Internal report – the communication of information about a legal violation to the Smart4Aviation Group, hereinafter referred to as the Report or Irregularity Report. 

External report – the communication of information about a legal violation to a public or central authority. 

Public disclosure – making information about a legal violation known to the public. 

Internal reporting procedure – a set of rules for reporting legal violations and taking follow-up actions. 

Whistleblower Department – individuals with written authorization from the Smart4Aviation Group to receive and verify internal reports, undertake follow-up actions, and process personal data: of the whistleblower, persons implicated in the report, and third parties mentioned in the report. 

Report register – contains report numbers and information related to the report, the progress, and the resolution of the case concerning the legal violation. 

Feedback – information provided to the whistleblower regarding planned or undertaken follow-up actions and the reasons for such actions.

Objective

In accordance with the Act of June 14, 2024, on the Protection of Whistleblowers (Dz.U. poz. 928), legal entities that employ or engage the services of at least 50 people as of January 1 or July 1 of a given year are required to establish an internal reporting procedure and take follow-up actions. 

Reporting a legal violation is intended to allow for actions to be taken before the consequences of such a violation occur or to minimize them as much as possible. Therefore, it is necessary to create a system for protecting whistleblowers. Every Team Member and/or Reporter should be aware of the possibility of making a report.

Scope

This procedure applies to all Team Members, Reporters, and Whistleblowers who wish to report or publicly disclose information about a legal violation obtained in the context of work, collaboration, or a commissioned service. The establishment of this procedure is also intended to protect whistleblowers from potential retaliatory actions (these actions are detailed in the section “Detailed Rules for Whistleblower Protection and Data Protection” within this procedure). Under this procedure, information about legal violations (i.e., actions or omissions that are unlawful or intended to circumvent the law) can be reported in relation to:

1. corruption;
   
2. public procurement;
   
3. financial services, products, and markets;
   
4. prevention of money laundering and terrorism financing;
   
5. product safety and compliance with requirements;
   
6. transport safety;
   
7. environmental protection;
   
8. radiological protection and nuclear safety;
   
9. food and feed safety;
   
10. animal health and welfare;
    
11. public health;
    
12. consumer protection;
    
13. privacy and personal data protection;
    
14. network and information systems security;
    
15. financial interests of the State Treasury of the Republic of Poland, local government units, and the European Union;
    
16. the internal market of the European Union, including public competition rules, state aid, and corporate taxation;
    
17. constitutional freedoms and human and citizen rights in relations between individuals and public authorities, unrelated to the areas listed in points 1-16.
    

If a report is made outside the above-mentioned subject matter, the provisions of the Whistleblower Protection Act will not apply, and the reporter will not receive whistleblower status.

Internal Reporting Procedure

1. Internal Reporting of Irregularities
   1. To report an irregularity, the Reporter should send an email to sygnalista@smart4aviation.aero. The report should provide a clear and comprehensive explanation of the report and include the following information:
      1. Date and location of the irregularity or date and location of when the information about the irregularity was obtained,
         
      2. Description of the specific situation or circumstances that may lead to the irregularity,
         
      3. Indication of the entity involved in the irregularity,
         
      4. Identification of potential witnesses to the irregularity,
         
      5. A list of all available evidence and information that could assist in addressing the irregularityThe Reporter is obligated to treat the information regarding suspected irregularities as confidential and to refrain from spreading such information unless required to do so by law.
   2. The Reporter is obligated to treat the information regarding suspected irregularities as confidential and to refrain from spreading such information unless required to do so by law.
      
   3. If the Reporter wishes to remain anonymous, they must send the report from an email address that does not reveal their identity. Ensure that this email remains active until the follow-up actions are completed.
      
   4. A Team Member/Reporter/Whistleblower always has the right to file an external report directly to an external authority, such as the Ombudsman or public authorities, or, where applicable, to institutions, bodies, or organizational units of the European Union, bypassing the internal reporting procedure described here. Reporting directly to a public or central authority without internal reporting does not deprive the Whistleblower of the protection guaranteed by the Whistleblower Protection Act.
      
