Przejdź do treści

Policies | Internal Reporting Procedure

Internal Reporting Procedure

Regulations concerning the internal procedure for reporting violations of law and taking follow-up actions at Phoenix Systems SA with its registered office in Warsaw established on 17.10.2025

§ 1 Purpose and scope of the Regulations

  • 1.1. These Regulations specify the rules for receiving and considering reports concerning violations of the law, constituting an internal procedure applicable at Phoenix Systems SA with its registered office in Warsaw (hereinafter referred to as the „Company”).
  • 1.2. The Regulations implement the solutions provided for in the Act of June 14, 2024, on the protection of whistleblowers (Journal of Laws of 2024, item 928), hereinafter referred to as the „Act”, fulfilling the legal obligations imposed on the Company.
  • 1.3. The purpose of this procedure is to:
    1. establish a uniform and effective internal mechanism within the Company enabling the reporting of law violations,
    2. define the rules of conduct in the event of receiving a report, including the method of its receipt, verification, and conducting further actions,
    3. ensure legal protection for persons making reports to the extent provided for by the Act, including protection against the disclosure of the Whistleblower’s personal data (identity),
    4. enable the Company to quickly identify and eliminate irregularities that may have a negative impact on its functioning or image,
    5. ensure the application of standards of lawful and ethical conduct in employee relations and within the Company’s organizational structure.
  • 1.4. The Company ensures that all reports submitted under the procedure will be handled in compliance with the principles of confidentiality, impartiality, and in accordance with applicable legal provisions. The organizational and technical measures implemented aim to guarantee the persons reporting law violations due protection, and the entire proceeding will be conducted in a manner ensuring the security of personal data.
  • 1.5. Employees and Collaborators of the Company should perform their duties in accordance with the law and the principles of professional ethics. As part of the tasks performed, they should identify potential risks of law violations, inform their superiors about their occurrence, promptly forward information about observed violations, and provide data necessary for their clarification. In business and external contacts, they should act in a way that promotes the prevention of such violations and contribute to the protection of the Company’s interests by counteracting their occurrence.

§ 2 Definitions For the purposes of the Regulations, the following meanings of the terms used are adopted:

  • 2.1. „HR and Administration Department” – the organizational unit of the Company responsible for personnel matters (Human Resources/HR), acting through a person/persons employed in this organizational unit, personally/individually authorized by the Company to receive internal Reports, verify them, and further communicate with the Whistleblower, in accordance with the rules set out in the Regulations, in particular, authorized to take Follow-up actions;
  • 2.2. „Follow-up action” – action taken by the Company or a Public Authority to assess the truthfulness of the information contained in the Report and to counteract the violation of law that is the subject of the Report, in particular through explanatory proceedings, initiation of an inspection or administrative proceeding, filing an accusation, action taken to recover funds, or closing the procedure carried out as part of the procedure for making internal Reports and taking follow-up actions or the procedure for receiving external Reports and taking follow-up actions;
  • 2.3. „Retaliatory action” – direct or indirect action or omission in a work-related Context that is caused by a Report and which violates or may violate the rights of the Whistleblower or causes or may cause unjustified harm to the Whistleblower, including the groundless initiation of proceedings against the Whistleblower;
  • 2.4. „Information about a violation of law” – information, including a justified suspicion regarding an actual or potential violation of law that has occurred or is likely to occur in the Company in which the Whistleblower participated in the recruitment process or other negotiations preceding the conclusion of a contract, works or has worked, or in another legal entity with which the Whistleblower maintains or has maintained contact in a work-related Context, or information regarding an attempt to conceal such a violation of law;
  • 2.5. „Feedback” – information provided to the Whistleblower on the planned or taken Follow-up actions and the reasons for such actions;
  • 2.6. „Work-related context” – past, present, or future activities related to the performance of work on the basis of an employment relationship or other legal relationship with the Company constituting the basis for the provision of work or services or holding a function in the Company or for the Company, within which information about a violation of law was obtained and there is a possibility of experiencing Retaliatory actions;
  • 2.7. „Public authority” – supreme and central government administration bodies, local government administration bodies, local government unit bodies, other state bodies, and other entities performing public administration tasks by virtue of law, competent to take Follow-up actions in the areas indicated in the Act;
  • 2.8. „Person concerned by the Report” – a natural person, legal person, or an organizational unit without legal personality, to which the act grants legal capacity, indicated in the Report as a person who committed a violation of law, or as a person with whom the person who committed a violation of law is associated;
  • 2.9. „Person assisting in making a Report” – a natural person who assists the Whistleblower in making a Report in a work-related Context and whose assistance should not be disclosed;
  • 2.10. „Person associated with the Whistleblower” – a natural person who may experience Retaliatory actions, including a co-worker or a person closest to the Whistleblower (spouse, ascendant, descendant, sibling, relative in the same line or degree, person in an adoption relationship and their spouse, as well as a person remaining in common cohabitation);
  • 2.11. „Employee” – a person providing work for the Company on the basis of an employment contract, regardless of the position held or function performed;
  • 2.12. „Regulations” – these Regulations concerning the internal procedure for reporting violations of law and taking follow-up actions;
  • 2.13. „Register of Internal Reports” – a record of internal Reports kept for the purposes of the procedure specified in the Regulations, containing information regarding Reports received by the Company;
  • 2.14. „GDPR” – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
  • 2.15. „Whistleblower” – a natural person indicated in § 5 of the Regulations;
  • 2.16. „Collaborator” – a person providing work on a basis other than an employment relationship, including on the basis of a civil law contract;
  • 2.17. „Report” – an internal Report or an external Report, submitted in accordance with the requirements specified in the Act;
  • 2.18. „Internal report” – oral or written communication of Information about a violation of law to the Company;
  • 2.19. „External report” – oral or written communication of Information about a violation of law to the Ombudsman or a public authority.

