Whistleblower – a person who reports a potential violation that may harm the public interest, believing the information to be true and correct, and obtains it while performing their professional duties or establishing legal relationships related to their job duties. A whistleblower can be any employee (including candidates and former employees) of the Company or its Subsidiaries, interns, employees of the Group’s service providers, and self-employed persons.
Responsible Person – the head of the Company’s Human Resources and Communications Department (or equivalent position), replaced during absence by the Data Security Specialist.
Potential Violations – administrative or criminal offences, violations of the Group’s Code of Ethics, and other actions that threaten public interests, such as official misconduct, corruption, tax evasion, money laundering, public procurement fraud, violations of Latvian and binding international economic sanctions, threats to public health, environment, occupational safety, product and service safety, competition, and consumer protection rights, etc.
Pseudonymization – the processing of personal data in such a way that specific individuals cannot be identified without additional information stored separately and protected technically and organizationally to prevent identification and disclosure of identity.
Parent Company or Company – Joint Stock Company “GRINDEKS”, registration No. 40003034935, as the dominant company and its dependent subsidiaries in the sense of the Latvian Group Law.
Subsidiary – a separate legal entity controlled and owned by the Company, i.e., a dependent legal entity within the meaning of the Group Law.
Group Company – Parent Company, branches, and representative offices of the Parent Company, as well as existing and future Subsidiaries. “Group Company” and “Group” should be considered synonymous.
Group Company’s Internal Regulations – the Group Company’s statutes and other internal normative acts, such as work regulations, orders, etc.
Reporting – the disclosure of information about illegal, unethical, or unlawful behaviour in the Group, which is provided by the whistleblower to the Responsible Person. Whistleblowing is not related to other reporting procedures of the Company or its Subsidiary.
Legislation – current laws, international agreements, and other regulatory acts that are generally binding in the country of the Group Company or representative office (branch). Legislation also includes all subsequent changes and amendments.
Purpose
1.1. The purpose of this order is to establish the procedure for reporting potential violations within JSC “Grindeks” or its Subsidiaries (as defined below) to protect employees, partners, consumers, etc. The Group guarantees protection for whistleblowers.
1.2. All reports are accepted and verified. Whistleblowers can report safely, knowing they will not be punished for good-faith reporting. Whistleblowers are provided with maximum confidentiality. We aim to create trust and encourage cooperation, ensuring our procedures are followed.
1.3. The established procedure is intended to help employees and management of our Group identify, report, and prevent potential violations.
Scope
2.1. The procedure is binding on all employees of the Group Companies
Submitting a Potential Violation Report
3.1. If a Whistleblower has reasonable suspicion of a violation that cannot be remedied by their efforts within the Group or Group Company, they are encouraged to report immediately to the Responsible Person. Reporting covers violations that have occurred, are occurring, or may occur, including attempts.
3.2. Reporting is voluntary, except where required by Legislation or direct job duties.
3.3. The whistleblower submits a “Whistleblower Report” to the Responsible Person. If it is not possible or suitable to report to the Responsible Person for objective reasons, the Whistleblower can exceptionally submit the Whistleblower Report to the Company’s Board or the Chairman of the Board, who appoints the Responsible Person by order.
3.4. Reports can be submitted in the following ways:
3.4.1. in writing in paper format, by placing the completed “Whistleblower Report” form into the box located in the Company’s lobby of building K18 on the 1st floor;
3.4.2. electronically at www.grindeks.com, where the mentioned form is available for electronic completion;
3.4.3. by sending the form electronically to the email address [email protected];
3.4.4. personally, by handing the report form to the Responsible Person;
3.4.5. verbally, by addressing the Responsible Person, who then writes down the report in the form.
3.5. The Responsible Person must check the communication channels mentioned in point 3.4. at least once a week.
3.6. If a whistleblower suspects a violation, they are initially advised to consider resolving the issue by contacting their direct supervisor. If the situation is unclear, they should first consult the Responsible Person.
3.7. The general reporting procedure is as follows:
1. Direct Supervisor or competent person (department) whose direct competence is the issue. This is the simplest way to resolve work (environment) issues and clear up misunderstandings, promoting clear and open communication.
