Internal regulation on whistleblowing

PREAMBULE
1. Since its inception, our company has been committed to its reputation and therefore emphasizes honest, legal, ethical and transparent conduct both within the company and towards customers, suppliers and other third parties.
2. Our company does not tolerate illegal conduct and always strives to do everything possible to eliminate the possibility of illegal conduct on the part of its employees, statutory bodies and other persons.
3. Through this policy, we are establishing an internal whistleblowing system to report potential violations and protect Whistleblowers from retaliation, thereby contributing to the formation of a corporate culture in the Company and the development of professional and honest business.
4. Our priority is to create a system and corporate environment that allows the reporting of suspected crimes, misconduct or other harmful actions without fear of retribution and with the assurance that all allegations will be properly investigated and, in the event of misconduct, appropriate remedial action will be taken.
INITIAL PROVISIONS
1. This internal regulation is binding for all employees of ELEKTRODESIGN ventilátory, spol. s r.o., ID No.: 248 28 122, with registered office at Boleslavova 53/15, 140 00 Prague 4 ("our company"), who are in an employment or similar relationship with the company, which is understood to mean, for example, a legal relationship based on an agreement on the performance of work, an agreement on work activity, etc. This internal regulation applies to the operation of the internal whistleblowing system we have established pursuant to Act No. 171/2023 Coll. on the Protection of Whistleblowers (the "Act").
2. The purpose of this Regulation is primarily to:
  (i) to support the Whistleblower and make it clear that the Whistleblower will not be disadvantaged in any way as a result of Notifications made in good faith, which is ensured primarily by the confidential nature of the communications between the Whistleblower and the Relevant Person;
  (ii) to put in place the best, most transparent and accessible Notification system possible, so that Personnel will not need to refer to any external systems; and
  (iii) to speed up the response to identified breaches and find solutions at an early stage.
3. We encourage our Workers to report serious misconduct that they have identified as a matter of priority using the procedure set out in this Internal Code. This procedure is set up to protect the confidentiality of their identity and their Notification to the maximum extent possible, and to ensure that the evaluation of Notifications occurs in a timely manner.
4. In contrast, our Notification System is not intended to encourage false accusations and defamation. Such actions can be sanctioned by employment, civil, misdemeanor and criminal law and are therefore not supported by our company in any way.
5. This or any other article of this Internal Regulation is without prejudice to the right of the Employee to use the external whistleblowing system operated by the Ministry of Justice.
DEFINITION OF BASIC TERMS
1. For the purposes of this bylaw, the following terms shall have the following meanings:
  (a) "our company" shall have the meaning set forth in Article 2, Paragraph 1 of this bylaw.
  b) "Notifier" means Employees who may submit information that may be the subject of a Notification under an internal or external system or who have already made a Notification.
  c) "Notification" has the meaning set forth in Article 4, Paragraph 1 of this bylaw.
  d) "Employees" means all persons employed by our Company, regardless of their position, who are working for us (including agency employees), as well as persons who are seeking employment with us or whose employment or similar legal relationship with our Company has ended.
  e) "An illegal act" means an act that has occurred or is about to occur in our company and that has the characteristics of a criminal offence or misdemeanour for which the law provides for a fine of at least 100.
  f) "Responsible Person" means a person or legal entity authorised by us who is not bound by the instructions of our company in relation to the Notification and clarification of the relevant facts and who is obliged to comply with the content of this Internal Regulation.
  g) "Repression" means any conduct in connection with the work or other similar activity of the Whistleblower which is in response to (and/or has been triggered by) the Notification and which may cause harm to the Whistleblower and/or the Commonly Protected Person (Art. 1 of the Act).
  h) "Commonly Protected Person" means a person with a connection to the Notifier who cannot be subjected to Reprisal in connection with a Bona fide Notification and who is:
  - a person who has provided assistance in discovering information that is the subject of the Notification, making the Notification or assessing the reasonableness of the Notification;
  - a person who is close to the Notifier;
  - a person controlled by the Notifier; or
  - another person who falls within one of the categories under section 4(1)(b) of the Act. 2 of the Act.
  i) "Act" shall have the meaning set forth in Article II, paragraph 1 of this bylaw.
