Internal Policy on the Whistleblower Program

The purpose of this policy is to define the procedures for implementing CforClean S.A.’s internal reporting system, in accordance with the Luxembourg law of May 16, 2023, transposing Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019, on the protection of persons who report violations of Union law.

This system allows affected individuals to report, in complete confidentiality and without fear of retaliation, incidents that may constitute a violation of applicable laws, regulations, or internal policies in a professional setting.

1. Purpose and Objective of the Program

The whistleblower program established by CforClean S.A. is designed to ensure a secure, confidential, and legally compliant framework for reporting information regarding legal violations.

This mechanism pursues the following objectives, among others:
• to prevent and detect conduct that is unlawful or contrary to internal rules;
• to ensure the protection of individuals who report concerns in good faith;
• to guarantee impartial and confidential handling of reports;
• to enable the company to take any appropriate corrective action;
• to strengthen compliance and ethics within the organization.
This system is not intended as a tool for managing routine personal complaints or disputes that fall exclusively under the purview of human resources.

2. Scope

In accordance with Article 2 of the Act of May 16, 2023, this provision applies to individuals working in the private or public sector who have obtained information regarding violations in a professional context.

This applies in particular to:
• salaried employees;
• self-employed individuals;
• shareholders and partners;
• members of administrative, management, or supervisory bodies;
• volunteers and interns, whether paid or unpaid;
• suppliers, subcontractors, and any person working under their supervision and direction;
• former employees when the information was obtained in the context of a prior employment relationship;
• job applicants who obtained information during a recruitment process or pre-contractual negotiations.

Protection also extends to facilitators, colleagues, or family members of the whistleblower who may be subject to retaliation.

3. Nature of the reports

Information may be reported if it relates, in particular, to:
• criminal or administrative offenses;
• acts of corruption, fraud, or embezzlement;
• violations of accounting or financial rules;
• breaches of personal data protection;
• violations of health and safety obligations;
• breaches of competition rules;
• environmental violations;
• violations of internal policies and governance rules;
• any violation of Luxembourg or European law falling within the scope of the Act.

The report must be made in good faith and be based on reasonable grounds to believe that the reported facts are true.

4. Exclusion of HR Claims

The whistleblower program may not be used for individual complaints regarding human resources or routine labor relations.

The following, in particular, are excluded from this program:
• disputes regarding performance evaluations;
• interpersonal conflicts;
• requests for pay raises;
• complaints regarding work organization;
• standard disciplinary proceedings;
• any requests falling under standard internal HR procedures.

These situations must be handled through the appropriate internal channels within the Human Resources department.

5. Internal Reporting Procedures

Reports can be submitted confidentially through the following internal channels:
1. Via secure email:
[email protected]

Reports are received and handled in strict confidence by Ms. Graca Barros, a member of the staff delegation and the designated official responsible for handling reports.

2. By mail:
CforClean S.A.
Attn: Whistleblower Coordinator
22, rue de l’Industrie
L-8399 Windhof

The envelope must include the following notation:
“Whistleblower Report—Do Not Open”

All information provided as part of the report is subject to enhanced security and confidentiality measures.

At the request of the whistleblower, reports may also be followed up with an in-person meeting, arranged within a reasonable timeframe, with the person designated to handle such reports.
This meeting will be arranged under conditions that ensure the strict confidentiality of the discussion and the protection of the whistleblower’s identity.

Option to report anonymously
Reports can be submitted anonymously through the channels listed above.

The whistleblower’s anonymity will be respected throughout the handling of the case. However, if the whistleblower remains unidentified, CforClean S.A. will be unable to send an acknowledgment of receipt or provide the feedback required by law. Anonymous reports will nevertheless be reviewed according to the same criteria as identified reports, provided that the information provided is sufficiently precise, credible, and substantiated to allow for its processing.

6. Procedure for Handling Reports

In accordance with the law of May 16, 2023, an acknowledgment of receipt will be sent to the whistleblower within a maximum of seven (7) days from the date the report is received.

