INTERNAL REPORTING PROCEDURE AND FOLLOW-UP ACTIONS
applicable at LeasingTeam International sp. z o.o.

§ 1

1. The operational strategy of LeasingTeam International sp. z o.o. in Warsaw (hereinafter referred to as “LTI”) is based on responsibility, prevention of corruption, and the prevention of other irregularities both within the organization and among cooperating entities, taking into account a number of aspects, particularly social interests, environmental protection, and relations with various groups of collaborators.
2. This Procedure is an element of the internal control system. Its primary purpose is to prevent irregularities within LTI.
3. LTI conducts its activities in strict compliance with legal regulations, good practices, and the highest ethical standards.
4. The primary purpose of the Procedure is to establish a system for reporting irregularities within LTI by creating safe reporting channels that prevent any retaliatory actions against so-called Whistleblowers.
5. The Procedure sets out the rules and procedures for reporting legal violations, including information on a justified suspicion of an actual or potential legal violation that has occurred or is likely to occur within LTI, or information concerning an attempt to conceal such a violation.

§ 2

Wherever the Procedure refers to:

1. Legal Entity – this refers to LTI;
2. Impartial Organizational Unit (hereinafter “IOU”) – this refers to a body authorized by LTI, an impartial commission within the organizational structure of the Legal Entity, authorized to receive reports, carry out follow-up actions, and process personal data obtained in connection with the internal report, including verification of the report and communication with the Whistleblower. The IOU is the Violations Commission;
3. Procedure – this refers to the Procedure for receiving internal reports and taking follow-up actions;
4. Act – the Act of 14 June 2024 on the Protection of Whistleblowers (Journal of Laws, item 928);
5. Whistleblower – refers to a natural person who reports a legal violation without acting in their own legal interest, regardless of their position, form of employment, or cooperation — whether before, during, or after their legal relationship with LTI (including: employee, former employee, job applicant, person performing work under a civil law contract, entrepreneur, shareholder or partner, member of a legal entity’s body, person working under the supervision and direction of a contractor, subcontractor or supplier — including under a civil law contract — intern, volunteer);
6. Report – refers to information about a legal violation submitted through the designated communication channels;
7. Reported Person – the individual identified in the report as the one who committed the violation;
8. Follow-up Action – refers to a procedure conducted in relation to a submitted report;
9. Reporting Channel – technical and organizational means that enable the submission of a report;
10. Retaliatory Action – a direct or indirect act or omission in a work-related context caused by the report, which violates or may violate the Whistleblower’s rights or causes or may cause the Whistleblower unjustified harm, including baseless initiation of proceedings against them.

§ 3

1. The Procedure and its provisions apply to the following groups of individuals entitled to submit a report:
   1. employees and collaborators, as well as former employees and collaborators of LTI,
   2. persons acting on behalf of and for the benefit of LTI,
   3. any other individuals in any way connected with LTI, in particular: persons assisting in reporting irregularities, interns, trainees, or job candidates, if they obtained information about irregularities during the recruitment process or other processes preceding the establishment of the employment relationship.
2. A report of irregularities may concern, in particular:
   1. entities affiliated with LTI,
   2. a natural person authorized to represent LTI,
   3. employees and collaborators of LTI in connection with their work for the company,
   4. a subcontractor or other entrepreneur who is a natural person, if the prohibited act was related to a contract with LTI,
   5. an employee, collaborator, or person authorized to act in the interest of or on behalf of an entrepreneur who is not a natural person, if the act was connected to the execution of a contract concluded by that entrepreneur with LTI.
3. Irregularities are defined as information that may indicate, in particular:
   1. suspected preparation, attempt, or commission of a prohibited act by the entities listed in point 2,
   2. failure to fulfill duties or abuse of powers by those entities,
   3. failure to exercise due diligence required under the given circumstances by the entities listed above,
   4. organizational irregularities at LTI that could lead to a prohibited act or damage,
   5. violation of generally applicable laws governing LTI’s operations,
   6. violation of internal procedures and ethical standards adopted by LTI.
4. A legal violation is any act or omission that is unlawful or aims to circumvent the law, in particular relating to:
   1. corruption;
   2. public procurement;
   3. financial services, products, and markets;
   4. anti-money laundering and counter-terrorism financing;
   5. product safety and compliance;
   6. transport safety;
   7. environmental protection;
   8. radiological protection and nuclear safety;
   9. food and feed safety;
   10. animal health and welfare;
   11. public health;
   12. consumer protection;
   13. privacy and personal data protection;
   14. security of networks and IT systems;
   15. the financial interests of the State Treasury of the Republic of Poland, local government units, and the European Union;
   16. the internal market of the European Union, including public-law rules on competition and state aid, and corporate taxation;
   17. constitutional freedoms and human and civil rights — occurring in the relationship between individuals and public authorities and unrelated to the areas mentioned in points 1–16.

