In the UK we have established separate reporting channels for Advania UK and Mirus based on the requirements of English law. These are not available on the WhistleB platform. Before reporting through the central channel, consider if you can use one of these channels. These policies can be found on Advania UK’s Fresh platform, under the BMS or for other Advania UK entities, your own intranet/Sharepoint site.

TABLE OF CONTENTS – WHISTLEBLOWING POLICIES ADVANIA GROUP COMPANIES

WHISTLEBLOWING POLICY - ADVANIA GROUP CENTRAL CHANNEL
WHISTLEBLOWING POLICY – INTERNAL REPORTING CHANNEL FOR ADVANIA SVERIGE AB
WHISTLEBLOWING POLICY - INTERNAL REPORTING CHANNEL FOR ADVANIA ÍSLAND EHF.
REGLUR UM VERKLAG VIÐ UPPLJÓSTRUN HJÁ ADVANIA ÍSLAND EHF. (POLICY IN ICELANDIC)

WHISTLEBLOWING POLICY - ADVANIA GROUP CENTRAL CHANNEL

Advania Sverige AB and its affiliates, (”Advania Group”) are committed to ethical business conduct at the highest level. We have a zero-tolerance policy when it comes to wrongdoing. This Whistleblowing Policy is an essential part of our commitment. It ensures that people with information concerning serious wrongdoing can report it. It also provides protection to any individual making a good faith report of potential wrongdoing.

This policy applies to Advania Group’s central whistleblowing channel which enables reporting of wrongdoing in all Advania companies. You are free to choose your avenue of reporting; however, if you are able to report using an internal channel we encourage you to do so.

WHAT CAN BE REPORTED THROUGH THE GROUP CENTRAL CHANNEL?

A reportable matter shall:

1. Relate to an individual who holds a leading or key position in an Advania Group company or at Advania Group level and
2. Concern serious wrongdoings relating to bookkeeping, internal accounting control, audit, bribery, financial crimes, or other serious wrongdoings of vital importance to the Advania Group or the life or health of an individual.

WHO MAY FILE A REPORT THROUGH THE WHISTLEBLOWING CHANNEL?

The central whistleblowing channel is available to the following people;

- workers/employees,
- volunteers,
- trainees,
- self-employed persons,
- persons otherwise performing work for Advania,
- persons belonging to the administrative, management or supervisory body of Advania,
- shareholders that are active in Advania,
- customer and suppliers of Advania, and
- other stakeholders, whether internal or external to Advania.

OTHER AVENUES FOR RAISING CONCERNS

Advania strives to offer a safe working environment where each and every one should feel comfortable voicing their opinion. If you are employed or otherwise engaged by Advania and feel comfortable doing so, we recommend that you raise your concerns with your closest superior, HR or someone in management that you feel confident in. Such information may include e.g. salary or work dissatisfaction or conflicts with a co-worker.

If you are eligible to use one of our local internal channels, established for a particular company within the Advania Group, this is also an option. Please see further on reportable matters in such local internal channels.

THE WHISTLEBLOWING CHANNEL

A written report can be submitted via Advania Group’s secure online whistleblowing channel provided by WhistleB Whistleblowing Centre AB (“WhistleB”). The WhistleB platform enables completely anonymous reporting through an encrypted platform. You do not have to provide any details revealing your identity, however you are encouraged to do so for the purpose of facilitating the investigation into the circumstances you are reporting. Your identity will always be protected by confidentiality. The information you choose to submit will always be documented. The WhistleB platform can be accessed here.

The receiver of reports submitted through WhistleB is CMS Wistrand law firm (”CMS Wistrand”) based in Stockholm, Sweden. After receiving a report, CMS Wistrand will make an initial assessment independently of Advania Group. If the report is deemed to qualify as a reportable matter under this policy, it will be forwarded to one of two designated investigators within Advania Sverige AB for further investigation

After submitting your report

Within seven days after having submitted your report we will confirm that the report has been received, unless you have declined such confirmation. Within three months of submitting your report you will receive information on the follow-up of your report. The documentation of your report will be kept as long as necessary, however no longer than two years after the follow-up of your report has been concluded.

What should be included in the report?

We recommend that you include the following information in the report:

• What is your concern?
• When did this happen?
• Where did it happen?
• Details of the case (describe what has happened and why you are submitting your report)

It is important that you describe all circumstances and facts regarding the reported matter – also, such circumstances and facts that you believe may be less important. If possible, please enclose documents or pictures.

PROTECTION OF WHISTLEBLOWERS

Advania Group is committed to protecting its whistleblowers. Whistleblowers who submit a report through the whistleblowing channel, are protected from retaliation as a result of their report.

Retaliation may include, for example, suspension, lay-off, dismissal, demotion or withholding of promotion, transfer of duties, change of location of place of work, reduction in wage, change in working hours or a negative performance assessment or employment reference.

PERSONAL DATA IN THE WHISTLEBLOWING CHANNEL

Advania Sverige AB is the controller of personal data processed through the central whistleblowing channel, for example when reports are received, stored, investigated or deleted. If a matter is referred to the relevant Advania company for investigation, that company may also act as a controller for the processing necessary to carry out the investigation. If you have any questions regarding our personal data processing, please contact us at gdpr@advania.se.

Personal data will be processed in the whistleblowing channel based on Article 6(1)(f) GDPR (legitimate interest assessment). The purpose of the processing is to detect and prevent serious wrongdoings related to Advania Group’s business.
Advania Sverige AB may process personal data relating to criminal convictions and offences based on Article 10 GDPR, Ordinance (2018:219) with supplementary provisions to the General Data Protection Regulation and the Swedish Data Protection Agency’s (“IMY”) provisions DIFS 2018:2. The processing of sensitive data is based on Article 9(1)(g) GDPR.