BASIC EMPLOYEE RIGHTS AND DUTIES
1. Employees have the right to report information about possible Illegal Acts that have occurred or are about to occur at our Company, or at any other person with whom they have been or are in contact in connection with the performance of work or other similar activities for our Company, and that:
  a) have the characteristics of a crime;
  b) have the characteristics of a misdemeanor, for which the law provides for a fine with a ceiling of at least 100.000 CZK;
  c) violates the Whistleblowers (Protection of Whistleblowers) Act; or
  d) violates any other Czech or EU legislation in the field of:
  - financial services, statutory auditing and other verification services, financial products and financial markets;
  - corporate income tax;
  - prevention of laundering of proceeds of crime and financing of terrorism;
  - consumer protection;
  - compliance with product requirements, including their safety;
  - safety of transport, transportation and traffic on roads;
  - environmental protection;
  - food and feed safety and protection of animals and their health;
  - radiation protection and nuclear safety;
  - competition, public auctioning and public procurement;
  - protection of internal order and security, life and health;
  - protection of personal data, privacy and security of electronic communications networks and information systems;
  - protection of the financial interests of the European Union; or
  - functioning of the internal market, including the protection of competition and State aid under European Union law.
2. If the Employee has reason to believe that the facts he/she wishes to report constitute a criminal offence and/or may cause serious harm to our Company or third parties, he/she shall, inter alia, be obliged to report such facts in accordance with the procedure set out in this Internal Regulation, out of loyalty to our Company. The obligation pursuant to this paragraph shall not apply if the facts in question are already known to our company and/or if the Employee would have a legal right to refuse to give notice in such a case, or if the Employee would be under a legal duty of confidentiality in relation to such facts.
3. The Employee may only disclose information that may constitute the content of the Notification (i.e., in particular, transmit it to the media, post it on social media or on a website) if:
  a) he/she has submitted the Notification via the internal notification system and to the Ministry of Justice or only to the Ministry of Justice, unless at the same time appropriate action has been taken within the time limits set by the Act, in particular if the Competent Person has not assessed the reasonableness of the Notification pursuant to Section 12 para. 3 of the Act, our company has not taken other appropriate action to prevent or remedy the unlawful condition pursuant to Section 12(3) of the Act. 5 of the Act, or a public servant under section 13 of the Act has failed to assess the Notification under section 17(5) of the Act. 1 of the Act;
  (b) has reasonable cause to believe that the violation alleged in the Notice may result in an imminent or apparent threat to domestic order or safety, life or health, the environment or other public interest, or to cause irreparable harm; or
  (c) has reasonable cause to believe that, if the Notice is filed with the Department of Justice, there is an increased risk, given the circumstances of the case, that he or a Commonly Protected Person will be subjected to retaliation or that the Title III process will be compromised. Act (which governs the Department of Justice's authority).
4. In assessing the reasonableness of the Notice, the Competent Person is authorized to:
  (a) require proof of the identity of the Worker or other person involved in the investigation, e.g.
  b) require the disclosure of information and the production or disclosure of documents, audiovisual and digital recordings and other items that may be relevant to the Notification;
  c) take electronic images, extracts, copies or copies of the documents produced or disclosed;
  d) make copies of audio-visual and digital records produced or made available;
  e) make, with the consent of the Officer or other person involved in the investigation, an audio or visual recording of their oral
  speech;
  f) enter any premises where facts may be ascertained and/or materials may be obtained which may be relevant to the Notice.
5. In the course of the investigation, the Competent Person shall further be entitled to request an oral explanation from the
  Employee or any other person involved in the investigation, which they may refuse to give. The Competent Person shall make a record of the course and content of the explanation or make an audio or visual recording. This is without prejudice to the duty of confidentiality under the Act and these Internal Rules.