§ 3 Competences regarding handling internal Reports

  • 3.1. The Company supervises the functioning of the system for receiving and handling internal Reports and provides the appropriate resources necessary to fulfill the resulting obligations.
  • 3.2. The HR and Administration Department, acting through a person/persons from the HR and Administration Department acting on the basis of a written authorization, is responsible for the implementation of tasks resulting from this procedure.
  • 3.3. The authorization referred to in § 3.2 covers:
    1. receiving internal Reports,
    2. verifying internal Reports and conducting explanatory proceedings,
    3. communicating with the Whistleblower, including requesting additional information and providing Feedback,
    4. maintaining the Register of Internal Reports,
    5. taking Follow-up actions.
  • The authorization template constitutes Attachment No. 1 to the Regulations.
  • 3.4. The HR and Administration Department is also responsible for taking Follow-up actions.
  • 3.5. In justified cases, before or during the undertaking of Follow-up actions, the HR and Administration Department may appoint a person to assist/consult/advise in a specific scope of the subject of the internal Report. The authorization template constitutes Attachment No. 2 to the Regulations.
  • 3.6. In the event that the HR and Administration Department is unable to handle an internal Report due to a long-term obstacle (bearing in mind, in particular, the Company’s obligation to meet the deadlines specified in the Regulations), or when the internal Report directly concerns a person/persons from the HR and Administration Department, or when a conflict of interest arises, the HR and Administration Department is obliged to exclude itself from handling the case. In such a case, the internal Report should be redirected (with a relevant explanation) to the Company’s Management Board. The Management Board shall designate from among its members a Management Board member who will take actions related to the internal Report, including Follow-up actions, on the terms set out in the Regulations. The provisions of § 3.2, § 3.3, and § 3.5 of the Regulations regarding authorization apply accordingly to the designated Management Board member.
  • 3.7. The person/persons from the HR and Administration Department authorized to receive and process internal Reports, and the persons referred to in § 3.5, as well as Management Board members who conduct activities related to an internal Report in accordance with § 3.6, are obliged to maintain impartiality and objectivity in implementing the procedure, as well as to maintain confidentiality with respect to personal data and any information obtained in connection with performing tasks resulting from the Regulations. This obligation remains in force also after the termination of the employment relationship or other legal relationship within which activities related to the procedure specified in the Regulations were performed. The template of the declaration that the persons indicated above are obliged to sign constitutes Attachment No. 3 to the Regulations. These persons will be obliged to conduct all activities covered by the Regulations with due diligence.

