Whistleblower policy for the Bikuben Foundation Group

1. Purpose of the whistleblower scheme

The Bikuben Foundation encourages an open corporate culture in which everyone can freely report suspicions of irregularities or illegal behaviour.

Employees, the management, members of the board of directors, customers, grant recipients, partners and other Bikuben Foundation Group stakeholders are thus included in the whistleblower scheme.

Employees of a group will often be the first to detect irregularities or fraudulent behaviour. However, it is often the case that people are reluctant to bring up their suspicion. In recognition of this fact, the Bikuben Foundation has chosen to establish a whistleblower scheme in which employees and others with an affiliation to the Bikuben Foundation Group can report illegal behaviour or negligence, as well as other serious and sensitive matters.

The purpose of the whistleblower scheme is to make it easier for the Bikuben Foundation Group’s employees and its stakeholders to:

• speak out about illegal or criticisable situations
• protect individuals who make use of the whistleblower scheme
• detect errors and negligence

The whistleblower scheme is a supplement to the Bikuben Foundation’s direct and daily internal communication about errors, unsatisfactory situations etc. Problems should thus be initially brought up with, for example, the employee’s line manager, staff representative or the management directly.

2. Scope of the whistleblower scheme

The Bikuben Foundation Group’s whistleblower scheme gives employees and other stakeholders the opportunity to anonymously report reasonable suspicion of serious and criticisable situations or illegalities that could result in punishment, financial loss or serious damage to the reputation of the Bikuben Foundation Group.

3. Reporting via the whistleblower portal

All Bikuben Foundation Group stakeholders can file a report either anonymously or by identifying their name and contact information. Current as well as former employees and former stakeholders can file a report.

4. Content of the report

The whistleblower scheme may only be used to file reports about individuals associated with the Bikuben Foundation Group.

Whistleblower reports can be filed about the following:

• The Bikuben Foundation Group’s employees. This should be understood to mean an individual the Bikuben Foundation Group, as employer, engages as a paid employee, regardless of the employee’s employment status (permanent, part-time, hourly wage, temporary employee or substitute)
• Members of the board
• Partners and suppliers
• Systematic failures that are not the fault of a specific individual or individuals

5. Types of issues that can be reported via the whistleblower portal

A whistleblower report must draw attention to serious offenses, wrongdoing or other serious situations or suspicions thereof. Reports must concern at least one of the following:

• Serious and/or criminal offenses such as theft, embezzlement, fraud, deception, bribery, corruption, accounting fraud / manipulation, unlawful use of assets, misuse of funds etc
• Serious instances of discrimination, violence, assault or harassment
• Gross violations of internal guidelines (a “gross violation” should be understood to mean: systematic, repeated and significant violations of internal guidelines and / or internal procedures)

It is assumed an individual filing a whistleblower report is knowledgeable of, or has a reasonable suspicion of, one of the above-mentioned offenses being committed.

Issues related to an individual’s employment, such as absenteeism, office conflicts, smoking, alcohol consumption, clothing, salary etc, as well as matters that are not serious, should not be reported on using the whistleblower portal; such matters should be brought up with a line manager, the human-resources department, the staff representative or the like.

To the extent possible, the report must be accompanied by electronic versions of relevant documents.

6. Reporting procedure

It is not possible to file a report in any other way; reports typically contain confidential information that may not be sent unencrypted over the open internet. Reports can be in Danish and English.

7. Confidentiality and anonymity

All information is treated confidentially and with discretion.

In the event a report is filed anonymously, the person filing the report should leave out any form of contact information (name, e-mail address, telephone number etc), and remove all metadata from files attached as documentation, for example names that are to remain anonymous. The person filing the report should not provide any information that can reveal their identity.

Should an enquiry be undertaken by an external body, such as the police, the Bikuben Foundation Group may be forced to disclose the identity of the individual filing the report, if the Bikuben Foundation Group is aware of it.

If the information is reported using a network belonging to the Bikuben Foundation Group or another monitored network, visits to the whistleblower portal may be registered internally as part of the routine logging of user activities. This risk can be avoided by entering the web address in a browser on a public or personally owned computer that is not connected to a monitored network.