6. The Competent Person is further entitled to request the Staff to prepare a professional opinion on factual issues related to the Notification within a reasonable time. This is without prejudice to the duty of confidentiality under the Act and these Internal Rules.
Basic procedural rules
1. The notice may be given in writing, orally or both. The notifier should accompany the notification with as full a description as possible of the facts established and relevant documents (if available). Explicitly naming the risks arising from the facts disclosed usually increases the value of the information to the company. If the Notification does not contain all the necessary information or data, the Competent Person may invite the Notifier to complete it.
2. An oral report may be made in the form of a voice recording, which the Notifier will upload to the web-based reporting interface. A transcript of the oral Notification shall be made, provided that the Notifier agrees. The Competent Person shall allow the Notifier to comment on the transcript and such comments shall be attached to the transcript. If the Notifier does not consent to the transcript, the Competent Person shall not make it. In such a case, a record shall be made which faithfully reflects the substance of the oral Notification. The Competent Person shall give the Notifier an opportunity to comment on the recording and such comments shall be attached to the recording. A similar procedure shall be followed if it is not technically possible to make an audio recording of the oral Notification.
3. At the request of the Notifier, the Notification may also be made in a physical meeting, which shall be made available to the Notifier within fourteen (14) days of the request. The rules of the preceding paragraph shall apply with respect to the documentation of the meeting.
4. A Whistleblower who makes a Notification in writing may do so by:
  (a) delivering the letter through a postal service provider to the address for delivery to the hands of the Competent Person, provided that such mail should be marked "Confidential, to the hands of the Competent Person only" or other similar wording ("Do not open, whistleblowing", etc.) - other Employees are not entitled to open an envelope marked in this way in any case and are obliged to hand it directly to the Competent Person;
  b) via electronic communication, within the interface HERE.
5. The procedure for dealing with a notification is as follows: (i) The Competent Person receives the notification and arranges for its preliminary assessment. (ii) If the notification is not admissible, i.e., does not fall within the scope of the Act, the Competent Person and a representative of our Company agree to forward the notification to another authorised person. The Competent Person shall inform the Notifier of this fact (if communication with the Notifier is possible). (iii) If the Notification is admissible, the Competent Person shall ensure, in cooperation with our Company, that the reasonableness of the Notification is examined. (v) The Competent Person shall register the Notification and related data in accordance with the Act and send the necessary notifications (if communication with the Notifier is possible) to the Notifier within the statutory time limits.
6. The Competent Person shall immediately upon receipt of the Notification initiate a process to clarify the facts that are the subject of the Notification. As part of this process, the Competent Person may have additional questions for the Notifier (if the Notifier has given the Competent Person the opportunity to contact the Notifier). The Notifier undertakes to answer such questions from the Relevant Person and to provide further assistance as requested.
7. The Relevant Person must keep the Notifier's identity confidential unless the Notifier expressly consents to the disclosure of his or her identity. The obligation of the Competent Person not to disclose the identity of the Whistleblower does not apply only if the Competent Person is obliged by law to disclose the identity of the Whistleblower.
8. The Competent Person shall acknowledge receipt of the Notification to the Notifier within seven (7) days of receipt. Such confirmation may also take the form of an automated message. The Competent Person's obligation under this paragraph shall not be triggered if: (i) the identity of the Notifier is not known to the Competent Person; and/or (ii) if it is clear that such action would reveal the identity of the Notifier; and/or (iii) if the Notifier has so requested.
9. The Competent Person shall promptly investigate the facts of the Notification and initiate the necessary follow-up investigations. In particular, as part of the investigation, he/she shall verify the truth and validity of the allegations in the Notification and, if necessary, propose to our Company to take action against the notified deficiency or otherwise terminate the process. The responsible person may also commission an internal investigation, which he/she shall continue to monitor or coordinate. The investigation shall be carried out with the utmost confidentiality among the smallest possible group of persons (and in particular with such persons who work in the area covered by the Notification and/or who can be expected to help clarify the relevant facts). Measures within the meaning of this paragraph may include, for example, giving instructions to the person acting unlawfully; preventing such person from accessing our facilities or premises; changing the assignment or duties of such person or (temporarily) discontinuing cooperation with such person, if possible. The Competent Person shall not propose such measures which could disclose the identity of the Whistleblower or the Commonly Protected Person or defeat or jeopardise the purpose of the criminal or misdemeanour proceedings or the conduct constituting an offence.