The personal data processed through the central whistleblowing channel is mainly processed by Advania Sverige AB, the relevant Advania affiliate, WhistleB and Wistrand. If a report submitted through the channel concerns a crime, the information may be handed over to the police agency or other relevant authority.
The personal data processed through the central whistleblowing channel will be processed for as long as necessary, however no longer than two years after the conclusion of the follow-up of your report.

According to the GDPR you have a right to request access to and rectification or erasure of personal data as well as restriction of processing. You also have a right to object to processing as well as the right to data portability. Please note that, due to the context in which this personal data is processed, these rights may be limited due to the information being covered by confidentiality.

If you are dissatisfied with our processing you may lodge a complaint with IMY.
Personal data is primarily collected from the reporting person. However, personal data may also be collected from other sources during the course of the investigation.

WHISTLEBLOWING POLICY – INTERNAL REPORTING CHANNEL FOR ADVANIA SVERIGE AB

Advania Sverige AB (”Advania”) is committed to ethical business conduct at the highest level. We have a zero-tolerance policy when it comes to wrongdoing. This Whistleblowing Policy is an essential part of our commitment. It ensures that people working for or with Advania can report wrongdoings. It also provides protection to any individual making a good faith report of potential wrongdoings.

This policy applies to Advania’s internal whistleblowing channel. For the groupwide central channel, see above.

WHAT IS WHISTLEBLOWING?

Do you have knowledge of a wrongdoing conducted in relation to Advania’s, business? Could the wrongdoing be considered of public interest? If so, you may use our internal whistleblowing channel for making this wrongdoing known.
Reporting through the internal channel is limited to reporting on wrongdoings that may reasonably be considered of public interest. It can for example be information on financial crimes, corruption, breaches of working environment codes, or instances of discrimination or harassment. If you are unsure if the information you want to report would be of public interest we encourage you to report anyway.

WHO MAY FILE A REPORT THROUGH THE WHISTLEBLOWING CHANNEL?

The internal whistleblowing channel is available to the following categories working for Advania;

• workers/employees,
• volunteers,
• trainees,
• persons otherwise performing work under the control of Advania,
• self-employed persons,
• persons belonging to the administrative, management or supervisory body of Advania, and
• shareholders that are active in Advania.

OTHER AVENUES FOR RAISING CONCERNS

Advania strives to offer a safe working environment where each and every one should feel comfortable voicing their opinion. If you are comfortable doing so, we recommend that you raise your concerns with your closest superior, HR or someone in management that you feel confident in. HR can be reached at hr@advania.se,
08-54670000. If the information you want to bring forward is not such that it would be considered of public interest, this is the avenue you should use. Such information may include instances of salary dissatisfaction or cooperation difficulties with a co-worker.

INTERNAL WHISTLEBLOWING CHANNEL

You can submit your report in written format, orally or through the means of a physical meeting. When you choose to submit your report orally or through the means of a physical meeting, the conversation will normally be recorded. However, recording will only take place if you consent. The information you choose to submit will always be documented. When you submit a report through the whistleblowing channel, your identity will always be protected by confidentiality.

You have the following alternatives for reporting:

In writing

A written report can be submitted via Advania’s secure online whistleblowing system provided by WhistleB Whistleblowing Centre AB (“WhistleB”). The WhistleB platform enables completely anonymous reporting through an encrypted platform. You do not have to provide any details revealing your identity, however you are encouraged to do so for the purpose of facilitating the investigation into the wrongdoing. The WhistleB platform can be accessedhere;here.

The receiver of reports submitted through WhistleB is Wistrand law firm (”Wistrand”) based in Stockholm, Sweden. After receiving a report, Wistrand will make an initial assessment, independently of Advania. If the report is deemed to fall within the scope of this policy it will be forwarded to one of two designated investigators within Advania for further investigation.

Through voice mail

To report on a wrongdoing please leave a message on our whistleblowing voice mail established through the WhistleB platform. To leave an oral report, please use the WhistleB platform here and choose “Reporting thorough voice mail”. The voicemail can only be accessed by Wistrand law firm and will be handled in the same way as a written report as described above. If you have reason to believe that the receiver cannot remain objective in the matter you want to report, we encourage you to instead submit a report in writing through WhistleB instead.

Through the means of a physical meeting

If you wish to report through the means of a physical meeting please contact;

Advania Sverige AB: Magnus Wemby, at 0761-400190

After submitting your report

Within seven days after having submitted your report we will confirm that the report has been received, unless you have declined such confirmation. This applies regardless of whether the report has been submitted in writing, orally or through the means of a physical meeting. Within three months of submitting your report you will receive information on the follow-up of your report. The documentation of your report will be kept as long as necessary, however no longer than two years after the follow-up of your report has been concluded.

What should be included in the report?

We recommend that you include the following information in the report:

• What is your concern?
• When did this happen?
• Where did it happen?
• Details of the case (describe what has happened and why you are submitting your report)

It is important that you describe all circumstances and facts regarding the reported matter – also, such circumstances and facts that you believe may be less important. If possible, please enclose documentation or pictures.

PROTECTION OF WHISTLEBLOWERS

Whistleblowers who submit a report through the internal whistleblowing channel, are protected from retaliation as a result of their report. Retaliation may include, for example, suspension, lay-off, dismissal, demotion or withholding of promotion, transfer of duties, change of location of place of work, reduction in wage, change in working hours or a negative performance assessment or employment reference. An instance of retaliation may in itself be a wrongdoing that could be subject to a report through the internal whistleblowing channel.

If you are subject to retaliation, and your report falls within the scope of the Swedish Whistleblowing Act (2021:890), you may be entitled to damages.

