No: PRAV – 123/23 RULEBOOK ON THE INTERNAL REPORTI

1. Introductory provisions

Pursuant to the Act on the Protection of Whistleblowers (Official Gazette 46/2022), the Company's Management Board on February 13, 2023. issued the Rulebook.

This Rulebook regulates the procedure for internal reporting of irregularities in the Company, determines the course of action in the case of reporting irregularities committed in the Company's working environment, and regulates the procedure for appointing a Confidential Person, Deputy Confidential Person and a third person.

The Rulebook applies to all processes in the Company and to relations with third parties (suppliers, customers and other business associates).

Preventing or attempting to prevent the reporting of irregularities is prohibited.

The provisions of the general or individual act of the Employer and the legal work, which prescribe the prohibition of reporting irregularities, have no legal effect.

It is forbidden to initiate malicious procedures against the whistleblower, related persons and the Confidential Person and his Deputy.

2. Obligation to protect identity

The identity of the applicant, i.e. the information on the basis of which his identity can be revealed and other information specified in the report of irregularities are available only to the persons in charge of receiving such reports and their further processing, and they must remain protected, unless the applicant of irregularities agrees to disclosure that data.

As an exception to paragraph 1 of this article, the identity of the applicant and all other information from paragraph 1 of this article can only be disclosed if this is a necessary and proportionate obligation imposed by European Union law or national law in the context of investigations by national authorities or in the context of court proceedings , among other things to protect the right of defense of the reported person.

Disclosures made on the basis of the exception provided for in paragraph 2 of this article are subject to appropriate protective measures based on the applicable rules of the European Union and national legislation. The body that discloses the identity of the applicant shall inform him before revealing his identity, unless such information would jeopardize related investigations or legal proceedings. When notifying, the competent authorities send the applicants a written notification with the reasons for the disclosure of confidential information.

The provisions of paragraph 1 of this article, which relate to the protection of the identity of the applicant, also apply to the protection of the identity of the registered persons.

3. Processing of personal data and protection of confidentiality

Any processing of personal data in accordance with the Law on the Protection of Whistleblowers, including the exchange or transfer of personal data to competent authorities, is carried out in accordance with the relevant regulations of the European Union and national law regulating the protection of personal data.

Personal data that are clearly not relevant to the handling of a particular application are not collected or, if accidentally collected, are deleted without undue delay.

The person to whom the whistleblower reports the irregularity, the assistant of the whistleblower and any other person who participates in the procedure following the whistleblower's report must protect the information obtained from the report and may not use or disclose it for purposes other than those necessary for correct further action.

4. Prohibition of revenge

The employer may not retaliate, attempt to retaliate, or threaten to retaliate against the whistleblower, related persons, and the Confidential Person and his/her Deputy for reporting irregularities or public disclosure.

Retaliation is any direct or indirect action or omission in the work environment prompted by internal or external reporting or public disclosure, and causes or may cause unjustified harm to the whistleblower.

The actions referred to in paragraph 2 of this article are particularly considered to be revenge:

• Temporary removal, dismissal, dismissal or equivalent measures
• Degradation or denial of opportunities for advancement
• Transfer of duties, change of place of work, reduction of salary, change of working hours
• Denial of opportunities for training
• Negative work evaluations or recommendations for employment
• Imposing or determining disciplinary measures, reprimands or other sanctions, including financial sanctions
• Coercion, intimidation, harassment or isolation
• Discrimination, disadvantage or unfair treatment
• Refusal of offers to conclude a contract for an indefinite period, and the legal conditions for this were met, if the worker had a reasonable expectation that the same would be offered to him
• Failure to conclude a consecutive fixed-term employment contract in accordance with the provisions of national law in the field of labor relations, or its early termination
• Causing damage, including damage to a person's reputation, especially on social media, or financial loss, including loss of business and loss of income
• Negative labeling based on an informal or formal sectoral or industry-wide agreement, which may mean that the person will not be able to find work in that sector or industry in the future
• Premature termination of the contract for the procurement of goods or services or its cancellation
• Cancellation of license or permit
• Referrals for psychiatric or medical evaluations.

The provisions of the general or individual act of the Employer and the legal work by which the Employer retaliates against the whistleblower or a related person for reporting irregularities or public disclosure have no legal effect.

5. Appointment of the Confidential Person and Deputy of the Confidential Person

Internal reporting of irregularities is reporting of irregularities to the Employer.

The Employer will appoint the Confidential Person and his Deputy on the proposal of at least 20% of the workers employed by the Employer, since the works council or the trade union commissioner who took over the rights and obligations of the works council has not been established at the Employer.

