at Lubatex spółka z ograniczoną odpowiedzialnością, with its registered office in Lubawka

Chapter I

1. The Internal Reporting Procedure was adopted at LUBATEX SP. Z O.O. pursuant to Article 25(1) and (2) in conjunction with Article 24(1) of the Act of 14 June 2024 on the Protection of Whistleblowers (Journal of Laws 2024, item 928).

2. The Procedure specifies:

a) the methods and channels for making internal reports;

b) the organisational unit/external entity authorised to receive internal reports;

c) the organisational unit within the organisational structure of LUBATEX SP. Z O.O. authorised to take follow-up actions, including verification of an internal report and further communication with the whistleblower;

d) the conditions for granting protection to whistleblowers and persons assisting in making a report in connection with the report made;

e) measures to protect whistleblowers and persons assisting in making a report against retaliation.

3. LUBATEX SP. Z O.O. ensures compliance with the Internal Reporting Procedure, including the proper functioning of channels enabling reports of breaches of law to be made, taking into account the need to protect the whistleblower’s identity from disclosure to unauthorised persons.

4. The Internal Reporting Procedure applies to:

a) former and current employees, regardless of the type of employment contract concluded, including temporary and seasonal employees;

b) persons performing work on a basis other than an employment relationship, including under a civil-law contract;

c) self-employed persons who have knowledge of breaches of law within the Legal Entity;

d) persons who are members of the bodies of the Legal Entity, including commercial proxies;

e) partners, shareholders and stockholders;

f) trainees, volunteers and interns;

g) a natural person referred to in point 4(a)-(f), where the report concerns a breach of law learned about before entering into an employment relationship or another legal relationship constituting the basis for providing work or services or performing a function within or for the Legal Entity, or after such relationship has ended;

and who make an internal report of a breach of law in a work-related context.

5. The provisions of the Internal Reporting Procedure also apply to:

a) persons assisting in making a report;

b) persons associated with the whistleblower;

c) legal entities owned by the person making the report, for which that person works, or which are otherwise associated with that person in a work-related context.

6. For the purposes of this Internal Reporting Procedure, the following definitions shall apply:

a) “follow-up action” means an action taken by the Legal Entity to assess the accuracy of the information contained in a report and to counteract the breach of law that is the subject of the report, in particular through an investigation, the initiation of an inspection or administrative proceedings, the bringing of charges, action taken to recover funds, or the closure of proceedings conducted under the internal procedure for reporting breaches of law and taking follow-up actions;

b) “retaliation” means a direct or indirect act or omission in a work-related context which is prompted by a report or public disclosure and which violates or may violate the rights of the whistleblower or causes or may cause unjustified harm to the whistleblower, including the unjustified initiation of proceedings against the whistleblower;

c) “feedback” means information provided to the whistleblower on planned or taken follow-up actions and the reasons for such actions;

d) “organisational unit” means an employee designated by LUBATEX SP. Z O.O. as an impartial unit within the organisational structure authorised to receive internal reports, and a three-person committee appointed to take follow-up actions, including verification of the internal report and further communication with the whistleblower, including requesting additional information and providing feedback to the whistleblower;

e) “work-related context” means past, present or future activities related to the performance of work under an employment relationship or another legal relationship constituting the basis for providing work or services or performing a function within or for the Legal Entity, in the course of which information about a breach of law was obtained and where there is a possibility of experiencing retaliation;

f) “breach of law” means an act or omission that is unlawful or intended to circumvent the law, concerning:

1) corruption;

2) public procurement;

3) financial services, products and markets;

4) prevention of money laundering and terrorist financing;

5) product safety and compliance;

6) transport safety;

7) environmental protection;

8) radiation protection and nuclear safety;

9) food and feed safety;

10) animal health and welfare;

11) public health;

12) consumer protection;

13) protection of privacy and personal data;

14) security of networks and information systems;

15) the financial interests of the State Treasury of the Republic of Poland, the unit

16) local government and the European Union;

