Whistleblower reporting and follow-up procedure at VASCO ELECTRONICS GÓRALSKI GROUP S.K.A.

Section 1
DEFINITIONS

Terms used in the procedure shall be understood as follows:

• Vasco Electronics – Vasco Electronics Góralski Group Spółka Komandytowo-Akcyjna with its registered office in Kraków, Al. 29 listopada 20, 31-401 Kraków, entered in the Register of Entrepreneurs kept by the District Court for Kraków Śródmieście in Kraków, 11th Commercial Division of the National Court Register with the KRS number: 0000421705, NIP [Tax Identification No.]: 6772369151, REGON [National Business Registry Number]: 122581850;
• Company management / Vasco Electronics - a group of individuals responsible for managing and representing the company. Their main responsibilities include making strategic decisions, overseeing day-to-day operations, managing the company's resources and representing the company before third parties (e.g. Management Board, General Partner, Board of Directors).
• Breach investigation team - the team responsible for handling the proceedings concerning the reported wrongdoing (whistleblowing report).
• Procedure - this document that pertains to receiving internal complaints, following up and protecting whistleblowers;
• Retaliation - a direct or indirect act or omission related to the filed whistleblowing complaint, which has the purpose or effect of deteriorating the situation of the Whistleblower;
• Follow-up actions - actions taken by complaint recipient to assess the authenticity of the allegations contained in the complaint and, where appropriate, to remedy the breach that is the subject of the complaint, including through actions such as internal investigations, prosecutions, actions taken for recovery or termination of procedures.
• Information on breaches - evidence of actual breaches as well as reasonable suspicions of potential breaches that have not yet been committed;
• Whistleblower - A Whistleblower is an individual who reports or publicly discloses information about a breach of the law obtained in a work-related context;
• Act - The Whistleblower Protection Act of 14 June 2024 (Polish Journal of Laws of 2024, item 928, as amended);
• Internal complaint - providing Vasco Electronics with information about the breach;
• External complaint - providing information about breaches of law to the public authority handling whistleblower complaints.
• Feedback - providing the whistleblower with information on the follow-up actions planned or taken and the reasons for such actions;
• Investigation procedure - the proceedings conducted with respect to the filed complaint;
• Reporting channel - the technical and organisational arrangements for reporting;
• Internal complaint register - a register of whistleblower complaints including information on the complaint and the progress and resolution of the law infringement proceedings;

Section 2
GENERAL PROVISIONS

1. Vasco Electronics operating strategy is based on responsibility, prevention of corruption and other law infringements both within the organisation and among cooperating entities, taking into account a number of aspects, in particular social interests, environmental protection, relations with different groups of associates.
2. The procedure is part of the management control system, prevention of law infringement incidents at Vasco Electronics being its primary objective.
3. Vasco Electronics conducts its business on the basis of absolute respect for legal provisions and good practice.
4. The primary objective of the Procedure is to create a breach reporting system at Vasco Electronics by creating secure reporting channels to prevent any retaliation against the whistleblower.
5. The procedure specifies in particular:
   1. the scope of the breach covered by the Procedure,
   2. the scope of persons entitled to report breaches,
   3. the process of handling and managing reports of law breaches,
   4. the principles of confidentiality, in particular the principle of keeping confidential the information provided in the content of the Internal Report and the identity of the whistleblower and of the person assisting the whistleblower in filing the complaint.

Section 3
SCOPE OF PROCEDURE APPLICATION

1. The procedure and its provisions apply to the following groups of persons entitled to file a complaint:
   1. employees, associates as well as former employees and associates of Vasco Electronics,
   2. persons acting for and on behalf of Vasco Electronics,
   3. any other persons connected in any way to Vasco Electronics, in particular: persons assisting in reporting a breach, apprentices, trainees or employee candidates, if they have obtained information concerning the wrongdoing during the recruitment process or other processes prior to the establishment of the employment relation;
2. A wrongdoing report may relate in particular to:
   1. Vasco Electronics,
   2. a natural person authorised to represent Vasco Electronics,
   3. employees and associates of Vasco Electronics with respect to performing work for the company
   4. subcontractor or any other entrepreneur who is a natural person, if its law infringement occurred in connection with the performance of the contract concluded with Vasco Electronics,
3. Infringement shall be defined as an act or omission that violates the legal provisions concerning:
   1. corruption;
   2. public procurement;
   3. financial services, products and markets;
   4. anti-money laundering and counter-terrorist financing;
   5. product safety and compliance;
   6. transport security;
   7. environmental protection;
   8. radiological protection and nuclear safety;
   9. food and feed safety;
   10. animal health and welfare;
   11. public health;
   12. consumer protection;
   13. privacy and data protection;
   14. security of ICT networks and systems;
   15. the financial interests of the State Treasury of the Republic of Poland, a local government unit and the European Union;
   16. the internal market of the European Union, including public law competition and state aid rules and corporate taxation;
   17. constitutional freedoms and rights of a human being and citizen - occurring in the relations of the individual with public authorities and not related to the areas indicated in points 1-16.