§ 4 Scope of violations qualifying for Reports

  • 4.1. A violation of law is an unlawful act or omission, or one aimed at circumventing the law, concerning:
    1. corruption,
    2. public procurement,
    3. services, products, and financial markets,
    4. anti-money laundering and counter-terrorist financing,
    5. product safety and compliance,
    6. transport safety,
    7. environmental protection,
    8. radiological protection and nuclear safety,
    9. food and feed safety,
    10. animal health and welfare,
    11. public health,
    12. consumer protection,
    13. protection of privacy and personal data,
    14. security of network and information systems,
    15. financial interests of the State Treasury of the Republic of Poland, a local government unit, and the European Union,
    16. the internal market of the European Union, including public law rules on competition and state aid as well as corporate taxation,
    17. constitutional freedoms and rights of man and citizen occurring in relations between an individual and public authorities and not related to the fields indicated in points 1-16.
  • 4.2. In a situation where the HR and Administration Department determines that the subject of the submitted internal Report is a violation of law other than those listed in § 4.1, the reporting person will not be treated as a Whistleblower, of which they will be informed by the HR and Administration Department, which will indicate, if possible, the appropriate procedure to follow in a given case.

§ 5 Authorized to make Reports

  • 5.1. A Whistleblower is a natural person who reports or publicly discloses information about a law violation obtained in a work-related Context, including:
    1. an Employee,
    2. a temporary worker,
    3. a Collaborator,
    4. an entrepreneur,
    5. a proxy,
    6. a shareholder,
    7. a member of an organ,
    8. a person providing work under the supervision and direction of a contractor, subcontractor, or supplier,
    9. an intern,
    10. a volunteer,
    11. an apprentice.
  • 5.2. The Regulations also apply to a natural person referred to in § 5.1 in the event of reporting Information about a law violation obtained in a work-related Context before the establishment of an employment relationship or other legal relationship constituting the basis for providing work or services or holding a function in the Company or for the Company, or after its termination.
  • 5.3. To a person applying for a job on the basis of an employment relationship or other legal relationship constituting the basis for providing work or services or holding a function, the Company provides information about the internal Reporting procedure upon commencement of recruitment or negotiations preceding the conclusion of a contract. The template of a declaration confirming familiarity with the contents of the Regulations constitutes Attachment No. 4.

§ 6 Entities covered by protection and the scope of this protection

  • 6.1. The Whistleblower is protected against Retaliatory actions from the moment the Report is made, provided they had reasonable grounds to believe that the Information about a law violation was true at the time the Report was made and that it constitutes information about a law violation.
  • 6.2. A Whistleblower against whom Retaliatory actions have been committed is entitled to compensation in an amount not lower than the average monthly remuneration in the national economy in the previous year, announced for pension purposes in the Official Journal of the Republic of Poland „Monitor Polski” by the President of Statistics Poland, or the right to redress.
  • 6.3. Making a Report cannot constitute the basis for liability, including disciplinary liability or liability for damages due to infringement of the rights of others or obligations set out in legal provisions, in particular regarding defamation, infringement of personal rights, copyrights, personal data protection, and the obligation of secrecy, including business secrets, taking into account Art. 5 of the Act, provided that the Whistleblower had reasonable grounds to believe that the Report is necessary to disclose a violation of law in accordance with the Act.
  • 6.4. The Whistleblower cannot waive the rights set out in the Act and cannot assume liability for damages arising from making a Report. This does not apply to assuming liability for damages arising from the intentional Reporting of false information.
  • 6.5. The provisions of § 6.1 – § 6.4 shall apply accordingly to the Person assisting in making a Report, the Person associated with the Whistleblower, a legal person or other organizational unit assisting the Whistleblower or associated with them, in particular, owned by or employing the Whistleblower.

