INTERNAL REPORTING PROCEDURE AND FOLLOW-UP ACTIONS
applicable at LeasingTeam sp. z o.o.

§ 1

1. The operational strategy of LeasingTeam sp. z o.o. in Warsaw (hereinafter referred to as “LT”) is based on responsibility, prevention of corruption, and prevention of other irregularities both within the organization and among collaborating entities, taking into account various aspects, in particular social interests, environmental protection, and relationships with different groups of associates.
2. The Procedure is an element of the internal control system. Its primary aim is to prevent irregularities within LT.
3. LT conducts its operations with absolute respect for legal regulations, good practices, and the highest ethical standards.
4. The main objective of the Procedure is to establish a system for reporting irregularities within LT by creating secure reporting channels that prevent any retaliatory actions against the so-called Whistleblower.
5. The Procedure defines the rules and method for reporting legal violations, including information on a justified suspicion of an actual or potential violation of law that has occurred or is likely to occur within LT, or information about an attempt to conceal such a violation.

§ 2

Whenever the Procedure refers to:

1. Legal Entity – this refers to LT;
2. Impartial Organizational Unit (hereinafter referred to as “IOU”) – this refers to a body authorized by LT, an impartial commission within the organizational structure of the Legal Entity, authorized to receive reports, take follow-up actions, and process personal data obtained in connection with the internal report, including verification of the report and communication with the Whistleblower. The IOU is the Violations Commission;
3. Procedure – this refers to the Procedure for receiving internal reports and taking follow-up actions;
4. Act – the Act of 14 June 2024 on the Protection of Whistleblowers (Journal of Laws, item 928);
5. Whistleblower – this refers to a natural person who reports a legal violation and does not do so for their own legal interest, regardless of the position held, form of employment or cooperation, both before establishing and after terminating the legal relationship with LT (including: employee, former employee, job applicant, person performing work on a basis other than employment, including under a civil law contract, entrepreneur, shareholder or partner, member of a governing body of a legal person, person working under the supervision and direction of a contractor, subcontractor or supplier, including under a civil law contract, intern, volunteer);
6. Report – this refers to information about a legal violation submitted via designated communication channels;
7. Reported Person – this refers to the individual indicated in the report as the person who committed the violation;
8. Follow-up Action – this refers to the proceeding conducted in connection with the submitted report;
9. Reporting Channel – this refers to the technical and organizational means enabling the submission of a report;
10. Retaliatory Action – this refers to a direct or indirect act or omission in a work-related context, caused by the report, that violates or may violate the Whistleblower’s rights or causes or may cause the Whistleblower unjustified harm, including the unjustified initiation of proceedings against the Whistleblower.

§ 3

1. The Procedure and its provisions apply to the following groups of individuals entitled to submit a report:
   1. employees and collaborators, as well as former employees and collaborators of LT,
   2. persons acting on behalf of and for the benefit of LT,
   3. all other individuals in any way associated with LT, in particular: individuals assisting in reporting irregularities, interns, trainees, or job applicants, if the irregularity-related information was obtained during the recruitment process or other processes preceding the establishment of an employment relationship.
2. A report of irregularities may concern, in particular:
   1. entities affiliated with LT,
   2. a natural person authorized to represent LT,
   3. employees and collaborators of LT in connection with performing work for LT,
   4. a subcontractor or other entrepreneur being a natural person, if their prohibited act was related to the execution of an agreement with LT,
   5. an employee, collaborator, or a person authorized to act in the interest of or on behalf of an entrepreneur who is not a natural person, if their act was related to the performance of a contract concluded by that entrepreneur with LT.
3. Irregularities shall be understood as information that may, in particular, indicate:
   1. suspected preparation, attempt, or commission of a prohibited act by the entities referred to in point 2,
   2. failure to perform duties or abuse of powers by the entities indicated in point 2,
   3. failure to exercise due diligence required under the circumstances by the entities referred to in point 2,
   4. irregularities in the organizational functioning of LT that could lead to a prohibited act or damage,
   5. violation of generally applicable laws under which LT operates,
   6. violation of internal procedures and ethical standards adopted at LT.
4. A legal violation is any act or omission contrary to the law or aimed at circumventing the law, concerning:
   1. corruption;
   2. public procurement;
   3. financial services, products and markets;
   4. anti-money laundering and counter-financing of terrorism;
   5. product safety and compliance;
   6. transport safety;
   7. environmental protection;
   8. radiological protection and nuclear safety;
   9. food and feed safety;
   10. animal health and welfare;
   11. public health;
   12. consumer protection;
   13. privacy and personal data protection;
   14. security of network and information systems;
   15. financial interests of the State Treasury of the Republic of Poland, local government units, and the European Union;
   16. the EU internal market, including public law rules on competition and state aid, and corporate taxation;
   17. constitutional freedoms and rights of individuals and citizens – occurring in relations between individuals and public authorities and unrelated to the areas specified in items 1–16.

