Whistleblower Policy at Gibotech

Gibotech has established a whistleblower program that allows you, as a supplier, customer, or business partner, to report actual or potential violations that have occurred, are occurring, or are likely to occur at Gibotech.

The purpose of the program is to ensure that you can report issues without fear of threats, retaliation, or other negative consequences. When you use the whistleblower program, you are therefore guaranteed protection.

Anyone who wishes to report an issue at Gibotech may make use of the whistleblower program.

How to report

You can report concerns through Gibotech’s whistleblower program.

When you submit a report, you have the option to create a “Secure Mailbox.” You can use the mailbox to send additional documentation related to your report. The mailbox can also be used if the whistleblower committee needs to contact you.

All communication through the secure mailbox is anonymous.

When you create a secure mailbox, it is important to remember to save the link that is generated for you. It is not possible to retrieve the link later.

You can also choose to report the matter through the Danish Data Protection Agency’s whistleblower program, so that the report is initially received by a neutral party.

What can be reported?

You can report the following under the whistleblower program:

• criminal offenses such as fraud, embezzlement, misappropriation of assets, accounting fraud, bribery, corruption, money laundering, and terrorist financing,
• forgery, hacking, computer fraud, eavesdropping, and recording conversations between others,
• violations of competition and procurement rules,
• all forms of extortion,
• serious or repeated violations of occupational safety and health laws,
• serious violations of environmental regulations and environmental pollution,
• serious or repeated violations of Gibotech’s key internal policies and guidelines,
• serious conflicts in the workplace; for example, severe bullying, harassment, discrimination, physical violence, threats, and sexual harassment,
• serious harassment, for example on the basis of race, gender, color, language, financial status, national or social origin, political or religious affiliation.

What cannot be reported?

The whistleblower policy is intended to supplement the normal dialogue between employees and managers, or between Gibotech and external parties.

Therefore, you cannot report the following through the whistleblower program:

• personal grievances, including: salary issues, difficulties working with others, violations of smoking or alcohol policies, absenteeism due to illness, etc.,
• other matters, including HR issues, minor violations of Gibotech’s internal guidelines, complaints about other employees’ conduct or lack of skills; including information about minor conflicts and disagreements in the workplace.

The Whistleblower Committee may reject reports that fall outside the scope of the Act and is not required to forward such reports to another authority.

Handling of reports

Your report will be received by Gibotech’s HR Coordinator, who will either investigate the matter further or decide to dismiss or close the case.

If the report falls under the whistleblower policy, it must be reviewed by the whistleblower committee. The committee will investigate the report and the matter in general.

If the report concerns one or more members of the whistleblower committee, that person or those persons will be excluded from the investigation, and others will take their place.

As the reporting party, you will receive a confirmation within seven days of the receipt of your report. You will generally receive feedback within three months, but in special cases it may be necessary to extend the deadline to six months.

Processing of Personal Data

The personal data processed in connection with the whistleblower program’s reporting portal is retained only for the period necessary to investigate the report and take appropriate action, unless there is another lawful basis for retaining the data for a longer period.

Personal data will be deleted upon completion of the initial investigation if it turns out that the report was unfounded.

If a formal investigation is initiated based on a report, personal data will be deleted within two months of the investigation’s conclusion. Substantiated reports containing information that may lead to liability under employment law, civil law, or criminal law will be retained until the conclusion of the respective proceedings or legal actions in accordance with the requirements of the applicable law.

The processing of personal data in connection with whistleblower reports, where EU Regulation 2016/679 (“GDPR”) applies directly, must comply with all GDPR guidelines, including providing adequate information to all data subjects regarding data processing, disclosing the relevant legal basis, retaining personal data for a specific period, and respecting data rights as set forth in the GDPR.

Please also refer to Gibotech’s general privacy policy.

Do you have any questions?

If you have any questions regarding Gibotech’s whistleblower policy, please contact our HR Coordinator at hr@gibotech.dk.