§ 7 Prohibition of Retaliatory actions

  • 7.1. No Retaliatory actions, nor attempts or threats to apply such actions, may be taken against the Whistleblower.
  • 7.2. If work was, is, or is to be provided on the basis of an employment relationship, Retaliatory actions cannot be taken against the Whistleblower, consisting in particular of:
    1. refusal to establish an employment relationship,
    2. notice of termination or termination without notice of an employment relationship,
    3. non-conclusion of a fixed-term employment contract or an indefinite-term employment contract after the termination of a probationary employment contract, non-conclusion of another fixed-term employment contract, or non-conclusion of an indefinite-term employment contract after the termination of a fixed-term employment contract where the Whistleblower had a legitimate expectation that such a contract would be concluded with them,
    4. reduction in the amount of remuneration for work,
    5. withholding promotion or being passed over for promotion,
    6. omission in granting work-related benefits other than remuneration or reduction of the amount of these benefits,
    7. demotion to a lower job position,
    8. suspension in the performance of employee or official duties,
    9. transferring the Whistleblower’s existing duties to another employee,
    10. unfavorable change in the place of work performance or working time schedule,
    11. negative evaluation of work results or a negative opinion on work,
    12. imposition or application of a disciplinary measure, including a financial penalty, or a measure of a similar nature,
    13. coercion, intimidation, or exclusion,
    14. mobbing,
    15. discrimination,
    16. unfavorable or unfair treatment,
    17. withholding participation or being passed over for selection to participate in training raising professional qualifications,
    18. unjustified referral for medical examinations, including psychiatric examinations, unless separate provisions stipulate the possibility of referring an employee to such examinations,
    19. action aimed at hindering the finding of employment in the future in a given sector or industry on the basis of an informal or formal sectoral or industry agreement,
    20. causing financial loss, including economic loss, or loss of income,
    21. inflicting other non-material damage, including violation of personal rights, in particular the good name of the Whistleblower.
  • 7.3. An attempt or threat to apply a measure specified in § 7.2 is also considered Retaliatory action due to making a Report.
  • 7.4. If work or services were, are, or are to be provided on the basis of a legal relationship other than an employment relationship constituting the basis for providing work or services or holding a function, § 7.2 and § 7.3 apply accordingly, provided that the nature of the work or services provided, or the function held, does not exclude the application of such an action against the Whistleblower.
  • 7.5. If work or services were, are, or are to be provided on the basis of a legal relationship other than an employment relationship constituting the basis for providing work or services or holding a function, making a Report cannot constitute the basis for Retaliatory actions, or attempts or threats to apply Retaliatory actions, including in particular:
    1. termination of a contract to which the Whistleblower is a party, in particular concerning the sale or delivery of goods or the provision of services, withdrawal from such a contract, or its termination without notice;
    2. imposition of an obligation or refusal to grant, limitation, or withdrawal of an authorization, in particular a concession, permit, or relief.
  • 7.6. The provisions of § 7.1 – § 7.8 apply accordingly to the entities referred to in § 6.5, in particular to the Person assisting in making a Report and the Person associated with the Whistleblower.
  • 7.7. The Company, ensuring the protection referred to in this paragraph, taking into account the rules set out in the GDPR, the Act, and the Regulations, takes actions aimed at respecting the protection of personal data, including the Whistleblower, the Person concerned by the Report, and other persons covered by the procedure. This protection covers in particular maintaining the confidentiality of the identity of the indicated persons and ensuring confidentiality at every stage of the proceedings conducted under the Regulations, as well as after its conclusion.
  • 7.8. The actions referred to in § 7.7 include in particular:
    1. allowing only persons authorized by written authorizations granted by the Company to receive and verify internal Reports and to process the personal data of the persons referred to in § 7.7;
    2. obtaining written declarations from the aforementioned persons authorized by the Company on their obligation to maintain the confidentiality of personal data and information obtained in the course of proceedings covered by the Regulations;
    3. holding liable persons who are proven to have breached the obligation referred to above.

