Whistleblower policy

Introduction

At Initgroup, we are striving to maintain a corporate culture based on openness, where anybody can freely report any suspicions of breaches of company policies, potential crime, or unethical behaviour. This goes for any case connected to employees, management, suppliers, customers, or others, who are connected to Initgroup.

Employees are often first to discover problems or unethical behaviour in the workplace. Any problem shall by default be reported to the immediate manager or any other member of the group management. Non-employees shall report to their contact at Initgroup, or to any management member. However, we do recognize that it may be difficult to bring forward information concerning colleagues, management, or business partners due to loyalty, fear of revenge, or other personal reasons. But it is crucial for Initgroup that this information is brought forward. To ensure this, we have initiated a whistleblower system, operated by Beierholm.

Using the system, individuals, who are in good faith, can confidentially and anonymously report any problem, crime, or issue. This includes cases that may cause financial loss or impact the company’s image negatively.

Any individual can report any knowledge or suspicion of serious problems or crimes. The system ensures that such reports are handled in absolute confidentiality and according to Danish law.

The purpose of this policy is to explain how the whistleblower system works, how to file a report, and what issues can be reported.

We encourage employees and business partners to use this system, as we have the best possibility to solve the case as best possible. But if you prefer to use a system not associated with Initgroup in any way, you are entitled to use the external whistleblower system run by Datatilsynet.

Who can file a report?

Any person, who has an affiliation with Initgroup may file a report. This includes employees, interns, contractors, volunteers, and others working with Initgroup in some capacity.

Who can be the reported on?

The case reported shall concern employees, management, board of directors, or any other party who are involved in business with Initgroup.

What can be reported on?

The whistleblower system shall be used only to report on crime, serious breaches of company policies, or unethical behaviour. Issues like payroll, grudges, or cooperation problems cannot be reported.

Issues that can be reported include (but are not limited to):

(a) breaches falling within the scope of the EU Union acts, concerning the following areas:

(i) public procurement;

(ii) financial services, products and markets, and prevention of money laundering and terrorist financing;

(iii) product safety and compliance;

(iv) transport safety;

(v) protection of the environment;

(vi) radiation protection and nuclear safety;

(vii) food and feed safety, animal health and welfare;

(viii) public health;

(ix) consumer protection;

(x) protection of privacy and personal data, and security of network and information systems;

(b) other serious breaches of Danish and EU law as well as other serious concerns. This includes (but is not limited to):

(i) Financial crime: Embezzlement, theft, corruption, bribery

(ii) Fraud: Forgery, misuse of internal information, sharing of classified information

(iii) Assault and misuse of power: Conflicts of interest, blackmail, physical or psychological violence, sexual assault, bullying, harassment

This list states examples only. If in doubt whether an issue should be reported, we encourage filing a report. All reports are answered and handled according to Danish law.

Who handles reports?

Reports are received by impartial case managers at Beierholm. As outcome of their review, the case may be turned down, or it may be sent to the whistleblower unit of Initgroup for internal handling, investigation, and decision for further action. In the section ”How are reports handled?”, you can see the exact procedures for the handling of reports, and who may be involved in case of internal investigation.

How do you file a report?

Reports are filed through a secure and encrypted website located here: whistleblower.beierholm.dk/portal/2860. The website can be accessed from a PC, a smartphone, or any other device able to browse the internet. For added security, whistleblowers are encouraged to avoid using employer networks. Instead, private phones, private computers, or publicly accessible computers, ie in libraries, should be used. Reports can be filed in this manner only.

Good faith

All reports must be submitted in good faith. It is important, that the system is not used for accusations against the innocent. Reports filed in bad faith will be turned down, and may lead to action, including suspension or dismissal, against the reporter.

IT-security

The system used for registration of reports is operated by Beierholm. Beierholm is an independent party and guarantees the security of the system. Beierholm has taken all necessary technical and organizational precautions against lawful or unlawful destruction of personal data, and against outsiders gaining access to personal data. The handling of personal data is regulated by strict protocols and procedures. The system does not log activity or IP-addresses, and all storage and transmission of data is encrypted. Only the appointed case manager and relevant investigators have access to this data.

If documents or pictures are submitted as evidence, the reporter needs to be aware that these files may include metadata or hidden information that may compromise the anonymity of the reporter. If possible, this information shall be removed prior to submission. Beierholm checks all files, and will remove any data that may identify the sender prior to handing over the data to outsiders.

How are reports handled?

After filing a report, the whistleblower shall within 7 days receive confirmation that the report has been received. The confirmation is sent to the secure mailbox of the whistleblower.

On reception of a report, a preliminary screening is performed by unbiased case managers at Beierholm. Based on this process, one of the following will happen next:

1. If the report implies a mainly internal case, the report will be handed over to the whistleblower unit at Initgroup for internal investigation.

The whistleblower unit of Initgroup consists of the following persons:

CEO Henrik Jensen, hje@picca.dk (responsible)

CFO Ingeborg Nordviken Kristiansen, ink@picca.dk

HR-specialist Gitte Peschardt, gpe@picca.dk

Only members of the whistleblower unit can know the identity of the whistleblower. If others need to be involved (ie. for investigating the case), the whistleblower must approve that information about his identity is shared.

2. If the report implies a person, who is a member of the whistleblower unit, the case will be submitted to the other members of the whistleblower unit, and handled without the involvement of the reported member.

3. If the contents of the report are of a very serious nature, or points at potential crime, the case may be submitted for further legal evaluation. This must be approved by Initgroup. On request, Beierholm may initiate contact to relevant legal advisors. All costs connected to legal consultancy or investigation are at the expense of Initgroup.

4. If Beierholm concludes that the case described by the report is not covered by this policy, is clearly unfounded, or if the report is submitted by mistake, the report will be turned down. In this case, the whistleblower will be encouraged to raise the issue internally if desired. The company will not be made aware of such cases.

The whistleblower will always be kept informed about the investigation of the case, and will receive feedback as defined by the law within 90 days.

Beierholm stores data for a period of five years, after which all data is deleted from Beierholm systems. Initgroup may at any time request the immediate deletion of data. Any data handled by Beierholm is covered by the privacy policy.

Requests for clarification and further information

On submittal of a report, the whistleblower is assigned a secure mailbox. After logging into the mailbox, the whistleblower can check for case updates or requests for further information or evidence. Any subsequent communication rests alone on the willingness of the whistleblower to log into the system and actively communicate. If further information or documentation is required, and the whistleblower does not check the mailbox, the case will often be closed.

Confidentiality and protection against retaliation

Anybody listed under "Who an file a report?", who submits a report in good faith, is protected under the whistleblower legislation. This means that:

(i) Information about the identity of the whistleblower (in cases where the right to anonymity has been waived or anonymity cannot be maintained) is protected, and cannot be shared outside of the whistleblower unit without written approval by the whistleblower.

(ii) The whistleblower is protected against any form of retaliation from colleagues or management. Examples of retaliation include dismissal, pay cuts, demotion, or harassment. Employees, who try to perform retaliation against a whistleblower, will be sanctioned, and may be dismissed from the company. Beierholm and Initgroup will, handle the report confidentially, and with as little consequence as possible to the daily workings of the company.

Questions

Any questions about the use of the Whistleblower protection system may be sent to Beierholm at whistleblower@beierholm.dk. You can also contact HR-specialist Gitte Peschardt at gpe@picca.dk.