Rules of Procedure – Whistleblowing Line

Introduction

In compliance with its Code of Ethics and the regulations in force in the Eastern Republic of Uruguay, ECOM establishes this internal procedure for the receipt, handling, and follow-up of reports and complaints.

The purpose of this procedure is to strengthen a culture of integrity, transparency, and accountability, as well as to prevent and detect at an early stage any potential legal, regulatory, or ethical breaches that may affect the organization, individuals, or the environment.

This system functions as an early warning mechanism that allows risks to be identified before harm materializes, as well as to adopt corrective measures when appropriate. The processing of information collected through this channel will comply with the provisions of Personal Data Protection Law No. 18,331 and its regulatory framework, ensuring lawfulness, purpose limitation, proportionality, security, and confidentiality in the processing of personal data.

Submission of reports

Who can submit a report?

Any person who has or has had an employment, contractual, or commercial relationship with ECOM, as well as any third party who has knowledge of potentially irregular facts, may submit a report. The channel is accessible through the company's website.

What can be reported?

The following, among others, may be reported:

Human and labor rights

• Workplace or sexual harassment.
• Discrimination.
• Violence in the workplace.
• Violations of labor rights.
• Unsafe working conditions.

Integrity and business conduct

• Bribery and corruption.
• Conflicts of interest.
• Fraud, theft, or other financial irregularities.
• Misuse of assets or confidential information.
• Non-compliance with internal policies.

Prevention of financial crimes

• Suspicious transactions linked to money laundering or terrorist financing, in accordance with Law No. 19,574 and related regulations.
• Any financial irregularity lacking legal or commercial justification.

Environment

• Conduct that creates environmental risks.
• Misuse of natural resources.
• Non-compliance with applicable environmental regulations.

Other serious infringements of applicable legislation or of ECOM's Code of Ethics may also be reported.

How to submit a report?

Reports may be submitted at any time through:

• Email: reportar.problema@ecom.uy
• Communication with the immediate supervisor or the Compliance Officer.

Reports may be submitted anonymously. It is recommended that reports be made with the highest possible level of detail and, where available, accompanied by background information or objective elements that facilitate their assessment.

Handling of reports

Who analyzes the report?

Reports will be received and assessed by the competent area or by the Compliance Officer, depending on the nature of the case.

The persons responsible for the analysis will:

• Act with independence and impartiality.
• Be bound by confidentiality obligations.
• Assess the plausibility of the facts.
• Determine the actions to be taken.

Where appropriate, other specialized internal areas may be involved, always ensuring the confidentiality of the process.

In all cases, the right of defense of the person allegedly involved will be guaranteed. This person will be informed, in a manner compatible with the protection of the whistleblower's identity where applicable, of the facts attributed to them and will be given a reasonable opportunity to respond and submit evidence.

Timeframes and communication

• Acknowledgment of receipt of the report will be provided when possible.
• The information received will be assessed and, where appropriate, an internal investigation will be initiated.
• Corrective or disciplinary measures will be adopted where warranted.
• Where feasible and without undermining the confidentiality of the process, the whistleblower will be informed of the general status of the case.

Proceedings will be conducted within a reasonable time frame, taking into account the complexity of the case and ensuring timeliness and proportionality in the measures adopted.

If a real or imminent breach of legal or ethical obligations is detected, ECOM will adopt immediate measures to prevent, mitigate, or correct the situation.

4. Protection of the whistleblower

ECOM promotes an environment in which individuals can raise concerns in good faith without fear of retaliation.

The following are guaranteed:

• Confidentiality in the handling of information.
• Possibility of anonymity.
• Protection against retaliation, discrimination, or sanctions for reports made in good faith.
• Respectful and impartial treatment of all parties involved.

Retaliation against whistleblowers or against those who cooperate in an investigation will not be tolerated. Any adverse measure adopted as a result of or in connection with a report made in good faith may be considered retaliation and may be subject to internal review, without prejudice to any legal actions that may be applicable under labor legislation.

False reports or reports made in bad faith will likewise not be tolerated and may give rise to disciplinary measures. A report will not be considered false if, although made in good faith, it cannot subsequently be substantiated.

5. Publication of the procedure

This procedure is publicly available on ECOM's website as part of its commitment to transparency, business ethics, and corporate social responsibility.

ECOM may review and update this procedure when necessary to adapt it to regulatory changes or improvements in its internal compliance practices and will communicate such changes in due course through the relevant institutional channels.

Retention of documentation and storage period

Information and documentation collected in the context of a report will be retained only for as long as necessary to fulfill the purpose for which it was obtained, in accordance with Law No. 18,331 and its regulatory framework.

In general terms:

• Reports that do not give rise to a formal investigation will be archived and their records deleted or anonymized within a maximum period of twelve (12) months from receipt, unless there is a legal obligation to retain them for a longer period.
• Where an internal investigation is initiated, documentation will be retained for the duration of the investigation and, thereafter, for as long as necessary to address any potential legal, administrative, or judicial liability arising from the reported facts.
• When the facts may give rise to administrative or judicial proceedings, documentation may be retained until the final conclusion of such proceedings and the expiry of the applicable statutory limitation periods.

Once the aforementioned periods have elapsed, information will be securely deleted, destroyed, or anonymized, ensuring confidentiality and preventing its subsequent recovery. ECOM will implement appropriate technical and organizational measures to ensure the integrity, availability, and confidentiality of information throughout the entire retention period.