2. Next-level or higher-level supervisor (if any). If, for justified reasons, reporting to the direct supervisor or another person (department) whose direct competence is the issue is not justified or appropriate, the whistleblower can contact the next-level supervisor. This may be relevant, for example, when the direct supervisor or competent person (department) does not adequately respond to the report.
3. The Company’s Board, Chairman of the Board, or the manager of the Subsidiary/representative office (branch). If the direct supervisor, competent person (department), or next-level supervisor does not ensure appropriate action regarding the report, or if there are other justified reasons, the Whistleblower can contact the Company’s Board, the Chairman of the Board, or the manager of the Subsidiary/representative office (branch). The whistleblower can also directly address the Company’s Board or its Chairman.
3.8. The whistleblowing procedure is an alternative solution used if the whistleblower has concerns that the general procedure may not provide an adequate response, the content of the response may be unsatisfactory, or in cases where the mentioned general procedure cannot be used.
3.9. The whistleblower needs to provide clear and thoughtful information in the report that does not contradict the whistleblower’s knowledge and available information, indicating physical or legal persons (if any) who are suspected or believed to be related to the potential violation. The background, course of events, reasons, as well as names, surnames, dates, places, and any other essential information should be provided. If possible, documents or copies, as well as other evidence (e.g., photographs, email correspondence copies), should be attached.
3.10. The whistleblower is not required to prove that the violation has occurred or to conduct an investigation unless this arises from the whistleblower’s position and direct job duties. In this case, the whistleblower should also provide the inspection results.
3.11. The whistleblower should also indicate whether this violation has been reported previously and whether they wish to receive confirmation of receipt of the report and a decision on the status of the report.
3.12. If a Group’s official or employee, who is not the Responsible Person, receives a person’s report and finds that the report or part of it may be classified as a Whistleblower Report, they must immediately forward the report to the Responsible Person (if received by email, it is forwarded to the email address: [email protected], if received personally, it is handed over personally to the Responsible Person), proposing to recognize this report as a Whistleblower Report.
3.13. The Responsible Person maintains a register of Whistleblower Reports (“Report Register”). The Report Register can only be accessed by the Responsible Person. Upon receiving a Whistleblower Report, it is immediately registered in the Report Register. Whistleblower Reports are not entered into the Group’s electronic document management systems. Reports registered in the Report Register and related information have the status of confidentiality.
Personal Data Protection and Confidentiality
4.1. The whistleblower must indicate their name, surname, and contact information. Anonymous reports are not accepted as they do not allow for clarification of details, asking questions, and fully assessing the situation, thereby reducing reliability.
4.2. Information that can identify the whistleblower and disclose their identity (personal data), as well as other information provided in the report, is specially protected and only available to the Responsible Person, helping the Responsible Person evaluate the report and provide a response to the whistleblower according to legislation and obtain as much information as possible about the specific potential violation.
4.3. The whistleblower’s personal data will not be disclosed without their consent, except where necessary for reviewing the Whistleblower Report, initiating an investigation case, or providing protection. The whistleblower’s identity is disclosed by informing them unless it harms the review of the violation.
4.4. If the report is not classified as a Whistleblower Report, but the submitter wishes to receive a substantive response without the protection guarantees provided by the Whistleblowing Law, the report is registered in the Group’s electronic document management system and forwarded for further consideration in the general procedure.
4.5. The Responsible Person or the person mentioned in point 3.12., who receives or processes the Whistleblower Report, must ensure the proper protection and confidentiality of the whistleblower’s personal data.
Reviewing the Potential Violation Report
5.1. Upon receiving a report of a violation, the Responsible Person immediately:
5.1.1. registers the report in the Report Register;
5.1.2. conducts an initial inspection to determine if the report meets the criteria for whistleblowing as defined in legislation;
5.1.3. determines whether the report preliminarily meets the criteria for whistleblowing as defined in legislation;
5.1.4. provides written confirmation of receipt of the report to the submitter and decides whether to recognize the report as a Whistleblower Report or to review the report in the general procedure and sends the corresponding decision to the submitter no later than 10 (ten) days from the date of receipt of the report.
