Internal whistleblowing system

FOREWORD

Applicable texts

Law no. 2016-1691 of December 9, 2016 on transparency, the fight against corruption and the modernization of economic life, known as the “Sapin 2 Law“, notably created the obligation for French companies with at least fifty employees to set up an appropriate procedure for collecting reports issued by members of their staff or by occasional outside collaborators.

This law is a transposition of the 4th European anti-money laundering and anti-corruption directive of May 20, 2015.

European Directive n°2019/1937 of October 23, 2019 has improved the protection of whistleblowers.

Scope of application

This policy applies to PILOT CORPORATION OF EUROPE and all of its French and foreign subsidiaries and branches (together the “PILOT Group“), subject to any specific provisions that may apply to foreign subsidiaries and branches, as well as to local regulations or procedures.

The PILOT Group promotes compliance with applicable laws and regulations, in particular those set out in its Code of Ethics.

All PILOT Group entities are invited to adopt this internal whistleblowing system. It will then be appended to their internal regulations after consultation with the IRP and distributed internally to all employees, by any means (posting, mailing, intranet, etc.).

In an effort to continually improve processes and so as to prevent or limit the risks to which a PILOT Group’s entities and/or one of its employees might be subject, employees, contractual partners, partners or stakeholders who so desire may use the professional report system set up by the PILOT Group (referred to as the “Internal Whistleblowing System”) to report any potential or actual breach of these rules.

This policy therefore applies to all such persons and covers all reports made through internal channels, whether via the dedicated page on the PILOT Group website or to authorized internal persons, as defined in point 3 and illustrated below (see Internal reporting procedure).

The three statutory reporting channels

Whistleblowers have three distinct channels for reporting incidents, all of which are protected by law:

Internal reporting: the whistleblower chooses to report the alert internally via one of the channels provided by the Pilot internal alert system.
External reporting: the whistleblower may send his or her report to any competent authority, or with the French government’s rights defender program, the judicial authority or any competent European Union body. External whistleblowing can take place either after internal whistleblowing, or directly when the whistleblower considers that it is not possible to remedy the situation effectively through internal whistleblowing, or when he or she is expose to the risk of reprisal.
Public disclosure: The whistleblower can finally make the report public under certain specific conditions:

after an external reporting, and to the extent that such reporting did not give rise to any appropriate measures in the time allotted; or
in the case of serious and imminent danger; or
when referring the matter to the competent authority would expose the whistleblower to the risk of reprisal or would not effectively remedy the situation, because of the specific circumstances of the case.

The Internal Whistleblowing System that is hereby implemented relates exclusively to the internal reporting as indicated in (i) above.

How the Internal Whistleblowing System works

If you are confronted with or witness :

Failure to comply with the PILOT Group’s Code of Ethics, internal policies or procedures;
A felony or misdemeanor ;
Violation (or attempted concealment of a violation) of an international commitment, a unilateral act of an international organization, European Union law, law or regulation;
Violations of human rights and fundamental freedoms, human health and safety, and the environment;
A threat or harm to the general interest.

And that you are unable to find answers to your questions through the usual channels.

You can choose between :

Refer to the Ethics Officer: responsable.ethique@piloteurope.com or ethics@piloteurope.com If you wish to remain anonymous, use a generic email address and preferably not a company computer.
Use the dedicated electronic channel: · It will be sent to you by return email upon request to the Ethics Officer · Available on the HR Intranet / Regulatory / Whistleblowing System. · Available on the website of Pilot Corporation of Europe. : www.pilotpen.eu https://www.ethicorp.com/pilot

The report must : · Be issued in good faith and without direct financial consideration by a natural person; · Be based on information of which you have personal knowledge if obtained outside a professional context; · Describe the facts objectively and accurately, providing any concerted evidence you have to support your report.

Response time : · The author of the report receives an acknowledgement of receipt within 7 days; · After analysis of its admissibility, the report is processed within three months; · The author will be kept regularly informed of the progress of its report.