EXTERNAL WHISTLEBLOWING CHANNELS

In addition to the internal channel described above, you have a right to report wrongdoings through external whistleblowing channels by contacting the relevant authority. A list of the relevant authorities can be found in the annex to Ordinance (2021:949) on the protection of persons reporting wrongdoing.
Additional information on external whistleblowing can be found on the Swedish Work Environment Authority’s website (https://www.av.se/om-oss/visselblasarlagen/extern-rapporteringskanal/lista-over-myndigheter-med-ansvar-enligt-ansvarsomrade-enligt-forordning-2021949/).

WHISTLEBLOWING POLICY – INTERNAL REPORTING CHANNEL FOR REAL TIME SERVICES CLOUD AB

Advania Sverige AB (”Advania”) is committed to ethical business conduct at the highest level. We have a zero-tolerance policy when it comes to wrongdoing. This Whistleblowing Policy is an essential part of our commitment. It ensures that people working for or with Advania can report wrongdoings. It also provides protection to any individual making a good faith report of potential wrongdoings.

This policy applies to Advania’s internal whistleblowing channel. For the groupwide central channel, see above.

WHAT CAN BE REPORTED THROUGH THE INTERNAL REPORTING CHANNEL FOR ADVANIA?

A reportable matter shall contain information acquired in a work-related context and concern contravention of EU regulations such as public procurement, the prevention of money-laundering and funding of terrorism, product safety and product conformity, environmental protection, radiation protection and nuclear safety, food and animal feed safety, animal health and well-being, protection of privacy and personal data, and security in network and information systems. Matters that are otherwise of public interest may also be reported.

If you are unsure if the information you want to report would be of public interest we encourage you to report anyway.

WHO MAY FILE A REPORT THROUGH THE WHISTLEBLOWING CHANNEL?

The internal whistleblowing channel is available to the following categories of individuals:

• workers/employees,
• job applicants,
• volunteers,
• trainees,
• persons otherwise performing work under the control of Advania,
• self-employed persons,
• persons belonging to the administrative, management or supervisory body of Advania, and
• shareholders that are active in Advania.

OTHER AVENUES FOR RAISING CONCERNS

Advania strives to offer a safe working environment where each and every one should feel comfortable voicing their opinion. If you are comfortable doing so, we recommend that you raise your concerns with your closest superior, HR or someone in management that you feel confident in. HR can be reached at hr@advania.se,
08-54670000. If the information you want to bring forward is not such that it would be considered of public interest, this is the avenue you should use. Such information may include instances of salary dissatisfaction or cooperation difficulties with a co-worker.

REPORTING IN THE INTERNAL WHISTLEBLOWING CHANNEL

You have the following alternatives for reporting:

In writing

A written report can be submitted via Advania’s secure online whistleblowing system provided by WhistleB Whistleblowing Centre AB (“WhistleB”). The WhistleB platform enables completely anonymous reporting through an encrypted platform. You do not have to provide any details revealing your identity, however you are encouraged to do so for the purpose of facilitating the investigation into the wrongdoing. The WhistleB platform can be accessed here

The receiver of reports submitted through WhistleB is CMS Wistrand law firm (”CMS Wistrand”) based in Stockholm, Sweden. After receiving a report, CMS Wistrand will make an initial assessment, independently of Advania. If the report is deemed to qualify as a reportable matter under this policy it will be forwarded to one of two designated investigators within Advania for further investigation.

Through voicemail

To report on a wrongdoing please leave a message on our whistleblowing voicemail established through the WhistleB platform. To leave an oral report, please use the WhistleB platform here and choose “Reporting through voicemail”. The voicemail can only be accessed by CMS Wistrand law firm and will be handled in the same way as a written report as described above. If you have reason to believe that the receiver cannot remain objective in the matter you want to report, we encourage you to instead submit a report in writing through WhistleB.

Through the means of a physical meeting

If you wish to report through the means of a physical meeting please contact;

Advania Sverige AB: Magnus Wemby, at 0761-400190

After submitting your report

Within seven days after having submitted your report we will confirm that the report has been received, unless you have declined such confirmation. This applies regardless of whether the report has been submitted in writing, orally or through the means of a physical meeting. Within three months of submitting your report you will receive information on the follow-up of your report. The documentation of your report will be kept as long as necessary, however no longer than two years after the follow-up of your report has been concluded.

What should be included in the report?

We recommend that you include the following information in the report:

• What is your concern?
• When did this happen?
• Where did it happen?
• Details of the case (describe what has happened and why you are submitting your report)

It is important that you describe all circumstances and facts regarding the reported matter – also, such circumstances and facts that you believe may be less important. If possible, please enclose documentation or pictures.

When you choose to submit your report orally or through the means of a physical meeting, the conversation will normally be recorded. However, recording will only take place if you consent. The information you choose to submit will always be documented. When you submit a report through the whistleblowing channel, your identity will always be protected by confidentiality.

PROTECTION OF WHISTLEBLOWERS

Whistleblowers who submit a report through the internal whistleblowing channel are protected from retaliation as a result of their report. Retaliation may include, for example, suspension, lay-off, dismissal, demotion or withholding of promotion, transfer of duties, change of location of place of work, reduction in wage, change in working hours or a negative performance assessment or employment reference. An instance of retaliation may in itself be a wrongdoing that could be subject to a report through the internal whistleblowing channel.

EXTERNAL WHISTLEBLOWING CHANNELS

In addition to the internal channel described above, you have a right to report wrongdoings through external whistleblowing channels by contacting the relevant authority. A list of the relevant authorities can be found in the annex to Ordinance (2021:949) on the protection of persons reporting wrongdoing.

Additional information on external whistleblowing can be found on the Swedish Work Environment Authority’s website here.

