Whistleblowing policy

1. Introduction
2. Cases that may be subject to reporting
3. Who can report
4. Reporting methods
5. Content of reporting/whistleblowing
6. Whistleblower protection
7. Manner of investigation and settlement

1. Introduction

This policy applies to persons obtaining information, in a business context, and willing to notify breaches of legislation, which have occurred or are likely to occur within or in relation to the activity of ELMAS S.R.L., in order to emphasize such cases and contribute to taking measures for the remedy of breaches.

1.1. Purpose and scope

The object of this policy is to establish the conditions for reporting suspected breaches of the rules of ethics, standards of conduct applicable at the level of ELMAS S.R.L., as well as of the legal provisions in force, in particular those within the categories set out under Law 361/2022 on the protection of whistleblowers in the public interest. This policy sets out the framework for the submission of internal reporting and provides protection, support and remedial measures, as the case may be, for the reporting persons.

This policy applies to all employees, including job candidates in the recruitment process, and collaborators of ELMAS S.R.L. who have obtained information on breaches of the law in a business context.

1.2 Principles

The whistleblowing policy is a manner of warranting the integrity, prestige and reputation of ELMAS S.R.L. By ensuring a reliable and safe environment for its employees, customers and suppliers, ELMAS S.R.L. encourages legitimate and solid whistleblowing of illegal acts or severe offenses they become aware of.

The principles of the Whistleblowing Policy are:
- ensuring the compliance with the fundamental rights and freedoms of the persons submitting such reports by ensuring, among others, the freedom of expression and information, the rights to personal data protection, protection of employees against any negative consequences they might incur following notification;
- accountability (the whistleblower must present data or information to support the reporting);
- impartiality (the examination will be objective);
- the principle of good faith (report only real breaches);
- the principle of balance (no person may rely on the protection granted by this policy to mitigate a possible disciplinary sanction for a more serious deed unrelated to the reporting, committed by him/herself).

1.3 Definitions

Whistleblower – natural person (employee, former employee, candidate or collaborator) who reports (anonymous or signed) through the communication channels referred to in this policy, reporting containing information on possible breaches of the law, irregularities, non-compliance with the internal rules of ethics, business conduct, corruption or breaches of the applicable legislation in force at national or European level, which would have occurred within or in relation to the activity of ELMAS S.R.L., obtained in a business context;
Collaborator – any natural person who has carried out or carries out an activity in own name or as a representative, employee or subcontractor of a legal entity in business relations, regardless of their nature, with ELMAS S.R.L.;
Whistleblowing investigation commission – the commission appointed by the decision of the director of ELMAS S.R.L., which will consist of at least 3 persons;
Business context – business activities, current or previous, of any nature, paid or not, carried out within ELMAS S.R.L. or within other legal entities of public or private law, under which persons can obtain information on breaches of the law and may incur damages in case of reporting them;
Breaches of law – deeds consisting of an action or inaction representing non-compliance with legal provisions concerning areas such as those mentioned in point 2 or even a reasonable suspicion of actual or potential breaches of the law;
Designated person – employee of ELMAS S.R.L. appointed by the company as the person in charge with receiving reports, recording thereof, examining and settlement of reporting together with the whistleblowing investigation commission appointed for this purpose, as well as communicating with the whistleblower. The designated person shall act impartially, shall inform the company’s management about the settlement method, shall keep in touch with the whistleblower and any public authorities or institutions involved;
Subject of the reporting – the natural or legal person mentioned in the reporting as the person to whom the breach of the law is attributed or associated with the said person;
Management personnel – director of ELMAS S.R.L.;
Policy – this whistleblowing policy;
Internal reporting – consists in the communication of information related to the breaches covered by this Policy, by using the internal reporting channels made available by ELMAS S.R.L.;
Reporting in good faith - legitimate, serious communication based on well-grounded reasons of the whistleblower, leading to the belief that the information concerning the occurrence or the possibility of occurrence of an irregularity covered by this policy, within or in relation to the activity of ELMAS S.R.L., is true at the time of reporting.

