval.

7.2 Enhanced checks

The review must identify relevant owners and beneficial owners, links to decision-makers, verifiable reputation, country of activity and justification for remuneration. Explanations must be checked against documents or reliable sources, and the conclusion recorded. Adverse news requires assessment, not automatic condemnation.

Red flags include refusal to identify beneficial owners, promises of privileged access, commissions without a specific service, payments to unrelated accounts, lack of experience and resistance to an)-corruption obligations. The third party must not be approved while a significant unresolved risk remains.

7.3 Contract and monitoring

The engagement must specify services, fees, deliverables, powers of representation, confidentiality, rights to materials and compliance obligations. It must also govern further subcontracting, incident reporting and the consequences of breach. Where the main contract requires it, the client’s prior consent must be obtained.

The project manager must verify the services before approving an invoice and review changes in ownership, team, bank account or payment destination. Additional checks must be proportionate to risk and contractual rights, respecting confidentiality and data protection.

When the collaboration ends, access must be closed and evidence retained. If a breach is identified, requiring remediation, suspending the service or terminating the contract must be considered according to its seriousness and the agreed terms.

8 Ethics reporting channel and incident management

8.1 Purpose and safeguards

The channel must enable enquiries and reports of reasonable suspicions of non-compliance relating to the company’s activities. It is available to internal personnel and professionally connected third parties. Both identified and anonymous reports must be accepted, and reporting persons must not be required to prove the facts conclusively.

The company prohibits retaliation against anyone reporting with reasonable grounds to believe the information is true, and, where applicable, against those assisting them. Failure ultimately to substantiate the facts does not make a report abusive. Deliberate falsehood must be distinguished from honest error.

Access to information must be restricted. The person concerned retains the presumption of innocence and the right to be heard. The reporting person’s identity may only be disclosed in circumstances provided for by law; no absolute guarantee of secrecy from competent authorities may be offered.

Channels and responsible persons

The written compliance channel is compliance@casalsrosell.com, managed by the Chief Compliance Officer (CCO). Before entry into force, its operation, restricted access and the appointment of the independent substitute in Annex V must be verified. A secure written route, an opportunity for verbal reporting or a meeting, and a route permitting anonymity must be provided. Ordinary identifiable email does not in itself guarantee the latter.

Reports concerning the CCO or the director must be submitted directly to the independent substitute through the separate contact published in Annex V. If this is not yet operational, the competent external authority may be contacted directly. Access to the file must not remain under the exclusive control of the person concerned. Routine commercial enquiries may be handled separately to avoid mixing them with confidential investigations.

Applicability of Law 2/2023

Whether the company is required to maintain an internal reporting system must be documented: the general threshold of 50 or more employees has sector-specific exceptions. A system voluntarily adopted under Article 10.2 must meet the law’s requirements. The assessment must be reviewed when staffing or activities change.

This chapter establishes the policy for receiving and handling reports; commissioning the system requires completion of appointments, channels, privacy information and the required procedure. The right to use external channels and competent authorities directly, without first exhausting the internal route, is preserved.

8.2 Procedure for handling reports

Receipt and initial assessment

The case handler must record an identifier, date, reporting channel and description of the facts. Where possible, the reporting person’s identity must be separated from working documents. Only relevant data may be collected. Receipt must be acknowledged within seven calendar days, unless doing so could compromise confidentiality.

The initial assessment must check for urgent risks to people, data, payments or evidence. Proportionate interim measures must be adopted where necessary, without prejudging guilt. Reports received by unauthorized persons must be forwarded confidentially to the case handler.

Impartial investigation

Before investigating, the case handler must be checked for conflicts. The scope of enquiries, participants and necessary evidence must be defined. Evidence must not be obtained through unlawful access, nor may the case be used to investigate private matters unrelated to the reported facts.

The person concerned must be informed and heard at a time compatible with preserving evidence and respecting their rights. Interviews and conclusions must be documented, distinguishing established facts, indications and unresolved questions. Complex cases or those involving management must be handled with independent external support.

