Whistleblowing – General policy and privacy

General policy on whistleblowing

I. Introduction

This policy applies to Airkan NV, with registered office at Berchemweg 105, 9700 Oudenaarde and registered in the Crossroads Bank for Enterprises under enterprise number 0423.001.459 (hereinafter “AIRKAN”).

AIRKAN considers integrity to be one of the cornerstones of its DNA. For this reason, AIRKAN has established a whistleblowing mechanism that allows both employees and external parties (hereinafter the “Whistleblower”) to confidentially report any violation of internal policies and procedures, unethical behaviour, fraud, poor quality and other violations of laws and regulations.

The whistleblowing system is in line with EU Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons reporting breaches of Union law (hereinafter the “Directive”) as well as the Belgian law transposing this Directive of 28 November 2022 on the protection of reporters of breaches of Union or national law established within a legal entity in the private sector (B.S. 15 December 2022).

II. Scope

This policy applies to all Whistleblowers, which are natural persons who have a working relationship with AIRKAN, including:

1. Employees;
2. Other non-employee employees;
3. Temporary workers such as contractors or agency workers;
4. Unpaid volunteers or trainees;
5. Persons providing self-employed services, such as consultants;
6. Shareholders;
7. Suppliers.

This policy also applies to persons whose working relationship has ended or is about to begin, if they have obtained information about incidents during or after the termination of the working relationship or during the recruitment process or other pre-contractual negotiations.

III. What can be reported ?

The following topics are covered by the whistleblowing policy:

1. Violations of statements or procedures communicated by us, including unethical behaviour, poor quality performance, incompetence and professional misconduct;
2. Bullying, harassment, discrimination or substance abuse;
3. A criminal offence, including theft or fraud;
4. Failure to comply with legal obligations;
5. Breaches of privacy and personal data protection;
6. Defects in the security of our network and information systems;
7. Attempts to suppress or conceal information relating to any of the above.

AIRKAN wishes to remind the Whistleblower that the following areas are excluded from the scope of the law: national security, classified data, information covered by medical professional secrecy, information between a lawyer and his client, as well as the secrecy of judicial deliberations.

IV. Submission of notifications

You are strongly encouraged to report your concerns through internal channels if you become aware of a violation of laws, regulations or internal policies and procedures.

As a Whistleblower, you may file either an internal or external report. If you communicate information in writing or verbally about a violation within AIRKAN, it is an internal report. You can also opt for an external report to the competent government authorities or for disclosure by publishing via a blog or via a journalist.

V. Protection of the Whistleblower

At AIRKAN, we are aware that you may be concerned about the potential implications and reprisals following a report.

AIRKAN has therefore created this public policy to ensure that there is a framework within which whistleblowers, including employees, can report their concerns without fear of reprisal.

It is important that you do not discuss your concerns with anyone involved in the incident or disclose your suspicions to anyone other than the person to whom you have sought confidential advice.

No whistleblower who reports an incident may be penalised or be the subject of discriminatory action because he or she made a report in good faith through the whistleblowing mechanism.

AIRKAN does not permit retaliation against those who report a violation or suspected violation of policies or procedures in good faith.

Indeed, the law prohibits any form of retaliation or unfavourable treatment against the whistleblower as long as his/her report meets the above conditions.

If you file a report and it would later turn out that you were mistaken or there is a valid explanation for your concern, you will not be penalised or discriminated against.

VI. Internal reporting channels

AIRKAN has three whistleblowing reporting channels accessible to internal and external whistleblowers.

Reports can be submitted through:

1. You can submit a report via our dedicated contact form on the www.airkan.be/en/whistleblowing-form website;
2. You can send an e-mail stating “Whistleblowing” to: whistleblowing@airkan.be;
3. You can send a letter stating “Whistleblowing” to: Airkan NV, Berchemweg 105, 9700 Oudenaarde, Belgium.