   5. Detailed information on external reporting can be found in Chapter 4 of the Act of June 14, 2024, on the Protection of Whistleblowers (Dz.U. poz. 928).
2. Receipt of an report
   

1. Each email sent to sygnalista@smart4aviation.aero will automatically generate a ticket in the Jira system under the WHISTLE project. Each report will be assigned a unique number and logged in the Report Register. The Whistleblower Department is responsible for maintaining the report Register and accepting tickets with the reported report.
   
2. The Report Register will include:
   
   1. Report number,
      
   2. Subject of the legal violation,
      
   3. Information about the person involved in the report,
      
   4. Contact email for the Reporter,
      
   5. Date the report was submitted,
      
   6. Information on follow-up actions,
      
   7. Date the case was closed.
      
3. Personal data and other information in the Internal Report Register will be stored for 3 years after the end of the calendar year in which follow-up actions were completed or proceedings initiated by those actions were concluded.
   
4. The Smart4Aviation Group ensures that the internal reporting procedure and the processing of personal data related to the reports prevent unauthorized access to the information and protect the confidentiality of the identity of the Reporter, later the Whistleblower, the person concerned in the report, and any third party mentioned in the report. Confidentiality protection applies to any information that could directly or indirectly identify the identity of these individuals.
   

3. Analysis of the report
1. Upon receiving an internal report of irregularities, the Whistleblower Department must take the following actions promptly, but no later than 7 business days from the date the report is received:
   

1. Send confirmation via email to the Reporter, acknowledging the receipt of the irregularity report.
   
2. Conduct a preliminary analysis of the report to assess its validity.
   
3. Assign or deny the Whistleblower status to the Reporter.
   
1. If the Reporter is not granted Whistleblower status, meaning their report does not fall under the scope of the Whistleblower Protection Act of June 14, 2024 (Dz.U. poz. 928), they will be notified by email with an explanation of the decision within a maximum of 7 business days from the report’s receipt. However, the report may be forwarded to the appropriate department within the Smart4Aviation Group (based on the content of the report) for further analysis or appropriate actions. The Whistleblower Department will ask the Reporter whether they wish for their personal data to remain anonymous during the next stages of the process.
   Further proceedings on such an report are not governed by the above-mentioned Act, and the subsequent steps of this procedure do not apply to these cases.
   

4. Follow-up Actions

1. If the Reporting Person attains Whistleblower status, the Whistleblower Department initiates an investigation that includes follow-up actions. These actions are conducted without undue delay, within a period not exceeding 3 months from the date of confirmation of the receipt of the internal report.
   
2. Follow-up actions include, among others: measures taken to assess the accuracy of the information contained in the report and to prevent the violation of law reported, particularly through:
   

1. an investigative procedure,
   
2. initiation of an audit,
   
3. filing charges,
   
4. actions taken to recover financial assets,
   
5. implementation or proposal of further preventive measures, and strengthening of the internal control system, etc.
   The proposed preventive measures may include:
   • closing the procedure without further action (if the report is not substantiated)),
     
   • conducting a discussion or addressing the issue with the Team Member responsible for the analyzed violation,
     
   • changes or rotations in positions,
     
   • amendments to internal procedures,,
     
   • taking civil actions, such as those related to contracts, damage repair, or compensation payments,
     
   • filing a request for disciplinary proceedings,
     
   • submitting a report of reasonable suspicion of a crime (if evidence has been gathered),
     
   • notifying the relevant authorities (if circumstantial evidence has been collected).
     