§ 4

1. The individual exercising overall supervision of the receipt and assessment of reports by the IOU, as well as maintaining the register of violations, is the Plenipotentiary for Legal Violations. The Plenipotentiary is appointed by the LT Management Board.
2. The IOU responsible for receiving and reviewing reports and authorized to take follow-up actions and communicate with the Whistleblower is the Violations Commission, composed of the Plenipotentiary for Legal Violations and two members appointed by the LT Management Board, with their consent, selected from among individuals who are: not related by blood or marriage, not residing in the same household, and not maintaining close private relationships with the Management Board. Violations are analyzed by a single-member composition proposed by the Plenipotentiary. The Plenipotentiary does not review reports unless required due to a lack of available Commission members.
3. Persons mentioned in the report whose involvement suggests a negative role in the alleged misconduct may not participate in analyzing the report.
4. If the report concerns the Plenipotentiary for Legal Violations or so many members of the Violations Commission that the minimum one-person composition cannot be maintained, the LT Management Board shall designate other individuals responsible for handling the report.
5. The Plenipotentiary for Legal Violations and the Violations Commission are required to maintain confidentiality regarding all information and personal data obtained in the course of receiving and verifying the report, as well as while undertaking follow-up actions, including after termination of employment or any other legal relationship under which these duties were performed.

§ 5

1. The Whistleblower may submit reports via email sent to LT@leasingteam.pl.
2. The submitted report should provide a clear and complete explanation of the subject of the report and should include at least the following: date and location of the incident or the moment and place where information about the violation was obtained; a description of the specific situation or circumstances indicating a potential violation of the law; identification of the entity concerned; identification of potential witnesses; and all evidence and information available to the Whistleblower that may assist in assessing the report.
3. The entity will not consider anonymous reports.
4. In accordance with the principle of good faith, every person entitled to make a report should do so when they have reasonable grounds to believe the information provided is true.
5. Knowingly submitting false reports is strictly prohibited.
6. If it is determined that false information was knowingly provided or the truth was deliberately withheld in the report, the reporting party may be held accountable under disciplinary procedures specified in the Labor Code and other applicable internal regulations. Such behavior may also be classified as a serious breach of fundamental duties by employees or individuals performing work under a non-employment basis and may result in termination of the employment or civil contract without notice.
7. The decision to grant Whistleblower status is made by the Violations Commission.
8. Whistleblower status may be granted to any reporting person unless a preliminary analysis reveals clear evidence of bad faith (presumption of good faith applies).
9. For each report, the IOU appoints one individual responsible for communicating with the respective Whistleblower. This person confirms receipt of the report within 7 days by sending a message to the email address from which the report was submitted.
10. If, during clarification proceedings, it is determined that a previously recognized Whistleblower acted in bad faith, they will lose the protections afforded to Whistleblowers.

§ 6

1. Access to reporting channels is granted only to the Plenipotentiary for Legal Violations, other members of the Violations Commission, and, where applicable, other persons responsible for handling the report.
2. Upon receipt of a report, within no more than 7 days, the Violations Commission conducts a preliminary verification of the report, i.e., the factual likelihood of a violation being legitimate (“Preliminary Verification”). A positive Preliminary Verification results in the Commission confirming receipt and granting Whistleblower status. Confirmation is sent to the email address from which the report was submitted.
3. Following the Preliminary Verification as described above, the Violations Commission may decide not to initiate Clarification Proceedings if the report is clearly unfounded or it is impossible to obtain further necessary information from the Whistleblower.
4. The Violations Commission reviews the report and takes follow-up actions without undue delay.
5. In justified cases (as described in items 2 and 3 above), the Violations Commission initiates Clarification Proceedings and, within no more than 30 days, makes a decision regarding the validity of the report, provided that all necessary documents and evidence can be collected within that time by the entity reviewing the report.
6. In particularly complex cases, the review may take up to 90 days from the date the Clarification Proceedings were initiated.
7. Subject to item 2, if the report enables immediate follow-up action — including an expedited Clarification Process — such actions shall be taken immediately upon receipt of the report.
8. If justified by the factual circumstances described in the report, specialists and independent consultants may be engaged in the Clarification Proceedings, e.g., for preparing subject-matter evaluations or legal opinions.
9. Information about planned or taken follow-up actions and the reasons for such actions shall be provided to the Whistleblower no later than 3 months after confirmation of receipt (or, if no confirmation is issued, 3 months after 7 days from the report). Feedback is sent to the email from which the report was submitted.
10. The Commission may issue recommendations for corrective or disciplinary measures against the person responsible for the legal violation and for measures aimed at eliminating or preventing similar violations in the future.
11. The Violations Commission prepares a report based on findings from the Clarification Proceedings and submits it to the Plenipotentiary for Legal Violations, unless the Plenipotentiary authored the report as the investigating party.
12. The report contains a description of the established facts, the identified irregularities and their causes, scope and consequences, and the individuals responsible.
13. The report also includes proposed follow-up actions. Depending on the findings, these may involve actions against responsible individuals, preventive measures, and enhancements to the internal control system. Such actions may include in particular:
    1. closing the case without further action (if the report proves unsubstantiated);
    2. holding a conversation or issuing a warning to the employee;
    3. issuing a reprimand, withholding a bonus, etc.;
    4. changes or rotations in staff positions;
    5. modifications to internal procedures;
    6. civil actions, e.g., concerning contracts, compensation for damages, claims for payment;
    7. initiating disciplinary proceedings;
    8. filing a notice of reasonable suspicion of a criminal offense (where evidence is available);
    9. notifying the relevant authorities (where circumstantial evidence exists).
14. The LT Management Board defines further actions and assigns responsibility for their implementation. The Plenipotentiary monitors the implementation and supports those responsible.
15. The Commission informs the Whistleblower of its findings and approved measures promptly after the Management Board approves the recommendations, and no later than 30 days after the conclusion of the Clarification Proceedings.
16. The findings, approved measures, and their implementation are recorded in the Register of Reports.
17. The Register of Irregularities includes in particular:
    1. Whistleblower’s contact details,
    2. all detailed information regarding the report,
    3. the course of analysis and assessment,
    4. persons and bodies involved in the handling process,
    5. any decisions and escalations (if applicable).
18. The Register of Reports is maintained with confidentiality, and personal data and other information are stored for 3 years after the end of the calendar year in which follow-up actions or proceedings initiated thereby were concluded.