VII. External reporting

In accordance with the Directive, the Belgian state is obliged to designate the authorities competent to receive, give feedback and follow up reports, and to provide them with sufficient resources.

The following authorities were designated to receive external reports on infringements within the private sector, each for their domain:

• the Federal Public Service Economy, SMEs, the Middle Classes and Energy;
• the Federal Public Service Finances;
• the Federal Public Service Health, Food Chain Safety and Environment;
• the Federal Public Service Mobility and Transport;
• the Federal Public Service Employment, Labour and Social Dialogue;
• the Programme Public Service Social Integration, Poverty Reduction, Social Economy and Metropolitan Policy
• the Federal Agency for Nuclear Control;
• the Federal Agency for Medicines and Health Products;
• the Federal Agency for the Safety of the Food Chain;
• the Belgian Competition Authority;
• the Data Protection Authority;
• the Financial Services and Markets Authority
• the National Bank of Belgium;
• the College of Supervision of Auditors;
• the authorities reported in Article 85 of the Law of 18 September 2017 on the prevention of money laundering and the financing of terrorism and on restricting the use of cash;
• the National Committee for the Security of Drinking Water Supply and Distribution;
• the Belgian Institute for Postal Services and Telecommunications;
• the National Institute for Sickness and Disability Insurance;
• the National Institute for Social Insurance of the Self-Employed;
• the National Employment Service
• the National Social Security Office;
• the Social Intelligence and Investigation Service;
• the Autonomous Anti-Fraud Coordination Service (CAF);
• the Shipping Inspectorate.

You may also opt for an external notification by publishing via a blog or via a journalist if appropriate measures have not been taken within a reasonable period of time or if the breach may pose an imminent or real danger to the public interest or a if there is a risk of reprisals or if it is unlikely that the breach will be effectively remedied.

VIII. Content of the report

Your report should contain the following information:

1. Your name and relationship with AIRKAN and your contact details;
2. Your role or involvement in the incident mentioned in the report;
3. A detailed description of the incident you wish to report, together with the time, date and location;
4. The name and contact details of other persons who witnessed or have more information about the incident;
5. Any information you may have about similar previous incidents relating to the person or persons named in your report;
6. Any evidence or useful documents you have in connection with the report.

IX. Receipt of the report

Reports are received and handled by the designated reporting manager for the follow-up of whistleblower reports, being: Angélique Van Welden, Human Resources.

If, due to the nature of the report, the reporting manager cannot fully guarantee impartiality, another reporting manager will be appointed. Upon receipt of the report, the manager will check whether the report falls within the scope of the whistleblower regulation.

Within 7 days of receiving the report, the whistleblower will be informed whether the report has been accepted or rejected. This feedback is not possible in the case of an anonymous report made via a telephone call or written communication.

In order to be subject to the whistleblower regulation, it is a condition that AIRKAN has reasonable grounds to believe that at the time of the report, the reported information is true and that it has followed the procedure provided for in the new law. Indeed, the whistleblower must have obtained the information on which the report is based in a professional context.

If the report does not fall within the scope, it will be rejected and the whistleblower will be asked to contact the external public authorities in accordance with Article VI of this Declaration.

X. Investigation of the notification

After acceptance of the report, the whistleblower responsible person starts an investigation into the content of the report. Within three months of the acceptance of the report, the whistleblower responsible officer shall inform the whistleblower of the status of the investigation. The whistleblower has the right to be informed of the status of the investigation. However, the whistleblower is not entitled to the content of the investigation.

As required by the Directive, AIRKAN is obliged to give the persons named in the report the opportunity to be heard in due course to explain their side of the facts, taking into account the anonymity and confidentiality of the report and where this does not harm the investigation.

XI. Termination of investigation

When the investigation is completed, the whistleblower will be informed of this and the outcome.

However, where the whistleblower is not a party to the case, the whistleblower is not entitled to detailed information on how AIRKAN is dealing with the report. As required by the Directive, we are obliged to inform the persons named in the report in due course of the termination of the investigation, taking into account the anonymity and confidentiality of the report.