Section 4
PERSONS RESPONSIBLE FOR MANAGING COMPLAINTS

1. The entity responsible for acceptance and consideration of Internal complaints and conducting the investigation procedure concerning an Internal complaint received is the designated Breach investigation team at Vasco Electronics.
2. Members of the Breach investigation team perform an initial verification of the Internal complaint, which consists in determining whether the Internal complaint meets the requirements set out in the Procedure.
3. The members of the Breach investigation team shall conduct the investigation or audit procedures on the basis of the principles of impartiality and protection of confidentiality.
4. The Internal complaint may not be analysed by a member of the breach investigation team if it appears from the content of the Internal complaint that a member of the breach investigation team may be involved in any way in the act or omission constituting the breach. In addition, the members of the Breach investigation team are required to report to the other members any reasonable doubts or reservations concerning their impartiality or integrity in respect of an Internal complaint filed.
5. In the case the law breach complaint involves a member of the breach investigation team, the complaint shall be considered by another member or members of the Breach investigation team.

Section 5
WHISTLEBLOWER PROTECTION

1. The protection provided by the Procedure shall apply to the Whistleblower from the moment of filing the complaint, provided that the Whistleblower had reasonable grounds to believe that the information that was the subject matter of the internal complaint was true at the time of filing and constituted information on law breach.
2. No retaliatory action or attempt or threat of such action shall be taken against the Whistleblower.
3. Examples of prohibited retaliation include, in particular, the following: termination of the employment relationship, reduction of remuneration or termination of a mutual contract with the Whistleblower solely due to the breach report filed by the Whistleblower, mobbing, discrimination, withholding of a promotion or omission in promotion.
4. The prohibition of retaliation also covers a person assisting in filing the complaint, as referred to in Article 2(8) of the Law on Whistleblowers, a person related to the whistleblower, as referred to in Article 2(9) of the Whistleblower Protection Act, as well as a legal person or other organisational unit assisting the whistleblower or related to them, in particular owned or employed by the whistleblower.
5. The protection does not apply to a whistleblower who is also the perpetrator/co-perpetrator/assistant of a breach of the law.

Section 6
REPORTING WRONGDOING

1. Internal complaints can be filed in the following electronic form via a dedicated email address - whistleblowers@vasco-electronics.com.
2. Upon the Whistleblower’s request, Vasco Electronics allows an oral internal reporting procedure. Submitting an oral complaint shall be carried out in the presence of at least two members of the Breach investigation team.
3. The Internal complaint shall indicate a clear and comprehensive explanation of the subject matter of the breach of the law and include, in particular:
   1. Whistleblower's name and surname;
   2. Whistleblower’s contact e-mail address;
   3. a description of the work-related context that made it possible to observe the reported breach;
   4. the date and place of the breach or the date and place when the information about the breach was obtained,
   5. a description of the subject of the breach that is as precise as possible;
   6. an indication of the entity to which the breach report relates to,
   7. an indication of the reasonable grounds that made it possible to conclude that the information about the breach is true;
   8. in addition, an indication of all evidence and information available to the Whistleblower which may prove helpful in the process of consideration of the breach.
4. The Whistleblower is obliged to treat the information they have that concerns suspected wrongdoing as confidential and to refrain from discussing publicly the reported suspected wrongdoing unless legal provisions oblige them to do so.
5. Vasco Electronics accepts anonymous submissions. If it is not possible to contact the Whistleblower, Vasco Electronics shall not inform the Whistleblower about the course of the investigation procedure and the implementation of corrective measures.
6. Complaints are accepted in Polish or English only.

Section 7
INFORMATION ON EXTERNAL COMPLAINTS

1. The Whistleblower may make an External complaint without filing an Internal complaint first.
2. The External complaint is accepted either by the Ombudsman or a public authority designated for this purpose.
3. The Ombudsman and the public authority are separate controllers in respect of the personal data provided in the External complaint that has been accepted by them.

Section 8
FALSE COMPLAINT

1. It is prohibited to deliberately file false wrongdoing complaints.
2. A person who has suffered damage due to a Whistleblower knowingly reporting or disclosing untrue information to the public is entitled to compensation or damages for violation of personal rights by the whistleblower who made such a complaint or public disclosure.
3. The person filing a false complaint is not subject to the protection that the Act grants to Whistleblowers.

