INTERNAL REPORTING PROCEDURE

Prepared pursuant to the provisions of the Act of 14 June 2024 on the protection of whistleblowers (Journal of Laws 2024.928 of 2024.06.24), hereinafter referred to as: “the Act”.

§ 1

Purpose of the procedure

The purpose of the procedure is to define the rules for reporting breaches of generally applicable law/violations of regulations in force in Skrivanek sp. z o.o. including secure internal communication channels for submitting reports, rules for undertaking follow-up actions and protection of persons submitting reports (“Whistleblowers”)

§ 2

Scope of the procedure

1. The Procedure specifies the principles and procedure for Whistleblowers to report internal violations of the law concerning the areas specified in Art. 3 of the Act, in particular: corruption; public procurement; financial services, products and markets; prevention of money laundering and financing of terrorism; consumer protection, protection of privacy and personal data, security of networks and ICT systems as well as violations of internal regulations and procedures or ethical standards applicable in Skrivanek sp. z o.o..

2. The list of violations of law and regulations that may be reported, as specified in paragraph 1 above, is closed. Reports of violations in any other scope will not be considered.

3. This procedure was established after consultation with representatives of employees of Skrivanek sp. z o.o..

4. This procedure does not apply to reports:

• made anonymously,
• made in bad faith (e.g. false declaration), or made solely in the individual interest of the reporting party,
• concerning information covered by regulations on the protection of classified information or criminal proceedings (pre-trial and in camera proceedings).

5. The Procedure applies to reports made by individuals who have obtained information about violations in a work-related context (“Whistleblower”), including:

• employee, former employee and employee candidate;
• a person working on a basis other than employment, including under a civil law contract;
• an intern, trainee, volunteer;
• a member of Skrivanek sp. z o.o. governing body;
• entrepreneurs, and persons who perform work under the supervision and management of contractors, subcontractors or suppliers performing tasks for Skrivanek sp. z o.o.

§ 3

Internal reporting

1. Reporting a violation is done by sending it to the dedicated email address: [email protected]

2. The notification should include in particular:

• name, surname, position, contact address and, in the case of external whistleblowers – company name;
• information whether the report was forwarded to an external entity
• a detailed description of the violations and the circumstances of the incident, including the date and place of the incident,
• indication of any witnesses to the violation of the law, indication of all evidence and information available to the Whistleblower that may be helpful in the process of considering the report, indication of the preferred method of return contact.

3. The information provided must be based on facts and directly related to the subject of the report.

4. Reports may only be made in good faith. It is prohibited to knowingly submit false reports. Making a report in bad faith is contrary to the norms of social coexistence and company’s interests and may result, as a breach of employee duties, in disciplinary actions, including termination of employment without notice.

5. The report containing the Whistleblower’s details is confidential. The data will be protected against unauthorized access.

§ 4

Preliminary review and follow-up

1. The person authorized to receive reports and take follow-up actions (“Authorized Person”) is the person holding the position of proxy at Skrivanek sp. z o.o..

2. A report is registered in the register of reports in accordance with § 5.

3. After receiving a report, the Authorised Person verifies the report with due diligence and takes follow-up actions, including further communication with the Whistleblower, requesting additional information regarding the report, collecting documents and information in order to verify the report.. To this end the Authorised Person may appoint a Committee – duly authorised and ensuring impartiality (which may include external advisors).

4. Within 7 days of receiving the report, the Authorised Person shall inform the Whistleblower about receipt of the Report, using a preferred method of return contact, if such was indicated by the Whistleblower.

5. The Authorised Person may decide not to conduct an investigation if the Report is clearly untrue or it is impossible to obtain the information necessary to take follow-up action. No follow-up action will be taken if the report is anonymous or concerns a violation outside the scope specified in § 2 section 1 of this Procedure.

6. Follow-up action is carried out without undue delay. Reports are treated with due seriousness and care in a confidential manner, and the principles of impartiality and objectivity apply when considering them.

7. Follow-up action and feedback to the Whistleblower will be taken without undue delay – no later than within 3 months from the confirmation of receipt of the report or, in the event of failure to provide confirmation of receipt of the report within 3 months, after 7 days’ period from the date of making the report.

8. After performing the investigation, the Authorized Person makes a decision as to the validity of the report. In the event of a justified report, the Authorized Person provides to the Employer short-term recommendations regarding appropriate corrective or disciplinary actions towards the person who violated the law, as well as long-term recommendations aimed at eliminating and preventing identical or similar violations to those described in the report in the future.

