Internal Reporting Procedure for Whistleblowers

§ 1. LEGAL BASIS AND PURPOSE OF THE PROCEDURE

The legal basis for introducing this Procedure is the provisions of the Act of June 14, 2024, on the Protection of Whistleblowers (Journal of Laws 2024, item 924; the “Act”), particularly Article 24(1) of the Act.

The purpose of the Act and this Procedure is to provide Whistleblowers with a safe means of reporting irregularities related to the areas specified in Annex 1 to this Procedure, without fear of experiencing Retaliation (as defined below).

§ 2. DEFINITIONS

“Follow-up Action” — an action taken by a legal entity or public authority to assess the veracity of information contained in a Report and to prevent the violation of law that is the subject of the Report, particularly through:

• investigative proceedings,
• initiating an audit or administrative proceedings,
• filing charges,
• actions taken to recover financial resources, or
• closing the procedure carried out under the internal procedure for reporting violations of law and taking Follow-up Actions or the procedure for receiving external reports and taking Follow-up Actions.

“Retaliatory Action” — direct or indirect action or omission in a work-related context:

• that is caused by the Report or public disclosure, and
• that violates or may violate the rights of the Whistleblower or causes or may cause unjustified harm to the Whistleblower, including unjustified initiation of proceedings against the Whistleblower.

“Reporting Channel” — a submission form that enables sending a Report to the System.

“Violation of law” — an act or omission contrary to law or intended to circumvent the law, concerning the area listed in Annex 1 to the Procedure.

“Person Concerned” — a natural person, legal entity, or organizational unit without legal personality to whom the law grants legal capacity, indicated in the Report or public disclosure as a person who has committed a violation of law or as a person associated with the person who committed the violation.

“Facilitator” — a natural person who assists the Whistleblower in making a Report or public disclosure in a work-related context and whose assistance should not be disclosed.

“Person Associated with the Whistleblower” — a natural person who may experience Retaliatory Actions, including a co-worker or a close person to the Whistleblower within the meaning of Article 115 § 11 of the Criminal Code of June 6, 1997 (Journal of Laws 2024, item 17).

“Employee” — a natural person performing work for the Employer under an employment contract or another legal relationship.

“Employer” — incro spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw (address: Rondo ONZ 1, 00-124 Warsaw; registration: National Court Register (KRS) number: 0000843341; NIP: 5252824200; share capital: PLN 42,100).

“Procedure” — the procedure for Whistleblower Reports in force at the Employer, contained in this document.

“Whistleblower” — a natural person who reports or publicly discloses information about a violation of law obtained in a work-related context, including: an employee, temporary worker, person providing work on a basis other than employment, including under a civil law contract, entrepreneur, proxy, shareholder or partner, member of the governing body of a legal entity or organizational unit without legal personality, person providing work under the supervision and direction of a contractor, subcontractor, or supplier, including under a civil law contract, intern, volunteer, trainee, including such persons before establishing an employment relationship or other legal relationship constituting the basis for performing work or services or holding a position in a legal entity or for the benefit of that entity, or after the termination of such a relationship.

“System” — the internal reporting form, available at https://forms.office.com/e/fdn2r2jUxZ, through which Reports are received and processed.

“Team” — people authorized by the Employer to receive Reports sent via the Reporting Channel, including conducting Follow-up Actions.

“Report” — a collective term for both Internal and External Reports.

“Internal Report” — information about a violation of law provided by the Whistleblower via the Reporting Channel.

“External Report” — oral or written submission to the Ombudsman or a public authority of information about a violation of law.

§ 3. MAKING AND RECEIVING REPORTS

A Whistleblower may submit Internal Reports via the Reporting Channel.

Team members are tasked with receiving Internal Reports.

A separate procedure outlines the detailed organization of their work in receiving and processing Internal Reports.

A Team member must promptly acknowledge receiving an Internal Report within 7 days, following the method specified in the Reporting Channel, unless the Whistleblower has not provided a contact address for the acknowledgment.

A Team member informs the Management Board of the receipt of an Internal Report. The information includes the date, sequential number of the Internal Report, and the area mentioned in Annex 1 to the Procedure to which the Internal Report relates.

§ 4. REPORT ANALYSIS AND FOLLOW-UP ACTIONS

Team members are responsible for conducting Follow-up Actions.

