INTERNAL REPORTING PROCEDURE AND FOLLOW-UP ACTIONS
applicable at LeasingTeam Outsourcing sp. z o.o.

§ 1

1. The operational strategy of LeasingTeam Outsourcing sp. z o.o. in Warsaw (hereinafter referred to as “LTO”) is based on responsibility, prevention of corruption, and prevention of other irregularities both within the organization and among cooperating entities, taking into consideration a range of aspects, particularly social interests, environmental protection, and relations with various groups of collaborators.
2. This Procedure is an element of the internal control system. Its primary objective is to prevent irregularities within LTO.
3. LTO conducts its operations based on strict adherence to legal regulations, good practices, and the highest ethical standards.
4. The main purpose of the Procedure is to establish a system for reporting irregularities within LTO by creating secure reporting channels that prevent any retaliatory actions against the so-called Whistleblower.
5. The Procedure defines the rules and procedures for reporting legal violations, including information about a justified suspicion of an actual or potential violation of the law that has occurred or is likely to occur within LTO, or information related to attempts to conceal such a violation.

§ 2

Whenever the Procedure refers to:

1. Legal Entity – this means LTO;
2. Impartial Organizational Unit (hereinafter “IOU”) – this means a commission authorized by LTO, an impartial unit within the organizational structure of the Legal Entity, authorized to receive reports, carry out follow-up actions, and process personal data obtained in connection with internal reports, including verification and communication with the Whistleblower. The IOU is the Violations Commission;
3. Procedure – this refers to the Procedure for receiving internal reports and conducting follow-up actions;
4. Act – the Act of 14 June 2024 on the Protection of Whistleblowers (Journal of Laws, item 928);
5. Whistleblower – a natural person submitting a report about a legal violation, not acting out of self-interest, regardless of job title, employment form, or cooperation — both before and after the legal relationship with LTO. This includes: employees, former employees, job applicants, individuals working under a civil law contract, entrepreneurs, shareholders or partners, members of a legal entity’s governing body, individuals working under the supervision and direction of a contractor, subcontractor or supplier (including under civil law contracts), interns, and volunteers;
6. Report – information about a legal violation submitted through designated reporting channels;
7. Reported Person – the individual indicated in the report as the one who committed the violation;
8. Follow-up Action – a procedure undertaken in connection with a submitted report;
9. Reporting Channel – technical and organizational solutions enabling submission of a report;
10. Retaliatory Action – any direct or indirect act or omission in a work-related context caused by the report which violates or may violate the Whistleblower’s rights or causes or may cause unjustified harm to the Whistleblower, including baseless initiation of proceedings against them.

§ 3

1. The Procedure and its provisions apply to the following groups of individuals entitled to submit a report:
   1. employees and collaborators, as well as former employees and collaborators of LTO,
   2. persons acting on behalf of and for the benefit of LTO,
   3. any other persons in any way connected with LTO, particularly: persons assisting in reporting irregularities, interns, trainees, or job candidates if the irregularity-related information was obtained during the recruitment process or other processes preceding the establishment of the employment relationship.
2. A report of irregularities may concern, in particular:
   1. entities affiliated with LTO,
   2. a natural person authorized to represent LTO,
   3. employees and collaborators of LTO in connection with work performed for LTO,
   4. subcontractors or other business entities being natural persons if their unlawful act was connected with the execution of a contract concluded with LTO,
   5. an employee, collaborator, or person acting in the interest or on behalf of an entrepreneur who is not a natural person if their act was related to a contract concluded by that entrepreneur with LTO.
3. Irregularities are understood as information which may, in particular, indicate:
   1. suspected preparation, attempt, or commission of a prohibited act by the entities referred to in item 2,
   2. failure to fulfill obligations or abuse of powers by those entities,
   3. lack of due diligence required under the circumstances on the part of the entities listed in item 2,
   4. irregularities in the organization of LTO operations that could lead to a prohibited act or damage,
   5. violations of generally applicable laws under which LTO operates,
   6. violations of internal procedures and ethical standards adopted by LTO.
4. A legal violation is understood as an unlawful act or omission, or an act intended to circumvent the law, concerning:
   1. corruption;
   2. public procurement;
   3. financial services, products, and markets;
   4. anti-money laundering and terrorist financing;
   5. product safety and compliance;
   6. transport safety;
   7. environmental protection;
   8. radiological protection and nuclear safety;
   9. food and feed safety;
   10. animal health and welfare;
   11. public health;
   12. consumer protection;
   13. privacy and personal data protection;
   14. network and IT system security;
   15. the financial interests of the State Treasury of the Republic of Poland, local government units, and the European Union;
   16. the internal market of the European Union, including public-law rules on competition and state aid, and corporate taxation;
   17. constitutional freedoms and human and civil rights — occurring in the relationship between individuals and public authorities and not related to the areas listed in items 1–16.