XII. Confidentiality of the report

If you raise an issue, the confidentiality of your identity will be ensured in accordance with applicable laws and regulations.

Your identity will not be disclosed to anyone other than those authorised to receive or follow up reports without your explicit consent. This also applies to any other information from which your identity can be (in)directly deduced.

Your identity may only be disclosed in the event of a necessary and proportionate obligation imposed by EU or national law in the context of investigations by national authorities or judicial proceedings. Among other things, to protect the data subject’s rights of defence.

 

Privacy statement around Whistleblowing

1. Introduction

This Privacy Statement applies to Airkan NV, with registered office at Berchemweg 105, 9700 Oudenaarde and registered in the Crossroads Bank for Enterprises under enterprise number 0423.001.459 (hereinafter “AIRKAN”).

AIRKAN wishes to inform you with this Privacy Statement why and how AIRKAN collects and processes personal data in the context of the whistleblowing process because we attach great importance to the protection of your privacy while processing your personal data.

By using the reporting form, the whistleblower agrees to the processing of his/her Personal Data for the purposes indicated in this Privacy Statement.

AIRKAN’s whistleblowing process complies with EU Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of individuals who report breaches of Union law (hereinafter the “Directive”), the personal data protection regulations being EU Regulation no. 2016/679 (hereinafter “AVG”), as well as the Belgian law transposing this Directive of 28 November 2022 on the protection of reporters of breaches of Union or national law established within a legal entity in the private sector (B.S. 15 December 2022).

More information around the scope, reporting procedure and protection mechanisms for whistleblowers can always be found online in our General Statement on Whistleblowing, published on our website www.airkan.be.

As data controller in accordance with Article 4 of the AVG, we are responsible for the processing of personal data collected and processed by AIRKAN in order to comply with the law.

2. In what ways do we process personal data about you?

Personal data will be processed on paper and/or using digital media.

AIRKAN will keep the information provided confidential and only persons authorised to perform these tasks and made aware of the restrictions imposed by personal data protection legislation will process your personal data.

AIRKAN will never disclose the information provided without consent or on a legal basis.

AIRKAN has ensured appropriate and organisational measures to secure your personal data against any form of loss or unlawful processing.

3. What type of personal data do we collect about you?

AIRKAN may process the following personal data collected from you (in case you are the reporter) or from a third person (in case you are the accused person and/or a witness):

1. Basis identification data

By “basic identification data” we mean any information that refers to a particular natural living person.

This personal data includes your basic identification data such as your first and last name, address, occupation, contact details and any other information you have given us about the person(s) involved in the complaint.

2. Sensitive categories of personal data

Following a notification, special categories of personal data may be collected. These include, for example, personal data relating to race or ethnicity, health, sex life, religion or personal beliefs, or trade union membership.

In this case, such personal data will only be processed to the extent permitted by applicable law or the need to establish a breach, or to exercise rights of the whistleblower.

In contrast, if such sensitive personal data is irrelevant and outside the scope of applicable law or not necessary to exercise any rights, it will be deleted immediately.

3. The description of the alleged infringement, as well as a description of the circumstances of the case.

When AIRKAN receives a report, a file is created containing the details of the report.

Indeed, we process this personal data for internal reporting purposes to provide internal information such as the number of reports we receive and about any actions we have taken as a result of such reports by whistleblowers. However, this never includes information that identifies individual whistleblowers or their employers (including former employers).

Within the description of the alleged breach you provide, personal data may be processed around:

• unlawful conduct or violations of the company of which you have become aware regarding your relationship with AIRKAN;
• unethical conduct, contrary to AIRKAN’s ethical principles

4. For what purposes do we process your personal data?

We need the information you provide with your report to investigate your report, including any evidence you have provided to us. We need to know the details of your complaint so that we can make a decision about AIRKAN’s compliance with the relevant laws and fulfil our obligations.