§ 4

1. The individual exercising overall supervision over the receipt and review of reports by the IOU, as well as maintaining the register of violations, is the Plenipotentiary for Legal Violations. The Plenipotentiary is appointed by the LTI Management Board.
2. The IOU responsible for receiving and reviewing reports and authorized to undertake follow-up actions and communicate with the Whistleblower is the Violations Commission, consisting of the Plenipotentiary and two members appointed by the LTI Management Board, with their consent, selected from among persons: not related by kinship or marriage, not living in the same household, and not maintaining close private relationships with the Management Board. The violation is analyzed by a one-person composition proposed by the Plenipotentiary. The Plenipotentiary does not review reports unless necessary due to a lack of available Commission members.
3. Persons indicated in the report whose conduct may suggest involvement in the irregularity shall not participate in its analysis.
4. If the report concerns the Plenipotentiary for Legal Violations or so many members of the Violations Commission that it is not possible to proceed in a minimum one-person composition, the LTI Management Board shall appoint alternative persons responsible for handling the report.
5. The Plenipotentiary for Legal Violations and the Violations Commission are obligated to maintain confidentiality regarding any information and personal data obtained in the course of receiving and verifying the report and during follow-up actions, including after the termination of the employment or other legal relationship under which such duties were performed.

§ 5

1. The Whistleblower may submit reports by email sent to LTI@ltinternational.eu.
2. The submitted report should include a clear and complete explanation of the subject of the report and at minimum the following: the date and place of the legal violation or the date and place the information about the violation was obtained, a description of the specific situation or circumstances giving rise to a potential violation, identification of the entity to which the report refers, identification of any witnesses to the violation, and all available evidence and information the Whistleblower possesses that may aid in assessing the report.
3. The entity shall not process anonymous reports.
4. In accordance with the principle of good faith, any person entitled to submit a report should do so when they have reasonable grounds to believe the information is true.
5. Knowingly submitting false reports is prohibited.
6. If it is determined that the report knowingly included false information or concealed the truth, the reporting party may be subject to disciplinary action as defined in the Labor Code or other applicable regulations, including internal disciplinary rules of the Entity. Such behavior may also be classified as a serious breach of basic employee obligations or obligations arising from another type of legal relationship, and as such may result in termination of the employment/civil contract without notice.
7. The decision to grant Whistleblower status is made by the Violations Commission.
8. Whistleblower status may be granted to any reporting person, unless the initial analysis of the report provides grounds to believe that the reporting person clearly acted in bad faith (presumption of good faith applies).
9. For each report, the IOU designates a person responsible for communicating with the specific Whistleblower. This person confirms receipt of the report within 7 days of receiving it by replying to the email address from which the report was submitted.
10. If it becomes apparent during the clarification proceedings that the person who was previously granted Whistleblower status acted in bad faith, they shall be deprived of the protection afforded to Whistleblowers.

§ 6

1. Access to reporting channels is limited to the Plenipotentiary for Legal Violations and other members of the Violations Commission, or where applicable, other individuals responsible for handling the report.
2. Upon receiving a report, no later than 7 days thereafter, the Violations Commission conducts a preliminary verification assessing the factual plausibility of the reported violation (“Preliminary Verification”). A positive Preliminary Verification leads to confirmation by the Commission of receipt of the report and the granting of Whistleblower status. The confirmation is sent to the email address from which the report was submitted.
3. Following the Preliminary Verification as per item 2 above, the Commission may decide not to initiate Clarification Proceedings if the report is clearly false or it is impossible to obtain from the Whistleblower the additional information necessary to verify the report.
4. The Violations Commission shall assess the report and undertake follow-up actions without undue delay.
5. In justified cases (per items 2 and 3 above), the Commission initiates Clarification Proceedings, and within 30 days makes a decision regarding the validity of the report, provided that the entity has had the opportunity to gather all required documents and evidence during that time.
6. In particularly complex cases, the assessment of the report may take up to 90 days from the initiation of Clarification Proceedings.
7. Subject to item 2, if the report allows for taking follow-up actions — including abbreviated Clarification Proceedings — such actions shall be taken immediately upon receipt of the report.
8. If justified by the factual circumstances described in the report, specialists or independent consultants may be involved in the Clarification Proceedings, e.g., by issuing expert assessments or legal opinions related to the subject of the report.
9. Information about planned or undertaken follow-up actions and the reasons behind them is provided to the Whistleblower no later than 3 months from confirmation of receipt of the report (or, if no confirmation was given, within 3 months from 7 days after submission). Feedback is sent to the same email address from which the report was submitted.
10. The Commission may issue recommendations for appropriate remedial or disciplinary actions against the person responsible for the legal violation and recommendations aimed at eliminating or preventing the recurrence of similar violations.
11. Based on the findings of the Clarification Proceedings, the Commission drafts a report and submits it to the Plenipotentiary for Legal Violations, unless the report was prepared by the Plenipotentiary as the person conducting the proceedings.
12. The report from the Clarification Proceedings includes a description of the established facts, the identified irregularities and their causes, scope and consequences, and the responsible parties.
13. The Commission attaches to the report proposals for further action. Depending on the findings, these actions may include steps against the violators, preventive actions, and improvements to the internal control system. Such actions may include, in particular:
    1. closing the procedure without further action (if the report is not confirmed);
    2. a conversation or warning to the employee;
    3. employee reprimand, removal of bonuses, etc.;
    4. changes or rotation in positions;
    5. amendments to internal procedures;
    6. civil actions concerning e.g., contracts, damages, or compensation;
    7. submission of a request to initiate disciplinary proceedings;
    8. filing a notice of reasonable suspicion of a criminal offense (where evidence exists);
    9. notifying the relevant authorities (where circumstantial evidence is gathered).
14. The LTI Management Board defines further actions and assigns individuals responsible for their implementation. The Plenipotentiary monitors the implementation of these actions and provides assistance to the responsible persons.
15. The Commission informs the Whistleblower of the findings and approved measures immediately following approval by the LTI Management Board, but no later than 30 days after the conclusion of Clarification Proceedings.
16. The findings, approved measures, and their implementation are recorded in the Register of Reports.
17. The Register of Irregularities includes in particular:
    1. Whistleblower contact details,
    2. all detailed information available regarding the report,
    3. the course of the analysis and assessment of the report,
    4. the individuals and bodies involved in the analysis and assessment process,
    5. any decisions and escalations (if applicable).
18. The Register of Reports is maintained with full confidentiality, and personal data and other information are stored for 3 years after the end of the calendar year in which follow-up actions were completed or after proceedings initiated as a result of those actions were concluded.