The whistleblower portal is designed to prevent or restrict the storage of information when visiting and using the portal. The whistleblower portal supports the use of TOR browsers (https://www.torproject.org/download/), which, when used to visit the whistleblower portal, can provide the highest possible level of anonymity.

8. Processing of reports

Advisory and accounting firm BDO has been engaged by the Bikuben Foundation Group as data processor. BDO provides and administers the whistleblower portal.

The reports filed via the whistleblower portal are accessed by a limited number of BDO employees entrusted to receive and register the reports and forward them to the management of the Bikuben Foundation Group. If the report relates to the management of the Bikuben Foundation Group, the report is forwarded to the chair of the Bikuben Foundation’s board or the chair of Enkotec’s board, if the report relates to Enkotec’s management.

An initial review of the report will be made to assess whether it falls within the framework of the whistleblower scheme, whether the matter should be looked into further or whether the report can be dismissed as manifestly unfounded (this would be the case if, for example, the report is filed by, or concerns issues related to, a person to whom this whistleblower scheme does not apply).

If the allegations in the report cannot be immediately dismissed, an enquiry into the matter will be opened. The enquiry will involve external assistance as necessary. This could be in the form of legal or other types of consultants.

9. Processing of personal data

All processing of personal data submitted in connection a whistleblower report (to include collection, storage and any transmission) is subject to applicable data-protection regulations.

The Bikuben Foundation Group has real and legitimate grounds for processing personal data submitted in a report, and the processing is considered to override the interests of the individual to whom the data relates. The processing is thus carried out on the basis of the legitimate-interests rule in Article 6 (1) (f) of the General Data Protection Regulation.

10. Processing whistleblower reports

A person filing a whistleblower report anonymously can follow its status using a 16-digit key code that is displayed after the report is filed via the whistleblower portal.

A person filing a whistleblower report can subsequently communicate anonymously with BDO using the 16-digit key code. The communication channel is used to acknowledge receipt of the report, and it provides an opportunity to ask any additional questions of the person filing the report without the individual having to reveal their identity. This can help ensure that there is sufficient information to assess the allegations made in the report.

In the event that the report was filed anonymously, the communication channel will likewise be used to communicate any decision about the report to the person who filed it. In the event a report is filed anonymously, the following deadlines for replying via the whistleblower portal apply:

• Receipt of the report is acknowledged within seven days
• A review of the report is initiated as soon as possible; the aim is for the review to be completed within three months
• The findings of the review are communicated via the anonymous communication channel to the person who filed the report
• As a rule, all reports are deleted from the whistleblower portal within 90 days of their filing date unless the deadline is manually extended by the recipient
• The person filing the report can access the status of the review via the whistleblower portal using the 16-digit key code until the report is deleted from the portal. However, the person filing the report has full access for one year from the time of filing the report

11. The person to whom the reported information relates

Unless there are special, significant and justified investigative considerations, the person to whom the reported information relates will be notified when a report has been received and in the event an enquiry is opened.

12. Rights

A report filed in good faith will not result in adverse consequences for the person who filed it.

A report filed in bad faith or filed to harass or harm the person to whom the reported information relates can have consequences for the person who filed it (such as the matter being reported to the police or workplace-related sanctions being imposed on the individual).

Individuals who submit information under the terms of the whistleblower scheme will, as a rule, be informed of the report’s status, as well as the outcome of the initial assessment and the enquiry into the allegations, if one is opened.

13. Deletion of data

If the report does not fall within the scope of the whistleblower scheme, or if the report is unfounded, the personal data it contains will be deleted immediately.

Personal data are also deleted when it is no longer necessary to store them, such as after the conclusion of an enquiry.

Reports are generally deleted from the whistleblower portal within 90 days of their filing unless the deadline is manually extended by the recipient.

The general guidelines for deletion of data apply otherwise. If the information collected leads to a disciplinary sanction being imposed on an employee, or if it is otherwise relevant and necessary to continue to store information about the employee, the information will be stored in the individual’s HR file.