WHISTLEBLOWING

The form is intended for reporting breaches of the law, i.e., actions or omissions that are contrary to the law or seek to circumvent the law, at DCG S.A. (“Company”) concerning the following:

• corruption;

• public procurement;

• financial markets, products and services;

• prevention of money laundering and terrorist financing;

• product safety and compliance;

• transport safety;

• environmental protection

• radiological protection and nuclear safety;

• food and fodder safety;

• animal health and welfare;

• public health;

• consumer protection;

• privacy protection and personal data;

• security of ICT systems and networks;

• financial interests of the State Treasury of the Republic of Poland, a local self-government body or the European Union;

• internal market of the European Union, including institutional rules of competition

• and state aid and taxation of legal persons;

• constitutional human and citizen freedoms and rights – existing in relations of the individual with public authorities and unrelated to the above-mentioned areas;

• breaches of the Act on Combating Money Laundering; and

• breaches within the meaning of Article 97d of the Public Offering Act, i.e., breaches of the law, including, in particular, the provisions of the Public Offering Act and Regulation 2017/1129, internal procedures (standards) and ethical standards.

The form was introduced based on the Whistleblowing Procedure of the VRG Group. The form is intended for Whistleblowers who make an internal report, i.e., natural persons disclosing information about a breach of the law obtained in a work-related context. Whistleblowers may include:

• employees, including temporary employees, also after the end of the employment relationship;

• persons providing work on a basis other than an employment relationship, including civil law agreements;

• entrepreneurs, proxies, shareholders, partners or members of bodies of legal persons or unincorporated entities;

• persons working under the supervision and management of a contractor, subcontractor or supplier;

• interns, volunteers or trainees;

• officers or soldiers;

• natural persons before the commencement of employment or another legal relationship forming the basis for the provision of work or services or the performance of functions at or for the Company, also after the end of such a relationship.

GDPR Privacy Notice for the Whistleblower:

The Controller of your personal data is the Company, i.e., DCG S.A., with its registered office in Warsaw, contact details: ul. Bystrzycka 81a, 04-907 Warszawa (“Controller”).

Please be advised as follows:

• 1. Providing your personal data is voluntary, and the report can be made anonymously.

• 2. Your personal data will be processed for purposes connected with the reported breaches of the law, based on the following:

  1. a legal obligation arising from Directive (EU) 2019/1937 of 21/11/2019 (according to Article 6(c) of the GDPR);
  2. a legitimate interest of the Controller, i.e., to receive, verify and clarify reports of breaches of the law (according to Article 6(1)(f) of the GDPR);
  3. or voluntary consent if you do not choose to remain anonymous (according to Article 6(1)(a) of the GDPR).

• 3. You may withdraw your consent at any time. The withdrawal of your consent will not affect the lawfulness of any processing done based on the consent before its withdrawal.

• 4. Your personal data will be processed for 3 years after the end of the calendar year in which the external report was submitted to the public authority competent to take follow-up action or after the end of the proceedings initiated by such action.

• 5. The Controller ensures the confidentiality of your data in connection with the received breach. Consequently, the data may be provided only to persons authorised by the Controller, parties competent to receive them under the law and parties the Controller has entrusted with data processing, e.g., a law firm.

• 6. Your personal data will not be processed by automated means or transferred to third parties.

• 7. You have the right to request access your data, request that they be erased or rectified or that their processing be restricted, the right to data portability and the right to lodge a complaint with the President of the Personal Data Protection Office.

A Data Protection Officer has been appointed; to contact the Data Protection Officer, send an e-mail to: rodo@denicler.eu