Sanctions

In order to encourage the filing of professional reports and protect whistleblowers, certain infractions are punishable by law:

Any person who deliberately prevents, in any manner whatsoever, the filing of a whistleblower report is subject to one year of imprisonment and a fine of €15,000.
Any breach of the confidentiality of a report, of a whistleblower, of the person who is the target of the report or of persons mentioned in the report is punishable by two years of imprisonment and a fine of €30,000.
Any discrimination based on the status of whistleblower, of facilitator, or of a person related to the whistleblower is punishable by three years of imprisonment and a fine of €45,000.
In addition, any abusive or delaying tactics employed against a whistleblower is punishable by a civil fine of €60,000 plus any potential damages as well as an announcement of the decision

The fines for legal entities are five times the fines for the individuals.

1. Facts that may give rise to a report

The Internal Whistleblowing System can be used to report facts likely to characterize :

Failure to comply with the PILOT Group’s internal policies or procedures;
A felony or misdemeanor ;
Violation (or attempted concealment of a violation) of an international commitment, a unilateral act of an international organization, European Union law, law or regulation;
Violations of human rights and fundamental freedoms, human health and safety, and the environment;
A threat or harm to the general interest.

In all fields, in particular :

Financial, accounting, banking ;
Fighting corruption ;
Anti-competitive practices ;
Occupational health, hygiene and safety ;
Fighting discrimination and harassment in the workplace ;
Environmental protection ;
Human rights and fundamental freedoms.

With the exception of items covered by :

National defense secrecy;
Medical secrecy;
The secrecy of judicial deliberations ;
The confidentiality of judicial investigations or inquiries; or
Attorney-client privilege.

The information may relate to potential events or events that have already taken place. In case of doubt, it is preferable to use the Internal Whistleblowing System rather than to run the risk that serious or underestimated conduct might not be disclosed.

2. Author of a report

2.1. Who may raise a report

The Internal Whistleblowing System can be used by :

PILOT Group employees
Persons whose employment relationship with the PILOT Group has ended, where the information giving rise to the report was obtained in the course of that relationship.
Persons who have applied for a job within the PILOT Group entity concerned, when the information giving rise to the report was obtained in the context of the person’s candidacy.
Shareholders, partners, and holders of voting rights at the relevant PILOT Group entity’s annual meeting.
Members of the board, management or supervisory bodies of the PILOT Group entity concerned.
The PILOT Group’s external and occasional collaborators (seconded consultants, temporary employees, trainees, etc.).
Contractors of the PILOT Group entity concerned, their subcontractors or, in the case of legal entities, members of the board, management or supervisory bodies of these contractors and their subcontractors.
As well as members of employees of the PILOT Group’s contractual partners and their subcontractors.

2.2. Whistleblower protective status

The following conditions must be met for a person to benefit from the whistleblower status and the associated protections:

He/she is a natural person – it cannot be a legal entity, i.e. a company, an association or even a labor union;
He/she acts without any direct financial compensation – no reward or remuneration of any kind can be expected;
He/she acts in good faith – the whistleblower must not act maliciously or out of revenge by submitting information the whistleblower knows to be false or erroneous;
When the information was not obtained in the course of professional activities, the whistleblower must have had personal knowledge of the events, i.e. have personally witnessed the facts (or been the victim) – the whistleblower cannot simply spread a rumor.

The information communicated must be factual and directly linked to the reported facts.

A whistleblower who does not meet conditions (i) to (iv) will not benefit from the protections detailed in 4.2 below and may be subject to disciplinary sanctions or legal action, notably for libel or slander, particularly if acting in bad faith.

Conversely, if the whistleblower uses the Internal Whistleblowing System in good faith, even if the reported information is ultimately determined to be inaccurate or the case is not pursued, he/she will not be subject to sanctions or disciplinary measures.

3. Submitting a report : internal channel

Any person meeting the conditions described in paragraph 2.2 above and who is unable to obtain answers to their questions through the hierarchical chain may submit a report via the Pilot whistleblowing system, as follows:

Either by referring to the Ethics Officer, at the following email address: ethique@piloteurope.com (or, for subsidiaries, branches or European sister companies, at the following email address: ethics@piloteurope.com);
Or by using the dedicated electronic channel, whose internet address will be sent to you by return email if you write to the Ethics Officer or can be found on the HR/Regulatory/Whistleblowing System section of the intranet (for employees of Pilot Corporation of Europe)

Regardless of the channel chosen, exchanges may take place in any form, whether in writing (including e-mail) or orally and, where appropriate, during a videoconference or physical meeting organized no later than twenty working days after receipt of the request. In any event, the confidentiality of this exchange must be ensured by both the person receiving the report and the whistleblower (see point 4 below).