§ 8 Communication channels for internal Reports

  • 8.1. Internal Reports may only be submitted via dedicated, confidential communication channels, through:
    1. written form, in accordance with § 8.3 of the Regulations, or
    2. oral form, in accordance with § 8.4, § 9.4, and § 9.6 of the Regulations.
  • 8.2. Internal Reports submitted anonymously will not be considered. In the case of such a report, it is registered without being given further course. Reports bearing a pseudonym will be treated as reported anonymously.
  • 8.3. A written internal Report can be made exclusively via electronic mail (e-mail), sent to the address dedicated to handling internal Reports: signal@phoenix-rtos.com and only by sending a completed internal Report form, constituting Attachment No. 5 to the Regulations, attached to the e-mail (in PDF format).
  • 8.4. Making an oral internal Report is possible only at the Whistleblower’s request during a face-to-face meeting organized by the HR and Administration Department, in accordance with § 9.4 – § 9.6 of the Regulations.
  • 8.5. An oral internal Report is documented in the form of:
    1. a recording of the conversation allowing its retrieval (if the Whistleblower consents to the recording) or
    2. minutes of the meeting, recreating its exact course. The template for the minutes constitutes Attachment No. 6 to the Regulations.
  • 8.6. After the minutes are drafted, the Whistleblower has the right to check, correct, and approve the meeting minutes by signing them.
  • 8.7. In situations of interrupted access to electronic mail, an internal Report may be made orally after scheduling a face-to-face meeting with the HR and Administration Department on the terms set out in § 8.4, § 9.4, and § 9.6 of the Regulations.

§ 9 Method of making internal Reports

  • 9.1. The Whistleblower may make an internal Report on the terms set out in the Regulations or make an external Report.
  • 9.2. To successfully make an internal Report in written form via electronic mail, it is necessary to provide the following information in the form referred to in § 8.3:
    1. name and surname of the Whistleblower,
    2. electronic mail address of the Whistleblower (contact address),
    3. indication of the type of violation (e.g., corruption, discrimination, personal data breach),
    4. description of the violation (if possible, dates, circumstances, and other relevant information).
  • 9.3. The Whistleblower also has the possibility to voluntarily supplement the internal Report with additional information, such as:
    1. contact telephone number of the Whistleblower,
    2. data of persons, entity, or organizational units (cells) that committed the violation (name, surname, name, function/position),
    3. place of the violation (e.g., office, department, other location),
    4. time of the violation (if possible, date, time. In the absence of such data, determining whether the violation took place in the past, is ongoing, may occur in the future, or is of a continuous nature),
    5. information on any actions taken before making the internal Report (e.g., informing a superior, previous reporting to another entity, other actions taken in connection with the violation),
    6. documents or other evidence (photos, videos, audio files, e-mails, screenshots) that can be attached as files to the internal Report.
  • 9.4. To make an internal Report orally, the Whistleblower should submit a request by phone to the number +48 885 522 422 to schedule a meeting to orally communicate the internal Report.
  • 9.5. Within 14 days of receiving the request, a face-to-face meeting will be organized to receive the internal Report.
  • 9.6. Effectively making an internal Report orally requires the Whistleblower to provide at least the data and information specified in § 9.2. The Whistleblower may also voluntarily provide data, information, documents, or other evidentiary materials specified in § 9.3.

§ 10 Receiving and preliminary verification of internal Reports, conducting explanatory proceedings

