Whistleblower policy

Background

Open, transparent, and safe to report

At ABC Labs, we strive to have an open and transparent workplace where malpractice does not occur. It is important to us that there is clear information on how to report confidentially and securely. In the event of suspicion of ongoing or previous malpractice, resources must be available to disclose them. By making it easy to report, we work together to promote the trust of employees, customers, and the general public in us.

Our cases are initially handled by Visslan to guarantee independent handling. Our Internal Contact Person(s) may come to handle the case after the Case Manager(s). See contact details under “Contact information for Case Manager(s).”

Definitions

Key terms used in this policy

• GDPR. The General Data Protection Regulation, a European regulation governing the processing of personal data and the free movement of such data within the European Union.
• The Whistleblower Directive. EU Directive 2019/1937 on the protection of persons reporting irregularities in Union law.
• Whistleblower Act. National implementation of the Whistleblower Directive in EU Member States.
• Visslan. The Whistle Compliance Solutions AB’s service Visslan, which enables digital reporting of misconduct: visslan.com.
• Misconduct. Acts or omissions that have emerged in a work-related context that there is a public interest in coming to light.
• Reporting. Written or verbal submission of information about misconduct.
• Internal reporting. Reporting of misconduct within a company in the private sector.
• External reporting. Reporting of misconduct to the competent authorities.
• Publication. Making information about misconduct available to the public.
• Reporting person. A person who reports or publishes information about misconduct acquired in connection with their work-related activities.
• Retaliation. Any direct or indirect act or omission in a work-related context caused by reporting or publication, which gives rise to (or may give rise to) unjustified injury to the reporting person.
• Follow-up. Any action taken by the Case Manager(s) to assess the accuracy of the allegations and, where appropriate, to address the reported infringement — including internal investigations, prosecutions, actions to recover funds, and closing the procedure.
• Feedback. Providing reporters (“whistleblowers”) with information on actions planned or taken as a follow-up, and on the grounds for such follow-up.

01 · Who can report?

Eligibility for protection

You can report and receive protection from the Whistleblower Act if you are an employee, volunteer, trainee, active shareholder, person who is otherwise available for work under our control and management, or part of our administrative, management, or supervisory body.

Contractors, subcontractors, and suppliers to us who have found out about malpractices within the company can also report. The fact that you have ended your work-related relationship with us, or that it has not yet begun, is not an obstacle to reporting malpractice or receiving protection for reporting malpractice externally.

02 · What can I report?

Reportable misconduct

In case of suspicion of possible misconduct, law or regulation violation, we urge you to report this to us as a whistleblowing case. When reporting, it is important that at the time of reporting you had reasonable grounds to believe the information was true. Whether you had reasonable grounds is assessed based on the circumstances and information available to you at that time.

In addition, it must actually be considered a violation that can be reported — only then does the report give you protection against retaliation.

2.1 — Malpractice in the public interest

You can report information about misconduct that has emerged in a work-related context that there is a public interest in coming to light. For other types of personal complaints without public interest — such as disputes or complaints regarding the workplace or work environment — we encourage you to contact your immediate manager, HR, or another suitable person instead.

Examples of malpractice of a serious nature that should be reported:

• Deliberately incorrect accounting, internal accounting control, or other financial crime.
• Incidence of theft, corruption, vandalism, fraud, embezzlement, or hacking.
• Serious environmental crimes or major deficiencies in workplace safety.
• Very serious forms of discrimination or harassment.
• Other serious misconduct affecting the life or health of individuals.

2.2 — Misconduct contrary to EU law

In addition, there is the possibility to report information about misconduct in a work-related context that is contrary to EU laws or regulations. If you suspect that this occurs, please read the scope of the Whistleblower Directive in Article 2 and Annex Part 1 for applicable laws.

03 · How do I report?

Reporting channels and process

3.1 — Written reporting

For written reporting we use Visslan, our digital whistleblowing channel. It is always available at abclabs.visslan-report.se. On the website, choose “report” to describe your suspected misconduct. Please describe what happened as thoroughly as possible so adequate measures can be applied. You may also attach evidence — written documents, pictures, or audio files — though this is not a requirement.

3.1.1 — Sensitive personal data

Please do not include sensitive personal information about people mentioned in your report unless it is necessary to describe your case. Sensitive personal data includes ethnic origin, political opinion, religious or philosophical beliefs, trade union membership, health, a person’s sexual life or sexual orientation, genetic data, and biometric data used to uniquely identify a person.

3.1.2 — Anonymity

You can be anonymous throughout the process without affecting your legal protection, but you also have the opportunity to share your identity under strict confidentiality. Anonymity can in some cases complicate the report’s follow-up possibilities and the measures we can take — in such cases we may later ask you to reveal your identity in strict confidentiality to the Case Manager(s).

