INTERNAL REPORTING PROCEDURE AND FOLLOW-UP ACTIONS
applicable at LeasingTeam Professional sp. z o.o.

§ 1

1. The operational strategy of LeasingTeam Professional sp. z o.o. in Warsaw (hereinafter referred to as “LTP”) is based on responsibility, prevention of corruption, and prevention of other irregularities both within the organization and among cooperating entities, taking into consideration various aspects, especially social interests, environmental protection, and relationships with various groups of collaborators.
2. This Procedure is an element of the internal control system. Its primary objective is to prevent irregularities within LTP.
3. LTP operates with absolute respect for the law, good practices, and the highest ethical standards.
4. The primary purpose of the Procedure is to establish a system for reporting irregularities within LTP by creating secure reporting channels that prevent any retaliatory actions against the so-called Whistleblower.
5. The Procedure defines the rules and procedures for reporting legal violations, including information about a justified suspicion of an actual or potential violation of the law that has occurred or is likely to occur within LTP, or information about an attempt to conceal such a violation.

§ 2

Wherever this Procedure refers to:

1. Legal Entity – this refers to LTP;
2. Impartial Organizational Unit (hereinafter “IOU”) – this refers to a commission authorized by LTP, an impartial unit within the organizational structure of the Legal Entity, authorized to receive reports, take follow-up actions, and process personal data obtained in connection with internal reports, including verification of the report and communication with the Whistleblower. The IOU is the Violations Commission;
3. Procedure – this refers to the Procedure for receiving internal reports and taking follow-up actions;
4. Act – the Act of 14 June 2024 on the Protection of Whistleblowers (Journal of Laws, item 928);
5. Whistleblower – a natural person who submits a report about a legal violation and does not do so for their own legal interest, regardless of their position, form of employment or cooperation—both before entering and after terminating the legal relationship with LTP (including: employees, former employees, job applicants, individuals working under a civil law contract, entrepreneurs, shareholders or partners, members of a legal entity’s governing body, individuals working under the supervision and direction of a contractor, subcontractor, or supplier, including under civil law contracts, interns, volunteers);
6. Report – information about a legal violation submitted through the designated communication channels;
7. Reported Person – the individual identified in the report as the person who committed the violation;
8. Follow-up Action – the procedure carried out in connection with the submitted report;
9. Reporting Channel – technical and organizational means that enable the submission of a report;
10. Retaliatory Action – any direct or indirect act or omission in a work-related context caused by the report, which violates or may violate the Whistleblower’s rights or causes or may cause unjustified harm to the Whistleblower, including unjustified initiation of proceedings against them.

§ 3

1. The Procedure and its provisions apply to the following groups of individuals entitled to submit a report:
   1. employees and collaborators, as well as former employees and collaborators of LTP,
   2. persons acting on behalf of and for the benefit of LTP,
   3. any other persons in any way connected with LTP, in particular: persons assisting in reporting irregularities, interns, trainees, or job applicants if they obtained information about irregularities during recruitment or other processes preceding the establishment of an employment relationship.
2. A report of irregularities may concern, in particular:
   1. entities affiliated with LTP,
   2. a natural person authorized to represent LTP,
   3. employees and collaborators of LTP in connection with work performed on behalf of LTP,
   4. a subcontractor or other entrepreneur who is a natural person, if the unlawful act was related to performing a contract concluded with LTP,
   5. an employee, collaborator, or person authorized to act on behalf of a non-natural person entrepreneur, if their act was related to performing a contract concluded by that entrepreneur with LTP.
3. Irregularities shall be understood as information that may, in particular, indicate:
   1. suspected preparation, attempt, or commission of an unlawful act by the entities listed in item 2,
   2. failure to fulfill duties or abuse of powers by the entities listed in item 2,
   3. lack of due diligence required under the given circumstances by the entities listed in item 2,
   4. organizational irregularities at LTP that may lead to the commission of an unlawful act or cause damage,
   5. violation of generally applicable laws under which LTP operates,
   6. violation of internal procedures and ethical standards adopted by LTP.
4. A legal violation is understood as an unlawful act or omission or one intended to circumvent the law, related to:
   1. corruption;
   2. public procurement;
   3. financial services, products, and markets;
   4. anti-money laundering and terrorist financing;
   5. product safety and compliance;
   6. transport safety;
   7. environmental protection;
   8. radiological protection and nuclear safety;
   9. food and feed safety;
   10. animal health and welfare;
   11. public health;
   12. consumer protection;
   13. privacy and personal data protection;
   14. security of networks and information systems;
   15. the financial interests of the State Treasury of the Republic of Poland, local government units, and the European Union;
   16. the EU internal market, including public-law principles of competition and state aid, and corporate taxation;
   17. constitutional freedoms and human and civil rights — in relations between individuals and public authorities and not related to the areas listed in points 1–16.

