WHISTLEBLOWING PROCEDURE

Clause 1

Introduction

1.      This document (hereinafter “the SOP”) is being implemented following the obligation under the EU Directive 2019/1937 of the European Parliament and of the Council of
23 October 2019 on the protection of whistleblowers under Union law.

2.      This SOP is intended to ensure the efficient internal whistleblowing system, which will be compliant with the domestic and European legislation.

3.      This SOP shall cover mechanisms for counteracting and elimination of irregularities at RWW HE Sp. z o.o. (hereinafter “the Company”) by opening whistleblowing channels and establishing the mechanism for the examination of reports, while ensuring the protection of whistleblowers against possible retaliatory actions.

Clause 2

Definitions

1.      Each time the reference is made in this SOP to:

a.       The Whistleblower – it shall be understood as a natural person who reports or publicly discloses a breach of law which they have become aware of in the work-related context, including:

-        employee;

-        individual who provides work on a basis other than employment relation, including under a civil law contract;

-        entrepreneur;

-        associate;

-        member of the body of the legal person or organization unit without legal personality;

-        individual who provides work under the supervision and management of the contractor, subcontractor or supplier;

-        trainee;

-        volunteer;

-        apprentice;

b.      internal report – it shall be understood as a report about a breach of law made verbally or in writing to the legal entity;

c.       external report – it shall be understood as a report about a breach of law made verbally or in writing to the Commissioner for Human Rights or to a public authority;

d.      breach of law - action or omission which is not compliant with law or is intended to circumvent the law, concerning:

-        corruption;

-        public procurement;

-        financial services, products and markets;

-        countering money laundering and terrorist financing;

-        product safety and compliance with requirements;

-        transport safety;

-        environment protection;

-        radiological protection and nuclear safety;

-        food and feed safety;

-        animal health and well-being;

-        public health;

-        consumer protection;

-        privacy and personal data protection;

-        network and IT systems security;

-        financial interests of the State Treasury of the Republic of Poland, local government units and the European Union;

-        the internal market of the European Union, including public law competition and State aid rules and corporate taxation;

-        constitutional freedoms and rights of the human being and the citizen relevant for the relations between the individual and public authorities and unrelated to the domains indicated in this subpoint;

e.       follow-up measure – it shall be understood as any action taken by the legal entity to assess the veracity of the reported information and to prevent a reported breach of law covered therein, in particular by way of investigation, initiation of inspections or administrative proceedings, prosecution, action taken to recover funds, or closure of the proceedings under the internal whistleblowing and follow-up procedure or those under or the external whistleblowing and follow-up procedure;

f.        retaliatory action – it shall be understood as direct or indirect act or omission in a work-related context, which is triggered by a report or a public disclosure, and infringes or is likely to infringe the rights of the Whistleblower or causes or is likely to cause unjustified harm to the Whistleblower, including an unjustified opening of proceedings against them.

g.       feedback – it shall be understood as information provided to the Whistleblower on follow-up measures, either planned or implemented, and reasons for such measures;

h.      work-related context – it shall be understood to cover past, present or future actions related to the provision of work under the employment relation or any other legal relation which forms the basis for the provision of work or services or for holding a function at a legal entity or on its behalf, where the information about a breach of law is obtained and there is a risk of retaliatory actions;

i.           public authority – it shall be understood as supreme and central government administration bodies, field government administration bodies, bodies of local self-government units, other state bodies and other entities which perform public administration tasks under the law, and are competent to take follow-up measures in areas indicated in sub-point d) above;

j.           person concerned by the report – it shall be understood as a natural person, legal person or organization unit without legal personality but granted with legal personality under the law, mentioned in a report or in a public disclosure as a person who has committed a breach of law or as a person to whom the person who has committed a breach of law is related;

k.       person who assists in making the report – it shall be understood as a natural person who assists the Whistleblower in making a report or a public disclosure in a work-related context and whose assistance should not be disclosed;

l.         person related to the Whistleblower – it shall be understood as the natural person who may experience retaliatory actions, including the coworker or the closest person of the Whistleblower within the meaning of Article 115, § 11 of the Criminal Code Act of 6 June 1997 (Journal of Laws of 2024, item 17);

m.    public disclosure – it shall be understood as disclosing to the public the information about a breach of law.

