In Spain, Law 2/2023 covers companies with 50 or more workers and, whatever their size, some sectors such as financial services or anti-money laundering; the EU Directive sets the same 50-worker threshold, applied through each country’s own law. A shop that isn’t required to have one can open it voluntarily: the module works the same way, and only the legal basis in the privacy notice changes. Starter texts are included for Spain, France, Italy and the EU Directive, in all four languages.

They are templates to review with your adviser, and the organisational side stays yours: appointing the system manager, consulting workers’ representatives, approving the policy, carrying out the DPIA. The module records the date of each step in a checklist and, for Spain, works out the last day to notify the appointment to the authority.

PrestaShop logs visitors’ IP addresses, sets cookies and loads the scripts of the theme and other modules: chat widgets, pixels, analytics. None of that belongs where someone reports what they’ve seen. The channel pages have their own layout with your shop logo: no theme, no hooks, no cookies, no stored IP address and nothing loaded from other domains. They stay open in maintenance mode and work without JavaScript.

Files give people away too: a photo carries the phone model and location, a Word file the author’s name. With the box ticked (the default), photos are re-encoded without EXIF data and DOCX, XLSX, ODT and ODS files lose their properties; PDFs and audio are left as they are, and the form says so. The self-diagnosis checks that the channel sets no cookie and that PrestaShop doesn’t record the visit.

Text, attachments, voice messages and identity are stored encrypted with AES-256-GCM. Reading them takes the company’s private key, protected by each team member’s passphrase and by a server key kept in a file outside the database, and unlocking the vault also asks for a two-factor code. A SuperAdmin who isn’t on the team gets a restricted access screen, and someone who copies the database can’t read the content.

People join with a one-time code that the system manager hands over in person or through a secure channel, never by email, and get a role: handler, HR, legal or data protection officer. The vault locks after 15 minutes of inactivity by default, revealing a reporter’s identity requires a reason that is logged, and every access goes into a chained audit trail you can verify.

After sending, the reporter sees the reference number, a 20-character access code shown only once, the date and time of receipt and a SHA-256 fingerprint of what they sent, and can download it as TXT or print it. By default the acknowledgement is already waiting in the mailbox. Those who would rather speak can record a voice message in the browser or upload an audio file, and ask for a meeting.

With the code and their password they come back whenever they like: read the team’s questions, signed with an alias, reply, add evidence and approve a meeting transcript. A button reports retaliation and makes the case a priority. If they left an email address, all they get is “You have a pending notification”. After several failed attempts, access is paused for longer each time.

Each case works out its dates from the entity’s country. In Spain: acknowledgement within 7 calendar days, a response within 3 months of receipt (extendable once by 3 more for especially complex cases) and a meeting within 7 days when requested. The dashboard and the case file show them in green, amber or red, email alerts to the team never contain case content, and the simulator shows a case’s timeline with the article behind each date.

Every report gets a row in the register, kept apart from the case files and exportable to CSV with a reason recorded in the audit trail. In Spain, if no investigation has started after 3 months, the case is marked for deletion and you confirm it; you can also anonymise it or keep it on legal hold. Deletion destroys the keys and leaves only a tombstone with no content.

When someone phones or asks to meet, you log the report in the back office with the real date of receipt, which starts the deadlines, their consent to the recording and the recording or minutes. A printed access sheet with a code and an initial password lets them follow the case in the mailbox like everyone else.

After installation the channel is in test mode: only the IP addresses you enter can see it, and everyone else gets a 404. Test reports use a TEST series, stay out of the register and can be aged to watch the traffic lights change. “Publish the channel” stays locked until the essentials are ready (vault, recovery kit, two-factor code, legal texts, HTTPS), then gives you the public URL and a QR code for workplace notices.