Outcome and follow-up

A response must be provided within three months of acknowledgement of receipt or, if none is issued, from the expiry of seven days after receipt. In particularly complex cases, this period may be extended by up to a further three months, with documented justification.

The outcome must state whether the case is closed or corrective, disciplinary or contractual measures are adopted, who will implement them and when their effectiveness will be checked. Where there are indications of a criminal offense, the matter must be referred to the appropriate authority under the applicable legal framework. The reporting person must receive feedback compatible with the rights of third parties.

Safekeeping and closure

The incidents register must be separate from commercial records and accessible only to authorized persons. Retention within the channel must be distinguished from retention in the investigation file, subject to the limits in Articles 26 and 32 of Law 2/2023 where applicable. Data must not be retained indefinitely. Possible retaliation must be reviewed and effective closure documented.

9 Approval 10 Measures and 11 Communication

9 Approval and updates

The Code enters into force on the date agreed by the governing body. The decision must identify the approved version, responsible persons, allocated resources and operational reporting channels. Substantive amendments require renewed approval and communication to the recipients concerned.

A review must be carried out annually and whenever activities change, new markets are entered, significant incidents occur or legal changes affect the system. The review must be recorded even if no amendment is deemed necessary. Previous versions must be archived so that the version in force at any given time can be established.

10 Response to breaches

Measures must be proportionate to seriousness, recurrence, intent and harm, respecting the right of defense and the applicable framework. Employment law and the relevant collective agreement apply to employees. The Code does not create penalties that are not legally permitted.

In commercial relationships, remediation may be required, activities suspended or contracts terminated in accordance with agreed terms. Breaches by the governing body must be addressed through the appropriate corporate and legal procedures, with independent support where necessary. Internal measures do not exclude other liabilities.

In addition to addressing individual conduct, the reasons why the control failed must be reviewed. Each corrective measure must have a responsible person, a deadline and evidence of closure. Merely reiterating the Code is insufficient where a specific process deficiency exists.

11 Communication and training

The Code must be provided to internal personnel when they join and to collaborators before services to which it applies begin. Acknowledgements of receipt or undertakings must be retained. Initial training must cover practical cases relevant to each person’s role; an annual refresher must be provided, with content and participants documented.

Clients and tender processes must receive the approved version in force, without completed records containing confidential data. Certifications, independent audits or implemented controls must not be claimed unless they can be substantiated. Translations must identify the source version and preserve its meaning.

Annex I Anti-Corruption Policy

A1 General prohibition

CASALS ROSELL INICIATIVES S.L. prohibits offering, promising, giving, requesting or accepting an improper benefit to influence a professional decision. The rule covers public and private relationships, financial and non-financial advantages, and actions carried out through third parties.

This includes hidden commissions, sham invoices, jobs promised to connected persons, personal favors and donations conditional on an award. The company does not permit paying to obtain improper influence or receiving payment to exercise it. A contract or invoice does not legitimize a fic)tious service.

A2 Facilitation payments and pressure

Unofficial payments to accelerate procedures to which a person is already entitled are prohibited. Official fees may only be paid to the legitimate recipient against appropriate documentation. Where a request is questionable, the basis for payment must be requested and the responsible person informed before proceeding.

If there is a real and immediate threat to physical safety, protecting the person takes priority. Any payment made under duress must be reported as soon as it is safe, accurately recorded and assessed with advice. This rule does not authorize payments to avoid commercial delays or financial losses.

A3 Intermediaries and fees

An intermediary may only act under a specific mandate, following due diligence and for justifiable remuneration. The contract must specify the work and the evidence to be provided. Commissions must not be paid for a mere promise of influence, nor percentages approved that are disproportionate to the substantiated service.

Where the company receives fees from different parties, it must assess the conflict and disclose it where appropriate before accepting them. Referral commissions must be explained to the client concerned and must not compromise the independence of recommendations.

A4 Response to an improper proposal

Anyone receiving such a proposal must reject it, avoid committing the company, retain available documentation and report it through the established channel. Negotiations must not continue for the purpose of gathering further evidence if doing so requires participation in the conduct. The responsible person must decide whether to suspend the relationship and what further action to take.

