PROCEDURE FOR REPORTING OFFENCES AND PROTECTING WHISTLEBLOWERS

1. DEFINITIONS
For the purposes of this Procedure and its annexes, the following expressions, whenever they begin with a capital letter, have the following meaning:

Act of retaliation: An act or omission that, directly or indirectly, occurring in a professional context and motivated by an internal or external complaint or public disclosure, causes or may justifiably cause the Whistleblower pecuniary or non-pecuniary damages.

The following acts are presumed to have been motivated by a complaint (internal or external) or public disclosure, until proven otherwise, when carried out within two years of the complaint or disclosure:

• Changes to working conditions, such as duties, hours, place of work or remuneration,
  failure to promote the employee or failure to fulfil labour duties;
• Suspension of the employment contract;
• Negative performance evaluation or negative reference for employment purposes;
• Failure to convert a fixed-term employment contract into an open-ended contract,
  whenever the employee had legitimate expectations of such a conversion;
• Non-renewal of a fixed-term employment contract;
• Disciplinary sanctions, including dismissal;
• Inclusion on a list, based on a sector-wide agreement, which could lead to the
  Whistleblower being unable to find employment in the sector or industry concerned in
  the future;
• Termination of a supply or service contract.

Internal Whistleblowing Channel: the channel identified in point 5 below, through which
reports of infringements must be submitted, with or without identification of the
Whistleblower.

Personal data: Any information about a specific, identified or identifiable person.

Whistleblower: Any member or former member of a certain organisation or entity who reports situations that may constitute, or actually constitute, an infringement of which they are aware, on the basis of information they have accessed.

SODECIA Group: any entity that is controlled by SODECIA- Participações Sociais, SGPS, S.A. or is under its control, through direct or indirect ownership, over which it has the power to manage and determine the policies of that entity, whether through the ownership of voting shares, by contract or otherwise.

2. OBJECT

In accordance with the applicable law and following the operating principles and values set by SODECIA, namely transparency, integrity and compliance with legal requirements, SODECIA implemented an internal, autonomous and independent whistleblowing channel to report infringements.

Therefore, SODECIA adopts this Procedure for Reporting Offences and Protecting Whistleblowers (“Procedure”) in order to (i) define the guiding principles for the communication and handling of infringements, (ii) clarify how and through which channels infringements can be reported, as well as who can report them, (iii) clarify which infringements are within the scope of the implemented whistleblowing channel and (iv) inform about the procedures for receiving, recording and handling reports of infringements.

SODECIA supports and encourages the reporting of any known or suspected misconduct or infringement, acting responsibly and in a safe way regarding such communications.

3. WHAT MAY BE REPORTED

For the purposes of this Procedure, an Infringement is any act or omission contrary to the rules contained in European Union acts, national rules implementing, transposing or complying with such acts or any other rules contained in legislative acts implementing or transposing them, including those providing for crimes or administrative infringements relating to the following matters:

• Public procurement;
• Financial services, products and markets and the prevention of money laundering and terrorist financing;
• Product safety and compliance;
• Transport safety;
• Environmental protection; 
• Radiation protection and nuclear safety;
• Food and feed safety, animal health and animal welfare;
• Public health;
• Consumer protection and anti-competitive practices;
• Privacy and personal data protection and network and information systems security
• Corruption; 
• Child labour;
• Human trafficking;
• Discrimination on any grounds;
• Harassment;
• Protection of human rights.

Also considered an infringement is an act or omission that is contrary to and harmful to the financial interests of the European Union, as well as an act or omission that is contrary to the rules of the internal market, including the rules on competition and state aid.

Violent crime, especially violent and highly organized crime, and economic and financial crime also form part of the concept of crime.

The principles and responsibilities established in this Procedure apply to complaints relating to the areas described above, thus communications that go beyond this scope will not be considered infringements for the purposes of this Procedure. Therefore, such complaints will not be handled, and must be forwarded to the responsible areas, which will respond directly to the Whistleblower, through the appropriate channels.

4. WHAT MAY BE REPORTED

a) Objective scope of application

This Procedure is applicable whenever SODECIA receives a complaint, which is defined as the disclosure of illicit and/or immoral conduct, made to an organization that has the capacity to act and take measures in relation to the matter reported. 

The complaint may concern infringements that have been committed, are being committed or can reasonably be expected to be committed, as well as attempts to conceal these infringements.

b) Subjective scope of application

For the purposes of this Procedure, a Whistleblower is a natural person who reports an Infringement on the basis of information obtained in the course of their professional activity, regardless of the nature or sector of that activity (even if that information was obtained in the course of a professional relationship that has since ended, or during the recruitment process or during another pre-contractual negotiation phase of a professional relationship that has or has not been established).

Whistleblowers may include (i) former and current employees, (ii) service providers, contractors, subcontractors, and suppliers, as well as any persons acting under their direction or supervision, (iii) clients, (iv) shareholders, members of SODECIA’s management and supervisory bodies, (v) volunteers and interns (paid or unpaid) and (vi) any other SODECIA stakeholder¹.