PERSONAL DATA IN THE Advania Sverige AB WHISTLEBLOWING CHANNEL

Advania Sverige AB, org.no 556214-9996, is the controller for the processing of personal data through its internal whistleblowing channel, for example when reports are received, stored, investigated or deleted. If you have any questions regarding our personal data processing, please contact us at Advania Sverige AB, Fredsborgsgatan 24, 117 43 Stockholm, or by phone at 08-546 70 000. Advania has appointed a Data Protection Officer to assist Advania in complying with applicable data protection legislation. You are always welcome to contact our Data Protection Officer at compliance@advania.se.

Sources of personal data

Personal data is primarily collected from the reporting person. However, personal data may also be collected from other sources, such as other employees, consultants and individuals representing other businesses.

Processing purposes, categories of personal data, legal bases and retention

Personal data will be processed as follows.

1.    To manage the internal reporting channel (including to receive reports, communicate with the reporting person, ensure necessary follow up and provide feedback to the reporting person).

Categories of personal data:

• Information provided in the report, which may include contact details, employees’ data such as job title and role, data relating to the alleged misconduct, special categories of personal data, financial information and personal data relating to criminal convictions and offences.
• Log data.

Legal basis:

Article 6(1)(c) GDPR, legal obligation to comply with obligations under the Swedish Act on the Protection of Persons Reporting Irregularities (2021:890).

Legal exemption for special categories of personal data: Article 9(2)(g) GDPR, processing is necessary for reasons of substantial public interest.

Retention:

Personal data included in a whistleblowing case is deleted when the investigation is completed and/or when the personal data is no longer needed for the purpose of carrying out the investigation or for taking action, at the latest within two years. Some personal data may be processed for a longer period if the personal data must be retained according to applicable laws. If it is decided that no investigation will be initiated, the personal data will be deleted immediately after such decision has been made.

2.    Establish, exercise, and defend legal claims

Categories of personal data:

• Information provided in the report, which may include contact details, employees’ data, data relating to the alleged misconduct, special categories of personal data and financial information.
• Log data.

Legal basis:

Article 6(1)(f) GDPR, the legitimate interest to establish, exercise, and defend legal claims.

Where personal data relating to criminal convictions and offences per Article 10 GDPR, is processed, Section 5 of the Ordinance (2018:219) with supplementary provisions to the General Data Protection Regulation, and the Swedish Authority for Privacy Protection’s (“IMY”) regulation DIFS 2018:2 apply.

Legal exemption for special categories of personal data: Article 9(2)(f) GDPR, processing is necessary for the establishment, exercise, or defense of legal claims.

Retention:

Personal data will be processed until the dispute has been finally settled. Additionally, personal data may be kept during a period of time corresponding to the applicable statutory limitation period. In Sweden, the general statutory limitation period is ten (10) years.

In addition to the foregoing, personal data will also be processed to ensure technical functionality and security, as detailed in our general Privacy Policy that can be found here.

Recipients

The personal data processed through the internal reporting channel for Advania Sverige AB is mainly processed by Advania Sverige AB, WhistleB (acting as processor) and CMS Wistrand (acting as controller).

Personal data (log data and information provided in the report, which may include contact details, employees’ data such as job title and role, data relating to the alleged misconduct, special categories of personal data, financial information and personal data relating to criminal convictions and offences) may however be shared with i.a. the following categories of recipients.

1. The Police (acting as an independent controller), to facilitate investigation of crimes.
2. Courts (acting as independent controllers), as needed to establish exercise and defend legal claims.
3. Professional advisors, providing counselling or investigation services. Depending on the activity performed, professional advisors may act as processors or independent controllers. For further information on the specific privacy roles, you are welcome to contact us.
4. Advania Group companies, as needed to handle received reports. Depending on the processing activity at hand, Advania Group companies may act as processors or controllers. For further information on the specific privacy roles, you are welcome to contact us.
5. Unions, as required under applicable employment laws.

Third country transfers

In the absence of an adequacy decision from the European Commission, we ensure by means of appropriate safeguards, such as the EU Commission’s standard contractual clauses, that personal data remains protected regardless of whether they are transferred outside of the EEA.

For a personal data transfer that is not covered by an adequacy decision, you can request a copy of the applicable safeguard.

Data subject rights

Right of access

You have the right to access your personal data and to be informed of the purposes of data processing, categories of personal data, the recipients,

or categories of recipients to whom the personal data has been or will be disclosed and the retention times.

Right of rectification

You have the right to obtain the rectification of incorrect or inaccurate personal data concerning you and to have incomplete personal data completed.

Right of erasure

You have the right to request erasure of your personal data in certain circumstances, for example, if

(i) the processing of your personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed,

(ii) you initially consented to the use of your personal data but have now withdrawn your consent and there is no other legal ground for the processing,

(iii) you have objected to the processing of your personal data and there is no overriding legitimate ground for the processing,

(iv) your personal data has been unlawfully collected and (or) further processed, or (v) there is a legal obligation to erase your personal data.

Right to restriction of the processing of your personal data

You can request restriction of the processing of your personal data in certain circumstances. For example, if you have requested to rectify your data or made an objection to your personal data processing, you may ask to temporarily limit the use of your personal data while your request is being considered.

Right to withdraw consent

Any consent forming the legal basis for processing of personal data can be withdrawn at any time.

Right to lodge a complaint

If you are dissatisfied with our processing of your personal data, we welcome you to contact us. You may however also lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement of the GDPR. The Swedish supervisory authority is the Swedish Authority for Privacy Protection, www.imy.se

Whistleblowing Policy - internal reporting channel for Advania Ísland ehf.