It is recommended that the whistleblower :

Indicates his/her identity and contact details;
Indicates the identity and functions of the persons who are the subject of the report (in particular victim(s) and targeted person (s));
States the facts reported ;
Attaches supporting documents, if available;
Does not use its work equipment (computer, tablet, work phone) or its work e-mail address to submit the report;
Enters an e-mail address at which he/she can be contacted to process the report. To ensure the confidentiality of their identity, this e-mail address may be a pseudonym.

If the whistleblower wishes to remain anonymous, the report can be processed only if the conduct mentioned is determined to be serious, the facts are sufficiently detailed and specific precautions can be implemented while the allegations are being investigated. If these conditions have not been met, the whistleblower will be asked to identify himself so that his report can be processed.

Whistleblowers who have provided an e-mail address will receive an acknowledgement of receipt of their report within 7 working days.

4. Guarantees offered by the Internal Whistleblowing System

4.1. Confidentiality of the information collected in the context of a report

The Internal Whistleblowing System guarantees the integrity and confidentiality of the information contained in a report The following information must remain strictly confidential:

The identity of the whistleblower0F[1], including with respect to the Ethics Committee referred to in paragraph 5.2;
The identity of the person(s) targeted in the report and of any third parties mentioned in the report;
And, more generally, the information contained in the report, i.e. the conduct forming the basis of the report.

In addition, the whistleblower is prohibited from disclosing the information contained in the report.

4.2. Whistleblower protection

As long as he/she meets the conditions set out in paragraph 2.2 above, the whistleblower benefits from extensive protection, including the following guarantees:

Confidentiality of data concerning him/her, which may not be disclosed without his/her consent1F[2] ;
Shifting the burden of proof (i.e. it is up to the PILOT Group to prove that its potential decision to dismiss or punish a whistleblower is motivated by objective factors unrelated to the warning);
Protection against reprisals (such as suspension, dismissal, disciplinary action, discrimination, disadvantageous treatment, etc.);
Exemption of both civil liability (particularly if the whistleblower had reasonable grounds to believe, at the time of reporting, that the report was necessary to safeguard the interests in question) and criminal liability;

4.3. Other persons benefiting from these protections

The protection afforded by the whistleblower status also benefits :

Facilitators, i.e. any natural person or private-law, not-for-profit legal entity such as an association or a labor union, that helps a whistleblower file a report;
Individuals who have a relationship with the whistleblower (e.g. colleagues or relatives) and who are themselves at risk of reprisals from their employer, client or the recipient of their services;
Legal entities controlled by the whistleblower and with which he or she works or has a professional relationship.

This protection only applies if the whistleblower adhere to the framework detailed in 2.2 above.

4.4. Rights of the person targeted by the report

Any person targeted by a whistleblowing report (witness, victim, presumed author of the alleged facts) has the right to full confidentiality and benefits from the fundamental principle of presumption of innocence, rights of the defense and right for privacy.

This obligation of confidentiality applies to the PILOT Group and its authorized representatives, who receive the report, as well as to the whistleblower and any person who may subsequently be interviewed as part of an internal investigation.

This confidentiality obligation is punishable by two years’ imprisonment and a fine of 30,000 euros.

5. Investigating a whistleblower report

5.1. Principles of report handling

As a preliminary point, it should be noted that an internal report is not the only reason why the PILOT Group may wish to conduct an internal investigation: a media campaign or public disclosure targeting certain facts likely to have occurred within the PILOT Group or to affect it (reputation, financial consequences…), a possible violation revealed during an internal or external audit or risk mapping exercise, or the opening of proceedings by a prosecuting authority as well as a request for information made by a foreign authority are all reasons likely to prompt Management to request that an internal investigation be carried out.

In addition, the internal investigation may be delegated to an outside firm (lawyers, consultants). It may also be carried out by the PILOT Group’s in-house teams.