The processing of the report may result in:
• a preliminary analysis;
• a request for additional information;
• an internal investigation;
• the implementation of corrective or disciplinary measures;
• the case being closed if the facts do not fall within the scope of the policy.
Feedback will be provided to the whistleblower within a maximum of three (3) months from the date of acknowledgment of receipt.

CforClean S.A. reserves the right to disclose any information to the appropriate authorities when circumstances require it.

7. External Reports

In accordance with Article 18 of the law of May 16, 2023, affected individuals may also file an external report with the competent authorities designated by Luxembourg law.

These authorities may have jurisdiction in the following areas, among others:
• data protection;
• labor law;
• the financial sector;
• public procurement;
• public health;
• competition;
• the environment.

Nevertheless, it is recommended that, whenever possible and appropriate, internal channels be used as a matter of priority to ensure that reports are handled quickly and effectively.

Public Disclosure
Pursuant to Article 19 of the Law of May 16, 2023, a whistleblower may also be entitled to legal protection in the event of public disclosure of the reported information—including through the media—in the cases exhaustively listed by the law, namely:
• when the whistleblower has first filed an internal and/or external report without any appropriate action having been taken in response within the statutory time limits; or
• when the whistleblower has reasonable grounds to believe that the violation may pose an imminent or clear danger to the public interest, or that there is a risk of retaliation or a low probability that the violation will actually be addressed through existing reporting channels.

However, it is strongly recommended that official internal or external channels be used before any public disclosure, in order to protect both the whistleblower’s interests and the effectiveness of the system.

8. Whistleblower Protection

Any person who files a report in accordance with legal requirements is protected against any form of direct or indirect retaliation.

The following are specifically prohibited:
• dismissals;
• suspensions;
• demotions;
• discrimination;
• intimidation;
• harassment;
• damage to one’s reputation;
• any other adverse action related to the report.

No civil, criminal, or disciplinary liability may be imposed on any person who has filed a report in good faith in accordance with applicable law.

However, individuals who knowingly disseminate false or misleading information may be subject to disciplinary and/or legal sanctions.

Support Measures for Whistleblowers
In addition to protection against retaliation, whistleblowers may benefit from support measures provided for under the Act of May 16, 2023, including, in particular:
• comprehensive, independent, and free information on available procedures and remedies, as well as on protection against retaliation, provided by the Whistleblower Office (OLA) established by law;
• assistance in dealing with the relevant authorities regarding protection against retaliation, including a certificate confirming that the whistleblower is entitled to legal protection;
• legal, financial, and psychological support, which can be requested from the Whistleblower Office (OLA), accessible via the official website of the Ministry of Justice: mj.gouvernement.lu.

CforClean S.A. is also committed to actively referring any whistleblower to the appropriate internal or external resources, depending on the nature and sensitivity of the report submitted.

9. Privacy and Data Protection

CforClean S.A. places particular importance on the protection of personal data and the confidentiality of reports.
Data collected as part of this system is processed in accordance with:
• the General Data Protection Regulation (GDPR);
• applicable Luxembourg law;
• CforClean S.A.’s internal data protection policy.

The data is strictly limited to the information necessary for analyzing and processing the report.
Access to the information is restricted exclusively to authorized personnel involved in processing the case.
Data is retained for a period commensurate with the purposes for which it is collected and the applicable legal obligations, and for a maximum of five (5) years from the closure of the report, unless there are ongoing judicial or administrative proceedings that would justify a longer retention period. At the end of this period, the data is securely deleted or anonymized.

All appropriate technical and organizational measures are implemented to ensure:
• the confidentiality of information;
• data integrity;
• the security of communications;
• the protection of the whistleblower’s identity and that of the individuals concerned.

10. Effective Date

This policy takes effect as of the date of its approval by the management of CforClean S.A.
It may be amended at any time to reflect changes in laws, regulations, or organizational structure.

Romuald Quaranta
Managing Director – CforClean S.A.