These rules apply only to Advania Ísland ehf.’s internal whistleblowing channel. They, in conjunction with the Icelandic Act on Protection of Whistleblowers No. 40/2020 (referred to in these rules as the “Icelandic Whistleblowers Act”), ensure that despite any non-disclosure or confidentiality obligations, an employee of Advania Ísland ehf acting in good faith and believing that a breach of legal obligations or other reprehensible misconduct has taken place in Advania Ísland ehf.’s activities to report information or pass on materials to a party who is able to take steps to have such conduct stopped or to respond to the breach of legal obligations or other reprehensible conduct, or to the police authorities or other appropriate public surveillance authorities, e.g. the Administration of Occupational Safety and Health.

The Icelandic Whistleblowers Act, and as further stipulated below, contains provisions that confer a certain protection on Employees who report breaches of legal obligations or other reprehensible misconduct in the activities of Advania Ísland ehf.

DEFINITIONS

1.  ”Internal whistleblowing”: when an employee who possesses information or data about a breach of legal obligations or other reprehensible misconduct in the activities of Advania Ísland ehf. is permitted to report such information or data in good faith to a party who is able to take steps to have such conduct stopped or to respond to the it, police authorities or to a public surveillance authority, e.g. the Administration of Occupational Safety and Health.
2. “External whistleblowing”: when an employee who possesses information or data about a breach of legal obligations or other reprehensible misconduct in the activities of Advania Ísland ehf. is permitted to report such information or data in good faith to a party outside Advania Ísland ehf., e.g. to the media. External whistleblowing is not normally permitted unless all opportunities for internal whistleblowing have first been exhausted without it having led to an adequate response.
3. ”In good faith”: when an employee has good reason to assume that the information or materials reported are correct, that it is in the public interest to share them and that the employee has no alternative method of preventing the breach of legal obligations or the misconduct involved.
4. ”Reprehensible misconduct”: conduct which jeopardizes the public interest, e.g. conduct which threatens people’s health or security, or that of the environment, without constituting an evident breach of legal obligations.
5. ”Employee”: someone who has access to information or materials relating to Advania Ísland ehf.’s activities due the role of the person, including by engagement or temporary or permanent appointment to a position, or as an independent contractor, a board member, a trainee, temporary worker and volunteer. The employee shall enjoy protection under the Icelandic Whistleblowers Act after the role of the person ends.

WHAT IS WHISTLEBLOWING?

Do you have knowledge of a wrongdoing conducted, i.e. breach of legal obligations or other reprehensible misconduct, in relation to Advania Ísland ehf.’s, business? Could the wrongdoing be considered of public interest? If so, you may use our internal whistleblowing channel for making this wrongdoing known.

Reporting through the internal channel is limited to reporting on wrongdoings that may reasonably be considered of public interest as defined above. It can for example be information on financial crimes, corruption, breaches of working environment codes, or instances of discrimination or harassment. If you are unsure if the information you want to report would be of public interest we encourage you to report anyway.

WHO MAY FILE A REPORT THROUGH THE WHISTLEBLOWING CHANNEL?

The internal whistleblowing channel is available to any person who falls under the definition of “Employee” above.

OTHER AVENUES FOR RAISING CONCERNS

Advania Ísland ehf. strives to offer a safe working environment where each and every one should feel comfortable voicing their opinion. If you are comfortable doing so, we recommend that you raise your concerns with your closest superior, HR or someone in management that you feel confident in. HR can be reached at mannaudsmal@advania.is or +354 440 9000. If the information you want to bring forward is not such that it would be considered of public interest, this is the avenue you should use. Such information may include instances of salary dissatisfaction or cooperation difficulties with a co-worker.

INTERNAL WHISTLEBLOWING CHANNEL

A written report can be submitted to the receiver of reports as defined below via Advania Ísland ehf.’s secure online whistleblowing system provided by WhistleB Whistleblowing Centre AB (“WhistleB”). It is also permitted to report to police authorities or other appropriate public surveillance authorities, e.g. the Administration of Occupational Safety and Health.

The WhistleB platform enables completely anonymous reporting through an encrypted platform. You do not have to provide any details revealing your identity, however you are encouraged to do so for the purpose of facilitating the investigation into the wrongdoing. The WhistleB platform can be accessed here.

The receiver of reports submitted through WhistleB is CMS Wistrand law firm (”CMS Wistrand”) based in Stockholm, Sweden. After receiving a report, CMS Wistrand will make an initial assessment, independently of Advania Ísland ehf. If the report is deemed to fall within the scope of these rules it will be forwarded to one of two designated investigators within Advania Ísland ehf. for further investigation.

The information you choose to submit will always be documented. When you submit a report through the whistleblowing channel, your identity will always be protected by confidentiality. Please note that confidentiality does not preclude the receiver of reports from fulfilling its obligation to inform in accordance with law, other regulations or judgment.

The receiver of reports is obliged to take steps to have the breach of legal obligations or other reprehensible misconduct stopped, or to respond to the situation in some other way.

After submitting your report

Within seven days after having submitted your report we will confirm that the report has been received, unless you have declined such confirmation. Within three months of submitting your report you will receive information on the follow-up of your report. The documentation of your report will be kept as long as necessary, however no longer than two years after the follow-up of your report has been concluded.

What should be included in the report?

We recommend that you include the following information in the report:

• What is your concern?
• When did this happen?
• Where did it happen?
• Details of the case (describe what has happened and why you are submitting your report)

It is important that you describe all circumstances and facts regarding the reported matter – also, such circumstances and facts that you believe may be less important. If possible, please enclose documentation or pictures.

PROTECTION OF WHISTLEBLOWERS

The protection that is stipulated here below is subject to the conditions that the Employee complies with the provision of the Icelandic Whistleblowers Act and follows the procedural rules set out in it, as is explained in detail in these rules.