§ 4

1. The individual responsible for overall supervision of the receipt and review of reports by the IOU, as well as for maintaining the register of violations, is the Plenipotentiary for Legal Violations. The Plenipotentiary is appointed by the LTP Management Board.
2. The IOU, responsible for receiving and reviewing reports and authorized to undertake follow-up actions and communicate with the Whistleblower, is the Violations Commission, composed of the Plenipotentiary and two members appointed by the LTP Management Board, with their consent, selected from individuals who are not related by blood or marriage, do not share a household, and do not maintain close personal relationships with the Management Board. Violations are reviewed by a one-person composition proposed by the Plenipotentiary. The Plenipotentiary shall not review reports unless necessary due to a lack of Commission members able to conduct the analysis.
3. Persons whose involvement is indicated in the content of the report as potentially negatively implicated in the act or omission constituting the irregularity may not participate in the report analysis.
4. If the report concerns the Plenipotentiary or so many members of the Commission that it prevents functioning in at least a one-person composition, the LTP Management Board shall appoint other responsible persons to handle the report.
5. The Plenipotentiary and the Violations Commission are obligated to maintain confidentiality regarding any information and personal data obtained in the course of receiving and verifying the report or during follow-up actions — even after the termination of employment or other legal relationship under which such duties were performed.

§ 5

1. The Whistleblower may submit reports via email sent to LTPRO@ltprofessional.pl.
2. The submitted report should contain a clear and complete explanation of the subject matter and include at least the following information: the date and location of the violation or the date and place the information was obtained; a description of the specific situation or circumstances indicating a potential violation; identification of the entity concerned; identification of any witnesses; and all evidence and information the Whistleblower possesses that may assist in evaluating the report.
3. The entity will not consider anonymous reports.
4. In accordance with the principle of good faith, any person entitled to make a report should do so when there are reasonable grounds to believe the information submitted is true.
5. Knowingly submitting false reports is prohibited.
6. If it is established that false information was knowingly provided or the truth was deliberately withheld, the reporting person may be held accountable under disciplinary measures specified in the Labor Code and other relevant internal regulations. Such behavior may also be classified as a serious breach of fundamental employee duties or contractual obligations and may result in termination of employment/civil contract without notice.
7. The decision to grant Whistleblower status is made by the Violations Commission.
8. Whistleblower status may be granted to any reporting person, unless the initial analysis of the report reveals clear evidence of bad faith (a presumption of good faith applies).
9. For each report, the IOU designates one person responsible for communication with the Whistleblower. This person confirms receipt of the report within 7 days by sending a message to the email address from which the report was submitted.
10. If it is determined during clarification proceedings that a Whistleblower previously granted status acted in bad faith, they shall be stripped of the protections granted to Whistleblowers.

§ 6

1. Access to reporting channels is restricted to the Plenipotentiary for Legal Violations, other members of the Violations Commission, or other individuals responsible for handling the report.
2. Upon receipt of a report, within no more than 7 days, the Violations Commission conducts a preliminary verification of the report, i.e., an assessment of the factual likelihood of the reported violation (“Preliminary Verification”). A positive Preliminary Verification results in the Commission confirming receipt of the report and granting Whistleblower status. Confirmation is sent to the email address from which the report was submitted.
3. Following the Preliminary Verification, the Commission may decide not to initiate Clarification Proceedings if the report is clearly false or if additional information required to verify the report cannot be obtained from the Whistleblower.
4. The Violations Commission reviews the report and takes follow-up actions without undue delay.
5. In justified cases (as per items 2 and 3 above), the Commission initiates Clarification Proceedings and, within 30 days, issues a decision on the merits of the report, provided that necessary documents and evidence can be gathered in that time.
6. In particularly complex cases, assessment of the report may take up to 90 days from the start of Clarification Proceedings.
7. Subject to item 2, if the report allows for follow-up action — including expedited Clarification Proceedings — this is undertaken immediately upon receipt of the report.
8. Where justified by the facts described in the report, specialists and independent consultants may be involved in the Clarification Proceedings, e.g., by preparing expert or legal opinions.
9. Information about planned or undertaken follow-up actions and their rationale is provided to the Whistleblower no later than 3 months after confirmation of receipt (or, if no confirmation is sent, within 3 months of 7 days following submission). Feedback is sent to the email address from which the report was submitted.
10. The Commission may issue recommendations for appropriate remedial or disciplinary actions against the person responsible for the legal violation and make recommendations intended to eliminate or prevent similar violations in the future.
11. Based on findings during Clarification Proceedings, the Commission drafts a report and submits it to the Plenipotentiary, unless the Plenipotentiary authored the report as the person conducting the proceedings.
12. The Clarification Proceedings report includes a description of the established facts, the nature and causes of the irregularities, their scope and consequences, and the individuals responsible.
13. The report also includes proposals for further action. Depending on the findings, these actions may include:
    1. closure of the procedure without further action (if the report is not substantiated);
    2. a discussion or verbal warning for the employee;
    3. a formal reprimand, loss of bonus, etc.;
    4. staff position changes or rotations;
    5. modifications to internal procedures;
    6. civil actions, e.g., contract enforcement, damage recovery, compensation claims;
    7. a request to initiate disciplinary proceedings;
    8. notification of a reasonable suspicion of a crime (if evidence is collected);
    9. notification of the appropriate authorities (if circumstantial evidence exists).
14. The LTP Management Board defines the follow-up actions and persons responsible for their implementation. The Plenipotentiary monitors the implementation and supports the responsible individuals.
15. The Commission informs the Whistleblower of its findings and the approved actions immediately after their approval by the LTP Management Board, and no later than 30 days after the conclusion of Clarification Proceedings.
16. The findings, approved actions, and their implementation are recorded in the Register of Reports.
17. The Register of Irregularities includes in particular:
    1. Whistleblower contact details,
    2. all detailed information held about the report,
    3. the course of the report’s analysis and assessment,
    4. persons and bodies involved in the analysis and assessment process,
    5. all decisions and escalations (if applicable).
18. The Register is maintained confidentially, and personal data and other report-related information are stored for 3 years after the end of the calendar year in which follow-up actions or related proceedings were completed.