§ 7

1. There is an absolute prohibition on taking retaliatory actions against a Whistleblower who has submitted a report (internal or external) or made a public disclosure — in accordance with the Act.
2. Any repressive, discriminatory, or otherwise unfair treatment of the Whistleblower will be regarded as a violation of the Procedure and may result in disciplinary liability or termination of the contract binding the retaliating party with LTI.
3. Unacceptable conduct toward the Whistleblower includes, in particular: refusal to establish employment, dismissal with or without notice, reduction of pay, withholding or omission of promotion, denial of work-related benefits other than pay, demotion, suspension from duties, transferring job responsibilities to another employee, adverse change in work location or schedule, negative performance review or opinion, imposition of disciplinary measures including financial penalties or similar actions, exclusion or omission from training aimed at professional development, unjustified referral for medical exams including psychiatric evaluations (if permitted by specific laws), or actions aimed at hindering future employment opportunities.
4. Unfavorable treatment also includes threats or attempts to apply any of the measures listed in item 3 above.
5. Protection does not apply to a Whistleblower who is also the perpetrator / co-perpetrator / accomplice of the irregularity.

§ 8

1. Maintaining confidentiality is intended to ensure the Whistleblower’s sense of security and to minimize the risk of retaliatory or repressive actions. A Whistleblower who has submitted a report and whose personal data has been unlawfully disclosed should immediately notify the LTI Management Board or the Violations Commission, which are obliged to take steps to protect the Whistleblower.
2. The identity of the Whistleblower, as well as all information allowing for their identification, shall not be disclosed to the entities concerned by the report, to third parties, or to other employees and collaborators of the entity. In particular:
   1. The Whistleblower’s data shall not be disclosed in any documents related to the proceedings;
   2. The Whistleblower’s data shall not be disclosed upon request of parties or participants in the proceedings;
   3. The Whistleblower’s data shall not be included in document distribution lists related to the proceedings;
   4. The Whistleblower shall not be a witness in the proceedings initiated as a result of their report, nor shall they be a participant or party in such proceedings.

   The identity of the Whistleblower or any other identifying information may only be disclosed when such disclosure is a necessary and proportionate obligation under generally applicable law in the context of national authority proceedings (e.g. courts).

3. The entity processes personal data only to the extent necessary to accept the report and undertake follow-up actions. Personal data not relevant to the report’s assessment shall not be collected, and if collected, shall be deleted. Such data shall be deleted within 14 days of determining that it is irrelevant to the case.

§ 9

1. A report may, in any case, also be submitted to the Ombudsman or a public authority, bypassing the Procedure set out herein, particularly when:
   1. within the feedback timeframe defined in the Procedure, LTI fails to provide feedback to the Whistleblower; or
   2. the Whistleblower has reasonable grounds to believe that the legal violation may pose a direct or obvious threat to the public interest, in particular where there is a risk of irreversible harm; or
   3. submission of an internal report would expose the Whistleblower to retaliatory actions; or
   4. in the case of an internal report, there is little likelihood that LTI will effectively address the legal violation due to special circumstances, such as the potential concealment or destruction of evidence, possible collusion between LTI and the perpetrator, or LTI’s involvement in the violation.
2. A report submitted to the Ombudsman or public authority bypassing the internal report does not deprive the Whistleblower of the protections guaranteed under the Act.

§ 10

The Procedure enters into force on 25 September 2024.