5.2. If the report is recognized as a Whistleblower Report, additionally, the Responsible Person:
5.2.1. pseudonymizes the report;
5.2.2. creates a Whistleblower Case;
5.2.3. proposes to the Chairman of the Board to issue an order to initiate an investigation case and establish an investigation committee (“Investigation Committee”);
5.2.4. informs the whistleblower about the progress of their report review within 2 months from the day the report is recognized as a Whistleblower Report;
5.2.5. after completing the Whistleblower Report review, informs about the established facts and the decision made or actions taken.
5.3. Each Whistleblower Report is processed confidentially and pseudonymized, considering the applicable legislation on personal data protection.
5.4. The Responsible Person does not send the confirmation and decision of point 5.1.4. if the whistleblower did not wish to receive it or if there is a suspicion that the whistleblower’s identity will be disclosed.
5.5. If the report is not recognized as a Whistleblower Report, the Responsible Person:
5.5.1. Provides written confirmation of receipt of the report to the submitter and decides to review the report in the general procedure, and sends the corresponding decision to the submitter no later than 10 (ten) days from the date of receipt of the report.
5.5.2. registers the submitter’s report in the general procedure in the Group’s electronic document management systems;
5.5.3. Makes a note in the Report Register that the report was not recognized as a Whistleblower Report.
Conducting the Investigation on Facts, Employee Actions
6.1. The task of the Investigation Committee is to fully, thoroughly, and objectively investigate the circumstances of the potential violation, identify the employee who committed the potential violation, and if signs of a violation as defined by legislation, internal rules of the Group Company, or employment contract are established, provide proposals to the Chairman of the Board or the manager of the Subsidiary for disciplinary action or, if the violation is not established or the violation is deemed minor, or disciplinary action cannot be applied due to legal or factual obstacles, then provide proposals to the Chairman of the Board or the manager of the Subsidiary on improving practices within the company.
6.2. The Investigation Committee’s work is led by the Chairman of the Investigation Committee. During the absence of the Chairman of the Investigation Committee, the work of the Investigation Committee is led by the Deputy Chairman of the Investigation Committee, who has all the rights and duties defined for the Chairman of the Investigation Committee during the Chairman’s absence.
6.3. The Chairman of the Investigation Committee, according to their competence, performs the following duties:
6.3.1. requests written and verbal explanations from Group Company employees, including (but not limited to) the employee against whom the Whistleblower Report is filed. Verbal explanations are documented in a written protocol or audio recording, which is permissible only with the employee’s consent, documented in the protocol, recording the content of the explanation;
6.3.2. requests and receives necessary information and documents from the Group Company’s departments;
6.3.3. convenes and chairs the meetings of the Investigation Committee;
6.3.4. if necessary, includes specialists from the relevant field with appropriate competence in the investigation processes, including requesting verbal or written explanations and opinions, inviting them to participate in the Investigation Committee meetings and certain actions along with other employees;
6.3.5. sets deadlines for fulfilling the Investigation Committee’s requests;
6.3.6. submits a report to the Chairman of the Board or the general manager of the Subsidiary on the need to extend the investigation term;
6.3.7. ensures the preparation of the investigation report and its submission to the Chairman of the Board or the general manager of the Subsidiary.
6.4. The Deputy Chairman and members of the Investigation Committee are responsible for actively participating in the investigation and preparing the report draft or reviewing specific issues according to their competence, as directed by the Chairman of the Investigation Committee.
6.5. The Group’s lawyer, who is part of the Investigation Committee, ensures the procedural compliance of the investigation with the requirements of legislation.
6.6. If the views of the members of the Investigation Committee, Deputy Chairman, and Chairman differ, the Investigation Committee makes a decision by voting, with a simple majority. If the votes are equally divided, the decisive vote belongs to the Chairman of the Investigation Committee, and during the Chairman’s absence, the decisive vote belongs to the Deputy Chairman of the Investigation Committee.