17) the internal market of the European Union, including public-law rules on competition and State aid, as well as taxation of legal persons;

g) “person concerned by the report” means a natural person, legal person or organisational unit without legal personality to which the law grants legal capacity, identified in the report or public disclosure as a person who committed a breach of law, or as a person associated with the person who committed a breach of law;

h) “person assisting in making a report” means a natural person who assists the whistleblower in making a report or public disclosure in a work-related context and whose assistance should not be disclosed;

i) “person associated with the whistleblower” means a natural person who may experience retaliation, including a co-worker or a person close to the whistleblower within the meaning of Article 115 § 11 of the Act of 6 June 1997 – the Penal Code;

j) “Legal Entity” means LUBATEX SP. Z O.O.;

k) “Internal Reporting Procedure” means this Procedure;

l) “Internal Reports Register” means a register kept in paper form containing information on reports made;

m) “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L 119, 04.05.2016, p. 1, as amended);

n) “whistleblower” means a natural person referred to in points 4 and 5 who reports a breach;

o) “public disclosure” means making information about a breach of law available to the public;

p) “Act” means the Act of 14 June 2024 on the Protection of Whistleblowers (Journal of Laws 2024, item 928);

q) “report” means an oral or written report of a breach or an external report submitted in accordance with the requirements set out in the Act;

r) “report of a breach” means an oral or written internal report to LUBATEX SP. Z O.O. of a breach of law – an internal report;

s) “external report” means the oral or written communication of information about a breach of law to the Commissioner for Human Rights or a public authority.

7. Handling a report of a breach is free of charge.

8. The Legal Entity does not accept or consider reports of breaches made anonymously.

9. The Legal Entity is the controller of personal data collected in the Internal Reports Register within the meaning of the GDPR.

Chapter II

1. For persons to whom this Procedure applies, the Legal Entity provides protection against retaliation where:

a) they had reasonable grounds to believe that the information concerning breaches that was the subject of the report was true at the time of reporting and that the information could constitute information about a breach of law;

b) they made an external report as referred to in the Act due to a justified concern that making a report of a breach would not prevent retaliation;

c) they made a public disclosure as referred to in the Act, having reasonable grounds to believe that:

i. the breach may constitute an imminent or manifest danger to the public interest, in particular where there is a risk of irreversible damage, or

ii. making an external report would expose the whistleblower to retaliation, or

iii. in the event of making an external report, there is little likelihood that the breach of law will be effectively addressed due to the particular circumstances of the case, such as the possibility of evidence being concealed or destroyed, collusion between the public authority and the perpetrator of the breach, or the public authority’s involvement in the breach.

2. The Legal Entity provides the possibility of reporting breaches through channels for receiving external reports which:

a) are independent of the communication channels used in the ordinary activities of the Legal Entity;

b) are intended exclusively for receiving reports of breaches of law, or for communicating with the whistleblower and recording events as part of follow-up actions carried out by the Legal Entity;

c) ensure the completeness, confidentiality and integrity of data, including protection against access by unauthorised persons;

d) allow information to be stored in a durable manner so as to enable further investigation;

e) prevent unauthorised persons from gaining access to information covered by the report;

f) ensure the confidentiality of the identity of the whistleblower and the person concerned by the report.

3. The Legal Entity ensures the impartiality and independence of persons receiving reports of breaches of law and persons carrying out follow-up actions.

4. Each person receiving a report of a breach has written authorisation to receive reports of breaches.

5. Each person taking follow-up actions in connection with a report of a breach, including verification of the report and further communication with the whistleblower, including requesting additional information and providing feedback to the whistleblower, has written authorisation to take follow-up actions.

6. A report of a breach may be made by:

a) a written report sent to the employer’s address: ul. Mickiewicza 17, 58-420 Lubawka, with the content of the internal report placed in an additional sealed envelope marked “whistleblower”. The person receiving company mail is obliged to immediately forward the sealed inner envelope to the person authorised at the workplace to receive internal reports;

b) a submission box located in the corridor by the employer’s HR office, marked “INTERNAL CHANNEL FOR REPORTING BREACHES OF LAW”.