Annex I Gifts invitations and hospitality

A5 Acceptance criteria

Gifts and invitations are permissible only if they serve a legitimate professional purpose, are occasional and transparent, and comply with the recipient’s rules. They must not influence decisions or create an obligation to reciprocate. The following amounts are internal limits proposed for approval with the Code, not statutory thresholds of permissibility.

In the private sector, gifts must not exceed EUR 50 per person per occasion, including taxes. Business meals must not exceed EUR 75 per person. Combined gifts and meals must not exceed EUR 150 per person and counterparty over twelve months. Hospitality must not be split to circumvent these limits.

Cash, gift cards and equivalents, luxury hospitality, relatives’ expenses, and gifts or invitations during a selection, award or negotiation that they could influence are prohibited. In the public sector, the rule is not to offer or accept individual gifts or invitations. Exceptions disguising an improper advantage are not permitted.

A6 Travel and events

Participation in a professional event must have an agenda, purpose and reasonable cost. Travel connected with service delivery and provided for contractually must be treated as project expenditure, supported by receipts and without personal components. Third-party invitations including transport or accommodation require prior written review and authorization.

If the beneficiary is the director, an independent person must review the invitation before acceptance. If such review cannot be obtained, the invitation must be declined or the business cost met from own resources. Leisure activities unrelated to the service must not be charged to the client.

A7 Records donations and sponsorships

All gifts and hospitality offered, received or declined must be recorded with the date, parties, purpose, estimated value and decision. Incompatible gifts must be returned; where this is not feasible, a lawful disposition that prevents personal benefit must be documented.

Donations and sponsorships require an identified beneficiary, legitimate purpose, authorization and traceable payment. They must not be linked to a contract award or used to channel favors. As an internal policy, the company will not contribute to political parties, candidates or en)ties used to finance them.

Annex II Code for suppliers and collaborators

B1 Required commitments

A supplier or collaborator adhering to this Annex undertakes to comply with the regulations applicable to the service and to act with integrity in dealings with CASALS ROSELL INICIATIVES S.L., its clients and other persons connected with the project.

They must reject all forms of corruption, hidden commissions and facilitation payments; observe the communicated rules on gifts and invitations; disclose conflicts of interest; and not claim representative powers not granted in writing. Fees must correspond to services actually performed and capable of substantiation.

The third party must respect human rights and the employment, safety and environmental obligations applicable to the service. They must not use forced or child labour, tolerate harassment or retaliate against persons reporting irregularities on reasonable grounds.

B2 Information and resources

Information received must be used solely to perform the assignment and must not be disclosed to others without authorization or a legitimate basis. Personal data must be protected, processing agreements observed and intellectual property respected. Security incidents affecting the project must be reported without delay.

Further subcontracting requires compliance with the contract and the stipulated authorizations. The supplier must pass relevant obligations on to its collaborators and retain its corresponding responsibility. An activity that the supplier could not lawfully perform itself must not be delegated.

B3 Verification and breaches

The supplier must provide proportionate evidence of compliance where the contract permits, respecting legitimate secrets and third-party data. They must report relevant incidents, cooperate in establishing the facts and implement agreed corrections. The consequences of a breach must be determined according to its seriousness, the law and the contract.

B4 Undertaking

The signatory declares that they have authority to assume these commitments, have received the Code and will communicate them to those involved in the service. Reservations or equivalence with an existing code must be documented before acceptance.

Company or professional name: ___________________________________

Representative and position: ______________________________________

Assignment and accepted version: __________________________________

Date and signature: ______________________________________________

Annex III Operational records

Records may be maintained in protected files, with a person responsible for safekeeping and access control. The following templates define the minimum content of each entry and must be duplicated for each new transaction. Completed records are restricted and must not be attached to commercial proposals.

