§ 1 INTRODUCTION

1 Pursuant to Article 25(1) and (2) of the Act of 14 June 2024 on the Protection of Whistleblowers (Journal of Laws of 2024, item 928, hereinafter referred to as the “Act”), VM.PL Sp. z o.o., with its registered office in Wrocław at ul. T. Kościuszki 82, 50-441 Wrocław, entered in the register of entrepreneurs maintained by the District Court for Wrocław-Fabryczna, 6th Commercial Division of the National Court Register under KRS number 0000201477 (hereinafter referred to as “VM.PL”), hereby establishes the “Procedure for Internal Reports at VM.PL”, which sets out the rules for internal reporting of violations of law, taking follow-up actions, and protecting persons reporting violations of law (whistleblowers).

2. Receiving reports of violations of law is an element of proper and safe management at VM.PL. It serves to increase the effectiveness of detecting irregularities and taking actions aimed at eliminating them and reducing risk at all organizational levels. The Employer’s objective is to increase the effectiveness of detecting irregularities and taking effective actions to eliminate them and effectively manage risk, as well as to increase trust among employees and business partners; therefore, the Employer encourages the use of the Procedure in situations where it is possible to remedy a violation of law within the Employer’s structure.

3. The internal reporting procedure was established after consultation with the representative of persons performing work at VM.PL, selected in accordance with the procedure applicable at VM.PL.

4. Each person performing work at VM.PL is obliged to familiarize themselves with the content of the Internal Reporting Procedure and to comply with it.

§ 2 DEFINITIONS

Whenever the Internal Reporting Procedure refers to:

1. Procedure – this shall mean the Internal Reporting Procedure concerning the receipt of reports of violations of law and the taking of follow-up actions.

2. Entity/Employer/VM.PL – this shall mean VM.PL Sp. z o.o., with its registered office in Wrocław at ul. T. Kościuszki 82, 50-441 Wrocław, entered in the register of entrepreneurs maintained by the District Court for Wrocław-Fabryczna, 6th Commercial Division of the National Court Register under KRS number 0000201477.

3. Whistleblower Team / Team – this shall mean a team of persons responsible for receiving reports and taking follow-up actions, including conducting explanatory proceedings concerning the report. The Team consists of its Chairperson and at least one Deputy Chairperson.

4. Whistleblower – this shall mean a natural person who makes a report (internal, external, or public disclosure) concerning a violation of law in a work-related context, regardless of position held, form of employment or cooperation, including an entrepreneur, commercial proxy, shareholder or partner, member of a governing body of a legal person or organizational unit without legal personality, a person performing work under the supervision and direction of a contractor, subcontractor or supplier, including under a civil law contract, trainee, volunteer, or intern. A Whistleblower shall also mean a person referred to in Article 4(2) of the Act.

5. Report – this shall mean an oral or written communication to the Employer of information concerning a violation of law.

6. Person concerned by the report – this shall mean a natural person, legal person, or organizational unit without legal personality to which the Act grants legal capacity, indicated in the report or public disclosure as a person who committed a violation of law, or as a person connected with the person who committed a violation of law.

7. Follow-up action – this shall mean an action taken to assess the accuracy of the information contained in the report and to counteract the violation of law that is the subject of the report, including explanatory proceedings.

8. Reporting channel – this shall mean technical and organizational solutions enabling the submission of reports.

9. Retaliatory action – this shall mean any direct or indirect act or omission in a work-related context caused by a report or public disclosure, which violates or may violate the rights of the Whistleblower, or causes or may cause unjustified harm to the Whistleblower, including the unfounded initiation of proceedings against the Whistleblower.

§ 3 MAKING REPORTS

1. The persons responsible for receiving reports and exercising overall supervision over the receipt of reports and the taking of follow-up actions are the persons designated by VM.PL, forming the Whistleblower Team. Members of the Team are appointed for an indefinite period. Information on the composition of the Team shall be provided in the customary manner.

2. Each member of the Team may act independently with regard to receiving reports. The handling of reports, including in particular the taking of follow-up actions, requires the cooperation of all Team members. Decisions shall be made by a majority of votes, and minutes shall be prepared from Team meetings and decisions. In case of doubts, the Team may consult the legal department and the VM.PL support department. Taking follow-up actions requires approval by the Management Board.

3. Each Team member shall act impartially and independently, on the basis of authorization to process personal data for the person designated to handle whistleblower reports.

4. A Team member with respect to whom the content of the report indicates that they may in any way be involved in the act or omission constituting the subject of the report may not analyze such report or otherwise handle it. VM.PL shall provide an alternative method for making reports concerning each Team member, in order to examine reports concerning them.