2. Cases that may be subject to reporting

Examples of cases that may be subject to reporting:

1. Breaches of the law in areas such as, but not limited to:

- public procurement, cadastre and land registration, works concessions
- prevention of money laundering and terrorism financing
- product safety and compliance
- environment protection
- food and fodder safety, animal health and welfare
- public health
- consumer’s protection
- transport safety
- protection of privacy and personal data, of networks and computer systems security
- competition and State aid
- taxation or obtaining tax advantages against the object/purpose of the tax law

2. Breaches of rules of ethics and standards of conduct

3. Acts/deeds in gross negligence, potential fraud or corruption
4. Acts/deeds compromising the reputation of ELMAS S.R.L.
5. Acts/deeds of conflict of interest with ELMAS S.R.L. or with the customers/suppliers of ELMAS S.R.L.
6. Acts/deeds that endanger the safety of an employee, sexual harassment and racial or any other type of discrimination
7. Bribery
8. Attempts to hide/conceal the situations described above.

If, following the whistleblowing and examining the context of the case, it is found that disciplinary investigations are also required, these are not covered by this Policy and shall be handled separately, according to rules of the labor law and the Internal Regulations of ELMAS S.R.L.. In this case, the investigation procedure of the issue reported by the whistleblower shall pe performed concomitantly with the disciplinary investigation procedure. ELMAS S.R.L. does not have the obligation to inform the whistleblower on the performance and/or result of the disciplinary investigation ordered regarding an employee.

3. Who can report

No employee or collaborator should accept irregularities committed by superiors, subordinates, collaborators or business partners, therefore any employee and/or collaborator is encouraged to report.

The following persons are also included in the category of persons who can report:
- shareholders and persons who are part of the management board of ELMAS S.R.L.
- volunteers and paid or unpaid trainees
- any other person working under the supervision and management of ELMAS S.R.L., its subcontractors and/or collaborators
- former employees of ELMAS S.R.L.
- persons who applied for a job with ELMAS S.R.L. etc.

Any person mentioned above who meets the following conditions can be a whistleblower:
- reports in good faith alleged/possible breaches of the law, of the internal rules;
- makes a report on the facts covered by this policy;
- acts in good faith, being certain of the reality of facts or that the deed constitutes a breach of law.

4. Reporting methods

Reporting within ELMAS S.R.L. can be done in writing, by sending the notification to the company’s email address, respectively to the company’s address for the attention of the company’s legal representative. In exceptional situations, when this portal may not be functional for various reasons, the reporting can be sent in electronic format by email to info@elmas.ro, ELMAS S.R.L..

Upon the whistleblower’s request in writing via one of the above-mentioned channels, the reporting can be done face-to-face, in a meeting between the whistleblower and the designated person, a meeting to be established within a maximum period of 30 days from the receipt of notification. When the reporting is done face-to-face, the designated person has the obligation to prepare, in writing, a recording protocol where the conversation shall be fully and accurately transcribed. The designated person must grant the whistleblower the possibility to verify, rectify and express agreement with the recording protocol, by signing it.

If the whistleblower does not agree to the recording of the conversation or does not sign the recording protocol, he/she must report the facts in writing. The reporting can be signed/assumed or anonymous.

5. Content of reporting/whistleblowing

The signed/assumed reporting must contain at least the following elements:
- the last and first name of the whistleblower (the person reporting);
- contact details of the whistleblower (the person reporting);
- the business context in which the information was obtained;
- description of the fact that could constitute a breach of the law within or in relation to the activity of ELMAS S.R.L.;
- the evidence supporting the reporting;
- date;
- signature.

Anonymous reporting: Using the dedicated email address allows anonymous reporting:
In both situations, the whistleblower shall receive a code by email from the moment of notification, which also constitutes the acknowledgement of the reporting receipt . With this code, the whistleblower shall be able to request information throughout the investigation period of the reported case in order to answer related questions, to provide additional details or just to check the status of the investigation and the notification settlement.

Even in the case of an anonymous reporting, it is required to provide the same information as in the case of a signed reporting, less the whistleblower’s identity and signature. However, in order for the notification to be subject to review, it is mandatory to mention the capacity of the whistleblower and the existence of solid indications regarding the breach of law.

