Norican Group Whistleblowing Policy
Norican is committed to conducting its business with honesty, integrity and professionalism, and we expect all employees to maintain high standards in line with Norican policies and procedures.
This commitment is enshrined within the Norican Code of Conduct (the “Code”), which also encourages people to “speak up” and report potential, suspected or actual violations of the Code, Norican’s policies and/or any laws and regulations that govern Norican’s operations.
If you see or suspect an action is not in line with the Code, you have a responsibility to speak up. We know that speaking up takes courage, and we commit to taking any concern seriously and sensitively, and investigating where appropriate.
Speaking up contributes to maintaining a culture of integrity and doing the right thing. All managers are responsible for creating a culture of open dialogue, and honest communication with their direct reports. DEVELOPING employee talent, and RESPECTING diversity and teamwork are two of our Values. We can only adhere to these Values if all of us feel comfortable in speaking up.
This Policy contains Norican global standards. In some jurisdictions, more stringent applicable laws and regulations may supersede the principles set out in this Policy.
Anybody who wishes to speak up can be assured that they can do so without fear of victimisation, retaliation, harassment or discipline. This Policy will also assure anyone against whom a report is made that the details and their identity will be kept confidential until such time as it may be appropriate for such details to be disclosed.
What is Whistleblowing?
Whistleblowing is the disclosure of information which relates to suspected wrongdoing.
This may include, but is not limited to:
• Breach of the Norican Code of Conduct
• Failure to comply with a legal obligation
• Money laundering
• Fraud or corruption
• Unauthorised disclosure of information
• Conflict of interests
• Racial, sexual, disability or other discrimination
• Financial malpractice, impropriety or fraud
• Practices endangering health and safety
• Other unethical, improper and/or illegal conduct
Out of scope
Employees should contact their line manager for issues relating to dissatisfaction in the workplace, as these issues cannot be investigated through the whistleblowing service.
If you are unsure whether something falls under the scope of this Policy, please contact the Norican Group General Counsel.
This Policy applies to all Norican employees, contract workers, officers and directors (“Employees”).
It also applies to suppliers, customers, representatives, distributors, agents, or any other third party who acts on behalf of, or for the benefit of Norican (“Third Parties). Norican will only engage Third Parties who uphold Norican’s Values and the principles of this Policy.
Speaking up – what to do.
There are 2 ways which you can report your concern:
Step 1
Norican has an open-door policy and encourages colleagues to share their concerns, suggestions or complaints with their line manager, HR representative, or General Counsel in the first instance. This may be done either verbally or in writing. It may be possible to agree a way of resolving the concern quickly and effectively.
Step 2
If you are not comfortable speaking with your line manager or other representatives mentioned in Step 1, or you are not satisfied with your line manager’s response, you are encouraged to report a concern through Norican’s whistleblowing online service at https://report.whistleb.com/noricangroup.
The Norican whistleblowing hotline is provided and maintained by WhistleB, an external service provider, and is available 24 hours a day, 7 days a week. You may submit an online report in the language of your choice. The service allows a report to be made anonymously.
All messages are encrypted in the whistleblowing hotline. To ensure the anonymity of the person sending a message, WhistleB deletes all meta data, including IP addresses. The person sending the report also remains anonymous in the subsequent dialogue with the Norican report investigator.
The way in which the investigation is processed will be the same regardless of how you report your concerns.
What happens next - handling of reported violations
The person who you raise the concern to, will listen to and consider your concern carefully and determine whether any action is needed. This may mean reporting it to a more senior members of staff or to the General Counsel.
If a person raises a concern directly to a supervisor, manager or the General Counsel in person, the message is treated according to this Policy.
The whistleblowing team within Norican
When a report is made through the whistleblowing hotline, access to messages is restricted to appointed individuals with the authority to handle whistleblowing cases. Their actions are logged and handled confidentially. When needed, individuals who can add expertise may be included in the investigation process. These people can access relevant data and are also bound by confidentiality.
Receiving a message
Upon receiving a report, the whistleblowing team decides whether to accept or decline the report. If the report is accepted, appropriate measures for investigation will be taken.
The whistleblowing team may decline a report if:
• the alleged conduct is not reportable conduct under this Whistleblowing Policy.
• the message has not been made in good faith or is malicious.
• there is insufficient information to allow for further investigation.
If a message includes issues not covered by the scope of this Whistleblowing Policy, the whistleblowing team will take appropriate actions to get the issue solved.