7. At the whistleblower’s request, a report of a breach may be made during a personal meeting with the whistleblower. The meeting should take place no later than 14 days from the date of the request. Written or electronic minutes shall be prepared of the meeting. The whistleblower has the right to review, correct and approve the minutes of the meeting by signing them.

8. A report of a breach should include in particular:

a) the identity of the whistleblower and an address for contacting the whistleblower;

b) identification of persons assisting in making the report and persons associated with the whistleblower;

c) a description of the breach of law with reference to persons, facts, events or other circumstances allowing it to be considered that the information provided about the breach of law is substantiated and that the information contained in the report may be true at the time of reporting;

d) the date or period during which the breach of law may have occurred or occurred;

e) documents that may constitute evidence demonstrating the facts referred to in the report of a breach;

9. Personal data of the whistleblower that allow their identity to be established shall not be disclosed to unauthorised persons unless the whistleblower has given explicit consent.

10. The Organisational Unit may carry out a preliminary verification of the report made. Preliminary verification of the report may not constitute an obstacle to accepting the report and carrying out follow-up actions.

11. A report of a breach shall be entered in the Internal Reports Register unless, as a result of the preliminary assessment of the report, it is obvious that the report:

a) is unfounded because it is based entirely on false statements and this fact is objective and raises no doubt, or

b) does not fall within the scope of this Procedure, or

c) was made anonymously.

12. Each report of a breach shall be entered in the Internal Reports Register.

13. Within 7 days of the report of a breach, the Legal Entity informs the whistleblower that the report has been accepted, while ensuring the necessary protection of the whistleblower’s identity against disclosure to unauthorised persons.

Chapter III

1. The Internal Reports Register is maintained by the Organisational Unit holding written authorisation from the Legal Entity to maintain the Internal Reports Register.

2. The Internal Reports Register is maintained in electronic form, including through the use of an IT system. Only authorised persons have access to the data collected in the Internal Reports Register.

3. The Internal Reports Register should be maintained systematically.

4. Upon receipt of a report of a breach, the Legal Entity processes personal data to the extent necessary to accept the report or take possible follow-up action. Personal data that are not relevant to the handling of the report are not collected and, if collected accidentally, are deleted immediately. Such personal data shall be deleted within 14 days from the date on which it is established that they are not relevant to the case.

5. Article 14(2)(f) of the GDPR shall not apply unless the whistleblower does not meet the conditions set out in Chapter V point 1 of the Internal Reporting Procedure or has expressly consented to the disclosure of their identity.

6. Article 15(1)(g) of the GDPR, insofar as it concerns providing information on the source from which personal data were obtained, shall not apply unless the whistleblower does not meet the conditions set out in Chapter V point 1 of the Internal Reporting Procedure or has expressly consented to such disclosure.

7. The Internal Reports Register shall include at least:

a) the report number;

b) the subject matter of the breach of law;

c) personal data of the whistleblower and the person concerned by the report necessary to identify those persons;

d) the whistleblower’s contact address;

e) the date the report was made;

f) information on follow-up actions taken;

g) the date the case was closed.

8. Personal data and other information in the Internal Reports Register shall be stored for a period of 3 years after the end of the calendar year in which the follow-up actions were completed, or after the completion of proceedings initiated by those actions.

Chapter IV

1. The Organisational Unit authorised by the Legal Entity to take follow-up actions, including verification of the internal report and further communication with the whistleblower, including requesting additional information and providing feedback to the whistleblower, performs its function impartially and objectively, ensuring respect for the rights of the whistleblower, persons assisting the whistleblower and persons associated with the whistleblower.

2. In the event of a conflict of interest, the person carrying out follow-up actions in connection with a report of a breach should refrain from continuing such actions. A conflict of interest exists where the impartial and objective conduct of follow-up actions is threatened by any personal interests or personal relationships with the whistleblower.