---

¹ Shareholders, investors, customers, consumers, workers, scientific community, local community, sectoral entities, suppliers, government and municipalities, financial institutions, media, civil society. Note that the identification of SODECIA stakeholders was carried out on the basis of criteria of responsibility, influence and dependence.

5. HOW TO REPORT AN INFRINGEMENT

a) Internal whistleblowing channel

Reports of infringements under this Procedure must be conducted through the platform available on SODECIA’s online page.

When submitting a complaint, and in order to facilitate the handling and analysis, the Whistleblower must ensure that all the information necessary for its analysis is provided in a clear and objective manner attaching, whenever relevant, supporting documentation .

Once the submission process is complete, the Whistleblower will obtain a credential (which includes a complaint number and a password), randomly and automatically generated by the platform, through which it will be possible to (i) monitor the status of the complaint, (ii) respond to any requests for additional information and (iii) verify the main conclusions and measures planned or adopted and the respective justification for following up on the complaints.

For security and confidentiality purposes, the credentials to access the platform are unique and generated when submitting the complaint, with the password only visible to the Whistleblower. Therefore, it is not possible for SODECIA to recover any credentials.

b) External whistleblowing channels

In some cases, the Whistleblower may also report an infringement to the competent authorities, namely the following:

• Criminal police bodies;
• Independent administrative authorities;
• Public institutes;
• General inspections and similar entities and other central services of direct State administration with administrative autonomy;
• Local authorities; and
• Public associations.

External whistleblowing channels allow complaints to be submitted in writing and/or verbally, anonymously or not. The contact details of the external whistleblowing channels, namely electronic and postal addresses and telephone numbers are published on the respective websites.

---

2 The Whistleblower can only use external whistleblowing channels when:
a) There is no internal whistleblowing channel;
b) The internal whistleblowing channel only accepts the submission of complaints by employees, which is not the case of the Whistleblower;
c) Has reasonable grounds to believe that the infringement cannot be effectively addressed or resolved internally by SODECIA or that there is a risk of retaliation;
d) Has initially submitted an internal complaint without having been informed of the measures envisaged or adopted following the complaint within the deadlines set out in point 7 of this Procedure; or
e) The infraction constitutes a crime or administrative offense punishable by a fine exceeding €50,000.

Any Whistleblower who, outside of the cases provided for by law, publicly discloses an Infringement or makes it known to the media or a journalist, does not benefit from the protection afforded by the Law and this Procedure.

6. WHISTLEBLOWING CHANNEL GUARANTEES

a) Confidentiality

Any report of infringements made through the whistleblowing channel identified above will be treated confidentially.

Access to the information relating to the complaint, including the identity of the Whistleblower, in cases where this is known, and information that may allow the respective identification, is restricted to the person(s)/body(ies) of Sodecia and the External Independent Company responsible for receiving and processing the complaints. The obligation of confidentiality extends to all persons who have received information about the complaints, even if they are not the persons responsible for receiving and/or processing them.

The identity of the Whistleblower may only be disclosed in fulfilment of a legal obligation or court decision, preceded by written communication to the Whistleblower, indicating the reasons for the disclosure, unless the provision of this information jeopardizes the related investigations or legal proceedings.

b) Anonymity

The whistleblowing channel implemented by SODECIA is prepared to ensure that the Whistleblower is able to report infringements anonymously. 

It is important to note that the whistleblowing channel implemented allows the Whistleblower to be contacted through the whistleblowing channel, while remaining anonymous.

7. HANDLING INTERNAL COMPLAINTS

Complaints can be submitted in writing/verbally to the whistleblowing channels best identified in 5.

Upon receipt of a complaint, all cases will strictly follow the same procedure, as detailed in the following points.

a) Reception

The reception and preliminary analysis of complaints will be conducted by an external entity independent of SODECIA. The analysis will be based on the information provided by the Whistleblower, to evaluate the admissibility of the complaint within the scope of point 3 of this Procedure.

After submitting the complaint on the platform, and within a maximum of 2 business days, the Whistleblower will receive a notification via platform and by email (only if the Whistleblower has indicated their email address when filling out the form), informing that the complaint is being analysed.

Additionally, within seven days after receiving the complaint, and if the Whistleblower indicated a contact on the platform (email or telephone), SODECIA will inform about the requirements, form and admissibility for submitting the complaint through external whistleblowing channels.

b) Handling and Analysis

After performing the preliminary analysis, the external entity’s team will forward the complaint to SODECIA’s Legal Department, which will continue the investigation.

If the information provided by the Whistleblower proves to be insufficient, the Whistleblower will be contacted through the platform and, whenever necessary, through alternative means of contact (in case the Whistleblower have provided an email or telephone), to send additional information. Therefore, it is recommended that the Whistleblower uses their credentials to regularly monitor the status of the complaint on the platform, in order to ensure that any requests for information are answered and dealt quickly and effectively.

If the Whistleblower reports any infringement related to members of SODECIA’s team involved in the whistleblowing handling process, the external entity will ensure that such complaint is alternatively sent to the Board of Directors of SODECIA, which will be responsible for the follow up.