10. If the Competent Person concludes that an Illegal Act has occurred, the Competent Person shall notify the members of the statutory body of our Company, except for such members who are directly affected by the Illegal Act, or if the Illegal Act affects all members of the statutory body of the Company, the Competent Person shall notify the members of the controlling body. In such notification, the Competent Person shall also specify the proposed remedial measures, unless such action may result in the disclosure of the identity of the Whistleblower or the Commonly Protected Person or frustrate or jeopardise the purpose of the criminal or misdemeanour proceedings or the conduct constituting the misdemeanour, in which case the Competent Person shall propose remedial measures as soon as such circumstances do not prevent their adoption.
11. For the purpose of investigating the Notification:
  a) the Officers shall provide the Competent Person with cooperation and respond to the Competent Person's request within a reasonable period of time specified by the Competent Person;
  b) the Competent Person shall be entitled to request documents necessary for the assessment;
  c) the Competent Person shall be entitled to request explanations and enter our offices and other premises.
  This paragraph shall also apply if, in the course of its performance, there should be or has been a breach of the duty of confidentiality established by the contract, Act No. 280/2009 Coll, Tax Code, as amended, or other legal provisions governing the performance of work.
12. The competent person may deal with the Notification in any of the following ways:
  a) if it finds that it is reasonable, propose to our Company measures to prevent or correct the violation found;
  b) if it finds that it is unreasonable, without undue delay, notify the Notifier in writing that, based on the facts set out in the Notification and all the circumstances known to it, it does not suspect that an infringement has been committed, or that the Notification is based on false information, and advise the Notifier of its right to file a Notification with a public authority; or
  c) if it finds that the Notification is not a notification under the Act (e.g. (c) if the notification does not relate to an infringement within the meaning of Article IV, paragraph 1 of this Internal Regulation), it shall inform the Notifier thereof without undue delay.
13. If the Notifier overwhelms the notification system with vulgarities or prima facie unsubstantiated communications, such communications may be dealt with on the basis that they do not constitute a Notification within the meaning of this Internal Regulation or the Act. If responding to such communications would jeopardize the proper functioning of the Notification System and/or if such communications constitute a clear abuse of the law, the Responsible Person may ignore them entirely. In such a case, only the documentation obligation set out in Article X below of this Internal Regulation shall apply.
14. The Whistleblower has the right to be informed of the outcome of the investigation of his/her Notification and of any action taken as a result of the Notification. This does not apply if the Notification was made anonymously. Information within the meaning of this paragraph shall be provided to the Notifier no later than thirty (30) days after receipt of the Notification. This period may be extended for up to an additional thirty (30) days in cases which are factually or legally complex, but not more than twice. The Competent Person shall notify the Notifier of the extension of the time limit and the reasons for the extension before the expiry of the time limit, unless:
  a) the Notifier expressly requests the Competent Person not to notify him/her;
  b) the Notifier has not provided the Competent Person with his/her contact details; or
  c) it is clear that such notification would disclose the identity of the Notifier.
  The right of the Notifier to information shall apply even if the final result of the investigation is not available after the above time limit has expired. In such a case, the information shall contain an indication of the current status of the investigation.
15. If the Notification is received by a person other than the Competent Person, that other person must immediately forward the Notification to the Competent Person for processing in a manner that ensures that the confidentiality of the content of the Notification and the identity of the Notifier is preserved. At the same time, any information relating to such Notification must be deleted from the document register maintained by the other person, if possible.
