HEXNOIR Whistleblowing Channel

Start

Step 1/5 Categorize concern

To facilitate the subsequent management of your claim, help us to categorize it in the best possible way.

Business

What category does your complaint best fit into?

Computer violation

Corruption

Environmental violation

Falsification of documents

Misappropriation

Money laundering

Moral or Sexual harassment / discrimination

Scam and other commercial fraud

Tax fraud

Theft and property offences

Unfair Competition

Violation against workplace safety

Do you suspect any of the following people?

Head of ESG & Sustainability

Head of Risk & Compliance

Member of the Supervisory Board

Other employee

I am not aware of any involvement of these persons

I have read the Terms of use and agree to them in accordance with the notice.

Information

Step 2/5 Personal information

If you prefer not to provide your personal data, you can do so by indicating that you want the report to be anonymous.

What is your relationship with the declared company?

Do you wish to report anonymously?

Yes

This channel requires the whistleblower's identification data are mandatory.

The selected category requires the identification data to be mandatory

First name

Last name

Following the email validation policy, you must validate this email before filing the report.

Contact telephone number

This channel is confidential. Your personal data will not be shared. If someone from the organisation needs to know your data, they will request it through the channel and they will only be able to see it if you authorise it.

Details

Step 3/5 Detailed information

Describe in as much detail as possible the incident you want to report, and attach evidence and evidence of this incident as much as possible.

Indicate which person or persons are the subject of the report

First and last name

Position

Have you discussed this with any member of management?

Yes

I do not remember

Are there any witnesses? Please indicate their names.

First and last name

Position

Tell us what you want to report in detail

Would you like to attach any additional documents?

Image (png, jpg, gif), Audio (wav, mp3), Video (ogg, mp4, mov, avi, wmv, mpg, mpeg) or PDF document up to 20Mb. Attention! If you report anonymously, make sure that the attachments do not include information in the content or metadata that could identify you.

Confirm

Step 4/5 Confirmation

As the final step in the process, you need to enter a password that only you will know. This password, as well as the identification code that we will give you at the end, will be essential to be able to follow the evolution of your communication.

Password

Password confirmation

Email address validation

According to the validation policy of this channel, we must validate the indicated email address. To do so, we will send you an email with a validation email with a code that you must indicate in the following field.

Verification code check received

Finish

Step 5/5 Finalize

You have already provided all the information needed to start the incident reporting process.

The information is ready to start the debugging process. responsibilities. Reported persons or events will be investigated in order to take appropriate action.

If the information you provide is false, the company reserves the right to take legal action against you.

You are in the final stage of the incident reporting process. When you click Send, your notification will be received and processed within 3 months (or 6 months in case of particular complexity of the case).

I have read the Data Protection and Consent Notice and agree to the processing of my personal data in accordance with the provisions of this notice.

Terms of Use

In compliance with the Law on Services of the Information Society and Electronic Commerce, as well as in compliance with current regulations on data protection, it is reported that the owner of the website ithikios.com and canaldenunciasanonimas.com and all its subdomains ( hereinafter, "the Web") is DIGITAL PRODUCTS DEVELOPMENT SL (hereinafter, ithikios), registered in the Mercantile Registry of Barcelona, with CIF B02767010, and with registered office at c / Mont Blanc 17, Sant Cugat del Valles, Spain.

ithikios is the owner of all rights to the Website. The simple access, navigation and use of the Website attributes the condition of user of the same (hereinafter, the "User") and implies the acceptance of this clause of terms and conditions. The information available through this website is not subject to contract and may be modified without prior notice.

ithikios will not be held responsible for problems arising from the consultation or use of this Website. To this end, access is obliged to comply with this, having to act in accordance with current Law, good faith and public order and, refraining from using the Website in a way that could prevent or impair its proper functioning.

This service can only be used to send complaints or inquiries to companies that have contracted the service with ithikios, guaranteeing confidentiality and anonymity (if the user so chooses), regarding the personal data of the complainant.

Conditions for the user

As a user, you are obliged to make correct and lawful use of the platform.
You will use the platform for the purposes it has been designed for, and in no case will you use it for purposes contrary to the law.
The ithikios channel / canaldenunciasanonimas is not an emergency service. In case of emergency contact local authorities.
You must fill in all the information defined as mandatory in order to be able to send it.
This service is not designed to present information that can be considered secret or strictly confidential.
Reflect and review the information you send to ensure that if you do not want it, you do not reveal your identity.
You will be able to choose between sending the communication indicating your contact details or without indicating them. In both cases, the platform will provide you with a unique identification number and a password. It is important that you write them down in a safe place, only with them will you be able to check the status of the communication. If you lose them, you will not be able to access it again. For security reasons, ithikios will not be able to provide access to lost codes.
If the organization proves that there has been bad faith when making the report, it reserves the right to take legal action if the complainant has been identified.
You will be able to download a certificate issued by ithikios in which you will have all the information that has been sent to the company, as well as the result once the investigation is completed.
The query system has traces to help users identify improper access to their query.
The Complainant expressly understands and agrees that ithikios will not be responsible for any direct or indirect, anticipated or unforeseen damage, interest or loss, including, among others, moral damage resulting from the use or inability to use this service.
The Complainant is responsible for the veracity of the information communicated, assuming the consequences of having acted in bad faith or sent false information or documentation.
You will be liable for any loss or damage of any kind that ithikios may suffer, directly or indirectly, as a result of improper use of the product, a breach of the terms and conditions of use or a breach of the law in force on your part.

