Latsco Whistleblowing Policy

1. INTRODUCTION

In line with our Code of Conduct and Ethics, the Whistleblowing Policy (the “Policy”) sets the framework through which companies of Latsco’s ecosystem (“Latsco” or “the Company”), handle reports for irregularities, omissions or offences in the conduct of Latsco’s business or breaches of the internal policies. This Policy is in compliance with the applicable national and international whistleblower protection legislation.

This Policy applies to our employees (irrespectively of their working relationship with the Company), as well as to customers, contractors, suppliers, or other stakeholders associated with Latsco in any way, who may report a violation of the law (collectively the “Whistleblower(s)”).

Our employees are encouraged to primarily report day-to-day issues or potential violations of the Code of Conduct and Ethics through the regular reporting channels under the Code of Conduct and Ethics (i.e., their direct / line manager, HR Department or the CEO). At Latsco, we aspire to ensure the highest level of safety, trust, and transparency for all our people. The Company will ensure that all reports are taken seriously, treated in confidence and will proceed with the appropriate investigation and corrective actions as required. All individuals who raise a concern in good faith are protected from any form of retaliation as a result of such disclosure. This Policy will contribute to the early identification of risks and to the timely adoption of the appropriate response where needed.

2. WHAT TO REPORT

Reports shall be submitted in good faith and upon reasonable belief of actual or potential illegal actions, offenses and breaches of the legislation, or of the Code of Conduct and Ethics, or of other internal policies and procedures. Cases that could be reported by Whistleblowers may refer to:

• Bribery
• Corruption
• Environmental protection
• Fraud
• Money laundering
• Procurement fraud
• Protection of personal data
• Terrorism
• Theft
• Violations of EU law

3. HOW TO MAKE A REPORT

To make a report, you can access the Latsco whistleblowing system which is available 24 hours a day/seven days a week:
https://whistleblowersoftware.com/secure/

Your report will be handled through the dedicated system, which is hosted by an external provider and operated in a secure manner, with the highest technical standards, that ensure confidentiality and prevent access to unauthorized parties.

Latsco is committed to the principle of accountability and thus we encourage anybody who wishes to share its concerns in good faith to be open with its identity, although anonymous reports are not forbidden in principle. Please do bear in mind that, with an anonymous report, it might be more difficult to establish a case, collect information and perform the much-needed follow-ups.

After the report’s submission, the Whistleblower will receive a personal password that should be kept securely. The Whistleblower will use it to log into the channel, edit or supplement its report through the system directly, read any feedback or follow-up on questions and reply to them. The Whistleblower may also choose to revoke the report from the system at any time. The Whistleblower may also, optionally, provide its email address. The only use of the email address is to notify the Whistleblower when relevant changes to its case are made, such as receiving a message or if the status of the case is updated. If the Whistleblower chooses not to enter an email address, it must check its case regularly for updates and messages to help in resolving the issue.

To help us effectively address every report, Whistleblowers are requested to provide information, facts, evidence, and any other known detail about the events reported in the most concrete manner possible, to facilitate the assessment and investigation. Lack of information could be the reason for deciding not to proceed with an Investigation and/or to conclude the case on the ground of no factual basis or that the report is otherwise unfounded.

4. POSSIBLE OUTCOMES

A Whistleblowing team will investigate the report, guaranteeing the avoidance of any conflict of interest. Upon completion of the case investigation, or if the report has been found inadmissible before the investigation, the Whistleblower will be informed of the decision taken on its report. Feedback to the Whistleblower will be provided no later than three (3) months from the acknowledgement of receipt of its report. If the investigation is still ongoing by the end of the above-mentioned three-month period, the Whistleblower must be informed on the progress of the investigation process.

In case the Whistleblowing team does not find allegations against the Reported person(s) having legitimate grounds, it may close the case with a reasonable justification. In case the allegations are valid, the Whistleblowing team shall propose measures/actions. Appropriate remedial action may vary from informal warnings, formal warnings to the suspension or termination of contractual relationship in serious violations. In any case, the Company reserves all its legal rights to pursue legal claims and proceed with judiciary remedies in cases the Company has in any way incurred damage from the acts or omissions of the Reported Person.

5. PERSONAL DATA PROTECTION

Since the filing of a report, the Whistleblowing team anticipates acquiring personal data, which may come from the report itself or from subsequent communications with the Whistleblower.

Any personal data are protected and processed solely in the context of preventing, detecting or investigating irregular, unethical, illegal or criminal conduct, always in accordance with relevant national and European legal framework at the time applicable for the protection of personal data and in compliance with the internal Privacy Policy.

It is strongly recommended that Whistleblowers refrain from including special categories of personal data about themselves or the Reported person(s) unless such inclusion is essential to support the allegation. Special categories of personal data encompass information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health-related information, or details about a person's sex life or sexual orientation.

Legal bases & Lawful Purpose of processing

If the report is covered by the scope of Greek Law 4990/2022, the legal basis for the processing of any categories of personal data with regards to that report is:

a) art.15 of the said Law and the legal obligation of Latsco to comply with the said legislation and

b) in other cases, the processing of personal data in respect of any potential/actual violation is based on Latsco’s legitimate interest to investigate a relevant matter according to art. 6(1)(f) of the GDPR.

If in exceptional cases, special categories of personal data are processed, the legal basis for the processing of such personal data will be Article 9(2)(f) or (g) of the GDPR, depending on the case.

Recipients of personal data

The personal data within a report may be shared for investigative purposes only with persons involved in the management and investigation of the report and only on a need-to-know basis.

If corrective measures shall apply, personal data may also be shared with the pertinent entities within the Latsco ecosystem, public authorities, judicial or administrative. Such disclosure will be executed in accordance with the relevant data protection legal framework.

In case personal data are transferred to a Latsco ecosystem entity outside the EEA, the Company ensures that the said transfer will be in compliance with the GDPR.

Retention of records & Reporting

Reports, investigation reports and relevant documentation thereof will be retained as long as it is necessary and proportionate for the purpose of investigating a certain report and providing feedback, of for the purpose of complying with the appropriate legislation, and to support potential legal claims and judicial proceedings.

Once the necessary and proportionate period has passed and the above-mentioned purposes are no longer served, personal data collected regarding the said report will be deleted or permanently anonymized within sixty (60) days. This will be the case also if a report does not fall under the scope of this Policy or obviously unfounded.

Technical Measures & Data subject rights

Latsco has taken all necessary and adequate technical and organizational measures to protect the personal data of Whistleblowers (including its anonymity) and other persons contained in the relevant reports. Any messages or information shared via the system are also encrypted and access to the system on both sides is password-protected.

If a Whistleblower wishes to exercise any of its rights under the applicable data protection legal framework, it shall contact the Data Protection Officer (email: dpo@latsco.com)