6. Whistleblower protection

! ELMAS S.R.L. agrees not to investigate the identity of the person who anonymously reported the specified irregularities.
! ELMAS S.R.L. warrants that reporting in good faith will not lead to adverse circumstances or consequences for the employee or collaborator, their dismissal or any other forms of retaliation.
! ELMAS S.R.L. warrants the confidentiality and anonymity of the identity of the whistleblower, except for the case when the whistleblower agrees with the disclosure of his/her identity.
! ELMAS S.R.L. prohibits any retaliation against the person who reports an abuse or irregularity, if the reporting is done in good faith.
! Retaliation consists, in particular, of dismissing an employee, suspending the individual employment contract, amending the individual employment contract, salary reduction and changing the working schedule, demotion or preventing promotion, termination of a contract with a collaborator, harassment, discrimination or abusive behaviour of the superior against an employee or collaborator, including by exercising influence on any person interacting with the employee or collaborator, acts that lead to the degradation/damage of the employment conditions of the employee or collaborator.

ELMAS S.R.L. does not tolerate and shall not act upon notifications of employees or collaborators that contain false information for the sole purpose of disparaging other employees or collaborators.

Whistleblower protection under this policy applies only under the following conditions:
- the information related to breaches of the law was obtained in a business context;
- the existence of reasonable grounds to believe that the information regarding the reported breaches was true at the time of reporting;
- an internal reporting under the conditions mentioned above was carried out.

7. Methods of investigation and settlement

7.1. Designated person – is the responsible person, appointed at the level of ELMAS S.R.L., to perform duties in relation to receiving, recording, reviewing, following up and settling reporting and who acts impartially.

The DESIGNATED PERSON receives the reporting sent via the means of communication provided for in this policy. The reporting is registered in the special electronic Register kept by the DESIGNATED PERSON and is subject to review by a whistleblowing investigation commission. The DESIGNATED PERSON coordinates and supervises the commission’s activity and ensures that the confidentiality and independence thereof are observed. In the event that the person reporting (whistleblower) is one of the members of the whistleblower investigation commission, the DESIGNATED PERSON proposes to the company’s management board his/her replacement with one of the substitute members.

If the reporting is addressed to the reporting employee’s superior, or to one of the company’s legal representatives, in order for the designated person to register the reporting, the whistleblower shall also submit the reporting in writing on the whistle-blow.org platform, or , as the case may be, verbally - face to face with the designated person, when the conversation recording protocol shall be also signed.

7.2. Confidentiality
The PERSON DESIGNATED to settle the reporting has the obligation not to reveal the whistleblower’s identity in public interest, nor the information that would allow his/her direct or indirect identification, except when having his/her express consent.
By way of exception, the identity of the whistleblower or other information related to the whistleblower may be disclosed only if required by law, subject to the conditions and limits provided thereon. In this case, the whistleblower shall always be informed in advance, in writing, on the disclosure of his/her identity and the reasons for the disclosure of the confidential data in question. However, if it is found that the whistleblower’s prior information would compromise the investigations or legal proceedings, the whistleblower shall no longer be informed in advance.
Information contained in reporting that represent trade secrets may not be used or disclosed for purposes other than those required to settle the reporting.

7.3. Acceptance, registration and preliminary check of reporting
The DESIGNATED PERSON initiates a preliminary check to determine whether the information contained in the notification allows the initiation and conduct of a clarification policy.
If the whistleblower has provided relevant, complete and correct contact details, the DESIGNATED PERSON will acknowledge receipt of the reporting to the whistleblower within maximum 7 calendar days after its receipt. The PIN code generated by the email constitutes at the same time acknowledgement of receipt, replacing the confirmation of the Designated Person.
The confidentiality obligation survives even if the reporting reaches by mistake a person within ELMAS S.R.L., other than the designated person. In this case, the reporting is forwarded, immediately, to the designated person by submitting it to the address of ELMAS S.R.L..

In cases where relevant, accurate or complete information is missing, the DESIGNATED PERSON may contact the person reporting in order to obtain additional information. The additional information thus obtained will be subject to an additional statement filled in and signed by the whistleblower or to the minutes of discussion prepared by the Designated Person, sent to the whistleblower by email and confirmed in writing by him/her through a response also sent by email. Depending on the results of the preliminary checks, the designated person assigns the status of the reporting to: “for review”, or “closed”.

For reporting with the status “for review” assigned, the designated person:
- subjects all information and documents related to the notification to a process of data anonymization for the person reporting;
- initiates a procedure aimed at clarifying the reported breach as completely as possible, involving the whistleblower investigation commission and, if necessary, other persons within or outside the company, by using external consultants/assistants;
- if the notification check is beyond the duties/powers of the Investigation Commission, the reporting is assigned to a department within the company’s structure (e.g.: HR department, Food Procurement, Non-Food Procurement, Accounting, Sales, etc.).