Clause 3

Body authorised to receive reports

1.      The person authorised to receive internal reports on behalf of the Company shall be Jolanta Neumann (position: Head of HR). Should a report concern the said person, the General Manager shall be authorised to carry out her duties.

2.      The duties of the person referred to in paragraph 1 shall be to:

a.    receive reports on breaches of law;

b.    perform a preliminary check of the report and forward it for further follow-up;

c.     appoint members of the Investigation Committee;

d.    contact the Whistleblower;

e.    provide feedback;

f.      keep the register of reports.

3.      The register of reports shall be kept in electronic form and shall include:

a.       report number;

b.      subject of the breach of law;

c.       personal data of the Whistleblower, the person concerned by the report, as needed for their identification;

d.      contact address of the Whistleblower;

e.       date of the report;

f.        information on follow-up measures, if any;

g.       case closure date.

4.      The person referred to in paragraph 1 shall make an entry into the register based on the internal report on the breach of law.

5.      Personal data and other information in the register of internal reports shall be retained for a period of 3 years after the end of the calendar year when relevant follow-up measures have been completed or the proceedings triggered by such measures have been terminated.

Clause 4

Whistleblowing rules

1.      The person referred to in Clause 3, paragraph 1 shall receive reports on the breach of law in the following forms:

a.       in writing – in electronic form – in the template included in Appendix 1 hereto. Reports shall be sent to the e-mail address: sygnalista.warsaw@raffles.com, together with the Whistleblower’s correspondence or electronic address to be used as “contact address”;

b.      in writing – in snail mail form – in the template included in Appendix 1 hereto. Reports shall be sent to the person referred to in Clause 3, paragraph 1 (the recipient) at the address of the Company: ul. Krakowskie Przedmieście 13, 00-071 Warsaw, together with the Whistleblower’s correspondence or electronic address to be used as “contact address”, and the mention on the envelope “by hand delivery”;

c.       verbally – at the Whistleblower’s request, within 14 days following its receipt, the person referred to in Clause 3, paragraph 1 shall organise a meeting and produce the minutes with the details of its course. The Whistleblower shall sign the minutes after their approval.

2.      In particular, the report shall include:

a.       data and place of the breach of law or date when the Whistleblower became aware of its occurrence;

b.      description of the situation or circumstances when the breach of law has occurred:

c.       identification of the person concerned by the report;

d.      identification of witnesses of the breach, if any;

e.       all evidence and information held by the Whistleblower which may be helpful in the follow-up process.

3.      Within 7 days after the report has been received, the Whistleblower shall receive the acknowledgment of its acceptance, except for situations when they failed to provide their “contact address”.

4.      Anonymous reports shall be accepted in the same form as reports made under the name, referred to in paragraph 1, points (a)-(b) above. With the proviso that the template included in Appendix 1 will not apply.

5.      The contents of the anonymous report shall be compliant with the provisions of paragraph 2 above.

6.      After the preliminary check has been performed and the entry has been made in the register of reports, the body referred to in Clause 3, paragraph 1 shall forward the report to the Investigation Committee for further processing.

7.      Making reports on the breach of law which has not occurred shall be subject to criminal liability referred to in § 8 below.

Clause 5

Follow-up measures

1.    The Investigation Committee shall be the internal body entitled to run investigation proceedings, and shall be composed of:

a.       the person referred to in Clause 3, paragraph 1; and

b.      at least 1 independent person – the category may include persons from outside the Company.

2.    For the purpose of investigation proceedings the person referred to in Clause 3, paragraph 1 shall appoint at least 1 independent person who shall sign the confidentiality and personal data protection agreement before they start their work.

3.    The Investigation Committee shall take steps to examine the contents of the report and establish whether such report was made in good faith.

4.    If the information covered by the report is insufficient, the person referred to in Clause 3, paragraph 1 shall contact the Whistleblower to fill in the gaps in the report.

5.    The Investigation Committee shall renounce to start the investigation if the information covered by the report is insufficient and additional information required for the investigation could not be obtained from the Whistleblower or if it has been established that the report was made in bad faith.