§ 7

1. An absolute prohibition is introduced on taking retaliatory actions against the Whistleblower who submitted a report (either internal or external), as well as public disclosure — in accordance with the Act.
2. Any repressive, discriminatory, or otherwise unfair treatment of the Whistleblower shall be regarded as a violation of the Procedure and may result in disciplinary liability or termination of the contract linking the retaliating party with LT.
3. Unacceptable actions toward the Whistleblower include, in particular: refusal to establish an employment relationship, dismissal with or without notice, reduction in salary, withholding or omission of promotion, exclusion from granting of employment-related benefits (other than salary), demotion, suspension from job or duties, reassignment of tasks to another employee, adverse change to workplace or working hours, negative performance review or opinion, imposition of disciplinary measures including financial penalties or similar sanctions, exclusion from or omission in training for professional development, unjustified referral for medical examination (including psychiatric evaluations where permitted by law), or actions intended to hinder future employment.
4. Threats or attempts to apply any of the above measures due to the act of reporting are also considered unfair treatment.
5. Protection does not apply to a Whistleblower who is simultaneously a perpetrator / co-perpetrator / accomplice in the irregularity.

§ 8

1. Maintaining confidentiality is intended to guarantee the Whistleblower’s sense of security and minimize the risk of retaliatory or repressive actions. A Whistleblower who has made a report and whose personal data has been unlawfully disclosed should immediately notify the LT Management Board or the Violations Commission, which are obliged to take measures to protect the Whistleblower.
2. The identity of the Whistleblower, as well as any information that could enable their identification, shall not be disclosed to the entity concerned by the report, to third parties, or to other employees and collaborators of the entity. Specifically:
   1. The Whistleblower’s data shall not be disclosed in any documents related to the proceedings;
   2. The Whistleblower’s data shall not be disclosed at the request of parties or participants in the proceedings;
   3. The Whistleblower’s data shall not be included in document distribution lists related to the proceedings;
   4. The Whistleblower shall not act as a witness, participant, or party in any proceeding initiated as a result of their report.

   The identity of the Whistleblower and other identifying information may be disclosed only if such disclosure is a necessary and proportionate obligation arising from applicable legal provisions in the context of proceedings conducted by national authorities (e.g. courts).

3. The entity processes personal data only to the extent necessary to receive the report and undertake follow-up actions. Personal data that is not relevant to the assessment of the report shall not be collected and, if collected, shall be deleted. Such data must be deleted within 14 days from the moment it is determined to be irrelevant to the case.

§ 9

1. A report may, in any case, also be submitted to the Ombudsman or a public authority, bypassing the procedure defined in the Procedure, particularly when:
   1. within the timeframe for providing feedback as defined in the Procedure, LT does not deliver a response to the Whistleblower; or
   2. the Whistleblower has reasonable grounds to believe that the legal violation may pose a direct or obvious threat to the public interest, particularly in the event of a risk of irreversible damage; or
   3. making an internal report would expose the Whistleblower to retaliatory actions; or
   4. in the case of an internal report, there is little likelihood of effectively counteracting the legal violation by LT due to specific circumstances of the case, such as the risk of evidence being concealed or destroyed, the possibility of collusion between LT and the perpetrator, or LT’s involvement in the violation.
2. A report submitted to the Ombudsman or a public authority without a prior internal report does not result in the Whistleblower losing the protection guaranteed under the provisions of the Act.

§ 10

The Procedure enters into force on 25 September 2024.