5. The Whistleblower may submit a report through the following channels:

1. postal mail: sent to VM.PL Sp. z o.o., with its registered office in Wrocław at ul. T. Kościuszki 82, 50-441 Wrocław, marked “report, to the addressee only _________ [name and surname]”. This is the appropriate channel for submitting a report concerning one of the Team members. Information on the current composition of the Team may be obtained by sending an inquiry to sygnal@vm.pl.
2. e-mail: to the address sygnal@vm.pl.
3. Forms form: made available by VM.PL on the internal SharePoint;
4. dedicated correspondence box at the VM.PL office: the box is located in a publicly accessible area without monitoring; the exact location of the box is indicated in the manner adopted by the Employer (SharePoint). Reports may be submitted analogously as specified in section 5(a).
5. orally: during a direct meeting organized within 14 days from receipt of the request for such form of reporting. Requests may be submitted via sygnal@vm.pl.

6. Subject to the Whistleblower’s consent, an oral report shall be documented in the form of:

1. a recording of the conversation (at the beginning of the recording, the Whistleblower should verbally express consent, which should also be recorded), or
2. minutes of the conversation reproducing its exact course.

7. In the event of consent to document an oral report, the Whistleblower may verify, correct, and approve the minutes of the conversation by signing them. After the minutes have been signed by the Whistleblower, no further amendments to the minutes may be made.

8. The report should contain a clear and complete explanation of the subject matter of the report, including at least:

1. the date and place of occurrence of the violation of law, or the date and place of obtaining information about the violation of law;
2. a description of the specific situation or circumstances creating the possibility of a violation of law;
3. identification of the person concerned by the report;
4. identification of any injured party;
5. identification of any witnesses to the violation of law;
6. indication of all evidence and information available to the Whistleblower that may prove helpful in the process of examining the report;
7. indication of the preferred method of follow-up contact.

9. A report may only be made in good faith. Submitting false reports may be punishable. Pursuant to the Act of 14 June 2024 on the Protection of Whistleblowers (Journal of Laws of 2024, item 928), a person submitting false information shall be subject to a fine, restriction of liberty, or imprisonment for up to 2 years.

10. If, as a result of the analysis of the report or during explanatory proceedings, it is determined that false information was knowingly provided or the truth was concealed in the report, the Whistleblower, being an employee, may be held liable under the disciplinary measures specified in the provisions of the Labor Code. Such conduct may also be classified as a serious breach of fundamental employee obligations and may result in termination of the employment contract without notice. With respect to a Whistleblower providing work, services, or goods under a civil law contract, a false report may result in termination of the contract and the end of cooperation, including without notice. A person who submitted a report in which false information was knowingly provided or the truth was concealed shall not benefit from the protection provided for Whistleblowers.

11.The Whistleblower may not submit a report anonymously. Anonymous reports may not be examined and may be deleted or destroyed.

§ 4 VIOLATIONS OF LAW SUBJECT TO REPORTING

1. A violation of law shall mean an act or omission that is unlawful or intended to circumvent the law.

2. Information reported by the Whistleblower may concern violations of law relating to:

1. corruption;
2. public procurement;
3. financial services, products, and markets;
4. prevention of money laundering and terrorist financing;
5. product safety and compliance with requirements;
6. transport safety;
7. environmental protection;
8. radiological protection and nuclear safety;
9. food and feed safety;
10. animal health and welfare;
11. public health;
12. consumer protection;
13. privacy and personal data protection;
14. security of networks and information systems;
15. financial interests of the State Treasury of the Republic of Poland, local government units, and the European Union;
16. the internal market of the European Union, including public law rules on competition and state aid, as well as corporate taxation;
17. constitutional freedoms and human and civil rights occurring in relations between individuals and public authorities and not related to the fields indicated above.

3. A report may concern a reasonable suspicion regarding an existing or potential violation of law that has occurred or is likely to occur at the Employer.

4. The Whistleblower may also report violations of procedures or internal regulations applicable at VM.PL, including, among others, the “Information Security Policy at VM.PL Sp. z o.o.”, the “Personal Data Protection Policy at VM”, the “Work Regulations for Employees of VM.PL Sp. z o.o.”, and the “Remote Work Regulations at VM.PL Sp. z o.o.”.