Amongst other things, this protection means among others:

That divulging the information is not regarded as a violation of any non-disclosure or confidentiality obligations by which the Employee may be bound. It also does not entail criminal or tortious liability for the Employee and it cannot result in sanctions by encumbering measures according to labour law.

That the Employee may not be subjected to retaliation, e.g. suspension, lay-off, dismissal, demotion or withholding of promotion, transfer of duties, change of location of place of work, reduction in wage, change in working hours or a negative performance assessment or employment reference. An instance of retaliation may in itself be a wrongdoing that could be subject to a report through the internal whistleblowing channel.

That the Employee may be entitled to damages if the Employee is subject to retaliation.

That if a dispute is brought to a court over the Employee’s position, the Employee shall not have to incur legal costs before the court.

EXTERNAL WHISTLEBLOWING CHANNELS

In general, there are three conditions governing external whistleblowing. Firstly, the divulging of the information must be made in good faith (as defined above). Secondly, the Employee must have just reason to believe that the conduct in question could be punishable by imprisonment. Lastly, the Employee shall normally have exhausted the channels for internal whistleblowing without it having led to an adequate response.

The last condition can be omitted in in very exceptional cases when, for valid reasons, internal whistleblowing is not possible. This refers to instances where making the information known is regarded as involving such important public interests that the interests of the employer or of other persons must give way to having the information brought to the notice of an external party, including the media. Such interests include the protection of: the security of the state, or the national interest in the sphere of defense; important national economic interests;

human health; and the environment.

Additional information on whistleblowing can be found on the Icelandic Administration of Occupational Safety and Health’s website: www.vinnueftirlitid.is.

PERSONAL DATA IN THE WHISTLEBLOWING CHANNEL

Advania Ísland ehf. is the controller of personal data processed through its respective internal whistleblowing channel, for example when reports are received, stored, investigated or deleted. If you have any questions regarding our personal data processing, please contact us at personuvernd@advania.is.

Personal data will be processed in the whistleblowing channel based on a legal obligation, cf. Article 9(1)(3) of the Icelandic Act on Data Protection and Processing of Personal Information No. 90/2018 (referred to in these rules as the “Icelandic GDPR Act”). The purpose of the processing is to detect and prevent wrongdoings related to Advania Ísland ehf.’s business.

Advania Ísland ehf. may process personal data relating to criminal convictions and offences based on Article 10 of the Icelandic GDPR Act. The processing of sensitive data is based on Article 11(1)(7) of the Icelandic GDPR Act.

The personal data processed through the internal whistleblowing channel is mainly processed by Advania Ísland ehf., WhistleB and CMS Wistrand. If a report submitted through the channel concerns a crime, the information may be handed over to the police agency or other relevant authority.

The personal data processed through the internal whistleblowing channel will be processed for as long as necessary, however no longer than two years after the conclusion of the follow-up of your report.

According to the Icelandic GDPR Act you have a right to request access to and rectification or erasure of personal data as well as restriction of processing. You also have a right to object to processing as well as the right to data portability. Please note that, due to the context in which this personal data is processed, these rights may be limited due to the information being covered by confidentiality.

If you are dissatisfied with our processing you may lodge a complaint with the Icelandic Data Protection Authority.

Personal data is primarily collected from the reporting person. However, personal data may also be collected from other sources during the course of the investigation. 

Reglur um verklag við uppljóstrun hjá Advania Ísland ehf. (policy in icelandic)

Þessar reglur gilda eingöngu um innri uppljóstranir. Þær, ásamt lögum um vernd uppljóstrara nr. 40/2020 (hér eftir “lög um uppljóstrara”), tryggja að þrátt fyrir fyrirmæli laga, siðareglna eða samninga um þagnar- eða trúnaðarskyldu er starfsmanni sem býr yfir upplýsingum eða gögnum um brot á lögum eða aðra ámælisverða háttsemi í starfsemi Advania Ísland ehf. heimilt að miðla slíkum upplýsingum og gögnum í góðri trú til aðila sem stuðlað getur að því að látið verði af eða brugðist við hinni ólögmætu eða ámælisverðu háttsemi eða til lögregluyfirvalda eða annarra opinberra eftirlitsaðila sem við eiga, til dæmis Vinnueftirlitsins.

Lög um uppljóstrara, sbr. einnig neðar, kveða á um ákveðna vernd til handa starfsmönnum sem upplýsa um lögbrot eða aðra ámælisverða háttsemi í starfsemi Advania Ísland ehf.

SKILGREININGAR

1.  „Innri uppljóstrun“: Þegar starfsmaður sem býr yfir upplýsingum eða gögnum um brot á lögum eða aðra ámælisverða háttsemi í starfsemi Advania Ísland ehf. er heimilt að miðla slíkum upplýsingum og gögnum í góðri trú til aðila sem stuðlað getur að því að látið verði af eða brugðist við hinni ólögmætu eða ámælisverðu háttsemi eða til lögregluyfirvalda eða annarra opinberra eftirlitsaðila sem við eiga, til dæmis Vinnueftirlitsins.
2.  „Ytri uppljóstrun“: Þegar starfsmaður sem býr yfir upplýsingum eða gögnum um brot á lögum eða aðra ámælisverða háttsemi í starfsemi Advania Ísland ehf. er heimilt að miðla slíkum upplýsingum og gögnum í góðri trú til utanaðkomandi aðila, þar á meðal fjölmiðla. Ytri uppljóstrun er að jafnaði ekki heimil nema innri uppljóstrun hafi fyrst verið reynd til þrautar.
3.  „Í góðri trú“: Þegar starfsmaður hefur góða ástæðu til að telja gögnin eða upplýsingarnar sem miðlað er réttar, það sé í þágu almennings að miðla þeim og að hann eigi ekki annan kost til að koma í veg fyrir þau brot eða þá háttsemi sem um ræðir.
4.  „Ámælisverð háttsemi“: Háttsemi sem stefnir almannahagsmunum í hættu, til dæmis hátterni sem ógnar heilsu eða öryggi fólks eða umhverfi, án þess að um sé að ræða augljóst brot á lögum eða reglum.
5. „Starfsmaður“: Sá sem hefur aðgang að upplýsingum eða gögnum um starfsemi Advania Ísland ehf. vegna hlutverks síns, þar með talið ráðinn, settur, skipaður, sjálfstætt starfandi verktaki, stjórnarformaður, starfsnemi, tímabundinn starfsmaður og sjálfboðaliði. Starfsmaður nýtur verndar samkvæmt lögum um uppljóstrara eftir að hlutverki hans lýkur.

