1. Purpose and scope

Adverity GmbH and its affiliated companies (collectively “Adverity”) are dedicated to maintaining the highest levels of corporate governance, integrity, and accountability in the conduct of business activities. Nonetheless, situations may arise in which Adverity's core values are either ignored completely or are not given sufficient consideration. Adverity has developed this Speak Up Policy ("Policy") to demonstrate its commitment to open and responsible management. Reporting persons can utilize it to report identified or suspected breaches without fear of retaliation.

This Policy establishes standards and procedures to ensure that all complaints and reports of misconduct are dealt with promptly and thoroughly, in accordance with Adverity's policies, procedures and applicable laws and regulations, while maintaining the highest levels of confidentiality, objectivity, and fairness.

This Policy applies to all current and former Adverity’s directors, officers, employees, contractors, consultants, shareholders, secondees, agents, interns, job applicants, business partners, suppliers (or their employee or subcontractor) and others who should be protected under the EU Whistleblower Directive and the corresponding national legislation under the EU Whistleblower Directive and the relevant laws of the countries where Adverity Group Companies are incorporated, under the condition that Adverity Group Companies fall under the scope of the relevant national legislation. It also applies to any natural persons in the vicinity of the Reporting person.

2. Definitions and abbreviations

• “Adverity Group Companies” means any of Adverity GmbH’s 100% subsidiaries.

• “EU Whistleblower Directive” means the “Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union Law”.
• “Report” or “to report’ means the oral or written communication of information on reportable concerns as described in section 3. of this Policy.
• “Reporting person” means a natural person who reports or publicly discloses information on reportable concerns acquired in the context of their work-related activities.
• “Retaliation” means any direct or indirect act or omission which occurs in a work-related context, is prompted by reporting, and which causes or may cause unjustified detriment to the Reporting person

  or to any natural person in the vicinity of the Reporting person.

3. Reportable concerns

Persons that have reason to believe that they have become aware of any behavior covered by this Policy shall promptly notify Adverity via internal reporting channels, as outlined in section 4. below.

Examples of reportable concerns which are determined by law include:

• public procurement;
• financial services, products and markets, and prevention of money laundering and terrorist financing;

• product safety and compliance;

• transport safety;
• protection of the environment;
• radiation protection and nuclear safety;
• food and feed safety, animal health and welfare;
• public health;
• consumer protection;
• protection of privacy and personal data, and security of network and information systems;
• prevention and punishment of criminal offenses such as: prohibited intervention, corruption and bribery of public officials (regulated in §§ 302 bis 309 Austrian Criminal Code);

Examples of additional reportable concerns include:

• any indication of bribery, fraud or corruption; breaches of competition laws; breaches of applicable data protection laws; harassment, retaliation, or discrimination; health and safety risks; sexual, physical or other abuse; conflicts of interest; misuse of company assets; insider trading; questionable accounting practices, suspicious of fraudulent financial information; fabrication, concealment or destruction of business or financial records without authorization;
  
  
• other reportable breaches as outlined in the EU Whistleblower Directive and the applicable national legislation of the countries where Adverity Group Companies are incorporated under the condition that Adverity Group Companies fall under the scope of the relevant national legislation.

Reporting persons are protected if they provide information that reveals breaches that have already occurred, breaches that have not yet occurred but are very likely to occur, acts or omissions that the Reporting person has reasonable grounds to believe are breaches, and attempts to conceal breaches. Persons who voice reasonable worries or suspicions but do not give positive evidence are likewise protected.

It should be highlighted that a specific concern, such as a personal work-related grievance, may be better addressed through another channel. A personal work-related grievance is a disclosure of activity that has personal consequences for the discloser but has no substantial implications for Adverity. Personal work-related grievances should be raised with an Adverity line manager or Adverity’s People department.

4. Raising a concern

Adverity provides confidential internal channels for people to report the reportable concerns as described in section 3. above. The following internal reporting channels have been established by Adverity:

• Report through Adverity’s Speak Up Helpline. This portal may be accessed via speakupadverity.whistlelink.com and is open to all Adverity’s team members as well as to third parties such as customers, vendors, and other external partners. Reporting parties may report issues at any time via the portal by filling out the web intake form (anonymous reporting is possible) available 24 hours a day, 365 days a year.

Reports should contain information answering at least the following questions:

• What happened?
• When did it happen?
• Who was or is involved?
• Where did it happen?

Reporting persons are strongly encouraged to not include in a report any names or other personal data which are not relevant to the report. The reporting person may choose to remain anonymous when reporting via Adverity's Speak Up Helpline.

Concerns raised via Adverity’s Speak Up Helpline will be passed to the Adverity’s authorized investigator. Reports should be given in good faith and with the best of intentions. As stated in section 9. below, it is prohibited to willfully report inaccurate or incorrect information. 

5. Investigation and possible outcomes

All investigations shall be carried out in a fair, independent, and timely manner, with all reasonable efforts taken to maintain confidentiality throughout the process. 

Concerns will be investigated by the Adverity’s authorized investigator as quickly as possible. The seriousness and complexity of a complaint may have an influence on the amount of time it takes to investigate it. The authorized investigator will acknowledge receipt of a report to the Reporting person within seven days of receipt of a report. A meeting with the investigator and the Reporting person will be granted within 14 calendar days on request of the Reporting person.  Adverity will diligently investigate each reported concern and provide verbal, written, or in-person feedback to the Reporting person within three months of receipt of the report.