6.7. The Investigation Committee submits a report to the Chairman of the Board or the manager of the Subsidiary by the deadline specified in the order. The report is signed by all members of the Investigation Committee. If any member of the Investigation Committee has a different opinion, they attach their separate opinion in a separate document to the report. The report includes:
6.7.1. the date and place of its preparation;
6.7.2. the date and place of the order for conducting the investigation;
6.7.3. the fact or action for which the investigation was initiated;
6.7.4. the actions taken during the investigation, including information about extending the investigation term if it was extended;
6.7.5. the established facts and materials in which they are recorded;
6.7.6. the evaluation of the explanations provided by employees and others involved, including arguments that refute or support them;
6.7.7. the analysis of the facts established during the investigation;
6.7.8. conclusions (whether a violation of legislation, employment contract, or internal rules of the Group Company was committed), indicating the legal norms and circumstances that justify them;
6.7.9. the Investigation Committee’s proposal: to apply disciplinary action to the employee who violated legislation, employment contract, or internal rules of the Group Company, with a proposal to improve Group practices, or to take actions provided for by legislation
6.7.10. The investigation report is approved by the Chairman of the Board or the general manager of the Subsidiary with a resolution. If the Chairman of the Board or the Manager of the Subsidiary determines the need to take specific actions by other departments, the Group’s lawyer prepares and sends copies of the Investigation Committee’s report to the relevant departments.
6.7.11. The Responsible Person informs the whistleblower according to points 5.2.4. and 5.2.5.
Particularities of Conducting Investigations against Employees
7.1. The behaviour of a Group employee is examined according to the legislation and general requirements for conducting investigations.
7.2. Upon initiating an investigation, the Investigation Committee prepares a written request to the employee to provide an explanation of the potential unlawful behaviour, violation of legislation, employment contract, or other norms, simultaneously explaining in writing the essence of the apparent violation committed by the employee, attaching a copy of the Group’s order on the establishment of the Investigation Committee if necessary.
7.3. The Investigation Committee evaluates the employee’s explanation received during the investigation and other information about the employee’s potential unlawful behaviour, violation of legislation, employment contract, or internal rules of the Group Company, and prepares an investigation report. The report indicates one of the following proposals:
7.3.1. to issue a disciplinary punishment;
7.3.2. to terminate the employment contract;
7.3.3. to terminate the investigation if:
7.3.3.1. no violation of legislation, employment contract, or other norms was established;
7.3.3.2. the limitation period for disciplining the employee has expired;
7.3.3.3. circumstances were established that prevent disciplinary action or termination of the employment contract for the specific employee.
Providing Feedback on Investigation Results to the Whistleblower
8.1. The whistleblower receives written feedback on the progress of the report review no later than 2 (two) months from the day the report is recognized as a Whistleblower Report.
8.2. After reviewing the investigation case, the whistleblower receives written information about the result of the report review and whether further actions or process improvements will be taken within the Group.
8.3. Information about specific individuals who may be involved in the violation is not disclosed, and the feedback may be general, considering the Group’s interest in maintaining the confidentiality of its information and the rights of third parties, including (but not limited to) the presumption of innocence and personal data protection requirements.
Final Provisions
9.1. The Company has the right to make amendments to this procedure by updating and approving a new procedure by order.
9.2. The Subsidiary, the Company’s representative office (branch) must comply with the mandatory legislation of the country where the Subsidiary or representative office (branch) operates and is established. If there are contradictions between the legislation of the Subsidiary’s or the Company’s representative office (branch) country, on one hand, and this procedure, on the other hand, the priority is given to the legislation of the Subsidiary’s country.
9.3. The managers of the Company’s departments, the managers of the Company’s representative office (branch), or the Subsidiaries ensure employee training on whistleblowing.
9.4. To ensure a transparent and open whistleblowing procedure, the latest version of this procedure is always published on the Group’s website.
9.5. If this procedure is translated into other languages, the text in Latvian shall prevail in case of discrepancies.
9.6. This procedure comes into effect upon signing the order approving this procedure.