Within a maximum period of 3 months from the date of receipt of the complaint, and whenever possible, SODECIA shall inform the Whistleblower of the measures planned or adopted to follow up on the complaint, or of the closing of the case. 

The follow-up may include, for example, closing it for failure to comply with the scope set out in point 4, closing due to insufficient evidence, conducting an investigation, forwarding it to a competent authority, amongst others.

SODECIA may call on internal or external persons, namely external auditors or other experts to assist in the investigation, especially when the matters in question so warrant. These people are also covered by the duty of confidentiality laid down in the law and in this Procedure.

c) Conclusion

Once the handling and analysis phase has been completed, the complaint process will be closed on the platform, which will contain information about the conclusions, as well as any measures implemented or to be implemented. If deemed necessary, depending on the revealed facts, infringements may be reported to the competent authorities.

Additionally, the Whistleblower may request information on the conclusion of the analysis and the measures applied as a result of the investigations, within 15 days after its conclusion.

8. WHISTLEBLOWER PROTECTION

Whistleblowers who, in good faith and with serious grounds for believing that the information is true at the time of the complaint or public disclosure, benefit from the protection enshrined in the law.

This protection includes an anonymous Whistleblower who is identified and extends to:

1. to other persons who assist the Whistleblower in the whistleblowing procedure;
2. Third parties linked to the Whistleblower;
3. Legal or similar persons owned or controlled by the Whistleblower.

a) Prohibition of retaliation

Acts of retaliation against the whistleblower are prohibited.

SODECIA undertakes not to retaliate against any person who in good faith reports an infringement or provides assistance and information in the process of analysing a complaint, and may not, accordingly, dismiss, threaten, suspend, repress, harass, withhold or suspend salaries and/or benefits, demote, transfer or otherwise take any disciplinary or retaliatory action in connection with the terms and conditions of the employment contract.

Threats and/or attempts at retaliation also qualify as retaliation.

b) Support measures

Whistleblowers are entitled to legal protection under the general terms and may also benefit under the general terms from measures for the protection of witnesses in criminal proceedings.

Whistleblowers enjoy all the guarantees of access to the courts for the defence of their legally protected rights and interests.

9. WHISTLEBLOWER LIABILITY

The Whistleblower cannot be held disciplinary, civil, administrative or criminally liable for a complaint or public disclosure of an Infringement made in accordance with this Procedure.

Nor can the whistleblower be held liable for obtaining or accessing the information that led to the complaint or public disclosure, unless such obtaining or access constitutes a criminal infringements.

The above does not invalidate the possible liability of Whistleblowers for acts or omissions that are not related to the complaint or public disclosure or that are not necessary for the complaint or public disclosure of an Infringement under the terms of the Law and this Procedure.

Complaints whose  sole purpose is to damage the reputation of an employee or a third party, that are false or contain manipulated documents, that do not provide adequate justification or that constitute misuse of the whistleblowing channel, shall not be tolerated and may constitute a disciplinary civil or criminal offense.

10. DATA PROTECTION

Processing of personal data and storage of complaints:

1. SODECIA keeps a record of all complaints received and retains them for a period of five years and, regardless of this period, during the pendency of judicial or administrative proceedings relating to the complaint.
2. The Personal Data collected in this context will be processed by SODECIA in accordance with the provisions of the Procedure “Processing and Protection of Personal Data (GP-HR-PR001)”.

11. INDEPENDENCE AND EQUITY

SODECIA ensures that the procedures for handling and analysing reports of infringements are conducted in an independent, autonomous and impartial manner. Any person who has a conflict of interest with the matter of the communication or regarding the Whistleblower and/or the reported person shall not take part in these procedures or in the final decision.

Once the complaints are registered on SODECIA’s whistleblowing channel, they will be objectively investigated, always respecting the rights of the person reported. Excluding cases of flagrant misconduct, which may require immediate measures, in other cases, no action will be taken before giving to everyone involved the opportunity to actively being listen.

If necessary, SODECIA may hire impartial external consultants, in order to better structure the course of action and mitigate the effects, always with the aim of ensuring fair treatment as a basic principle.

12. ADDITIONAL INFORMATION

a) Approval and review

This Procedure and its subsequent revisions are approved by the Board of Directors, and must be revised whenever there are changes with a significant impact on the procedures established herein, namely changes in applicable legislation and/or in SODECIA’s internal policies. 

b) Disclosure

This Procedure must be disclosed as follows:

• on SODECIA’s website;
• to all employees and members of SODECIA’s corporate bodies, making it available in a specific repository.

c) Additional questions

Any questions about this Procedure can be sent to the Legal Department via email at whistleblowingquestions@sodecia.com.

d) Monitoring

The legal department at SODECIA shall be responsible to assess the effectiveness, usefulness, and efficacy of the proposed measures, and for implementing, monitoring, and reviewing the Whistleblowing channel.

The implementation is subject to monitoring as follows:

• In October of each year, a mid-term evaluation report is drawn up on situations identified as high or maximum risk;
• In April of the following year, the annual assessment report must be drawn up, which must include, in particular, a quantification of the degree of implementation of the preventive and corrective measures identified, as well as a forecast of their full implementation.