In all cases, internal investigations must be conducted with independence and impartiality, in accordance with the following principles, failing which the employer may be held liable:

Loyalty ;
Proportionality ;
Discretion and confidentiality;
Respect for the presumption of innocence;
The adversarial principle ;
Respect for the rights of the defence ;
Respect for privacy and compliance with the General Data Protection Regulation of May 25, 2018 (hereinafter “GDPR”. The latter aims to harmonize the protection of individuals’ personal data within the EU).

5.2. Concerning the report and the whistleblower

Following an internal report, and insofar as its author has provided an e-mail address enabling him/her to be contacted, he/she will receive an acknowledgement of receipt within 7 days. This acknowledgement is made without prejudice to the admissibility of the report, which will be analyzed at a later stage.

In the event of a whistleblower submitting a report to his or her line manager, said manager is asked to inform the Ethics Officer immediately. Except in cases of conflict of interest, the report is processed by an Ethics Committee composed of:

From the Head of Ethics: General Secretary – Head of the Legal and Compliance Department;
The Director of Human Resources, who also deputises for the Ethics Manager in case of absence;
From the Chairman and Chief Executive Officer ;

The absence of any conflict of interest is carefully verified.

The Ethics Committee assesses the admissibility of the report and, where appropriate, the actions to be taken (internal investigation, legal proceedings, etc.), as well as any immediate precautionary measures and remedial measures that may be implemented. The Head of Ethics or local ethics manager may carry out the investigation himself or subcontract it to a specialized firm.

The whistleblower may communicate any additional information and documents (in writing/oral, electronically or by hand delivery) during the investigation.

The whistleblower is kept informed of the action taken on the report within three months of acknowledgement of receipt. He/she is also informed of the closure of the file linked to his/her report.

5.3. Concerning the person targeted by the report

Any person targeted by a report, whether as a witness, victim or alleged author of the facts, must be notified thereof within a reasonable timeframe, not to exceed one month the report is filed, unless such notification carries the risk that achieving the purpose of the data processing will be seriously compromised, such as the risk that proof of the conduct will be destroyed. In such cases, the information must be provided as soon as the risk has been eliminated, and must not contain information concerning the identity of the person who submitted the report, or of any other person targeted by the report.

The information communicated must mention the investigation, its characteristics as well as the rights of the person targeted by the report.

This person will also be informed of the accusation against him or her, the departments that might receive the report, and how the person can exercise his or her rights to access and rectify any personal data.

Under no circumstances will the identity of the whistleblower be communicated to him/her.

The information required to identify the persons concerned by the report may only be disclosed, except to the judicial authorities, once it has been established that the report is well-founded. In other words, the PILOT Group will carry out an internal investigation, bearing in mind that personal data must only be accessible to those persons authorized to have access to it by virtue of their duties, and/or will refer the matter to the judicial authorities.

The person targeted by the report will also be informed if and when verification has been completed, or whether a disciplinary or judicial procedure has been initiated.

This possibility is nevertheless conditional on appropriate measures being taken to protect the rights and freedoms and legitimate interests of the data subject.

In accordance with the GDPR, the information communicated must mention the existence of the investigation, its characteristics (in particular, the purposes pursued, the types of data likely to be included, the types of persons likely to issue the report or to be the subject of it, the main stages of the procedure triggered by the report, data retention periods, etc.) as well as the rights available to the person targeted by the report.

Lastly, if disciplinary action or legal proceedings are taken against the person targeted as a result of the report, that person will be able to obtain access to certain elements of his or her file under the applicable rules of ordinary law, including the identity of the whistleblower and any other person targeted by the report, subject to the adoption of appropriate measures to protect the rights and freedoms and legitimate interests of the persons concerned.

6. Personal data protection

6.1. Storage of data

Any personal data processed in pursuance of this Internal Whistleblowing System will be treated in accordance with the applicable legal provisions on the protection and processing of personal data.

The recipients of all or part of the data are the persons authorized to receive alerts from whistleblowers, and the members of the Ethics Committee, subject to the limitations imposed by the need to preserve the confidentiality of the whistleblower’s identity.

This data is collected in order to comply with the legal obligations applicable to the PILOT Group. It will be recorded in a computerized file, and may be forwarded as appropriate to lawyers or consultants in the event of an internal investigation by an outside firm, to the Ethics Manager, to members of the Ethics Committee, and to the competent administrative and judicial authorities.

