Internal Whistleblower policy

Purpose

This Whistleblower policy is valid for all reports made through (Company name)

The purpose of our Whistleblower Scheme is to give all employees the opportunity to report on serious breaches of the legislation without fear of retaliation or repercussions. Furthermore, the purpose is to secure the protection of the whistleblower who reports on mistakes or negligence which can lead to economical loss or harm us.

As an employee you are often the first to discover legal breaches in the workplace. Therefore, we have established the mandatory Internal Whistleblower Scheme, to provide an anonymous possibility for doing such reports. Identifying such events or actions and handling them in a fitting manner is important for us.

How can you make reports?

Reports can be made through our Whistleblower Scheme on this website. It’s not possible to make reports in any other way.

Who can use our Whistleblower Scheme?

Our Whistleblower Scheme is available to all our employees including full- and parttime employees, substitutes, and fixed-term employees.

Which type of legal breaches can be reported?

Breaches falling within the material scope of the Whistleblower Scheme are

1) Serious offences to EU legislation or other serious conditions connected to the company. What constitutes breaches depends on the specific assessment of the breach which can be breaches as:

Bribery
Document forgery
Hacking, recording of conversations or wiretapping
Theft
Embezzlement
Fraud
Data fraud
Blackmailing
Sexual harassment
Gross harassment e.g., based on race, gender, sexuality, skin colour, language, national or social origin, political or religious affiliation

2) Breaches of the EU regulations as defined in article 2.1 in the whistleblower directive which can be found here.

What cannot be reported?

The Whistleblower Scheme is a supplement to the normal daily dialogue between employees and management. Therefore, dissatisfactions with things like salary, cooperation difficulties, breach of smoking- or alcohol policies, sick leaves or other personal dissatisfactions cannot be reported through the Whistleblower Scheme.

It’s important, that the Whistleblower Scheme is not abused to make accusations against innocent persons. All reports must therefore be done in a good faith. If a report is made in a bad faith, and is done in a rash of negative personal feelings, vengeance etc. it can result in warnings or termination of the employment etc.

Confidentiality and anonymity

All information’s or data received through our Whistleblower System are processed confidentially. Our Whistleblower System is implemented so that confidentiality of both the whistleblower and the subject /person of the report is secured. This includes that receipt, registration, and storing of the report is only available to relevant persons, who are investigating the reports.

If you choose to report non-anonymously, we ensure the same level of confidentiality. However, if the report leads to legal processing or lawsuit against the person or persons who are subject to the report, you may be called in as a witness. In such cases we cannot ensure your confidentiality.

Furthermore, there can occur situations where the identity of relevant persons cannot be kept anonymous. This can e.g., be

A police investigation is being pursued
The whistleblower is offered compensation in form of sick leave or treatment etc.

Secure Mailbox

When making a report as a whistleblower, you can create a secure mailbox. The mailbox can be used to provide further documentation in relation to the initial report. The internal investigators and the whistleblower can communicate through the secure mailbox without the whistleblower’s identity being compromised. The use hereof is solely based on the whistleblower’s willingness to log-on and answer questions or to upload further documentation.

If you choose to create a secure mailbox, when making a report, you will create a password and be provided with a unique link to your mailbox linked to the report. At this point it is very important that you save this link on your device, as the link cannot be reproduced.

Process for the handling of reports

Reports are initially sent to our partner PersondataSupport ApS. They make an initial screening of the report to ensure that there is no conflict of interest between the contents of the report and the internal investigators. Furthermore, they will do an initial analysis to determine whether the report fall within the material scope of the Whistleblower legislation or whether it should be rejected.

Subsequently the report is released (Insert internal invetigators). The whistleblower unit or relevant persons in the unit will then analyze the report to ensure that the content falls within the material scope of the Whistleblower Scheme. Hereafter they will conclude whether the contents of the report merit a further investigation, or whether it shall be rejected.

If the report concerns one or more of the Whistleblower Unit, the report will be released to (Internal investigators), who will conduct the same analysis.

If the report does not fall within the material scope, the whistleblower unit can advise the whistleblowers on how they should proceed with their report. If the report falls within the material scope, the whistleblower unit will conduct an internal investigation of the content.

The whistleblower will receive feedback on the report within 3 months after the report has been made to us. However, circumstances can occur, so that the whistleblower unit must extend this deadline to 6 months. The whistleblower unit will inform the whistleblower of the extension and reasons within the initial period of 3 months.

If the report is sufficiently substantiated and the internal investigation finds it necessary, appropriate measures will be applied to the person in question. This can be disciplinary sanctions, warnings, termination, police reports or in some cases lawsuit.

Whistleblower protection

When an Employee in good faith reports under the scope of the Whistleblower Scheme, they are granted a protection.

As a Whistleblower you cannot be held responsible for the following:

Disclosure of confidential information’s, if the Whistleblower is in good faith of the necessity of the information to uncover breaches of the law, or serious conditions, or events.
Procurement of information, unless the procurement is a result of a criminal offence such as hacking, wiretapping etc.
Breaches of contractual non-disclosure agreement with the company
Furthermore, the Whistleblower is protected against retaliation and attempts of retaliation because of the reports. This includes but is no limited to:
Termination, suspension
Changes in assignment, position, working hours, salary
Degradation or lack of promotions
Negative performance review
Harassment of any form
Exclusion from employee activities
Revocation of licenses or permissions
Other harmful action against the whistleblower or persons close to the whistleblower

We take all claims of reprisals very seriously, and they will be investigated.

IT Security

Our whistleblower solution is hosted by PersondataSupport ApS who is ISO 27001 and ISAE3000 certified and ensures the necessary security and anonymity in the solution.

PersondataSupport ApS has taken the necessary technical and organizational measures to ensure, that personal data is not subject to accidental or unlawful destruction, is lost or compromised, and no unauthorised personnel is given access or can misuse personal data.

All data transmissions and storage of data are encrypted.

If a report is made from a device on the company’s network, there is a risk, that visited websites are logged in your browser history and/or in the company’s own logs. This risk can be eliminated by making your report on a device that is not connected to the company’s network.

If you upload documents, you should pay attention to whether these contains metadata or other information that can compromise or identify you. It is important that you are aware that you have given your prior consent if your report contains sensitive personal information.

Logging

Registration of reports is done anonymously in the system. The only thing that is registered is the report itself. There is no log of the used IP-address or machine-ID on the device used to make the report.

Processing of personal data

Our processing of personal data regarding the Whistleblower Scheme is described in our privacy policy for the whistleblower solution.

Question

If you have questions, you are welcome to contact us at: (Insert contact information)