Upon confirming receipt of an Internal Report, a Team member conducts a preliminary analysis of the Internal Report to verify its accuracy and the information therein.

After conducting the preliminary analysis, the Team member decides whether to take Follow-up Actions or to refrain from taking Follow-up Actions.

Refraining from Follow-up Actions may occur if:

• The Internal Report is clearly unreliable.
• The Internal Report does not concern an area mentioned in Annex 1 to this Procedure.
• The information contained in the Internal Report was or is the subject of a previous Internal Report, and the content of the Internal Report does not provide significant new information.

The Team member communicates the decision referenced in § 4(3) to the Employer’s Management Board and, if possible, to the Whistleblower through the Reporting Channel. This communication includes the reason for not pursuing Follow-up Actions.

When conducting Follow-up Actions, the Team member is authorized to gather information from any Employee to thoroughly and comprehensively address any doubts raised in the Internal Report.

While carrying out Follow-up Actions, Team members operate independently and are not subject to instructions from the Employer or any supervising personnel.

A Team member may contact the Whistleblower at any time to obtain additional information regarding the Internal Report.

As part of conducting Follow-up Actions, a Team member also seeks to identify potential sources of the violation of law and takes actions or proposes, if possible, changes in existing processes, policies, practices, or customs that will minimize the occurrence of similar violations in the future.

A Team member must provide feedback to the Whistleblower within 3 months of acknowledging receipt of the Internal Report through the Reporting Channel, unless the Whistleblower has not provided a contact address for the feedback.

§ 5. REGISTER OF INTERNAL REPORTS

The Team maintains a register of Internal Reports. An entry in the register of Internal Reports is made based on an Internal Report.

The register is kept electronically in the System and includes the elements mentioned in Article 29(4) of the Act.

§ 6. FAMILIARIZATION OF EMPLOYEES WITH THE PROCEDURE

The Employer makes the Procedure available to all Employees in a way that allows them to become acquainted with its provisions.

Employees confirm their familiarity with the Procedure by submitting a statement in this regard using the HRM system used by the Employer.

§ 7. EXTERNAL REPORTS

The procedure and conditions for making External Reports are defined by the provisions of Chapter 4 of the Act.

A Whistleblower may make an External Report without prior internal reporting.

An External Report is received by the Ombudsman or a public authority.

§ 8. PROTECTION OF WHISTLEBLOWER AND OTHER PERSONS

The Whistleblower is protected under Chapter 2 of the Act from the moment the Report is made, as long as they had reasonable grounds to believe that the reported information was true and pertained to a violation of law.

Retaliatory Actions or attempts or threats of such actions may not be taken against the Whistleblower.

An exemplary catalog of behaviors constituting Retaliatory Actions is provided in Annex 1 to the Procedure.

The prohibition on Retaliatory Actions against Whistleblowers is independent of the type of legal relationship under which work, services, functions, or service are or are to be performed.

An attempt or threat of Retaliatory Actions, including due to the making of a Report or public disclosure, is also considered a Retaliatory Action.

A Whistleblower who has faced Retaliatory Actions is entitled to damages of no less than the average monthly salary in the national economy for the previous year, as published for pension purposes in the Official Gazette of the Republic of Poland “Monitor Polski” by the President of the Central Statistical Office, or the right to redress.

Making a Report cannot constitute grounds for liability, including disciplinary liability or liability for damages, for violation of the rights of others or obligations specified in legal provisions, provided that the Whistleblower had reasonable grounds to believe that the Report was necessary to disclose the violation of law in accordance with the Act.

The protection measures mentioned in § 8(1) through 8(7) also apply accordingly to a Facilitator and a Person Associated with the Whistleblower.

A person who has suffered damage due to the intentional reporting or public disclosure of false information by the Whistleblower has the right to damages or redress for the violation of personal rights from the Whistleblower who made such a Report or public disclosure.

§ 9. PERSONAL DATA

Upon receiving an Internal Report, the Employer processes personal data to the extent necessary to accept the Internal Report or take any Follow-up Action. Personal data that is irrelevant to the consideration of the Internal Report is not collected — and if accidentally collected, is immediately deleted. Deletion of such personal data occurs within 14 days from the determination that it is irrelevant to the matter covered by the Internal Report.