Section 9
INVESTIGATION PROCEDURE

1. If the Internal complaint meets the requirements set out in the Procedure, members of the Breach investigation team shall take certain follow-up actions to assess the authenticity of the information contained in the Internal complaint, in particular by conducting an investigation or audit procedures.
2. Within 7 working days of complaint acceptance, the Breach investigation team confirms to the Whistleblower the acceptance of the complaint, unless the Whistleblower has not provided a contact address that the confirmation shall be sent to.
3. The maximum time limit for providing the Whistleblower with feedback cannot exceed 3 months from the date of complaint acceptance unless the Whistleblower has not provided a contact address that the confirmation shall be sent to.
4. A report shall be drawn up by the Breach investigation team from the investigation procedure, which shall also include the Team's recommendations for the way the case shall be handled. The report shall be presented to the management of Vasco Electronics.
5. Feedback to the Whistleblower shall include confirmation of the Follow-up actions taken by the Breach investigation team and, if reasonable given the extent of the breach, also of other corrective procedures relevant to the breach that were implemented at Vasco Electronics.

Section 10
BREACH INVESTIGATION TEAM

1. The investigation shall be handled by a Breach investigation team consisting of at least two persons, ensuring independence, objectivity and competence.
2. The members of the Breach investigation team are appointed by the management of Vasco Electronics.
3. The Team shall consist of no less than two and no more than six persons. Members of the Team are recruited from departments that have knowledge and experience in resolving breaches of the law and labour disputes.
4. Experts who are or are not employees of Vasco Electronics may additionally be appointed by a member of the Breach investigation team to carry out specific specialist activities during the course of the investigation. The identity of the Whistleblower must not be disclosed when seeking expert support.
5. A member of the Company’s Management cannot be neither a member of the Breach investigation team nor an expert.
6. While the investigation procedure is being conducted, the members of the Breach investigation team have the right to:
   1. access the department's documents and data;
   2. obtain information from employees in the various organisational units;
   3. obtain oral and written explanations from the unit's employees and contractors;
   4. access the premises of the unit in order to carry out a site inspection or secure evidence;
   5. consult, to the extent necessary, the information and data obtained with the Whistleblower.
7. A report shall be drawn up by the Breach investigation team from the findings of the investigation and submitted to the management of Vasco Electronics.
8. The investigation report shall include a description of the established factual circumstances, including the wrongdoing found and their causes, extent and effects, and the persons responsible for them.

Section 11
TERMINATION OF PROCEEDINGS

1. A member of the Breach investigation team attaches suggestions for further action to the investigation report. Depending on the findings, these actions may include actions against perpetrators, actions to prevent breaches and strengthening the entity's internal audit system.
2. The management of Vasco Electronics identifies further steps and the people responsible for implementing them. The Breach investigation team oversees the implementation of these actions and provides assistance to those responsible.
3. A member of the Infringement Team shall inform the whistleblower of the findings and the approved measures as soon as the Management of Vasco Electronics approves the proposals.
4. The arrangements made, the measures approved and their implementation are recorded in the Internal complaint register.

Section 12
COMPLAINT REGISTER

1. The register of internal complaints shall include:
   1. complaint number;
   2. subject of the complaint;
   3. personal data of the whistleblower and the person concerned necessary to identify them;
   4. whistleblower's contact address;
   5. complaint filing date;
   6. information on follow-up actions taken;
   7. the date of procedure termination.
2. The Internal complaints register also includes anonymous complaints. If the whistleblower has not provided their personal data or contact address, such a complaint is marked as anonymous in the register.
3. The information concerning the complaint shall be kept in the Internal complaint register for a period of 3 years after the end of the calendar year in which the follow-up action was completed or after the completion of other proceedings initiated by these activities.

Section 13
FINAL PROVISIONS

1. The Management of Vasco Electronics is responsible for the correctness and effectiveness of the functioning of the Procedure.
2. At least once a year, the Breach investigation team shall provide the Company's Management with aggregated information on internal complaints and the follow-up actions taken on them.
3. Vasco Electronics shall inform all persons performing work for Vasco Electronics of the adoption and content of this procedure, as well as any amendments thereto.
4. A person applying for a job on the basis of an employment relationship or any other legal relationship providing a basis for the provision of work or services or holding a position shall be provided with information on the procedure at the commencement of recruitment or negotiations prior to the conclusion of a contract other than an employment relationship.
5. The procedure comes into force 7 days after it has been communicated to Vasco Electronics employees and associates.