  • 10.1. The HR and Administration Department is obliged to confirm to the Whistleblower the receipt of an internal Report within 7 days of receiving it, unless the Whistleblower did not provide an e-mail address to which the confirmation should be sent.
  • 10.2. The maximum deadline for providing Feedback to the Whistleblower is a period not exceeding 3 months from the date of confirming receipt of the internal Report, or, in the case of not providing the confirmation referred to in § 10.1, 3 months from the lapse of 7 days from making the internal Report, unless the Whistleblower did not provide an e-mail address to which the confirmation should be sent.
  • 10.3. Confirmation of receipt of an internal Report and provision of Feedback, referred to in § 10.1 and § 10.2, are sent to the e-mail address provided by the Whistleblower. In the event that the Whistleblower requests in the internal Report or at a later stage of the procedure another form of providing Feedback, e.g., by phone, the Feedback is provided in the manner indicated by the Whistleblower.
  • 10.4. In the case of an oral internal Report, confirmation of its receipt may be provided directly during a meeting with the HR and Administration Department. If the Whistleblower does not receive the above confirmation during the meeting, receipt of the internal Report and provision of Feedback, referred to in § 10.1 and § 10.2, will be carried out in accordance with § 10.3.
  • 10.5. The HR and Administration Department performs a preliminary verification of the internal Report and then decides on further Follow-up actions.
  • 10.6. Preliminary verification of an internal Report involves assessing whether:
    1. the violation described therein falls within the catalogue of violations specified in § 4 of these Regulations and the Act,
    2. the internal Report was made by an authorized person, indicated in § 5 of these Regulations and the Act,
    3. the internal Report contains sufficient information to initiate and conduct explanatory proceedings.
  • As part of the preliminary verification, it is possible to consult the content of the internal Report with the manager of the organizational unit in which the violation occurred. If the Report concerns this manager, the consultation takes place with their direct superior.
  • 10.7. If the Report contains sufficient information to initiate explanatory proceedings, the HR and Administration Department conducts Follow-up actions without undue delay. Follow-up actions include, in particular, assessing the truthfulness of the allegations contained in the internal Report.
  • 10.8. In order to determine the truthfulness of the violations, the HR and Administration Department may ask the Whistleblower via their e-mail address or in another way, if indicated by the Whistleblower in accordance with § 10.3 or § 10.4, for explanations or provision of a larger amount of additional information or evidence regarding the submitted internal Report.
  • 10.9. Refusal to provide explanations or to submit additional information referred to in § 10.8, as well as the cessation of further cooperation by the Whistleblower, do not suspend the course of proceedings, including the conduct of explanatory proceedings.
  • 10.10. The HR and Administration Department conducts explanatory proceedings with respect for the dignity of the persons whom the activities concern.
  • 10.11. The HR and Administration Department draws up minutes or official notes from the course of activities undertaken as part of the explanatory proceedings.
  • 10.12. In the course of the proceedings, all evidence that may contribute to clarifying the circumstances indicated in the internal Report is admitted, in particular:
    1. documents,
    2. minutes,
    3. statements,
    4. official notes.
  • 10.13. As part of the explanatory proceedings, the HR and Administration Department is authorized, in particular, to:
    1. hear the Whistleblower,
    2. hear the Person concerned by the Report,
    3. hear Employees and Collaborators who may have information relevant to the case,
    4. receive documents or objects relevant to the case,
    5. analyze documents and any other data, including securing electronic information carriers.
  • 10.14. Minutes are drawn up for each hearing or receipt of documents/objects, according to the template constituting Attachment No. 7 to the Regulations.
  • 10.15. The minutes are presented to the heard person for reading and approval. After accepting the content, the minutes are signed by all participants in the activity. The heard person has the right to submit objections to the content of the minutes – objections are entered into the minutes and also signed.
  • 10.16. After completing the explanatory activities, the HR and Administration Department assesses the validity of the internal Report and makes a decision in the case; in particular, it may:
    1. consider the internal Report unjustified and close the proceedings,
    2. consider the internal Report justified and propose actions aimed at effectively eliminating the identified law violations,
    3. conclude that the Regulations do not apply to recognizing the internal Report,
    4. conclude that due to the insufficient scope of information or lack of cooperation from the Whistleblower, it was not possible to recognize the internal Report,
    5. conclude that other reasons occurred that made it impossible to recognize the internal Report,
    6. decide to notify the competent authorities if the nature of the report or the revealed circumstances require it.
  • 10.17. The decision of the HR and Administration Department is documented in the form of a final report.
  • 10.18. After the procedure is completed, the HR and Administration Department provides the Whistleblower with Feedback on the manner of its handling. If the nature of the Report permits, the HR and Administration Department may additionally indicate alternative possibilities for solving the reported problem through other available paths of procedure.

§ 11 Maintaining the Register of Internal Reports

  • 11.1. The Company acts as the controller of personal data contained in the Register of Internal Reports. The Register may be maintained in the form of an Excel spreadsheet (the Register template constitutes Attachment No. 8).
  • 11.2. The HR and Administration Department makes entries into the Register of Internal Reports on the basis of a received internal Report. The HR and Administration Department is also responsible for maintaining the Register on an ongoing basis. In the case specified in § 3.6 of the Regulations, the obligations referred to in this § 11.2 will be performed by a Management Board member.
  • 11.3. Every internal Report is registered in the Register of Internal Reports, regardless of the further course of explanatory proceedings.
  • 11.4. The Register of Internal Reports includes:
    1. internal Report number,
    2. date of making the internal Report,
    3. personal data of the Whistleblower and the Person concerned by the Report, necessary to identify these persons,
    4. electronic mail address of the Whistleblower (contact address),
    5. subject of the law violation,
    6. information on Follow-up actions taken,
    7. case closure date.
  • 11.5. Access to the Register of Internal Reports is granted exclusively to authorized persons.
  • 11.6. Personal data and other information in the Register of Internal Reports are stored for a period of 3 years after the end of the calendar year in which Follow-up actions were completed, or after the conclusion of proceedings initiated by these actions.