The Whistleblower’s personal data, allowing their identity to be established, is not disclosed to unauthorized persons unless with the Whistleblower’s express consent.

The provision of § 9(2) does not apply when disclosure is a necessary and proportionate obligation arising from legal provisions in connection with investigative proceedings conducted by public authorities or preparatory or judicial proceedings conducted by courts, including to guarantee the right to defense of the Person Concerned.

Before making the disclosure mentioned in § 9(3), the relevant public authority or court notifies the Whistleblower by sending, in paper or electronic form, an explanation of the reasons for disclosing their personal data unless such notification would jeopardize the investigative, preparatory, or judicial proceedings.

Personal data processed in connection with the acceptance of the Internal Report or the taking of Follow-up Actions and related documents are stored for 3 years after the end of the calendar year in which the External Report was forwarded to the public authority competent to take Follow-up Actions or Follow-up Actions were completed, or after the conclusion of proceedings initiated by those actions.

The provision of § 9(5) does not apply if documents related to the Internal Report are part of the files of preparatory or court or administrative proceedings.

§ 10. FINAL PROVISIONS

Whenever the Procedure mentions making decisions or providing information to the Employer’s Management Board, in situations where the Internal Report concerns a member of the Employer’s Management Board, the relevant decision is made, or the Supervisory Board of the Employer is informed.

The Procedure has been consulted with Employee representatives as required by the Act and the Employer’s regulations.

The Employer declares that as of the date of entry into force of the Procedure, all Employees have been acquainted with the Procedure.

The Employer undertakes to review the Procedure annually to verify that it ensures the objectives described in § 1 of the Procedure.

Employee representatives may submit proposals for amendments to the Procedure to the Employer in electronic form by sending an email to: hello@incro.io

The content of the Procedure is available in the Notion application and on the Employer’s website.

Annex 1: AREAS IN WHICH THE WHISTLEBLOWER MAY REPORT VIOLATIONS OF LAW

Areas in which the Whistleblower may report violations of law:

• Corruption
• Public procurement
• Services, products, and financial markets
• Anti-money laundering and countering the financing of terrorism
• Product safety and compliance with requirements
• Transport safety
• Environmental protection
• Radiological protection and nuclear safety
• Food and feed safety
• Animal health and welfare
• Public health
• Consumer protection
• Privacy and data protection
• Security of networks and information systems
• Financial interests of the State Treasury of the Republic of Poland, local government units, and the European Union
• Internal market of the European Union, including public legal principles of competition and state aid, and taxation of legal entities
• Constitutional freedoms and human and citizen rights arising in relations between individuals and public authorities and not related to the areas specified in items (a) through (q).

‍

Annex 2: EXEMPLARY CATALOG OF RETALIATORY ACTIONS

Retaliatory Actions against the Whistleblower may not be taken, including in particular:

• Refusal to establish an employment relationship
• Termination or dismissal without notice of the employment relationship
• Failure to enter into a fixed-term or indefinite-term employment contract after the termination of a probationary employment contract, failure to enter into a subsequent fixed-term employment contract, or failure to enter into an indefinite-term employment contract after the termination of a fixed-term employment contract — when the Whistleblower had a reasonable expectation that such a contract would be concluded
• Reduction in the amount of remuneration for work
• Suspension of promotion or being passed over for promotion
• Being passed over for the granting of work-related benefits other than remuneration or the reduction of such benefits
• Transfer to a lower job position
• Suspension from the performance of employee or official duties
• Assignment of the Whistleblower’s current duties to another employee
• Unfavorable change in the place of work or work schedule
• Negative evaluation of work performance or a negative opinion about work
• Imposition or application of a disciplinary measure, including a financial penalty, or a measure of a similar nature
• Coercion, intimidation, or exclusion
• Mobbing
• Discrimination
• Unfavorable or unfair treatment
• Suspension from participation or being passed over in selection for participation in training aimed at improving professional qualifications
• Unjustified referral to medical examinations, including psychiatric examinations, unless separate regulations provide for the possibility of referring an employee to such examinations
• Actions aimed at making it difficult to find employment in the future in a given sector or industry based on an informal or formal sectoral or industry agreement
• Causing financial loss, including economic loss, or loss of income
• Causing other non-material harm, including the violation of personal rights, particularly the good name of the Whistleblower.