C1 Gifts invitations and hospitality

Identifier and date: ______________________________________________

Person and counterparty offering or receiving: ________________________

Description and professional purpose: _______________________________

Estimated value and twelve-month cumulative amount: __________________

Public or private sector and ongoing decision process: __________________

Decision, authorization and supporting document: ______________________

C2 Conflict of interest declaration

Declarant and assignment: _________________________________________

Connection or interest and decision affected: __________________________

Abstention or protective measure applied: ____________________________

Independent reviewer and reasoned decision: __________________________

Client notification where appropriate and review date: __________________

C3 Third-party due diligence

Identity, tax details and service: ___________________________________

Representatives and relevant beneficial owners: _______________________

References, connections and checks performed: ________________________

Red flags identified and explanations obtained: ________________________

Risk rating, approval and next review: ________________________________

C4 Confidential incident monitoring

Record the case code, receipt and response dates, case handler, potential incompatibilities, interim measures, findings, corrections and closure date. Identification data and evidence must be held in a separate file with restricted permissions. Sensitive information must not be copied into general project records.

Annex IV Controls and review

This table sets out minimum operational controls. It does not replace an individual assessment of criminal risks: likelihood and impact must be assessed against actual activities, and the effectiveness of controls subsequently verified.

D1 Documented annual review

The review must examine a proportionate sample of assignments, invoices and third parties; the actual operation of the reporting channel; conflict declarations; and incidents. Its findings must identify deficiencies, measures, resources and deadlines. Where there has been no activity in an area, this must be recorded.

High risks, new services and recurring deficiencies require specialist review. Where functions are concentrated in one person, this external review must enable effective scrutiny of decisions and evidence.

Annex V Approval and implementation

E1 Approval decision

The Sole Director of CASALS ROSELL INICIATIVES S.L. approves the identified version of this Code, assigns oversight functions and allocates the resources necessary for its application.

The signature evidences the decision adopted but does not itself certify the implementation or effectiveness of all controls.

Approved version and decision date: Version 1.0 — 22 September 2026.

Competent body and decision reference: Sole Director — decision approving the Code of Ethics and Compliance, reference COMP-001.

Effective date: 22 September 2026.

Signature:

Original language and translated versions

The original version of this Code of Ethics and Compliance is the Catalan text approved by the Sole Director of CASALS ROSELL INICIATIVES S.L.

The company will issue Spanish and English versions to facilitate understanding and dissemination among the individuals and en)ties concerned. These versions will faithfully reproduce the content of the approved Catalan version and state the corresponding version number and approval date.

In the event of any discrepancy in interpretation between versions, the Catalan version will prevail, without prejudice to applicable mandatory law. Any discrepancy identified will be corrected in the translation concerned.

Annex V Appointments and reporting arrangements

E2 Appointments and means of communication

Compliance coordination: Chief Compliance Officer (CCO).

Day-to-day management of the channel: Chief Compliance Officer (CCO), formally appointed by a separate decision.

Independent substitute person or service and separate contact:

Written channel for internal personnel and third parties: compliance@casalsrosell.com

Anonymous reporting route: anonymous postal correspondence addressed to the CCO at: Avda Diagonal 534, Entl Esq, 08006 Barcelona.

Verbal reporting and meeting requests: a meeting must be arranged in fewer than 7 working days following a request through either of the two preceding routes.

Safekeeping of records and allocated resources: the Chief Compliance Officer (CCO), or the independent substitute for matters assigned to them, is responsible. Documentation will be retained in a secure digital repository, with access restricted to authorised persons according to their duties, two-factor authentication and backups. Paper documents, if any, will be kept in a locked filing facility with controlled access. The compliance mailbox, storage and record- keeping facilities, necessary time commitment and any external support required by each case will be allocated to this function. Retention and deletion of information will be governed by the internal procedure and applicable regulations.

E3 Checks before entry into force

Actual activities, staffing and functions must be confirmed; the applicability of Law 2/2023 and an)-money laundering legislation documented; appointments accepted; channels tested; and the privacy information and corresponding procedure approved. The gift limits in Annex I and independent review rules must also be validated.

Before presenting the document to clients as being in force, the registers must be activated, the Code communicated to the persons concerned and contact details tested. Appointment of the person responsible for the system must be notified to the competent authority where required.

E4 Internal acknowledgement of receipt

I declare that I have received and read the Code, am aware of the enquiry and reporting channels, and accept its obligations within the scope of my duties.