3.1.3 — Follow-up and login

After reporting, you will receive a sixteen-digit code which you can use to log back in at abclabs.visslan-report.se. It is very important that you save this code — without it, you cannot access your report again. If you lose the code, you can submit a new report referencing the previous one.

Within seven days you will receive a confirmation that the Case Manager(s) has received your report. The Case Manager(s) is the independent and autonomous party that receives reports in the reporting channel — their contact information is in section 6 below. You and the Case Manager(s) can communicate through the platform’s built-in anonymous chat function.

You will receive feedback within three months on any measures planned or implemented due to the reporting. It is important that you log in regularly with your sixteen-digit code to answer any follow-up questions — in some cases the report cannot be taken forward without your answers.

3.2 — Verbal reporting

It is also possible to conduct a verbal report by uploading an audio file as an attachment when creating a report at abclabs.visslan-report.se. Select that you have evidence for the report and upload an audio file describing the same facts and details you would have included in a written case.

A physical meeting with the Case Manager(s) can be requested via Visslan — either in an existing report or by creating a new report asking for a physical meeting.

3.3 — External reporting

We urge you to always report malpractice internally first, but in the event of difficulties (or if internal reporting yields no results), it is possible to conduct external reporting instead. We refer you to contact the competent authorities or, where applicable, to EU institutions, bodies, or agencies.

04 · What are my rights?

Protections during and after reporting

4.1 — Right to confidentiality

During the handling of the report, your identity as a reporting person is treated confidentially and access to the case is prevented for unauthorized personnel (i.e., outside the Case Manager(s)). We will not disclose your identity without your consent unless applicable law compels us to, and we will ensure that you are not subjected to retaliation.

4.2 — Protection against reprisals or retaliation

In the event of a report there is protection against negative consequences in the form of a ban on reprisals and retaliation. The protection also applies, where relevant, to persons in the workplace who assist the reporting person, your colleagues and relatives in the workplace, and legal entities you own, work for, or are otherwise related to.

This means threats of retaliation and attempts at retaliation are not permitted. Examples include being fired, forced to change tasks, having disciplinary measures imposed, being threatened, discriminated against, or blacklisted in your industry due to reporting.

Even if you were identified and subjected to reprisals, you would still be covered by the protection as long as you had reasonable grounds to believe the misconduct reported was true and within the scope of the Whistleblower Act. Protection is not obtained if it is a crime in itself to acquire or have access to the information reported.

The protection against retaliation also applies in legal proceedings — including defamation, copyright infringement, breach of confidentiality, breach of data protection rules, disclosure of trade secrets, or claims for damages — and you shall not be held liable as a consequence of reports or disclosures, provided you had reasonable grounds to believe it was necessary to report or publish such information to expose misconduct.

4.3 — Publication of information

The protection also applies to the publication of information. It is then assumed you have reported internally within the company and externally to a government authority, or directly externally, and no appropriate action has been taken within three months (in justified cases six months). Protection also applies when you had reasonable grounds to believe there may be an obvious danger to the public interest if not made public — for example in an emergency. The same applies when there is a risk of retaliation in external reporting, or it is unlikely the misconduct will be remedied effectively (e.g., evidence may be concealed or destroyed).

4.4 — Right to review meeting documentation

If you have requested a meeting with the Case Manager(s), they will, with your consent, ensure complete and correct documentation of the meeting is preserved in a lasting and accessible form — for example by recording the conversation or keeping minutes. Afterwards, you will have the opportunity to check, correct, and approve the protocol by signing it.

We recommend that this documentation is kept on Visslan’s platform by the whistleblower creating a case where the information can be collected securely, with the option to communicate securely.

05 · GDPR and handling of personal data

How we protect your data

We always do our utmost to protect you and your personal information. We therefore ensure that our handling is always in accordance with the General Data Protection Regulation (“GDPR”).

All personal data without relevance to the case will be deleted, and the case will only be saved for as long as it is necessary and proportionate to do so. The longest a case will be processed is two years after its conclusion. For more information about our handling of personal data, see our Privacy Policy.

06 · Additional contact

Get in touch

If you have further questions about how we handle whistleblower cases, you are always welcome to contact the Case Manager(s). For technical questions about Visslan’s platform, please create a case at abclabs.visslan-report.se. If this is not possible, contact Visslan directly using the details below.

6.1 — Case Manager(s)

Internal Contact Persons

The Internal Contact Person(s) may take over the case from the Case Manager(s), regardless of whether the case is deemed to be a whistleblowing matter or, for example, a personnel matter.

6.2 — Visslan support