Adapt’s Whistleblower Policy

1.1 Legal requirement

The Whistleblower Directive as of 17/12-2021, with effect from 17/12-2023. All companies with more than 50 employees must have a process and a reporting channel.

The reporters need to know about the process and how a case is being handled before they report anything. The case needs to be handled efficiently and they need to receive confirmation about the receival of the case within 7 days and a full answer/report about what has been investigated within 3 months from the receival date.

Whistleblower: A natural person who reports or publishes information about violations that the person has gained access to in connection with that person's work-related activities.

Affected person: A natural or legal person specified in the report or publication as a person to whom the violation can be attributed or to whom said person is associated to.

1.2 What can be reported

• Economic crime (embezzlement, bribery, fraud, money laundering, forgery)

• Environmental treads (environment, health, and safety)

• Providing false or misleading information to the public

• Violations in any kind (Physical violence or sexual abuse)

• Breach of occupational safety

1.3 Who can report

• All employees (Full time, part time, Student assistant, and trainees

• Former employees

• Customers

• Vendors

Reporters can be confidential if desired.

Requirements for the reporting channel

The whistleblower scheme must first and foremost consist of a secure reporting channel that complies with the GDPR rules and other security requirements.

Whistleblowers must be able to report orally, in writing or both. In Adapt you have both options.

In schemes where it is possible to report orally, the whistleblower has the right to a physical meeting if the whistleblower requests it. Such a meeting must as a starting point be offered within seven days.

All employees must be able to report through the reporting channel.

Other people who are connected to your company can also be given the opportunity to use the reporting channel.

The persons responsible for the reporting channel must be impartial.

Our reporting channel in Adapt is complient with all the above.

1. 4 Requirements for the procedure

• The reporting channel must be designed in a way that ensures confidentiality in relation to the whistleblower and the other persons mentioned in the whistleblower policy.

• A whistleblower unit must be appointed, which is responsible for communicating with the whistleblower and following up on the cases (can be advantageously the same employee or department that receives the reports)

• The whistleblower must receive confirmation of the report within seven days, this can be a autoreply.

• The whistleblower must receive feedback on the outcome of the case and a reason for this within three months of reporting the case.

1.5 Protection of the reporter

• All whistleblowers who use the reporting channel with reasonable grounds are entitled to protection

• The whistleblower's identity must not be disclosed to unauthorized persons

• The information in the report may only be passed on as part of follow-up on the case

• Processing of personal data must follow the GDPR regulations

• Reports may only be kept for as long as necessary

• Reports may only be kept for as long as is necessary and proportionate to fulfill requirements arising from the whistleblower act, or if there is a legitimate reason for continued storage, e.g. if it is required by other legislation, or if there is reason to believe that the report can be strengthened by later reports (linking). There is no specific deadline for how long reports must be kept. Storage in accordance with the data protection legal rules will generally meet the requirements.

• Any form of threats or attempted reprisals against whistleblowers or other protected persons is prohibited.

• Whistleblowers can report anonymously*

• Due to the requirement of confidentiality, reports must not be stored and processed in a generally accessible place, such as e.g. a shared drive or an archive where there is general access for the workplace's other employees.

• In Adapt all communication will stay in the Proton Inbox.

*Anonymously: Whistleblowers can report anonymously without revealing their identity. It will require that they create a private email account, to send and receive the case information from. Whistleblowers can also be confidential, so only the whistleblower unit know there identity. This needs to be stated in the email.

In some cases the whistleblower unit might ask if they can share the Whistleblowers identity, to make sure they can investigate the case and talk with other implecated people.

Complaint: the whistleblower can, within 5 working days after receiving the case report, complain/object to the report. Then the whistleblower unit has to re-check that all investigations needed were performed, or comment on why it was enough.

2.1 Case Assessment

Once a case has been submitted and received by the Whistleblower unit, the case will be assessed in accordance with its nature, its gravity of infringement and to which parties involvement is needed in the administration thereof.

The parties and level of involvement are indexed as follows:

• Whistleblower unit: as the first party of contact, the whistleblower unit will always be involved in the administration of the case. The unit will assess if the submitted case requires more parties involved or if the unit itself is capable of administering the case.

• The individual Director: If the case involves an incident that has occurred within the same department, the individual Director will be involved in the administration of the case.

• Management Group: If the case involves an incident that has occurred across two or more BU’s the management group will be involved in the administration of the case. The same is evident if the incident is client-, partner- or other third-party- related.

• External: If the incident is of a serious nature, to which the whistleblower unit and management group find a criminal offense has occurred, an external judicial third-party will be involved in the administration of the case. (If judicial assistant is needed, we will involve our lawyers from Bird&Bird)

2.2 Adequate information on the case

The purpose of the case submission form is to ensure enough or adequate information is provided to the whistleblower unit allowing them to proceed with the administration of the case. However, in the instance the case submission is lackful or of a profound complexity that requires more detailed information, the whistleblower unit will return to submitter, whether anonymous or not, for additional input.

2.3 Output

An outcome of the case has to happen within three months from the date the case submission has been received. The output to submitter will consist of a standardized mail to submitter and involved parties describing the nature of the case, how it has been processed and what the final outcome is. The standardized mail will contain following questions answered:

• What have the whistleblower unit and involved parties investigated?

• What events have occurred since the submission of the case?

• What are the results of the investigation?

• What actions have been taken to solve the case?

Complaint: should the submitter not feel that the case has been handled correctly and/or the outcome is wrongful, the submitter have the opportunity to make an objection to the whistleblower unit via mail within 5 working days after receiving the communicated output.

2.1 Case Process Visualized