Feedback to the Reporting person shall include:

• the action planned or taken following the report; and
• the grounds for the action planned or taken; and
• the grounds if and why a report is closed.

In all situations, the Reporting person's chosen means of communication should be used to keep them updated on the investigation's progress and results. During the investigation, the investigator may ask the Reporting person to provide further information about the concern, but the Reporting person is under no obligation to provide such information. The individual who has been accused of any wrongdoing will also be informed of the concerns and given the opportunity to respond (unless there are any restrictions or other reasonable bases for not doing so).

To the extent permitted by law, the investigator will inform the Reporting person and/or a person against whom accusations have been made of the findings. Adverity will document the findings in a report, but any report will be Adverity's property and will only be shared with the Reporting person or any person accused of wrongdoing, if Adverity deems it appropriate. Any information about the investigation should be treated as confidential by the Reporting person.

The investigation's findings might lead to:

• referral to other channels or procedures if the report only affects the Reporting person;
• referral to relevant authority;
• closure of the report based on lack of sufficient evidence or other grounds;
• further internal measures to be taken based on the conducted internal investigation; or
• findings from an internal investigation and remedial measures.

6. Confidentiality and anonymity

Within the limits set by relevant laws and regulations, Adverity takes great care to preserve the identity of the individual voicing a concern, as well as the confidentiality of the report. The identity of a person who raises a concern, the identity of those who are affected by the report, and any documents shared in connection with it will be kept strictly confidential and will not be shared with third parties unless Adverity is required by applicable law or regulation to do so.

Adverity will treat all reports as either confidential or anonymous to ensure the safety of individuals reporting concerns, unless there is a legal obligation for Adverity to disclose such information. The decision to submit a concern in an anonymous manner is completely up to the person who is reporting it.

Information on the identity of the person who raised a concern, the reported conduct and the investigation process or outcomes should only be shared with those who have a legitimate need to know, or unless required by applicable law or regulation.

Adverity will additionally take the following steps to safeguard the identity of the Reporting person:

• all disclosure-related documents will be kept in a safe location;
• only personnel directly involved in managing and investigating the disclosure will have access to all information;
• the identity of the Reporting person or information that is likely to lead to the identification will only be disclosed to a restricted number of personnel who are directly involved in handling and investigating a concern;
• communications and documents about the investigation will not be transmitted to an email address accessible to employees not directly involved in handling and investigating a concern; and
• the confidentiality obligations will be reiterated to everyone engaged in handling and investigating a concern.

7. No retaliation

Adverity will not tolerate retribution, harassment, or other negative repercussions, either directly or indirectly, by management or any other person or entity, against anyone who, in good faith, disclosed a compliance concern or known or potential misbehavior, or participates in a review or investigation of the same. Retaliation includes but is not limited to: suspension, lay-off, dismissal, demotion or withholding of promotion, transfer of duties, change of location of place of work, reduction in wages, change in working hours, withholding of training, negative performance assessment or employment reference, imposition or administering of any disciplinary measure, reprimand or other penalty, coercion, intimidation, harassment, ostracism, discrimination, disadvantageous or unfair treatment, failure to convert a temporary contract into a permanent one, failure to renew a temporary employment contract, harm (including to the person’s reputation, particularly in social media), loss of business, loss of income, early termination or cancellation of a contract for goods or services, cancellation of a licence or permit.

Any person found to have retaliated against another for making a report or participating in good faith in an investigation will face disciplinary action as necessary, which may include termination of employment for Adverity’s employees, and termination of the engagement or contractual arrangements or other appropriate action in the case of third parties.

8. Disclosing concerns externally

Adverity strongly encourages individuals to report concerns mentioned in section 3. via the internal reporting channel as outlined in section 4. above. In most cases individuals should not find it necessary to notify anyone externally. However, the law acknowledges that it may be appropriate under certain circumstances for individuals to disclose concerns which are determined by law (mentioned in the first paragraph in section 3.) to an external body, such as a competent external reporting authority. In Austria, the competent authority for external reporting is The Federal Office for the Prevention of and Fight against Corruption (Das Bundesamt zur Korruptionsprävention und Korruptionsbekämpfung) with address at Herrengasse 7, 1010 Vienna.

9. Malicious report

To be protected, the Reporting person must make reports in good faith. No action will be taken against someone who makes a genuine accusation in good faith, even if it is not confirmed by a subsequent investigation. It's crucial for anyone considering bringing claims to make sure they're honest. When a report is made primarily for some other improper motive, it may not be considered in good faith. Anyone who uses this Policy to make malicious accusations that they know are false will not be protected by it and could face disciplinary action.

10. Retention

Adverity will store reports for no longer than is necessary and proportionate in order to comply with the requirements imposed by applicable laws.

11. Contact

For any questions about or in connection to this Policy you can contact Adverity’s Legal & Compliance department (compliance@adverity.com).

 

Reviewed and approved in the compliance management tool.

Document Information
Document Owner	Deputy Head of Legal & Compliance
Version	V3.0
Date of Version	2023-10-03