§ 7

1. An absolute prohibition is introduced on taking retaliatory actions against the Whistleblower who submitted a report (internal or external), or made a public disclosure — in accordance with the Act.
2. Any repressive, discriminatory, or otherwise unfair treatment toward the Whistleblower shall be considered a violation of this Procedure and may result in disciplinary action or termination of the contract linking the retaliating person with LTP.
3. The following actions toward the Whistleblower are considered unacceptable: refusal to enter into an employment relationship, dismissal with or without notice, reduction in pay, blocking or omission from promotion, exclusion from other work-related benefits, demotion, suspension from duties, reassignment of job responsibilities to another employee, unfavorable changes in work location or schedule, negative performance evaluation or opinion, imposition or application of disciplinary measures including financial penalties or similar sanctions, denial or omission from training opportunities to improve professional qualifications, unjustified referral for medical examination including psychiatric evaluation (if provided for by applicable laws), or actions intended to hinder future employment.
4. Unfavorable treatment due to a report also includes threats or attempts to apply the measures listed in item 3 above.
5. Protection does not apply to a Whistleblower who is also the perpetrator / co-perpetrator / accomplice of the irregularity.

§ 8

1. Maintaining confidentiality is intended to ensure the Whistleblower’s sense of security and to minimize the risk of retaliatory or repressive actions. A Whistleblower who has submitted a report and whose personal data has been unlawfully disclosed should immediately notify the LTP Management Board or the Violations Commission, which are obliged to take steps to protect the Whistleblower.
2. The identity of the Whistleblower, as well as any information that could enable their identification, shall not be disclosed to entities concerned by the report, third parties, or other employees and collaborators of the entity. In particular:
   1. The Whistleblower’s data shall not be disclosed in any documents related to the proceedings;
   2. The Whistleblower’s data shall not be disclosed upon request from parties or participants in the proceedings;
   3. The Whistleblower’s data shall not be included in document distribution lists related to the proceedings;
   4. The Whistleblower shall not be a witness, participant, or party to any proceeding initiated as a result of their report.

   The identity of the Whistleblower and other identifying information may be disclosed only when such disclosure constitutes a necessary and proportionate legal obligation arising from generally applicable legal provisions in the context of proceedings conducted by national authorities (e.g., courts).

3. The entity processes personal data only to the extent necessary to receive the report and carry out follow-up actions. Personal data that is not relevant to the assessment of the report is not collected and, if collected, shall be deleted. Deletion of such data shall occur within 14 days of determining that it is irrelevant to the case.

§ 9

1. A report may, in any case, also be submitted to the Ombudsman or a public authority, bypassing the procedure defined in this Procedure, particularly when:
   1. within the deadline for providing feedback set in the Procedure, LTP fails to deliver feedback to the Whistleblower; or
   2. the Whistleblower has reasonable grounds to believe that the legal violation poses a direct or obvious threat to the public interest, particularly where there is a risk of irreversible harm; or
   3. making an internal report would expose the Whistleblower to retaliatory actions; or
   4. in the case of an internal report, there is little likelihood that LTP will effectively counteract the legal violation due to specific circumstances of the case, such as the possibility of hiding or destroying evidence, potential collusion between LTP and the violator, or LTP’s involvement in the violation.
2. A report submitted to the Ombudsman or a public authority bypassing internal reporting does not deprive the Whistleblower of the protection guaranteed under the provisions of the Act.

§ 10

The Procedure enters into force on 25 September 2024.