§ 5 ANALYSIS OF THE REPORT, EXPLANATORY PROCEEDINGS

1. All members of the Whistleblower Team shall have access to the reporting channels. All actions shall initially be undertaken by the Chairperson of the Team. In the event of the Chairperson’s absence or where the report concerns the Chairperson of the Team, actions shall be undertaken by the Deputy. The Team shall internally appoint the Chairperson and the Deputy Chairperson of the Team.

2. Upon receipt of a report, the Team shall take actions to assess the accuracy of the information contained in the report, including verification of the report and further communication with the Whistleblower, including, where justified, requesting additional information regarding the report and providing feedback concerning the report.

3. The Whistleblower shall receive confirmation of receipt of the report within 7 days from the date of receipt of the report, unless the Whistleblower did not indicate a contact address to which such confirmation should be sent. In the case of an oral report, the Whistleblower shall receive confirmation of receipt of the report during the meeting at which the report is made.

4. The Team may decide to refrain from conducting explanatory proceedings where the content of the report clearly indicates that it is manifestly false or where it is impossible to obtain the information necessary to conduct explanatory proceedings.

5. A report enabling explanatory proceedings to be conducted shall be processed without undue delay.

6. The Team may involve, if deemed justified, representatives of the Employer’s organizational units or independent consultants in the explanatory proceedings.

7. The Team shall examine the report, undertake follow-up actions in consultation with the Management Board, and provide feedback without undue delay, no later than within 3 months from the confirmation of receipt of the report or, if confirmation of receipt was not provided, within 3 months from the expiry of 7 days from the submission of the report.

8. After conducting the explanatory proceedings, the Team shall assess the validity of the report. In the case of a justified report, the Team shall issue recommendations regarding appropriate remedial or disciplinary actions against the person who committed the violation of law, as well as recommendations aimed at eliminating and preventing the same or similar violations as those described in the report in the future. Recommendations shall be submitted to the Management Board of VM.PL in the form of a report, and the Whistleblower shall receive information regarding the follow-up actions taken.

9. In the event of a negative verification of the report, the Team shall immediately provide the Whistleblower and the person concerned by the report with information regarding the submitted report and the results of the conducted verification.

§ 6 PROHIBITION OF RETALIATORY ACTIONS

1. It is prohibited to undertake retaliatory actions, attempt to undertake such actions, or threaten to undertake such actions against a Whistleblower who has made a report, as well as against a person making a public disclosure, in accordance with the Act of 14 June 2024 on the Protection of Whistleblowers (Journal of Laws of 2024, item 928).

2. It is prohibited to undertake retaliatory actions against a person who assisted the Whistleblower in making the report, as well as against a person connected with the Whistleblower.

3. Undertaking any actions of a repressive, discriminatory, or otherwise unfair nature against the Whistleblower shall be treated as a violation of the Procedure and may result in disciplinary liability or termination of the agreement binding the person undertaking retaliatory actions with the Employer.

4. In particular, the following actions against the Whistleblower shall be inadmissible:

1. refusal to establish an employment relationship;
2. termination of the employment relationship with or without notice;
3. failure to conclude a fixed-term or indefinite-term employment contract after termination of a probationary employment contract;
4. failure to conclude another fixed-term employment contract or an indefinite-term employment contract after termination of a fixed-term employment contract, where the employee had a justified expectation that such contract would be concluded;
5. reduction of remuneration for work;
6. withholding promotion or overlooking the employee in promotion decisions;
7. overlooking the employee in granting work-related benefits other than remuneration or reducing the value of such benefits;
8. transferring the employee to a lower position;
9. suspension from performing employee or official duties;
10. transferring the employee’s existing duties to another employee;
11. unfavorable change of workplace or working time schedule;
12. negative assessment of work performance or negative work opinion;
13. imposing or applying a disciplinary measure, including a financial penalty, or a similar measure;
14. coercion, intimidation, or exclusion;
15. mobbing;
16. discrimination;
17. unfavorable or unfair treatment;
18. withholding participation or overlooking the employee in selecting participants for training aimed at improving professional qualifications;
19. unjustified referral for medical examinations, including psychiatric examinations, where separate regulations provide for the possibility of referring an employee for such examinations;
20. actions aimed at hindering future employment in a given sector or industry based on an informal or formal sectoral or industry agreement;
21. causing financial loss, including economic loss or loss of income;
22. causing other non-material damage, including infringement of personal rights, in particular damage to the reporting person’s reputation.

5. Retaliatory actions resulting from making a report or public disclosure shall also include threats or attempts to apply the measures specified in section 3 above. The burden of proof that the action undertaken does not constitute retaliatory action shall rest with the Employer.