Name, role, date and signature: _____________________________________

Annex VI Mandates and boards of directors

F1 Definition of the role

Before accepting a board-related role, a distinction must be made between external advice without holding office, attendance as a guest, personal appointment as a director, and appointment of a legal entity with an individual representative. A consultancy contract does not replace the corporate appointment or remove the responsibilities of the office.

The mandate record must identify the company, jurisdiction, role, term, powers, remuneration, other concurrent assignments and eligibility requirements. Incompatibilities and the scope of any liability insurance must be reviewed, without assuming that cover exists.

F2 Diligence loyalty and independence

When holding office as a director, conduct must comply with the duties of care and loyalty applicable to the company concerned. Meetings must be prepared for, sufficient information requested, independent judgement maintained and the company’s interests served. Instructions from a client or shareholder do not justify breaching these duties.

Conflicts must be disclosed to the appropriate body and abstention applied where required. Any waivers are subject to the company’s applicable legal regime; CCO authorization does not replace them. Related-party transactions and additional consultancy services require particular review.

F3 Confidential information and opportunities

Board documentation must be kept separate from other clients’ files, with limited access. It must not be shared with shareholders, collaborators or clients merely because they belong to the same consultancy. Confidentiality continues after the appointment ends, subject to statutory exceptions.

Opportunities learned of through the role must not be used for personal benefit incompatible with the duty of loyalty. If inside information concerning financial instruments is received, advice on applicable restrictions must be obtained before trading, recommending transactions or disclosing it.

F4 Mandate controls

The CCO must review conflicts before acceptance, on renewal of the mandate and whenever counterparties or interests change. Authorizations and decisions that may lawfully be retained must be preserved, respecting the board’s documentation rules.

In the event of serious disagreement or improper instructions, the matter must be recorded through the appropriate corporate mechanism and independent advice, abstention or an orderly resignation considered. For foreign boards, the local regime must be verified. This document does not presume that Spanish rules resolve all international obligations.

Annex VII References and correspondence with the model

G1 Reference structure

This document combines the Code of Ethics and Conduct, the An)-Corruption Policy and the commitments required of suppliers and collaborators within a single framework for CASALS ROSELL INICIATIVES S.L.

The governing body’s commitment and the scope of application are set out in sections 1 and 2. Principles and values are addressed in sections 3 and 4; standards of conduct in section 5; and legal compliance, subcontracting, the ethics reporting channel, approval, measures and communication in sections 6 to 11.

Annexes I and II set out the an)-corruption rules and the commitments required of suppliers and collaborators. Annexes III and IV contain operational records, controls and review arrangements. Annex V covers approval, appointments and reporting arrangements, while Annex VI addresses mandates and board director roles. This Annex sets out the structure of the Code and the legal references for consultation.

G2 Legal framework for reference

The following references guide legal review and must be consulted in the relevant current version. Their inclusion does not imply that all obligations apply to every assignment.

Spanish Criminal Code, particularly Article 31 bis on the criminal liability of legal en)ties and organizational and management models. BOE: https://www.boe.es/buscar/act.php?idtiBOE- A-1995-25444

Law 2/2023 on the protection of reporting persons. BOE: https://www.boe.es/buscar/act.php? idtiBOE-A-2023-4513

Law 15/2007 on the defense of compe)tion. BOE: https://www.boe.es/buscar/act.php? idtiBOE-A-2007-12946

Law 10/2010 on the prevention of money laundering and terrorist financing. BOE: https:// www.boe.es/buscar/act.php?idtiBOE-A-2010-6737

General Data Protection Regulation and Organic Law 3/2018. AEPD guidance on breaches: https://www.aepd.es/derechos-y-deberes/cumple-tus-deberes/medidas-de-cumplimiento/ brechas-de-datos-personales-notificacion

Spanish Companies Act, Articles 225 et seq. BOE: https://www.boe.es/buscar/act.php?idtiBOE- A-2010-10544

Law 31/1995 on occupational risk prevention. BOE: https://www.boe.es/buscar/act.php? idtiBOE-A-1995-24292