The whistleblowing team will send appropriate feedback within 3 months from the date of receiving the report.
A person making a report should not include sensitive personal information about anybody mentioned in the report if it is not necessary to do so.
Investigation
All reports are treated seriously and in accordance with this Whistleblowing Policy.
• No one from the whistleblowing team, or anyone taking part in the investigation process, will attempt to identify the whistleblower.
• The whistleblowing team can, when needed, submit followup questions via the channel for anonymous communication.
• A report will not be investigated by anyone who may be involved with or connected to the misgiving.
• The whistleblowing team decides if and how a whistleblowing message should be escalated.
• Whistleblowing reports are handled confidentially by the parties involved.
Confidentiality
Any report made under this Policy will be handled promptly, sensitively and seriously and treated as far as reasonably practicable in a confidential manner. Investigation into the report will be handled by persons with the appropriate level of seniority and expertise.
If confidentiality is not reasonably practicable, for instance, because of the nature of the information, this will be explained to the reporter and Norican will seek to address any questions or concerns.
The person making a report is expected to keep confidential the fact he/she has reported an alleged breach, the nature of and details associated with the alleged breach, and the identity of all entities and persons referenced in the report.
The identity of any person against whom a report has been made will also be handled sensitively, seriously and confidentially until such time as the report is judged to be well-founded and it is appropriate for the authorities and/or such person(s) to be notified.
Where the law permits, a report may be made anonymously. However, concerns expressed anonymously cannot be dealt with as effectively as open disclosures as they are often more difficult to investigate, and so we encourage all reporters to be open with their identity.
No retaliation
Norican will not tolerate any form of retaliation against anyone who makes a report, raises a concern or helps with an investigation in the reasonable belief there has been a violation of the law, or the Norican Code of Conduct, provided that the report is made in good faith.
Reporting in good faith means providing all the information you have with the belief that such information is true, regardless of whether it later turns out to be mistaken.
Any person who makes a report in compliance with the provisions of this Policy, shall be protected against any acts of retaliation, harassment, victimisation or any other detrimental treatment.
Where employees consider that they have been the victim of retaliation for reporting a violation, or have good reason to believe or fear that they are exposed to a risk of retaliation as a result of reporting a violation, they must notify their line manager, an HR representative or the General Counsel. Anyone involved in any retaliation may be subject to disciplinary actions, including dismissal.
A person who makes a malicious report, or makes a report in bad faith based on false or misleading information, shall not be protected and may be subject to disciplinary or legal actions.
Breach of Policy
Breaches of this Policy and of laws applicable to the protection of whistle-blowers will not be tolerated and may lead to disciplinary action including dismissal.
Personal data
Processing of Personal Data:
This whistleblowing service may collect personal data on the person specified in a message, the person submitting the message (if not sent anonymously) and any third person involved, in order to investigate facts on the declared misdeeds and inappropriate behaviour eligible under our Code. This processing is based on the legitimate interest to prevent reputational risks and to promote an ethical business activity.
The provided description and facts under this processing are only reserved to the competent and authorized persons who handles this information confidentially. You may exercise your rights of access, of rectification and of opposition, as well as of limited processing of your personal data in accordance with the local data protection legislation. These rights are subject to any overriding safeguarding measures required to prevent the destruction of evidence or other obstructions to the processing and investigation of the case.
For any further questions or complaints please address your request to the Norican Group General Counsel.
Deletion of Data:
Personal data included in whistleblowing messages and investigation documentation is deleted when the investigation is complete, with the exception of when personal data must be maintained according to other applicable laws. Permanent deletion is carried out 30 days after completion of the investigation. Investigation documentation and whistle-blower messages that are archived should be anonymised under GDPR; they should not include personal data through which persons can be directly or indirectly identified.
Person Data Controller:
Norican Global A/S, responsible for the personal data processed within the whistleblowing service.
Personal Data Processor:
WhistleB Whistleblowing Centre Ab (World Trade Centre, Klarabergsviadukten 70, SE-107 24 Stockholm) responsible for the whistleblowing application, including processing of encrypted data, such as whistleblowing messages. Neither WhistleB nor any sub-suppliers can decrypt and read messages. As such, neither WhistleB nor its sub-processors have access to readable content.
Who to contact?
If you have any questions about this Policy or need further guidance please contact the General Counsel at general.counsel@noricangroup.com.