Hvað er uppljóstrun

Hefur þú vitneskju um misferli, þ.e. lögbrot eða aðra ámælisverða háttsemi, í tengslum við starfsemi Advania Ísland ehf.? Gæti misferlið varðað almannahagsmuni? Ef svo er, þá geturðu notað innri uppljóstrunarkerfið okkar til að koma þessu misferli á framfæri.

Tilkynning í gegnum innri uppljóstrunarkerfið takmarkast við tilkynningar um misferli sem skynsamlega geta talist varða almannahagsmuni eins og skilgreint er hér að ofan. Það geta til dæmis verið upplýsingar um efnahagsbrot, spillingu, brot á starfsreglum eða tilvik um mismunun eða áreitni. Ef þú ert ekki viss um hvort upplýsingarnar sem þú vilt tilkynna varði almannahagsmuni hvetjum við þig til að tilkynna engu að síður.

Hver má tilkynna í gegnum innri uppljóstrunarkerfið?

Innri uppljóstrunarkerfið stendur öllum sem falla undir skilgreininguna á „starfsmanni“ hér að ofan til boða.

Aðrar leiðir til að koma áhyggjum á framfæri

Advania Ísland ehf. leitast við að tryggja öruggt vinnuumhverfi þar sem öllum á að líða vel með það að láta sína skoðun í ljós. Ef þú ert sátt/ur við að gera það, þá mælum við með því að þú komir áhyggjum á framfæri til þíns næsta yfirmanns, mannauðsdeild eða einhvern innan stjórnenda sem þú treystir. Hægt er að ná í mannauðsdeildina á mannaudsmal@advania.is eða +354 440 9000. Ef upplýsingarnar sem þú vilt koma á framfæri eru ekki þess eðlis að þær varði almannahagsmuni, þá er þetta leiðin sem þú ættir að nota. Slíkar upplýsingar geta til dæmis falið í sér tilvik um óánægju með launakjör eða samstarfsörðugleika við samstarfsmenn.

Innri uppljóstrunarkerfið

Hægt er að skila skriflegri tilkynningu til viðtakanda tilkynninga eins og skilgreint er hér að neðan í gegnum öruggt uppljóstrunarkerfi Advania Ísland ehf., sem WhistleB Whistleblowing Center AB (her eftir „WhistleB“) býður upp á. Einnig er heimilt að tilkynna til lögregluyfirvalda eða annarra opinberra eftirlitsaðila sem við eiga, til dæmis Vinnueftirlitsins.

WhistleB kerfið gerir fullkomlega nafnlausa tilkynningu mögulega í gegnum dulkóðað kerfi. Þú þarft ekki að veita neinar persónugreinanlegar upplýsingar en við hvetjum þig til þess til að auðvelda rannsókn á misferlinu. Hægt er að nálgast WhistleB kerfið á hér

Viðtakandi tilkynninga sem sendar eru í gegnum WhistleB er lögmannsstofan CMS Wistrand (hér eftir, CMS Wistrand“), sem hefur aðsetur í Stokkhólmi, Svíþjóð. Eftir að hafa fengið tilkynninguna mun CMS Wistrand framkvæma frummat, óháð Advania Ísland ehf. Ef tilkynningin telst falla undir gildissvið þessara reglna verður hún send öðrum tveggja tilnefndra rannsakenda innan Advania Ísland ehf. til frekari rannsóknar.

Upplýsingarnar sem þú ákveður að senda inn verða alltaf skjalfestar. Þegar þú sendir tilkynningu í gegnum uppljóstrar verður persónuauðkenni þitt ávallt verndað af þagnarskyldu. Hafið í huga að þagnarskylda kemur ekki í veg fyrir að viðtakandi tilkynninga fullnægi upplýsingaskyldu sinni samkvæmt lögum, öðrum reglum eða úrlausnum dóma.

Viðtakanda tilkynninga er skylt að stuðla að því að látið verði af eða brugðist við hinni ólögmætu eða ámælisverðu háttsemi, eða bregðast við aðstæðunum með öðrum viðeigandi hætti.

Eftir að hafa tilkynnt

Innan sjö eftir að þú hefur sent inn tilkynninguna munum við staðfesta að tilkynningin hafi borist, nema þú hafir hafnað slíkri staðfestingu. Innan þriggja mánaða frá því að þú sendir tilkynninguna færðu upplýsingar um eftirfylgni hennar. Skjalfesting gagnanna verður aðeins geymd eins lengi og nauðsynlegt er, þó ekki lengur en tveimur árum eftir að eftirfylgni tilkynningar þinnar er lokið.

Hvað á að koma fram í tilkynningu?

Við mælum með því að þú hafir eftirfarandi upplýsingar í tilkynningunni:

• Hverjar eru áhyggjur þínar?
• Hvenær gerðist atvikið?
• Hvar gerðist atvikið?
• Nánar um málið (lýstu því sem hefur gerst og ástæðu tilkynningarinnar)

Það er mikilvægt að þú lýsir öllum aðstæðum og staðreyndum varðandi málið, einnig þeim aðstæðum og staðreyndum sem þú telur að gætu skipt minna máli. Ef mögulegt er, vinsamlegast látið fylgja skjöl eða myndir.