Data protection and consent to HEXNOIR

LEGAL BASIS

Articles 13 to 21 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, relating to the protection of natural persons with regard to the processing of personal data and to the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report violations of Union law Law of
21 March 2022 to improve the protection of whistleblowers Decree No. 22-1284 of

3 October 2022 relating to procedures for the collection and processing of reports issued by whistleblowers and establishing the list of external authorities established by Law No. 22-401 of 21 March 2022 Deliberation of the CNIL no. 2023-064 of
6 July 2023 concerning adoption of a framework relating to the processing of personal data intended for the implementation of a professional alert system
Article L1152-1 of the Labor Code relating to moral harassment
Article L1152-3 of the Labor Code relating to sexual harassment
Article L2312-59 paragraph 1 of the Labor Code relating to alerts in case of violation of personal rights.

Article L2312-60 paragraph 2 of the Labor Code relating to alerts in case of serious and imminent danger.

HOLDER

The person responsible for processing personal data is HEXNOIR Groupe 7 rue Galvani 75017 PARIS — Rcs Paris 90179017000038

PURPOSE OF THE TREATMENT

The

processing aims to ensure an evaluation of the documents transmitted

The processing may concern reports relating to violations of national and European regulations, which govern the activities of HEXNOIR Group, the principles and rules of conduct contained in the Code of Ethics and the Internal Regulations, as well as the provisions contained in the SAPIN II Law, No. 2016-1691 of 9 December 2016, relating to transparency, the fight against corruption and the modernization of economic life.

Reference is made to illegal or fraudulent conduct referring to employees, members of legal entities or third parties who can determine, directly or indirectly, criminal liability, damage to economic integrity and/or image.

Personal data is acquired because it is contained in the report and/or in the acts and documents attached to it.

TYPE OF DATA PROCESSED

The reception and management of alerts result in the processing of personal data within the meaning of article 9 of the RGPD. Only so-called “common” data is processed (name, first name, email address, telephone number). The treatments must not contain particular data such as racial or ethnic origin, political opinions, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data in order to uniquely identify a natural person, data relating to the health or sexual life or sexual orientation of the person (article 9 of the GDPR

If the report contains particular data or personal data relating to criminal convictions or offenses as defined by the RGPD, (transmitted to the whistleblower or to third parties), the Data Controller will destroy them, except in cases where the processing is authorized by law.

The data provided will be treated while protecting the confidentiality of the whistleblower's identity throughout the procedure under the responsibility of the Data Controller.

LEGAL BASIS FOR THE TREATMENT

The processing meets a legal obligation for HEXNOIR Group within the meaning of article 6, paragraph 1, C. of the RGPD and article 5.3 Treatment of the identity of the author of an alert in the CNIL Repository relating to the processing of personal data intended for the implementation of an alert system, version of 6 June 2023 (Repository - Professional alerts

PROCESSING METHODS

Personal data will be processed with electronic tools for the time strictly necessary to achieve the purposes for which they were collected

The processing is carried out in strict compliance with the RGPD and the CNIL Framework relating to the processing of personal data intended for the implementation of an alert system, version of June 6, 2023, in particular the provisions concerning the system for the internal collection and management of professional alerts (DAP).

HEXNOIR Group, with the support of the provider of the WHISTLEBLOWING platform, implements appropriate measures to ensure that the data provided is treated appropriately and in accordance with the purposes for which they are managed.

In accordance with the provisions of articles 24, 25 and 32 of the RGPD, NETHERHACK Group uses security, organizational, technical and physical measures to protect information against alteration, destruction, loss, loss, theft or abusive or illegitimate use.

DATA

RETENTION PERIOD The data

will be processed for the time strictly necessary to achieve the purposes indicated above, without prejudice to any subsequent conservation in order to comply with legal obligations in compliance with current legislation on the protection of personal data (article 5, paragraph 1, e. of the RGPD and Article 7 of the CNIL Repository relating to the processing of personal data intended for the implementation of a alert device).

The duration of conservation and archiving of personal data relating to an alert will differ depending on whether or not the alert is effective.

If the data controller decides to follow4 an alert, or if disciplinary or litigation action is initiated, all personal data collected during the investigation may be retained until the end of the procedure, until the expiry of the statute of limitations (six years) or exhaustion of remedies (Article 133-3 of the Criminal Code).

In the event that the alert instruction does not lead to any follow-up, personal data must be destroyed or anonymized within two months following the end of the investigation (Sapin II Law).

RIGHTS

In accordance with the provisions of article 15 and following of the GDPR and applicable laws, the data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning him or her is being processed and, if so, access to said personal data

In accordance with the forms provided for by law, the person concerned has the right to request the correction of inaccurate personal data and the integration of incomplete data and to exercise any other rights in accordance with article 15 and following of the GDPR.

As part of a disciplinary procedure, the data subject has the right to revoke, at any time, his consent to the disclosure of his identity without this affecting the lawfulness of the processing, based on the consent, carried out before the withdrawal (article 13 of the GDPR).

The person concerned has the right to oppose the processing of their data, subject to the conditions for exercising this right in accordance with the provisions of article 9 of the CNIL Framework and article 21 of the RGPD.

These rights can be exercised upon request made by: Email to the address:

[email protected] Mail to the address
HEXNOIR, 7 rue Galvani, PARIS 75017