Protection of accused persons
1. Persons who are accused of wrongdoing by the Notice will be promptly informed of the allegations and asked to comment, unless doing so would significantly impair or jeopardize the clarification of the Notice, in which case the accused persons will be informed promptly once the danger has passed. Notification to the accused persons shall not contain any information that would enable the identity of the Notifier to be revealed.
2. If the Competent Person discovers that the Notifier has made a false Notification of the Accused Person's wrongdoing without having reasonable grounds to believe that the Notification is based on true information, the Competent Person shall inform the Accused Person of this fact.
ANONYMOUS NOTICE
1. It is desirable that Notifiers provide information at the time of Notification that will enable them to be contacted further to clarify the relevant facts. Providing such information also enhances the credibility of the Notification made. However, if Notifiers do not wish to provide such information, in particular because of concerns about reprisals, they may also submit a Notification anonymously.
Protection of the NOTIFIER and THIRD PARTIES CHANGED IN THE NOTIFICATION
1. The confidentiality of the identity of the Notifier and any third parties mentioned in the Notification must be maintained during the Notification process and follow-up.
2. Our Company shall ensure that unauthorized persons, which means all legal and natural persons who are not responsible for receiving the Notification and taking follow-up actions and who are not involved in the investigation process, do not have access to the information contained in the Notification. This applies in particular to all information from which the identity of the Notifier can be directly or indirectly inferred.
3. The confidentiality of the identity of the Notifier is protected in particular by:
  a) all communication channels are operated in a secure manner and can only be accessed by the Relevant Person after entering a password (beyond the entry of computer login details);
  b) the telephone line to the Relevant Person is direct, not subject to being switched by another person;
  c) Employees are expressly instructed by this policy not to open any package marked "Confidential, for the hands of the Competent Person only" or other similar wording and their obligation to forward such package directly to the Competent Person;
  d) only the Competent Person shall have access to the records of the data on the Notices received, the documents relating to the Notices and the Notices stored and such data shall be stored in a secure manner, separately from other data of our Company;
  e) the Competent Person shall be bound by confidentiality of the facts of which he/she has become aware in the course of his/her activities, even after the termination of such activities, and shall be instructed and a record of such instruction shall be signed. respectively. In selecting the Competent Person, our company shall ensure that the Competent Person not only meets the legal conditions for the performance of this activity, but also possesses sufficient professional knowledge, moral maturity and guarantees the impartial performance of his/her tasks;
  g) information about the identity of the Notifier and the Jointly Protected Persons may be provided only with their written consent, unless the Competent Person is obliged to provide such information to the relevant public authorities pursuant to other legal regulations (in which case it shall notify the Notifier thereof in advance, together with the reasons for which it is obliged to provide the identity information and allow the Notifier to comment on the provision of the information).
4. A worker who makes a Compliant Notification shall not be subject to Reprisal or the threat of Reprisal. The right to protection from Reprisal cannot be waived. This right to protection also applies to Commonly Protected Persons.
5. An employee who takes action leading to unjustified Repression of a Whistleblower is in violation of this Internal Regulation and must endure the measures that our Company takes against him/her as a result of the violation in question.
6. Confidentiality shall be maintained by any person who gains access to protected information or personal data.
DISCLOSURE OF AFFECTED PERSON
1. The background, knowledge, skills, abilities and characteristics of a Competent Person must not give rise to any doubt that he or she is carrying out his or her activities properly and impartially.
2. The Competent Person shall not be instructed or otherwise influenced in such a way as to interfere with or jeopardise the proper performance of his or her duties. The preceding sentence shall be without prejudice to the possibility of control by a superior managerial employee of the proper performance of the activities of the Competent Person, subject to the requirement of impartiality and confidentiality of information related to the Notification under these Internal Regulations and under the Act.
3. The Competent Person shall promptly forward the Notification to another Competent Person for processing if his or her impartiality can reasonably be doubted due to his or her relationship to the Notifier, the accused person or the information contained in the Notification. If the Notification cannot be forwarded to another Competent Person for processing, the Competent Person shall inform the Notifier and advise the Notifier of the right to submit the Notification through the external notification system under the jurisdiction of the Ministry of Justice.