In order to effectively carry out the clarification policy, the notification should contain sufficient information answering the following questions: Where? – the name of the company to which the reporting refers. If possible, additional locations related to the reported suspicion or reported abuses or irregularities must be provided.

Who? – any data known to the reporting person, which identifies the employee, collaborator or other subject of the notification or related to the reporting. Information about people who may be witnesses or who are victims of the reported situation.
What? – a description of the event with all related information and documents.
When? – the date of the event and/or the period when the abuse or irregularity occurred
How? – by what means, tools or systems the reported abuse or irregularity was committed
Why? – why you believe the perpetrator committed the potential abuse or irregularity

The “closed” status is assigned whenever, as a result of an initial check, it is found that:
a) the reporting is irrelevant – it does not refer to a breach covered by this policy – or unequivocally false;
b) the reporting is minor and does not require subsequent actions other than closing the procedure;
c) the information provided was insufficient or impossible to be verified and the reporting person failed to provide additional information within 15 days.

7.4. Subsequent actions
Any information collected by the DESIGNATED PERSON is confidential and may not be disclosed, unless the disclosure would compromise certain investigations or legal proceedings, or insofar as the disclosure is required for the effective conduct of the procedure for clarifying and settling the reporting. Except for the case when there is an express consent of the reporting person, no information that would allow the direct or indirect identification of the said person shall be disclosed by the person designated to settle the reporting.

If the reporting received the status “for review”, the DESIGNATED PERSON initiates the clarification procedure. Under the supervision of the designated person, the members of the investigation commission take measures to establish the circumstances of the reported facts. Depending on the degree and nature of the irregularity, the following actions may be taken, but not limited to:
*document review
*review of publicly available information
*consultation with internal or external experts on detailed issues
*conducting interviews, in order to clarify information, with employees, collaborators and, if necessary, with other persons (e.g.: with employees of the business partner) * taking statements.

During the clarification procedure, the DESIGNATED PERSON and the members of the investigation commission shall make sure that the number of persons warned and notified of the possible breach or irregularity is as small as possible.

If, during the clarification procedure, the reporting is not confirmed, the investigation commission prepares a report describing the activities carried out for the investigation and its outcome, and the notification will receive the status “unconfirmed”, and shall be archived by the DESIGNATED PERSON. If the notification is confirmed, in whole or in part, the investigation commission, under the supervision of the designated person, shall prepare a written report that will contain both a description of the activities carried out and a conclusion of the procedure.

The report will also be presented to the members of the management board of ELMAS S.R.L. If the notification is checked and endorsed as justified, it is assigned the status “confirmed”. Any documentation created during the clarification procedure is archived in accordance with the archiving rules of ELMAS S.R.L..

Based on the clarification procedure report, the following actions may be taken (but not limited to):
*initiation of a disciplinary/criminal investigation procedure against the employees or collaborators involved in the case
*notification of the competent legal institutions
*implementation of additional processes or procedures
*amendment of existing processes and procedures
*employee training by attending courses
*in justified cases, all employees or only employees within an internal department are informed on the procedure carried out, its outcomes and the remedies taken *fulfilment of other remedies.

The designated person documents the entire clarification procedure in the form of an electronic report.

Documentation of reports must include the following:
*notification number
*notification description
*clarification procedure status – pending, closed, confirmed, unconfirmed
*description of the most important decisions made - e.g.: regarding the termination of the employment contracts, the introduction of an additional internal control or other procedures, introduced or amended.

7.5. Information obligation
The designated person has the obligation to inform the whistleblower in the public interest on the status of subsequent actions, within no more than 3 months from the date of acknowledgment of the receipt of reporting or, in the event that receipt of the reporting was not acknowledged, from the expiry of the 7 days calculated from the date of receiving the reporting , and, subsequently, whenever there is progress in the conduct of subsequent actions, unless the information could compromise their performance. The designated person has the obligation to inform the members of the management board of ELMAS S.R.L. concerning the method of settling the reporting.

The designated person has the obligation to inform the whistleblower in the public interest on the manner of settling the reporting, including when it has been closed. The designated person regularly carries out activities to promote or present this policy in order to ensure that employees are aware of both the policy and the channels available for reporting suspected irregularities.

If there are certain doubts or misunderstandings regarding this policy, any employee / collaborator / stakeholder can request additional information from the designated person.