The number of employees on the basis of which the percentage of employees required for the appointment of the Confidential Person and his Deputy is determined is the number of employees of the Company on the day of submission of the proposal.

The proposal for the appointment of a Confidential Person and his Deputy is submitted to the Company's management. The proposal must be accompanied by the written consent of the proposed person and the Deputy for appointment as a Confidential Person or Deputy. The proposal must contain the names, surnames, personal identification numbers and signatures of the workers submitting the proposal.

The Management Board of the Company is obliged to determine whether there are conditions for the appointment of a Confidential Person and his Deputy by inspecting the signature lists in order to verify the identity of the signatories and to meet the requirements of the prescribed majority of signatories. The inspection will be carried out in the presence of an authorized representative of the Employer and an authorized representative of the group of workers. The Management Board of the Company is obliged to appoint the proposed Confidential Person and his Deputy no later than five days from the date of receipt of a valid nomination proposal.

In the case of several proposals from the workers from the previous paragraph of this article, the proposal that has more support from the workers will have priority, and in the case of proposals that have equal support from the workers, the proposal that was received first will have priority.

Exceptionally from Article 5, Paragraph 2 of this Rulebook, the Employer shall appoint a Confidential Person and his Deputy without the proposal of at least 20% of the workers employed by the Employer, if such a proposal is not given or received in the administration within 8 days from the publication of this Rulebook. 

The appointed Confidential Person and his Deputy shall be dismissed by the Employer without delay based on the proposal of at least 20% of the Employer's employees, upon the written request of the Confidential Person or the Deputy for dismissal, or upon their giving a written statement that they withdraw their consent to the appointment.

The employer will initiate the procedure for the appointment of the Confidential Person and his Deputy no later than within 30 days from the dismissal of the Confidential Person and his Deputy. Until the decision on the appointment of a new Confidential Person is made, the duties of the Confidential Person are performed by her Deputy, unless the circumstance of termination or impossibility of performing both functions indicates that it is necessary to appoint a third person to temporarily perform the duties of the Confidential Person.

Sva prava, ovlasti i obveze povjerljive osobe primjenjuju se na Zamjenika povjerljive osobe, kao i na privremeno imenovanu treću osobu..

All rights, powers and obligations of a Confidential Person apply to the Deputy of a Confidential Person, as well as to a temporarily appointed third person.

The deputy of the Confidential Person acts in the following cases:

• When the duty of the Confidential Person ends for any reason and continues until the appointment of a new Confidential Person;
• Longer absences of a Confidential Person, and longer absences mean a period of 30 days or more;
• If the same Confidential person for the authority in question i
• In cases of short absence of the Confidential Person, and it is about situations where it is not possible to wait for the Confidential Person's return.

In agreement with the Confidential Person, the Deputy of the Confidential Person can constantly participate in the work of the Confidential Person, as an assistant.

6. Obligations of the Employer

The employer is obliged to:

• Protect the whistleblower from retaliation and take necessary measures to stop the retaliation and eliminate its consequences;
• Protect the data received in the application from unauthorized disclosure, unless this is contrary to national law;
• Ensure the conditions for keeping records of applications in accordance with the provisions of this Rulebook;
• Take measures to eliminate established irregularities;
• Create conditions for the smooth implementation of all activities related to the reporting of irregularities, as well as the independent and smooth work of the Confidential Person and his Deputy.

The employer must not put the Confidential Person and/or Deputy Confidential Person in a disadvantageous position.

The employer must not influence or try to influence the actions of the Confidential Person and/or the Deputy of the Confidential Person when taking actions within their jurisdiction necessary for the protection of whistleblowers.

7. Reports of irregularities

Reporters of irregularities are authorized to:

• Report the committed irregularity to the Confidential Person,
• Keep the documentation that proves the committed irregularity.

The report of irregularities contains information about the person reporting the irregularities, the reported person and information about the irregularities.

The report of irregularities can be submitted in written or oral form.

Written form includes any form of communication that provides a written record.

Oral registration is possible by telephone or other voice message systems and, at the applicant's request, by physical meeting within a reasonable time.

The Confidential Person and his deputy keep records of every received report of irregularities.

Applications are kept in a permanent form in accordance with the national law regulating the protection and processing of documentation.

If a telephone device on which it is possible to make a sound recording or another voice message system on which it is possible to make a sound recording is used to submit the report, the Confidential Person and his Deputy have the right to record the oral report, with the consent of the applicant, in one of the following ways:

• a sound recording of the conversation in a permanent and accessible form
• or by a complete and accurate transcript of the conversation made by the employees who are responsible for handling the application.