3. Follow-up actions shall be conducted in a systematic and thorough manner, allowing the chronology of the actions taken and the persons involved in carrying out the follow-up actions to be reconstructed.

4. The purpose of follow-up actions includes, among other things:

a) establishing the facts in accordance with the law;

b) collecting and securing evidence;

c) identifying persons who may be connected with the breach of law;

d) protecting the identity of the whistleblower and the persons concerned by the report;

e) providing feedback to the whistleblower;

f) initiating administrative or judicial proceedings;

g) submitting a notification of a suspected criminal offence;

h) introducing solutions to prevent breaches of law in the future.

5. Within a period not exceeding 3 months from the date of confirmation of receipt of the report of a breach, the Legal Entity provides the whistleblower with feedback on how the case has been handled.

Chapter V

1. The whistleblower is entitled to the protection specified in the provisions of this Chapter from the moment of making a report or public disclosure, provided that they had reasonable grounds to believe that the information that was the subject of the report or public disclosure was true at the time of making the report or public disclosure and that it constituted information about a breach of law.

2. No retaliation, attempt at retaliation or threat of retaliation may be taken against the whistleblower, in particular in the form of:

a) refusal to establish an employment relationship;

b) termination of the employment relationship with or without notice;

c) failure to conclude a fixed-term or indefinite-term employment contract after termination of a probationary employment contract, failure to conclude a subsequent fixed-term employment contract, or failure to conclude an indefinite-term employment contract after termination of a fixed-term employment contract – where the whistleblower had a reasonable expectation that such a contract would be concluded with them;

d) reduction in remuneration for work;

e) withholding promotion or omission from promotion;

f) omission from the granting of work-related benefits other than remuneration or reduction of such benefits;

g) transfer to a lower position;

h) suspension from performing employment or service duties;

i) transfer of the whistleblower’s existing duties to another employee;

j) an adverse change in the place of work or working-time schedule;

k) a negative performance appraisal or negative employment reference;

l) imposing or applying a disciplinary measure, including a financial penalty, or a measure of a similar nature;

m) coercion, intimidation or exclusion;

n) mobbing;

o) discrimination;

p) adverse or unfair treatment;

q) suspension of participation in, or omission from selection for, training aimed at improving professional qualifications;

r) unjustified referral for medical examinations, including psychiatric examinations, unless separate provisions provide for the possibility of referring an employee for such examinations;

s) action aimed at making it more difficult to find employment in the future in a given sector or industry on the basis of an informal or formal sectoral or industry agreement;

t) causing financial or economic loss or loss of income;

u) causing other non-material harm, including infringement of personal rights, in particular damage to the whistleblower’s reputation.

3. An attempt or threat to apply the measures specified in point 2 shall also be regarded as retaliation due to making a report or public disclosure.

4. Where work or services were, are or are to be provided on the basis of a legal relationship other than an employment relationship, constituting the basis for performing work or services, performing a function or serving in an official capacity, making a report or public disclosure may not constitute grounds for retaliation or an attempt or threat of retaliation, including in particular:

a) termination of a contract to which the whistleblower is a party, in particular one concerning the sale or supply of goods or the provision of services, withdrawal from such a contract, or termination thereof without notice;

b) imposing an obligation or refusing to grant, restricting or withdrawing an entitlement, in particular a concession, permit or relief.

5. A whistleblower who has been subjected to retaliation is entitled to compensation in the amount specified in the Act.

6. A whistleblower shall be subject to criminal liability as provided for in the generally applicable provisions in this respect if they make a report or public disclosure knowing that no breach of law has occurred.

Chapter VI

1. A whistleblower may make an external report without first making an internal report.

2. External reports are received by the Commissioner for Human Rights or a public authority.

3. A report may be made orally or in writing. The reporting person may also make an anonymous report:

in paper form – by placing the report in the complaints and grievances box located on the Company’s premises,

online – via the anonymous reporting form available at: Complaints – Lubatex

Making an anonymous report does not require providing personal data or any other information that would enable the reporting person to be identified.

The Internal Reporting Procedure is effective from 25.09.2024.