§ 4

1. The person responsible for overall oversight of the receipt and review of reports by the IOU, as well as for maintaining the register of violations, is the Plenipotentiary for Legal Violations. The Plenipotentiary is appointed by the LTO Management Board.
2. The IOU responsible for receiving and reviewing reports, authorized to undertake follow-up actions and communicate with the Whistleblower, is the Violations Commission. The Commission consists of the Plenipotentiary for Legal Violations and two members appointed by the LTO Management Board, with their consent, selected from among persons who are not related by family or marriage, do not share a household, and do not maintain close personal relations with the Management Board. Violations are analyzed by the Commission in a one-person composition proposed by the Plenipotentiary. The Plenipotentiary does not examine reports unless necessary due to the unavailability of Commission members who can conduct the analysis.
3. Persons whose conduct, according to the content of the report, indicates potential involvement in the irregularity must not participate in the analysis of that report.
4. If the report concerns the Plenipotentiary for Legal Violations or involves so many members of the Commission that it is impossible to proceed in a minimum one-person composition, the LTO Management Board shall appoint alternative individuals responsible for handling the report.
5. The Plenipotentiary for Legal Violations and the Violations Commission are obliged to maintain confidentiality regarding any information and personal data obtained in the course of receiving and verifying the report, and in connection with follow-up actions, even after the termination of employment or other legal relationship under which these duties were carried out.

§ 5

1. The Whistleblower may submit reports via email sent to LTO@leasingteam.pl.
2. The submitted report should include a clear and complete explanation of the subject matter and at least the following information: the date and place of the legal violation or the date and place the information was obtained, a description of the specific situation or circumstances indicating a possible legal violation, identification of the entity the report concerns, identification of any potential witnesses, and all evidence and information available to the Whistleblower that may assist in assessing the report.
3. The entity will not consider anonymous reports.
4. In accordance with the principle of good faith, any person entitled to submit a report should do so when they have reasonable grounds to believe the information is true.
5. Knowingly submitting false reports is prohibited.
6. If it is determined that false information was knowingly provided or the truth was knowingly withheld, the reporting individual may be subject to disciplinary measures as defined in the Labor Code and other applicable regulations, including internal disciplinary rules. Such conduct may also be classified as a serious breach of fundamental employee obligations or obligations arising from another legal basis for employment and may result in termination of the employment or civil contract without notice.
7. The decision to grant Whistleblower status is made by the Violations Commission.
8. Whistleblower status may be granted to any reporting person, unless the preliminary analysis indicates that the reporting individual clearly acted in bad faith (presumption of good faith applies).
9. For each report, the IOU appoints one person responsible for communication with the Whistleblower. This person confirms receipt of the report within 7 days of receipt by sending a message to the email address from which the report was submitted.
10. If, during clarification proceedings, it becomes clear that the reporting person who had previously been granted Whistleblower status acted in bad faith, that individual shall lose the protection granted to Whistleblowers.

§ 6

1. Access to reporting channels is granted only to the Plenipotentiary for Legal Violations and other members of the Violations Commission, or other individuals responsible for the report.
2. Upon receipt of the report, within no more than 7 days, the Violations Commission conducts a preliminary verification of the report—i.e., an assessment of the factual likelihood that the violation reported is valid (“Preliminary Verification”). A positive Preliminary Verification results in the Commission confirming acceptance of the report and granting Whistleblower status. Confirmation is sent to the email address from which the report was submitted.
3. Following the Preliminary Verification as per item 2, the Commission may decide not to initiate Clarification Proceedings if the report is clearly false or it is impossible to obtain additional information from the Whistleblower necessary for verifying the report.
4. The Violations Commission reviews the report and takes follow-up action without undue delay.
5. In justified cases (as referenced in items 2 and 3), the Commission initiates Clarification Proceedings and, within no more than 30 days, issues a decision on the merits of the report—provided that all necessary documents and evidence can be gathered in that time.
6. In particularly complex cases, review of the report may take up to 90 days from the start of the Clarification Proceedings.
7. Subject to item 2, if the report allows for immediate follow-up action, including expedited Clarification Proceedings, these shall be initiated without delay upon receipt of the report.
8. Where appropriate based on the facts described in the report, specialists and independent consultants may be involved in the Clarification Proceedings, e.g., through issuing expert opinions, including legal analyses.
9. Information regarding planned or undertaken follow-up actions and their justification is provided to the Whistleblower no later than 3 months from confirmation of receipt (or, if no confirmation was issued, within 3 months of 7 days following report submission). Feedback is sent to the email address from which the report was submitted.
10. The Commission may issue recommendations for appropriate corrective or disciplinary measures against the person responsible for the legal violation, as well as recommendations aimed at preventing future similar violations.
11. Based on the findings of the Clarification Proceedings, the Commission drafts a report and submits it to the Plenipotentiary for Legal Violations, unless the report was authored by the Plenipotentiary themselves as the conducting party.
12. The Clarification Proceedings report includes a description of the established facts, identified irregularities and their causes, scope and consequences, and the responsible individuals.
13. The report includes proposed further actions, which, depending on the findings, may involve actions against the offenders, preventive steps, and measures to strengthen the unit’s internal control system. These measures may include, in particular:
    1. closure of the case without further action (if the report is not substantiated);
    2. a conversation or warning issued to the employee;
    3. an official reprimand, withholding bonuses, etc.;
    4. changes or rotations in positions;
    5. adjustments to internal procedures;
    6. civil action, e.g., contract enforcement, damage repair, compensation claims;
    7. a request to initiate disciplinary proceedings;
    8. notification of justified suspicion of a crime (where evidence is available);
    9. notifying appropriate authorities (in cases where circumstantial evidence has been gathered).
14. The LTO Management Board determines further actions and appoints individuals responsible for their execution. The Plenipotentiary monitors implementation and supports the responsible persons.
15. The Commission notifies the Whistleblower of its findings and the approved measures promptly following Management Board approval and no later than 30 days after conclusion of the Clarification Proceedings.
16. The findings, approved measures, and their implementation are recorded in the Register of Reports.
17. The Register of Irregularities includes, in particular:
    1. Whistleblower contact information,
    2. all detailed information held about the report,
    3. the process of analysis and evaluation of the irregularity report,
    4. individuals and bodies involved in analyzing and assessing the report,
    5. all decisions and escalations (if applicable).
18. The Register of Reports is maintained with full confidentiality. Personal data and other information are retained for 3 years after the end of the calendar year in which follow-up actions were completed or proceedings initiated as a result of those actions were concluded.