In accordance with the GDPR, the PILOT Group ensures that only information that is relevant and necessary with regard to the purposes of the processing is collected and/or stored as part of the Internal Whistleblowing System. The following information is considered relevant and necessary with regard to the purposes of the processing (non-exhaustive list):

The report (reported facts) ;
The identity, functions and contact details of :
- The whistleblower ;
- Persons mentioned in the report ;
- Persons involved, consulted or heard in the collection or processing of the report ;
- Facilitators and people in contact with the whistleblower.
Information collected during the investigation on the alleged facts;
Investigation reports ;
Actions taken further to the whistleblower report.

The retention period of this data is subject to the provisions of the GDPR :

Data relating to a report may be kept in the active database until a final decision has been taken on the action to be taken. This decision must be taken within a reasonable time of receipt of the report;
Once a final decision has been taken on the action to be taken on the report, the data may be kept in the form of an intermediate archive, for the time strictly proportionate to its processing and the protection of its authors, the persons it concerns and the third parties it mentions, taking into account the time required for any further investigations;
When disciplinary or litigation proceedings are initiated against a person targeted or the source of an abusive report, the data related to the report may be held by the Ethics Committee until the end of the procedure or until the statutory limitation for recourse against the decision has expired.
Data may be kept for longer periods, for interim storage, if the data controller is legally obliged to do so (for example, to meet accounting, social or tax obligations), or for evidential purposes in the event of an audit or dispute, or for the purposes of carrying out quality audits of the processes used to process reports.

In addition, and in accordance with the GDPR, data processed to manage a pre-litigation must be deleted as soon as the dispute has been settled out of court or, failing that, as soon as the corresponding legal action has become time-barred. Data processed to manage a dispute must be deleted when appeals are no longer possible against the decision made to enforce it.

Finally, the PILOT Group is committed to ensuring :

that data are not used for purposes that are improper or incompatible with the following purposes:
- Receive and process reports of a breach of a specific rule;
- Carry out the necessary checks, investigations and analyses;
- Define the action to be taken on the report ;
- Ensuring the protection of data subjects;
- Exercise or defend legal rights,

it being specified that re-use for the purposes of defending the rights of the PILOT Group in the context of a lawsuit linked to the report would a priori constitute a compatible objective;

confidentiality of the data;
that the retention periods specified in this paragraph are complied with.

6.2. Access and rectification rights

The whistleblower and the persons targeted in the report may access their personal data at any time and request that it be corrected or deleted if it is inaccurate, incomplete, ambiguous or out of date.

When such person or persons exercise their access rights, they may not obtain, through the exercise of these rights, any data related to third parties. In particular, the person targeted by the whistleblower report may in no event use his or her access rights to obtain information about the identity of the whistleblower.

In accordance with the GDPR, the right of rectification, provided for in Article 16, must be evaluated with respect to the purpose for which the data are collected. This right to rectify is limited, and may not be used to retroactively change information contained in the whistleblower report or collected during the investigation into it.

The exercise of this right, when admissible, must not make it impossible to reconstitute the chronology of any changes to important aspects of the investigation.

This right may be used only to rectify factual data whose accuracy can be verified by the person responsible for handling whistleblower reports using reliable evidence, without deleting or replacing initially collected data, including erroneous data. To exercise this right, please send your request to privacy@piloteurope.com.

7. Information for employees and external or occasional collaborators

This policy must be distributed to all PILOT Group employees by any means (management letter, posting, e-mail, intranet site, hand-delivery, etc.). To this end, this document is available on the intranet page of the HR/Regulatory/Alert System Intranet. It is also posted on the premises. It must be adopted and appended to the internal regulations of the entities concerned, so that everyone can refer to it. It is also made accessible to third parties via the Pilot Corporation of Europe website: www.pilotpen.eu.

Mr Yoshio WADA Chairman and Chief Executive Officer

[1] Unless the PILOT Group decides to communicate these facts to the judicial authorities.

[2] Unless the PILOT Group decides to communicate these facts to the judicial authorities.

[3] Article 14 of the General Data Protection Regulation (“GDPR“).