If a telephone device on which it is not possible to make a sound record or another voice message system on which it is not possible to make a sound record is used to submit the report, the Confidential Person and his Deputy have the right to record the oral report in the form of an accurate record of the conversation recorded by the person responsible for dealing with application.

If a person requests a meeting with a Confidential Person for the purpose of submitting an application, the Confidential Person ensures, with the consent of the applicant, that complete and accurate records of the meeting are kept in a permanent and accessible form.

The Confidential Person has the right to record the meeting in one of the following ways:

• a sound recording of the conversation in a permanent and accessible form
• or the exact minutes of the meeting prepared by the persons responsible for processing the application.

If a report of irregularity was received by the Employer by a person who is not competent to act on the report of irregularity, the latter must forward it to the Confidential Person without delay and without changes, while protecting the identity of the person who reported the irregularity and the confidentiality of the data from the report.

8. Implementation of the procedure and obligations of the Confidential Person and the Deputy of the Confidential Person

The procedure for internal reporting of irregularities begins with the submission of the report to the Confidential Person.

On the occasion of each received report of irregularities, the Confidential Person creates a case containing: information about the applicant, description of the irregularities and information about the reported person, date of receipt of the report, i.e. detection of irregularities and collected documentation of the course of the procedure.

Upon receipt of the report of irregularities, the Confidential Person carries out further proceedings in order to investigate the merits of the report and in the process of examining the merits of the report, it produces evidence, i.e. receives written statements of the reported person, statements of witnesses and, if necessary, statements of the whistleblower, assistants to the whistleblower, related persons and undertakes other necessary actions to establish the factual situation.

Each employee, or the person giving the statement from the previous paragraph, is obliged to provide the Confidential Person with all the necessary information at his disposal, which is related to a particular report of irregularities.

The Confidential Person and his Deputy are obliged to:

1. Receive a report of irregularities and confirm receipt of the report within seven days from the date of receipt
2. Without delay, undertake the actions within its jurisdiction necessary for the protection of the whistleblower
3. Undertake actions to investigate irregularities and provide the applicant with feedback on the application, as a rule, within 30 days, but no longer than 90 days from the date of confirmation of receipt of the application or, if the confirmation has not been sent to the applicant, after seven days have passed from the date of submission of the application
4. Protect the whistleblower from irregularities and revenge and take necessary measures to stop and eliminate irregularities and their consequences.

In terms of taking the necessary measures to stop and eliminate irregularities and their consequences, the Confidential Person is obliged, while preserving the identity of the person who reported the irregularities and the information from the report, to inform the competent persons in the company (managers, the Management Board) about the same, depending on the level and severity of the irregularities, and request that irregularities are eliminated in the shortest possible time.

All persons who have been notified by the Confidential Person about irregularities must immediately stop or remove them and inform the Confidential Person about what has been done. If the irregularities are not resolved within a reasonable period of time, the Confidential Person will inform further persons in the hierarchy. If even then the irregularity is not resolved, the conditions have been met for the Confidential Person to submit an external report to the competent authority.

1. Forward the irregularity report without delay to the authorities authorized to act on the contents of the report, if the irregularity has not been resolved with the Employer.
2. Inform the whistleblower in writing about the outcome of the examination of the report without delay.
3. Inform the competent body for external reporting of irregularities in writing about the received reports and the outcome of the proceedings within 30 days from the date of decision on the report.
4. Protect the identity of the whistleblower and the data received in the report from unauthorized disclosure or publication to other persons, unless this is contrary to a special law
5. Provide clear and easily accessible information on the procedures for submitting a report to the competent authority for external reporting and, if necessary, to the institutions, bodies, offices or agencies of the European Union responsible for dealing with the content of the report of irregularities
6. Keep records of received applications.

The Confidential Person and Deputy Confidential Person are obliged to perform their duties legally and conscientiously and must not abuse their powers to the detriment of the whistleblower.

9. Final provisions

The internal reporting system, as well as the information about it, must be easily accessible to all persons from the work environment, understandable and effective in order to encourage the primary use of the internal reporting system.

This Rulebook cannot reduce the scope of rights or deny any right to the whistleblower from the Law.

If any provision of this Rulebook is not in accordance with the Law, it has no legal effect.

Non-compliance with the provisions of this Rulebook constitutes a serious violation of the obligation from the employment relationship.

The Management Board of the Company is authorized to interpret this Rulebook and adopt its amendments.

This Rulebook enters into force and applies from 21.2.2023 for an indefinite period.

With the entry into force of this Rulebook, the Rulebook on the procedure for internal reporting and resolution of irregularities and the appointment of a Confidential Person from 08.11.2021. PRAV-115/21. is invalidated and ceases to be valid.

This Rulebook will be published on Public so that it is publicly available to all workers.