§ 5

Register of reports

1. Each report is subject to registration in the register of reports.

2. The register of reports is kept in strict confidence. Access to the register of reports is limited to authorized persons, to the extent necessary to perform the tasks, and personal data and other information in the register are stored for a period of 3 years after the end of the calendar year in which the follow-up actions were completed or after the proceedings initiated by those actions were completed.

§6

External report

1. A Whistleblower may make an external report without first making an internal report, however it is advisable to first use the internal reporting channel in force in Skrivanek sp. z o.o. and submit an internal report.

2. An external report is received by the Commissioner for Human Rights or a public authority.

3. External reporting may be made orally or in writing.

4. External report in document form may be made:

• in paper form – to the correspondence address indicated by the Commissioner for Human Rights or the public authority receiving the report;
• in electronic form – to the e-mail address or electronic mailbox address, or address for electronic deliveries, indicated by the Commissioner for Human Rights or the public authority receiving the report, or via a dedicated online form or application indicated by the public authority as the application appropriate for submitting reports in electronic form.

5. Public authorities and the Commissioner for Human Rights place information for whistleblowers on their websites in the Public Information Bulletin in a separate, easily identifiable and accessible section.

6. The Commissioner for Human Rights or a public authority that has received an external report shall immediately, but no later than within 7 days from the date of receipt of the report, send the whistleblower a confirmation of its receipt, unless the whistleblower has clearly submitted a different request in this respect or the Commissioner for Human Rights or a public authority has reasonable grounds to believe that confirmation of receipt of the report would jeopardise the protection of the confidentiality of the whistleblower’s identity.

 

An external report may also be made to the relevant Union bodies, offices and agencies, such as the European Anti-Fraud Office (OLAF), the European Maritime Safety Agency (EMSA), the European Aviation Safety Agency (EASA), the European Securities and Markets Authority (ESMA) and the European Medicines Agency (EMA), which have external reporting channels and procedures for receiving reports, ensuring confidentiality of the identity of the reporting persons.

§ 7

Protection of the whistleblower against retaliatory actions

1. Any retaliatory actions against a Whistleblower acting in good faith as a result of reporting, including actions of a repressive or discriminatory nature or other type of unfair treatment that violates their rights or cause them unjustified damage, as well as threats or attempts to apply such measures will be treated as a violation of the principles of this Procedure and may result in disciplinary actions or termination of the employment contract, as well as liability under generally applicable law.

2. In the event of retaliatory action, the Whistleblower will immediately notify Skrivanek sp. z o.o. of this fact.

3. A person who makes a report in bad faith, being an abuse of the procedure (e.g. submitting false declarations) is not protected.

§ 8

Personal data and identity protection

1. Skrivanek sp. z o.o. is the controller of personal data collected in connection with the proceedings concerning reporting of violations and the protection of reporting parties.

2. In matters concerning the processing of personal data, you can contact the Data Protection Officer: [email protected]

3. The Whistleblower’s personal data enabling his/her identity to be established shall not be disclosed to unauthorised persons, unless with his/her voluntary, express, written consent. An exception is when such disclosure is a necessary and proportionate obligation under the law in the context of investigations or legal proceedings conducted by public authorities or courts, including in order to safeguard the rights of defence of the person concerned.

4. Identity protection also applies to persons associated with a given case, including a person associated with the Whistleblower and assisting the Whistleblower in making a report.

5. The reporting channel should be reserved solely for the information of the Authorised Person, designated to receive reports.

6. Only the Authorised Person and other persons authorised to take follow-up actions to the extent necessary to perform their tasks have access to the reports, with a reservation that information may be disclosed to the legal office providing legal services to Skrivanek sp. z o.o. to the extent necessary.

7. Personal data that is clearly not relevant to the processing of the application is not collected, and in the event of accidental collection, it is deleted without undue delay.

§ 9

Final provisions

1. The procedure enters into force 7 days after it is communicated to persons working at Skrivanek sp. z o.o. through:

• business e-mail,
• placing it on company’s website, maintained at: https://skrivanek.pl/en/about-us/standards/whistleblower/,

not earlier than September 25, 2024

The provisions of the Procedure with regard to external reporting (Par.6) shall enter into force on 25 December 2024.

2. A person applying for employment under an employment relationship or another legal relationship constituting the basis for the provision of work or services or the performance of a function at Skrivanek sp. z o.o. is provided with information on the internal reporting procedure at the time of commencement of recruitment or negotiations preceding the conclusion of a contract.

3. In matters not regulated by this internal reporting procedure, generally applicable provisions regarding whistleblower protection shall apply accordingly.

4. Amendments to this internal reporting procedure are made in the same manner as its creation.