§ 7

1. An absolute ban is introduced on taking retaliatory actions against a Whistleblower who has submitted a report (whether internal or external), as well as against public disclosure—in accordance with the Act.
2. Any retaliatory, discriminatory, or otherwise unfair treatment of a Whistleblower shall be regarded as a violation of the Procedure and may result in disciplinary consequences or termination of the contract between the retaliating party and LTO.
3. Specifically prohibited actions against a Whistleblower include: refusal to establish employment, dismissal with or without notice, reduction of salary, withholding or omitting promotion, excluding the individual from work-related benefits other than salary, demotion, suspension from duties, transferring the Whistleblower’s responsibilities to another employee, adverse changes in workplace or working hours, negative performance evaluations or opinions, imposing or applying disciplinary measures—including financial penalties or similar sanctions—exclusion from or failure to consider participation in professional training, unjustified referral for medical exams including psychiatric evaluations (where legally permitted), or any actions aimed at hindering future employment opportunities.
4. Unfavorable treatment also includes threats or attempts to apply any of the measures listed in item 3 above.
5. Protection does not apply to a Whistleblower who is simultaneously the perpetrator / co-perpetrator / accomplice in the irregularity.

§ 8

1. Maintaining confidentiality is aimed at ensuring the Whistleblower’s sense of security and minimizing the risk of retaliatory or repressive actions. A Whistleblower who has submitted a report and whose personal data has been unlawfully disclosed should immediately inform the LTO Management Board or the Violations Commission, which are obligated to take action to protect the Whistleblower.
2. The identity of the Whistleblower, as well as all information enabling their identification, shall not be disclosed to the entities concerned by the report, third parties, or other employees or collaborators of the entity. In particular:
   1. The Whistleblower’s data shall not appear in any documents related to the proceedings;
   2. The Whistleblower’s data shall not be disclosed upon request by parties or participants in the proceedings;
   3. The Whistleblower’s data shall not be included in document distribution lists related to the proceedings;
   4. The Whistleblower shall not serve as a witness, participant, or party in proceedings initiated as a result of their report.

   The identity of the Whistleblower, as well as any other identifying information, may only be disclosed if such disclosure is a necessary and proportionate obligation arising from applicable laws in the context of proceedings conducted by national authorities (e.g., courts).

3. The entity processes personal data to the extent necessary to accept the report and to undertake follow-up actions. Personal data irrelevant to the assessment of the report shall not be collected, and if collected, shall be deleted. The deletion of such personal data shall occur within 14 days from the determination that the data is not relevant to the case.

§ 9

1. A report may, in any case, also be submitted to the Ombudsman or a public authority, bypassing the Procedure defined herein, especially when:
   1. within the feedback deadline set forth in the Procedure, LTO does not provide feedback to the Whistleblower; or
   2. the Whistleblower has reasonable grounds to believe that the legal violation poses a direct or obvious threat to the public interest, especially where there is a risk of irreversible harm; or
   3. submitting the internal report would expose the Whistleblower to retaliatory actions; or
   4. in the case of an internal report, there is a low likelihood that LTO will effectively counteract the violation due to the specific circumstances of the case, such as the risk of evidence being hidden or destroyed, the possibility of collusion between LTO and the violator, or the involvement of LTO in the violation.
2. A report submitted to the Ombudsman or public authority bypassing the internal report does not result in the Whistleblower losing the protection guaranteed under the provisions of the Act.

§ 10 The Procedure enters into force on 25 September 2024.