§ 12 Processing of personal data, documents

  • 12.1. The processing of personal data of the Whistleblower and other persons, obtained in connection with the proceedings specified in the Regulations, takes place in accordance with the personal data protection procedures applicable in the Company, adopted pursuant to the GDPR provisions, and in accordance with the provisions of the Act.
  • 12.2. Upon receiving an internal Report, the Company processes personal data to the extent necessary to accept this report or take potential Follow-up actions. Personal data that are not relevant to considering an internal Report are not collected, and if collected accidentally, they are immediately deleted. The deletion of this personal data takes place within 14 days from the moment it is determined that they are irrelevant to the case.
  • 12.3. Personal data processed in connection with accepting an internal Report or taking Follow-up actions, and documents related to such a report, are stored by the Company for a period of 3 years after the end of the calendar year in which Follow-up actions were completed, or after the conclusion of proceedings initiated by these actions.
  • 12.4. The Company deletes personal data and destroys documents related to an internal Report after the retention period has expired, unless documents related to this report constitute part of files of preparatory proceedings, court proceedings, or court-administrative proceedings.
  • 12.5. Each time, within the deadlines indicated in Art. 13 and 14 of the GDPR, the Whistleblower and persons whose personal data will be processed in connection with making an internal Report by the Whistleblower will be presented with a relevant information clause regarding the rules for processing personal data, in accordance with the content of Attachment No. 9 or Attachment No. 10 to the Regulations.

§ 13 Disclosure of Whistleblower’s identity

  • 13.1. The personal data of the Whistleblower, allowing their identity to be established, is not subject to disclosure to unauthorized persons, unless with the explicit consent of the Whistleblower.
  • 13.2. The provisions of § 13.1 do not apply when disclosure is a necessary and proportionate obligation resulting from legal provisions in connection with explanatory proceedings conducted by public authorities or preparatory or court proceedings conducted by courts, including in order to guarantee the right of defense vested in the Person concerned by the Report.
  • 13.3. Before making the disclosure referred to above, the competent public authority or the competent court notifies the Whistleblower of this fact, sending an explanation in paper or electronic form of the reasons for disclosing their personal data, unless such notification would jeopardize the explanatory proceeding, preparatory proceeding, or court proceeding.