6.    The actions of the Investigation Committee shall be documented in a thorough and transparent manner. This shall concern in particular:

a.       minutes – produced after each meeting of the Committee;

b.      electronic correspondence;

c.       memos from interviews;

d.      phot documentation.

7.    Should the Investigation Committee confirm during the proceedings that the report is well-founded, it shall produce the report with the recommendations on corrective and preventive measures to be taken in order to remedy the existing situation covered by the report or to take steps to prevent similar occurrences in the future.

8.    The report produced by the Investigation Committee shall be forwarded to the Management Board of the Company which shall assess the submitted corrective action plan and decide about its approval, rejection or modification.

9.    Feedback on the course of follow-up measures shall be provided to the Whistleblower by the person referred to in Clause 3, paragraph 1, at the latest within 3 months after the receipt of the internal report was acknowledged.

Clause 6

Retaliatory actions

1.      The Whistleblower shall not be subject to any retaliatory measures or any attempts or threats of such measures.

2.      If the Whistleblower has provided, still provides or will provide work  based on the employment relationship, no retaliatory actions shall be taken against them, and in particular:

a.       refusal to enter into the employment relationship;

b.      termination of the employment relationship with or without notice;

c.       failure to conclude a fixed-term employment contract or an employment contract for an indefinite period after the termination of a trial period employment contract, failure to conclude another fixed-term employment contract or failure to conclude an employment contract for an indefinite period after the termination of a fixed-term employment contract;
- if the Whistleblower had reasonable grounds to believe that such contract would be concluded;

d.      reduced remuneration for work;

e.       withholding promotion or omission in promotion;

f.        omission when granting work-related benefits other than the remuneration or reduced amount of such benefits;

g.       demotion;

h.      suspension of employee or professional duties;

i.         transfer of the Whistleblower’s duties to another employee;

j.         unfavourable change in the place of work or the working time schedule;

k.       negative assessment of work performance or negative opinion about work;

l.         imposition or application of a disciplinary measure, including a financial penalty, or a measure of similar nature;

m.    coercion, intimidation or exclusion;

n.      mobbing;

o.      discrimination;

p.      unfavourable or unfair treatment;

q.      suspension of participation or omission in the selection for training to improve professional qualifications;

r.        unjustified referral for medical examinations, including psychiatric examinations, unless separate regulations provide for the option to refer the employee for such examinations;

s.       action intended to make it more difficult to find a job in the future in a specific sector or industry, based on the informal or formal sectoral or industry agreement;

t.        financial loss, including economic loss, or loss of income;

u.      other non-material damage, including infringement of personal rights, in particular the good repute of the Whistleblower.

3.      Retaliatory actions for making a report or a public disclosure shall also be deemed to include any attempt or threat to use the measure defined in paragraph 2.

4.      If the work or services were, are or are to be provided on a basis used to provide work or services or to perform a function or duty other than the employment relationship, the provisions of paragraphs 2-3 shall apply accordingly, unless the nature of the work or services provided or the function or duty performed excludes the use of such measure towards the Whistleblower.

5.      If the work or services were, are or are to be provided on a basis used to provide work or services or to perform a function or duty other than the employment relationship, the report or the public disclosure may not give rise to retaliatory actions or an attempt or threat to employ such retaliatory actions, including in particular:

a.       termination of the agreement to which the Whistleblower is a party, in particular concerning the sale or delivery of goods or the provision of services, withdrawal from such agreement or its termination without notice;

b.      imposition of an obligation or refusal to grant an entitlement, its restriction or withdrawal, in particular a license, a permit or a relief;

6.      The Whistleblower against whom retaliatory actions have been taken shall be entitled to damages in an amount not lower than the average monthly salary in the national economy in the preceding year, published for retirement purposes in the Official Journal of the Republic of Poland ‘Monitor Polski’ by the President of the Central Statistical Office, or to a compensation.

7.      The person who has been harmed due to the deliberate reporting of false information by the Whistleblower shall be entitled to compensation or damages for violation of personal rights, to be paid by the Whistleblower who has made such report.

8.      The provisions of this paragraph shall apply accordingly to the person who assists in making the report and to the person related to the Whistleblower.

