Principles of whistleblower protection (WHISTLEBLOWING)

The obligated entity, through the competent person, receives and processes reports made by an employee of the obligated entity or a person who performs voluntary work, professional practice or an internship at the obligated entity (the "whistleblower").

The obligated entity does not exclude the receipt of reports from other persons who are active for the obligated entity in a manner other than in a basic employment relationship.

A report is considered to be a communication containing information about possible unlawful conduct that has occurred or is about to occur at the obligated entity or at a person with whom the whistleblower has been or is in contact in connection with the performance of employment, volunteer work, professional practice, or internship at the obligated entity, and which has the characteristics of a criminal offense or misdemeanour for which the law stipulates a fine of at least CZK 100,000, violates the Act or other legal regulation or European Union regulation in the area of:

• 01financial services, statutory audit and other assurance services, financial products and financial markets,
• 02corporate income tax,
• 03the prevention of money laundering and terrorist financing,
• 04consumer protection,
• 05compliance with product requirements, including product safety,
• 06transport, shipping, and road traffic safety,
• 07environmental protection,
• 08food and feed safety and animal protection and health,
• 09radiation protection and nuclear safety,
• 10economic competition, public auctions, and public procurement,
• 11protection of internal order and security, life and health,
• 12protection of personal data, privacy, and security of electronic communications networks and information systems,
• 13protection of the financial interests of the European Union, or
• 14the functioning of the internal market, including the protection of competition and state aid under European Union law.

Except in cases where the whistleblower is known to the competent person, the report must contain the first name, surname, and date of birth, or other information enabling the identification of the whistleblower.

The report must not violate:

• 01the duty of confidentiality in the performance of the activities of a lawyer, trainee lawyer, and employee of the company through which the lawyer practices law as a partner under the law governing the practice of law, or another person who participates in the provision of legal services within such a company,
• 02duty of confidentiality when providing legal assistance in proceedings before a court or other public authority.

The obligated entity has appointed a competent person and a substitute competent person. Unless otherwise specified in these principles, all provisions concerning the competent person shall apply mutatis mutandis to the substitute competent person.

The competent person receives and processes reports. The substitute competent person receives and processes reports in cases where the competent person is unable to do so.

If there is any doubt about the impartiality of the competent person, they shall forward the report to the substitute competent person for handling, and if the report cannot be forwarded to the substitute competent person, the competent person shall inform the reporter of this fact and instruct them on the possibility of submitting a report through an external reporting system.

The form in Appendix 1 may be used to submit a report.

The competent person shall receive reports through the contact channels. Reports may also be made in person and/or anonymously to the designated mailbox at the registered office of the obligated entity. Reports may also be submitted to the ministry using the form available at oznamovatel.justice.cz.

The competent person shall immediately notify the whistleblower in writing of the receipt of the report, but no later than 7 days from the date of receipt of the report. The competent person shall not do so if the identity of the whistleblower would be disclosed or if the whistleblower so requests.

After evaluation, the competent person shall inform the whistleblower of the result of such assessment within 30 days of the date of receipt of the report. In factually or legally complex cases, this period may be extended by up to 30 days, but no more than twice.

In the event that certain necessary information or data is missing, the competent person shall request the whistleblower to provide it.

If, when assessing the validity of the report, the competent person concludes that it is not a report within the meaning of the law, they shall inform the reporter without undue delay and instruct the reporter on their right to contact the competent public authority. Otherwise, the competent person shall, without undue delay, propose to the obligated entity appropriate measures to prevent or remedy the unlawful situation, while maintaining the confidentiality of the identity of the whistleblower.

The obligated entity shall take the measures proposed by the competent person or other appropriate measures. The competent person shall immediately notify the whistleblower thereof.

The competent person shall keep electronic records of data on reports received, which shall include:

• 01the date of receipt of the report,
• 02the first name, last name, date of birth, and contact address of the whistleblower or other information from which the identity of the whistleblower can be deduced, if known,
• 03a summary of the content of the report and identification of the person concerned, if their identity is known,
• 04the date of completion of the assessment of the merits of the report by the competent person and its outcome,
• 05proposed and adopted preventive or corrective measures.

The competent person shall keep the report and related documents for a period of 5 years from the date of receipt of the report.

Access to the records, reports, and documents retained shall be restricted to the competent person.

The obligation to assess the impact on personal data protection shall not apply to the processing of personal data in connection with the report.

The processing of personal data in connection with the report is carried out on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR"), taking into account the need to maintain the confidentiality of the whistleblower's identity.

Retaliatory measures are considered to be actions or omissions that may cause harm to the whistleblower.

Retaliatory measures include, in particular:

• 01termination of employment or non-renewal of employment or a working relationship based on a contract for work or a contract for services,
• 02reduction of wages, salary, or remuneration, or non-granting of a personal allowance,
• 03transfer or reassignment to another job,
• 04performance evaluation or work assessment,
• 05denial of professional development,
• 06change in working hours,
• 07requiring a medical assessment or occupational health examination,
• 08termination or withdrawal from the contract, or
• 09interference with the right to protection of personality.

No retaliatory measures may be taken against the whistleblower or:

• 01a person who provided assistance in gathering information that is the subject of the report, in filing the report, or in assessing its merits,
• 02a person who is close to the whistleblower,
• 03a person who is a colleague of the whistleblower,
• 04or other persons specified by law.

When assessing the validity of a report, the competent person is entitled to request information, make copies, transcripts, extracts, and other audiovisual recordings.

The competent person is entitled to require persons performing work or other similar activities for the obligated entity to prepare, within a reasonable time, a written statement on the factual issues related to the report.

The competent person shall perform their duties personally, impartially, and confidentially.

The competent person may disclose the identity of the person against whom the report is directed to the necessary circle of persons for the purpose of investigating the information contained in the report or proposing or imposing preventive or corrective measures.

The competent person shall submit to the obligated entity an annual written report on their activities for the past calendar year, which shall include:

• 01the total number of admissible reports,
• 02the number of reports that were forwarded to the competent public authority,
• 03the number of ongoing investigations,
• 04the number of completed investigations,
• 05the number of reports for which the information contained therein could not be investigated, including the reasons why,
• 06number of reports meeting the relevant parameters of the Act,
• 07identified deficiencies, proposed preventive or corrective measures, and preventive or corrective measures taken.

The obligated entity shall publish the report in a manner allowing remote access within 15 days of its submission by the competent person.