§ 14 Information on external reporting procedure

  • 14.1. A Whistleblower may make an external Report without first making an internal Report.
  • 14.2. An external Report is received by the Ombudsman or a Public Authority. The Ombudsman and the Public Authority act as separate controllers regarding personal data provided in an external Report received by these authorities.
  • 14.3. An external Report can be made orally or in writing. The Ombudsman and a Public Authority may accept Reports made anonymously.
  • 14.4. An external Report in documentary form can be made:
    1. in paper form to the correspondence address indicated by the Ombudsman or the Public Authority receiving the external Report;
    2. in electronic form to an electronic mail address or an electronic delivery box address, or an electronic delivery address, indicated by the Ombudsman or the Public Authority receiving the Report, or via a dedicated web form or an application indicated by the Public Authority as appropriate for submitting reports in electronic form.
  • 14.5. The Ombudsman or Public Authority that accepted an external Report sends the Whistleblower, immediately, but no later than 7 days from the day of accepting the Report, confirmation of its acceptance, unless the Whistleblower explicitly submitted a different request in this regard or the Ombudsman or Public Authority has reasonable grounds to believe that confirming receipt of the Report would jeopardize the protection of the confidentiality of the Whistleblower’s identity.
  • 14.6. The Ombudsman or Public Authority may ask the Whistleblower, using the contact address provided, for explanations or additional information that they may possess. If the Whistleblower objects to sending the requested explanations or additional information, or if sending them could jeopardize the protection of the confidentiality of their identity, the Ombudsman or Public Authority refrains from demanding explanations or additional information.
  • 14.7. The Ombudsman:
    1. accepts external Reports regarding law violations in the areas indicated in Art. 3 sec. 1 points 1-16 of the Act, conducts their preliminary verification, and forwards them to a public authority competent to take Follow-up actions,
    2. accepts and processes external Reports if such a report concerns a law violation in the field indicated in Art. 3 sec. 1 point 17 of the Act and no other Public Authority is competent to take Follow-up actions,
    3. ensures common access to information about the rights and legal remedies available to Whistleblowers and entities referred to in § 6.5, including the Person assisting in making a Report and the Person associated with the Whistleblower, against Retaliatory actions, in particular by publishing this information on its website in the Public Information Bulletin,
    4. provides advice to Whistleblowers and entities referred to in § 6.5 in the scope referred to in point 3 above,
    5. provides Whistleblowers and entities referred to in § 6.5 with information about authorities that, within the scope of their tasks, may take actions serving to protect Whistleblowers against Retaliatory actions, and, where appropriate, support in contacts with such authorities, in particular by informing competent authorities of the perceived need to cover a Whistleblower with protection.
  • 14.8. If an external Report concerns Information about a law violation, the Ombudsman immediately, but no later than within 14 days of the Report being made, forwards the Report to a public authority competent to take Follow-up actions.
  • 14.9. The Ombudsman informs the Whistleblower about the forwarding of the external Report. The information includes at least an indication of the public authority to which the external Report has been forwarded and the date of forwarding.
  • 14.10. The Ombudsman refrains from forwarding an external Report if the Report does not concern Information about a law violation.
  • 14.11. The Ombudsman informs the Whistleblower about refraining from forwarding the external Report, providing findings from the preliminary verification of the Report.
  • 14.12. A public authority:
    1. accepts an external Report,
    2. conducts preliminary verification of an external Report, consisting of determining whether such report concerns Information about a law violation, and determining whether it concerns law violations within a field belonging to the scope of operations of this authority, and if not – determining a public authority competent to take Follow-up actions;
    3. considers an external Report – in the event that this report concerns law violations within a field belonging to the scope of operations of this authority,
    4. forwards an external Report immediately, but no later than within 14 days from its making, and in justified cases – no later than within 30 days, to a Public Authority competent to take Follow-up actions in the event that the external Report concerns law violations in a field not belonging to the scope of operations of this authority – and informs the Whistleblower thereof,
    5. takes Follow-up actions with due diligence,
    6. provides the Whistleblower with Feedback.
  • The provisions of § 14.10 and § 14.11 apply accordingly.
  • 14.13. A Public Authority provides the Whistleblower with Feedback within a period not exceeding 3 months from the date of accepting the external Report. In justified cases, a Public Authority provides the Whistleblower with Feedback within a period not exceeding 6 months from the date of accepting the external Report, after informing the Whistleblower thereof before the lapse of the 3-month period.
  • 14.14. Personal data processed in connection with accepting an external Report and documents related to this report are stored by the Ombudsman for a period of 12 months after the end of the calendar year in which the external Report was forwarded to a Public Authority competent to take Follow-up actions.
  • 14.15. Personal data processed in connection with accepting a Report or taking Follow-up actions and documents related to this report are stored by a Public Authority for a period of 3 years after the end of the calendar year in which the external Report was forwarded to a Public Authority competent to take Follow-up actions or Follow-up actions were completed, or after the conclusion of proceedings initiated by these actions.
  • 14.16. The Ombudsman and Public Authority delete personal data and destroy documents related to an external Report after the retention period has expired, unless documents related to this report constitute part of files of preparatory proceedings, court proceedings, or court-administrative proceedings.
  • 14.17. In appropriate cases, external Reports may be submitted to institutions, bodies, offices, or agencies of the European Union.

§ 15 Final provisions

  • 15.1. In matters not regulated by the Regulations, the relevant provisions of the Act shall apply.
  • 15.2. The Regulations shall enter into force after the lapse of 7 days from being communicated to persons performing work, in the manner adopted by the Company.
  • 15.3. Any amendments to the Regulations shall be made in writing according to the procedure applicable for its establishment and will be recorded in the register of amendments to the Regulations, constituting Attachment No. 11.

Warsaw, date 17.10.2025 Regulations approved by:

Paweł Pisarczyk, President & CEO
Kaja Swat, Vice-President & COO
Marek Białowąs, Vice-President & CTO