Clause 7

Personal data protection and privacy

1.      The Company shall be the controller of the Whistleblower’s personal data, the personal data of other persons mentioned in the report, and the personal data collected in the register of reports.

2.      The personal data of the Whistleblower and persons concerned by the report shall be stored and protected in line with the provisions of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (“GDPR”).

3.      The Whistleblower’s personal data which allow for their identification shall not be disclosed to any unauthorised persons, unless the Whistleblower consents to such disclosure. The exception shall apply when the disclosure is a necessary and proportionate obligation under the law, to be met in connection with investigations conducted by public authorities or preliminary proceedings or prosecutions conducted by courts, including in order to guarantee the right of defence of the person concerned by the report.

4.      After receiving the report, the Company shall process personal data to the extent necessary to accept such report or to take a follow-up measure, if any.

5.      The Company shall ensure that this Whistleblowing SOP and the processing of personal data in connection with  received reports prevents any unauthorised persons from getting access to the information covered by the report and shall ensure that the confidentiality of the identity of the Whistleblower, the person concerned by such report and the third person named therein is protected. Confidentiality safeguards shall apply to information which may be used to identify such persons, either directly or indirectly.

6.      The persons with the written authorisation from the Company shall be the only ones allowed to receive and verify internal reports, take follow-up measures and process the personal data of persons referred to in paragraph 3. The authorised persons shall keep secret the information and personal data which they have obtained while receiving and verifying internal reports and taking follow-up measures, also after the termination of their employment or another legal relationship under which they performed such work.

7.      Personal data processed in connection with the received report shall be retained for a period of 3 years after the end of the calendar year when relevant follow-up measures have been completed or the proceedings triggered by such measures have been terminated.

Clause 8

Criminal liability

Pursuant to the Whistleblower Protection Act of 14 June 2024 (Journal of Laws, item 928):

a.       Whoever, in order to prevent another person from making a report, prevents or materially hinders that person from doing so, shall be liable to a fine, a restriction of liberty or an imprisonment of up to one year (Article 54, paragraph 1 of the Act).

b.      Should the perpetrator of the act referred to in paragraph 1 use violence, unlawful threat or deceit against another person, they shall be liable to an imprisonment of up to 3 years (Article 54, paragraph 2 of the Act).

c.       Whoever takes retaliatory actions against the Whistleblower, a person who assists in making the report or a person related to the Whistleblower shall be liable to a fine, a restriction of liberty or an imprisonment for up to 2 years (Article 55, paragraph 1 of the Act).

d.      Should the perpetrator of the act referred to in paragraph 3 be persistent in their actions they shall be liable to an imprisonment of up to 3 years (Article 55, paragraph 2 of the Act).

e.       Whoever, contrary to the provisions of the Act, discloses the identity of the Whistleblower, the person who assist in making the report or the person related to the Whistleblower, shall be subject to a fine, a restriction of liberty or an imprisonment of up to one year (Article 56 of the Act).

f.        Whoever makes a report or a public disclosure knowing that no breach of law has occurred shall be liable to a fine, a restriction of liberty or an imprisonment for up to 2 years (Article 57 of the Act).

Clause 9

External reports

1.      The Whistleblower shall be entitled to make an external report to the Commissioner for Human Rights or to public authorities.

2.      The Commissioner for Human Rights and the public authority shall be separate controllers of personal data covered by the respective external report which they have accepted.

3.      The detailed procedure for making external reports has been described in Chapter 4 of the Whistleblower Protection Act of 14 June 2024 (Journal of Laws, item 928):

Clause 10

Final provisions

1.      This SOP has been approved after the consultations with the representatives of Employees, elected according to the procedure in place at the Company. The declaration on the approval of the SOP and the conduct of consultations has been included in Appendix 2 hereto.

2.      The Head of HR Department shall be responsible for the implementation, compliance with and updates of this SOP in the event of changes in the applicable legislation.

3.      This SOP shall become effective on 25 September 2024.

Appendices:

1)     Whistleblowing report template:

2)     Declaration of the representatives of Employees on the conduct of consultations and the approval of the SOP before its announcement.