1. Each time, depending on the subject of the report, the Whistleblower Department engages representatives from the relevant department within the Smart4Aviation Group to participate in the follow-up actions related to the reported irregularity. The following individuals are prohibited from being involved in the investigative procedure:
   
   1. The whistleblower who submitted the report under investigation,
      
   2. The person to whom the report pertains,
      
   3. Anyone who is a direct subordinate or supervisor of the person to whom the report pertains,
      
   4. Anyone closely related to the person to whom the report pertains (as defined by criminal law),
      
   5. Anyone responsible for tasks or actions that are under scrutiny,
      
   6. Anyone whose involvement would raise justified doubts about their impartiality for other reasons.
      
2. Only individuals with written authorization from the Smart4Aviation Group may be allowed to receive and verify Internal reports, undertake follow-up actions, and process personal data. Authorized individuals are required to maintain confidentiality regarding the information and personal data obtained in the course of receiving and verifying internal reports, as well as during the follow-up actions. This obligation to maintain confidentiality continues even after the termination of employment or other legal relationships under which they performed this work.

5. Follow-up Actions Report and Feedback for the Whistleblower
   

1. Based on the findings from the follow-up actions, the Whistleblower Department, with potential assistance from representatives of the specific department within the Smart4Aviation Group involved in the follow-up actions, prepares a report. This report is attached to the unique Report in the Jira WHISTLE project. The report summarizes the follow-up actions, including those taken to assess the accuracy of the information provided in the report and to prevent the violation of law reported by the Whistleblower.
   
2. The Whistleblower Department sends feedback to the Whistleblower via email, detailing the planned or undertaken follow-up actions and the reasons for these actions. The maximum deadline for providing feedback to the Whistleblower is 3 months from the date of confirmation of the receipt of the internal report.

Detailed rules for the protection of the Whistleblower and his data

1. A strict ban is imposed on any retaliatory actions, as well as attempts or threats of such actions, against a Whistleblower.
   
2. No retaliatory actions, as defined in Chapter 2 of the Act of June 14, 2024, on the Protection of Whistleblowers (Journal of Laws No. 928), may be taken against a Whistleblower for reporting a violation, including but not limited to:
   1. Refusal to enter into an employment or cooperation agreement,
      
   2. Termination or dismissal from employment or cooperation without notice,
      
   3. Failure to renew a fixed-term or indefinite contract where the Whistleblower had reasonable expectations that such a contract would be renewed,
      
   4. Reduction in salary,
      
   5. Withholding or bypassing a promotion,
      
   6. Exclusion from or reduction in other work-related benefits besides salary,
      
   7. Demotion to a lower position,
      
   8. Suspension from job duties or responsibilities,
      
   9. Reassignment of the Whistleblower's duties to another team member,
      
   10. Adverse changes in the location of work, cooperation, or work schedule,
       
   11. Negative performance reviews or opinions regarding work or cooperation,
       
   12. Imposition of disciplinary measures, including financial penalties or similar actions,
       
   13. Coercion, intimidation, or exclusion,
       
   14. Mobbing,
       
   15. Discrimination,
       
   16. Unfavorable or unfair treatment,
       
   17. Denial or omission from participation in career development or training,
       
   18. Unjustified referral for medical examinations, including psychiatric evaluations, unless legally required,
       
   19. Actions aimed at hindering future employment in the same sector or industry based on informal or formal agreements,
       
   20. Causing financial or economic losses, or loss of income,
       
   21. Inflicting other non-material harm, including the violation of personal rights, particularly the Whistleblower's good name.
       In cases of alleged retaliatory actions, the burden of proof (so-called reversed burden of proof) rests on the person taking the action, not the Whistleblower, to demonstrate that the action is not retaliatory.

3. The party taking retaliatory action, not the Whistleblower, must prove that the action taken is not retaliatory (the so-called reversed burden of proof).
4. The personal data of individuals granted Whistleblower status is subject to special protection to minimize the personal risk to the individual reporting the irregularities, including negative consequences from the individuals or entities involved in the report.
   
5. The Whistleblower's data must remain confidential and cannot be disclosed during the follow-up proceedings to the parties or participants in the process without the explicit and unequivocal consent of the Whistleblower.
   
6. The Whistleblower is not required to provide additional personal data beyond what was included in the original report, even if it does not allow for clear identification.
   
7. The Whistleblower's data will not be revealed in any documents related to the proceedings.
   
8. The Whistleblower's data will not be disclosed at the request of parties or participants in the procedure.