EVIDENCE AND STORAGE OF NOTIFICATIONS
1. The Competent Person shall keep an electronic record of the data on received Notifications, in the following scope:
  a) date of receipt of the Notification;
  b) name, if applicable, first name, surname, date of birth and contact address of the Notifier, or other data from which the identity of the Notifier can be inferred, if such data are known to the Competent Person;
  c) summary of the content of the Notification and identification of the person against whom the Notification was directed, if applicable. the identity of the person to whom the Notification otherwise relates, if the Competent Person knows his or her identity; and
  d) the date of completion of the assessment of the reasonableness of the Notification and its outcome (including any preventive or remedial measures proposed and taken).
2. The Competent Person shall retain the Notification and documents relating to the Notification for a period of 5 years from the date of receipt of the Notification.
3. The purpose of recording and storing information on Notifications submitted is to enable control through our company's internal control systems as well as through the control systems of public authorities. Only the Competent Person shall have access to the records referred to in paragraph 1.
DATA SECURITY AND PROTECTION
1. Our Company will ensure that the relevant data protection rules are followed as part of the procedure under this Internal Regulation. The contact and other data of the Notifier are intended solely for the purpose of making the Notification and its verification and are not used for other (e.g. business) purposes.
2. Personal data collected in the course of the procedure under this Internal Regulation will be deleted once the legal basis for processing it has ceased to exist.
3. Personal data is processed in relation to the Notice on the basis of Article 6(1)(c), (e) or (f) of the General Data Protection Regulation ("GDPR"). Special categories of personal data within the meaning of Article 9(1) of the GDPR may be processed in relation to the Notice on the basis of Article 9(2)(e), (f) or (g) of the GDPR.
4. The information obligation pursuant to Articles 13 and 14 GDPR shall be fulfilled while maintaining confidentiality pursuant to this Internal Regulation. The exercise of the right of access to personal data under Article 15 GDPR may only be granted to the data subject in accordance with Article 23 GDPR provided that the confidentiality of the identity of the notifier and other persons named in the Notification is maintained.
5. A request for access to personal data relating to the Notification shall be forwarded by the Data Protection Officer to the Competent Person for processing. If the Competent Person determines that no data is held in relation to the Notification or that an exemption from the obligation to provide such information applies, the request shall be deferred without further delay.
6. The obligation to notify a personal data breach (security incident) to a data subject, while maintaining confidentiality under this Internal Regulation, shall also apply to the Competent Person.
7. The processing of personal data in connection with the Notification is not subject to the obligation to carry out a data protection impact assessment. Further details on data protection can be found at HERE.
8. All persons authorised to access the Notification System work independently in respect of their tasks in relation to the Notification System and are therefore not bound by our instructions. These persons are trained on the operation of the system and the rules for its use.
CONTRACTING PROVISIONS
1. Our Company shall ensure that the Relevant Person is duly advised of the rights and obligations imposed on him/her under the Act and these Internal Rules.
2. Our Company shall publish on its website information:
  a) on the methods of notification through the internal notification system and the Ministry of Justice;
  b) the identification of the Relevant Person, his/her telephone number and email address and/or other address for service; and
  c) that it does not exclude the receipt of Notices from persons who do not perform work or other similar activities for it under section 2(3)(a), (b), (h) or (i) of the Act.
3. This bylaw shall come into force and effect on December 15, 2023 and shall be issued for an indefinite period. Our Company may amend this bylaw by issuing a new complete version, which will be announced at least one (1) week prior to the effective date of the respective amendments.
4. If individual clauses of this bylaw cease to be valid or effective, e.g., as a result of new legislation or case law, the remaining provisions shall remain unaffected.

In Brandýs nad Labem - Staré Boleslav on 12 December 2023

Ing. Petr Koutník, Ph.D.

agent

Internal regulation on whistleblowing

Contact Us