Vernd uppljóstrara

Sú vernd sem kveðið er á um hér á eftir er háð þeim skilyrðum að starfsmaður uppfylli ákvæði laga um uppljóstrara og fylgi þeim málsmeðferðarreglum sem þar koma fram eins og nánar er greint frá í þessum reglum.

Verndin felur meðal annars í sér að:

• Miðlun upplýsinga telst hvorki brot á þagnar- eða trúnaðarskyldu sem starfsmaðurinn kann að vera bundinn af né heldur felur slík miðlun í sér refsi- eða skaðabótaábyrgð á viðkomandi og getur ekki leitt til stjórnsýsluviðurlaga eða íþyngjandi úrræða að starfsmannarétti.
• Óheimilt er að láta starfsmann sæta óréttlátri meðferð, en til slíkrar meðferðar telst til dæmis frávikning um stundarsakir, uppsögn, stöðulækkun, halda aftur af stöðuhækkun, tilfærsla á starfsskyldum, breyting á starfsstöð skerðing launa, breyttur vinnutími eða neikvætt frammistöðumat eða meðmæli. Tilvik um óréttláta meðferð getur í sjálfu sér verið misferli sem gæti verið tilkynnt í gegnum innra uppljóstrunarkerfið.
• Starfsmaðurinn getur átt rétt til skaðabóta sé hann látinn sæta óréttlátri meðferð, sbr. ofar.
• Komi til ágreinings fyrir dómi um stöðu starfsmanns skal honum veitt gjafsókn í héraði, fyrir Landsrétti og Hæstarétti.

Ytri uppljóstrunarkerfið

Almennt eru þrjú skilyrði fyrir ytri uppljóstrun. Í fyrsta lagi þarf miðlunin að vera í góðri trú (eins og skilgreint er hér að ofan). Í öðru lagi þarf starfsmaður að hafa réttmæta ástæðu til að ætla að um háttsemi sé að ræða sem getur varðað fangelsisrefsingu. Loks, verður starfsmaðurinn að jafnaði að hafa reynt innri uppljóstrun til þrauta.

Síðasta skilyrðinu má sleppa í algjörum undantekningartilvikum þegar innri uppljóstrun kemur af gildum ástæðum ekki til greina. Með því er átt við að miðlunin teljist í þágu svo brýnna almannahagsmuna að hagsmuni Advania Ísland ehf. eða annarra verða að víkja fyrir hagsmunum af því að upplýsingum sé miðlað til utanaðkomandi aðila. Slíkir hagsmunir eru til dæmis:

• Öryggi ríkisins eða hagsmuni ríkisins á sviði varnarmála;
• Efnahagslega mikilvæga hagsmuni ríkisins;
• Heilsu manna; og
• Umhverfið.

Frekari upplýsingar um uppljóstrun er að finna á heimasíðu Vinnueftirlitsins: www.vinnueftirlitid.is.

Persónuupplýsingar í uppljóstrunarkerfinu

Advania Ísland ehf. er ábyrgðaraðili persónuupplýsinga sem unnið er með í gegnum viðkomandi innri uppljóstrunarkerfi, til dæmis þegar tilkynningar berast, þær eru geymdar, rannsakaðar eða þeim eytt. Ef þú hefur einhverjar spurningar í tengslum við vinnslu okkar, vinsamlegast hafið samband á personuvernd@advania.is.

Vinnsla persónuupplýsinga í uppljóstrunarkerfinu byggir á lagaskyldu, sbr. 3. tölul. 1. mgr. 9. gr. laga um persónuvernd og vinnslu persónuupplýsinga nr. 90/2018 (hér eftir „lög um persónuvernd“). Tilgangur vinnslunnar er að uppgötva og koma í veg fyrir misferli sem tengjast viðskiptum Advania Ísland ehf.

Advania Ísland ehf. er heimilt að vinna persónuupplýsingar sem tengjast refsidómum og brotum á grundvelli 10. gr. laga um persónuvernd. Vinnsla viðkvæmra gagna byggir á 7. tölul. 1. mgr. 11. gr. sömu laga.

Vinnsla persónuupplýsinganna er aðallega framkvæmd af Advania Ísland ehf., WhistleB og CMS Wistrand. Ef tilkynning, sem lögð er fram í gegnum tilkynningarkerfið, varðar lögbrot er heimilt að afhenda upplýsingarnar til lögregluyfirvalda eða annarra viðeigandi yfirvalda.

Vinnsla persónuupplýsinga í gegnum innri uppljóstrunarkerfið verða unnar eins lengi og þörf er á, þó ekki lengur en í tvö ár eftir að eftirfylgni tilkynningar þinnar lýkur.

Samkvæmt lögum um persónuvernd hefur þú rétt á að biðja um að aðgangi að og leiðréttingu eða eyðingu persónuupplýsinga ásamt takmörkun á vinnslu. Þú hefur einnig rétt til að andmæla vinnslu og til gagnaflutnings. Vinsamlegast athugið að vegna þessa samhengis sem þessar persónuupplýsingar eru unnar í geta þessi réttindi verið takmörkuð vegna þess að upplýsingarnar falla undir trúnað.

Ef þú ert óánægð/ur með vinnslu okkar geturðu lagt fram kvörtun til Persónuverndar.

Persónuupplýsingum er fyrst og fremst safnað frá tilkynnanda. Hins vegar getur persónuupplýsingum einnig verið safnað frá öðrum aðilum meðan á rannsókn stendur.