6. A Whistleblower making a report in bad faith (i.e. making a report knowing that no violation of law occurred) shall not be subject to the protection provided for in the Procedure and in the Act of 14 June 2024 on the Protection of Whistleblowers (Journal of Laws of 2024, item 928).

7. A person who suffered damage as a result of a report made in so-called bad faith shall have the right to claim compensation or damages for infringement of personal rights from the Whistleblower who made such report.

§ 7 PERSONAL DATA

1. The personal data of the Whistleblower allowing their identity to be established shall not be disclosed to unauthorized persons unless the Whistleblower consents to such disclosure.

2. Maintaining confidentiality is intended to guarantee the Whistleblower’s sense of security and to minimize the risk of retaliatory or repressive actions. A Whistleblower who has made a report and whose personal data has been unlawfully disclosed should immediately notify the Team of such situation. The Team shall be obliged to take actions aimed at protecting the Whistleblower.

3. The identity of the Whistleblower, as well as all information enabling their identification, shall not be disclosed to the persons concerned by the report, third parties, or other employees and associates of the entity. The identity of the Whistleblower, as well as other information enabling their identification, may be disclosed only where such disclosure constitutes a necessary and proportionate obligation arising from generally applicable provisions of law in the context of explanatory proceedings, preparatory proceedings, or court proceedings conducted by public authorities or courts, respectively, or where the Whistleblower gives the consent referred to in section 1. The identity of the persons concerned by the report shall be subject to confidentiality requirements analogous to those applicable to the identity of the Whistleblower.

4. Personal data that is not relevant to the examination of the report shall not be collected, and where such data is collected accidentally, it shall be deleted within 14 days from the determination that it is not relevant to the case.

5. The information clause for the Whistleblower constitutes Appendix No. 1 to the Procedure. The clauses shall be made available again upon confirmation of receipt of the report.

6. The information clause for the person concerned by the report shall be made available in the event follow-up actions are undertaken against the person concerned by the report.

§ 8 REGISTER OF REPORTS

1. Each report shall be registered in the Register of Reports, regardless of the course of follow-up actions.

2. The Team shall be responsible for maintaining the Register of Reports.

3. The Register of Reports shall contain at least:

1. the report number;
2. the subject matter of the violation of law;
3. the personal data of the Whistleblower and the person concerned by the report, necessary for the identification of those persons;
4. the contact address of the Whistleblower;
5. the date of submission of the internal report;
6. information on the follow-up actions taken;
7. the date of completion of the case.

4. The Register of Reports shall be maintained in accordance with confidentiality principles. Personal data and documents related to the report shall be stored for a period of 3 years after the end of the calendar year in which the follow-up action was completed, or after the completion of proceedings initiated by such actions, or after the report was forwarded to the public authority competent to undertake follow-up actions.

§ 9 INFORMATION CONCERNING EXTERNAL REPORTS

1. A report may in any case also be submitted to the Commissioner for Human Rights or a public authority, bypassing the Procedure, in particular where: within the time limit for providing feedback, the Employer did not undertake follow-up actions or did not provide feedback, or the Whistleblower has reasonable grounds to believe that the violation of law may constitute a direct or obvious threat to the public interest, in particular where there is a risk of irreversible damage, or where making an internal report would expose the Whistleblower to retaliatory actions, or where, in the event of making an internal report, there is little likelihood of effectively counteracting the violation of law by the Employer due to the specific circumstances of the case, such as the possibility of concealment or destruction of evidence or the possibility of collusion between the Employer and the perpetrator of the violation of law or the Employer’s involvement in the violation of law.

2. A report made to the Commissioner for Human Rights or a public authority without prior internal reporting shall not result in depriving the Whistleblower of the protection guaranteed under the provisions of the Act of 14 June 2024 on the Protection of Whistleblowers (Journal of Laws 2024.928).

3. The contact details for the Commissioner for Human Rights are as follows:

Citizen Information Hotline: 800 676 676,

E-mail: biurorzecznika@brpo.gov.pl,

Correspondence address: Office of the Commissioner for Human Rights, al. Solidarności 77, 00-090 Warsaw.

It is also possible to submit a report in sign language, anonymously via the contact form on the website, or in person at one of the branch offices.

§ 10 FINAL PROVISIONS

1. The Team shall be responsible for the adequacy and effectiveness of the functioning of the Procedure.

2. The adequacy and effectiveness of the Procedure shall be regularly assessed by the Team together with the legal department operating at the Employer.

3. VM.PL shall be responsible for familiarizing all employees subordinate to it with the provisions of the Procedure. Employees and associates employed at VM.PL after 25 September 2024 shall provide an appropriate statement confirming that they have familiarized themselves with the Procedure. Employees and associates employed before 25 September 2024 shall confirm familiarization with the Procedure via a Forms form.

4. Initial and regular training within the scope covered by the Procedure shall be conducted where necessary. In particular, employees and associates shall be informed about the Procedure during onboarding.

5. The Procedure shall enter into force on 25 September 2024, i.e. after the expiry of 7 days from the date on which it was communicated to persons performing work in the manner adopted by the Employer.

6. The Procedure shall be published in the manner adopted by the Employer, i.e. by making it available on SharePoint and by sending a communication via the Microsoft Teams application. Information regarding the Procedure shall also be available on the Employer’s website and shall be attached to each recruitment announcement (e.g. in the form of a link to the website).

Information Clause for the Whistleblower

Information on the Processing of Personal Data

1. The controller of your personal data is VM.PL Sp. z o.o., with its registered office in Wrocław at ul. T. Kościuszki 82, 50-441 Wrocław, entered in the register of entrepreneurs maintained by the District Court for Wrocław-Fabryczna, 6th Commercial Division of the National Court Register under KRS number 0000201477, NIP: 8951811558, REGON: 932985224, share capital in the amount of PLN 116,400 (hereinafter referred to as the “Controller” or “VM.PL”).
2. In matters related to the processing of personal data, you should contact us by e-mail at: rodo@vm.pl or at the Controller’s registered office address indicated in section 1.
3. Your personal data shall be processed in the event you make an internal report in accordance with the Internal Reporting Procedure at VM.PL. Your personal data within the scope resulting from the report and other information provided during the handling of the report shall be processed for the purpose of handling the report and fulfilling legal obligations imposed on the Controller. The legal basis for the processing of your personal data is:
   1. Article 6(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the EU L 119 of 2016, p. 1, as amended), hereinafter referred to as the GDPR, i.e. the Controller’s legal obligation, in connection with the provisions of the Act of 14 June 2024 on the Protection of Whistleblowers (Journal of Laws, item 928), for the purpose of carrying out tasks related to the handling of internal reports;
   2. Article 9(2)(g) of the GDPR in connection with the provisions of the Act on the Protection of Whistleblowers, where such personal data is included in the Whistleblower’s report;
   3. Article 6(1)(a) of the GDPR – you may consent to the disclosure of personal data enabling your identity to be established. In the event of giving such consent, the Controller shall inform the persons indicated in the report about the provision of their data by you (as part of the information obligation under Article 14 of the GDPR or as part of the exercise by those persons of their right of access to personal data), unless the Whistleblower does not meet the conditions indicated in Article 6 of the Act on the Protection of Whistleblowers or has expressly consented to the disclosure of their identity. In the absence of consent, the persons indicated in the report shall receive information without indicating the source of the data.
4. Personal data shall be disclosed only to entities authorized to process such data under the provisions of law. Personal data shall be disclosed to entities providing services supporting the Controller’s operations on the basis of agreements concluded with the Controller (e.g. IT service providers). Personal data may also be disclosed to external entities supporting the Controller in the field of handling internal reports. Personal data shall be disclosed to separate controllers, i.e. competent authorities, where follow-up actions are undertaken.
5. Personal data shall be stored for a period of 3 years after the end of the calendar year in which follow-up actions were completed, or after the completion of proceedings initiated by such actions. Personal data that is not relevant to the examination of the report shall not be collected, and where such data is collected accidentally, it shall be deleted within 14 days from determining that it is not relevant to the case.
6. In connection with our processing of personal data, you have the right to:
   1. request access to your personal data;
   2. request rectification of your personal data;
   3. request erasure;
   4. request restriction of the processing of your personal data;
   5. request transfer of personal data;
   6. withdraw the consent referred to in section 3(c);
   7. object to the processing of your data;
   8. lodge a complaint with the President of the Personal Data Protection Office if you consider that the processing of your personal data violates legal provisions.

Please note, however, that requests for the exercise of the above rights shall be assessed in light of the GDPR provisions, and therefore we do not guarantee their fulfillment in every case. Withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

7. Providing your personal data is voluntary but necessary for reporting a violation of law. Failure to provide personal data may result in the report being classified as anonymous and left unexamined.
8. Your personal data shall not be used for profiling purposes, including automated decision-making.
9. With regard to data processed for the purposes of handling internal reports made in accordance with the Internal Reporting Procedure at VM.PL, we do not transfer your personal data outside the European Economic Area (EEA).