Your personal data will be processed for the following purposes:

• Enabling you to submit reports;
• To enable AIRKAN to process, assess and further investigate your reports by involving relevant AIRKAN departments where appropriate;
• To comply with legal obligations of competent authorities;
• Enable AIRKAN to establish, exercise or defend our rights;
• Perform our controls and activities to monitor business risks and improve our internal processes.

5. On what legal basis do we process your personal data?

Personal data mentioned in reports of alleged infringements are only processed on the basis of a legal obligation, as this information is necessary to comply with the EU Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons reporting infringements of Union law as well as the Belgian law transposing this Directive of 28 November 2022 on the protection of reporters of infringements of Union or national law established within a legal entity in the private sector (B.S. 15 December 2022).

6. Will your personal data be passed on to third parties?

AIRKAN may, directly or indirectly, transfer personal data to:

Supervisory public institutions:

As a result of the investigation of the notification, AIRKAN will, in some circumstances, have to transmit information around personal data to the relevant governmental supervisory body, tax authority or public prosecutor competent for the investigation of the related breach.

These entities will act as independent controllers of the respective processing operations.

AIRKAN and its sister and parent companies

Only authorised employees have access to personal data. These are individuals who have been specifically designated and who can thereby guarantee the full confidentiality of the personal data provided in accordance with the most appropriate security measures implemented by AIRKAN.

Your personal data may be used by AIRKAN personnel assigned to a specific role, bound by a confidentiality obligation and having received appropriate instructions.

Your personal data will only be made accessible to those persons who need it within the Group in view of their function or hierarchical position. These persons will be properly instructed to prevent the loss, destruction, unauthorised access or unauthorised processing of data.

These companies act as part of the designated controller, AIRKAN SA, unless they act on behalf of AIRKAN as external data processors and have therefore signed a specific contract regulating the processing entrusted to them, in accordance with Article 28 of the AVG.

Service providers of AIRKAN:

In addition, the data may be used by third-party companies carrying out instrumental activities on behalf of AIRKAN, such as service providers (including IT companies) entrusted with specific management of contractual obligations, external consultants for the management of the research process and legal assistance, companies and firms in the context of assistance and advisory relationships.

These companies act as external data processors and are directed and supervised by AIRKAN, unless they act as external data processors on behalf of AIRKAN and have therefore signed a specific contract regulating the processing entrusted to them, in accordance with Article 28 of the AVG.

7. How long do we keep your personal data?

Personal data obtained in the context of whistle-blowing will be retained for a duration of 6 to 10 years depending on the severity of the breach. Indeed, reports that may give rise to criminal investigations may be retained for a duration of up to 10 years.

Your personal data is processed and stored, in accordance with AIRKAN’s data retention policy, for the time necessary to manage the reports and for the period strictly necessary to achieve the purposes for which it was collected and for the fulfilment of applicable legal obligations.

Moreover, the data will be deleted or permanently anonymized when the above purposes are achieved, unless the data controller is obliged to retain the data for a further period of time to comply with legal obligations.

In any case, your data will not be kept for more than 10 years after the submission of the report

8. Do we transfer your personal data outside the EU?

AIRKAN may transfer your personal data to parties located in third countries, which are countries outside the European Economic Area (i.e. the European Union, Norway, Iceland and Liechtenstein).

However, such a transfer is only possible if the country where the receiving party is located provides sufficient legal safeguards to protect your personal data and has been assessed as adequate by the European Commission. In the other cases, AIRKAN has concluded a model contract (Standard Contractual Clauses) with the recipient so that a similar (w)like protection is provided as in Europe.

If more information or a copy of the guarantees in these international transfers of personal data is desired, the procedure described under Article 10 can always be followed.

9. What are your rights?

Data protection legislation provides various rights for data subjects in relation to the processing of personal data so that the data subject can continue to exercise sufficient control over the processing of their personal data.

AIRKAN already tries through current policies to provide as much information as possible to data subjects in order to be as transparent as possible regarding the processing of personal data.

AIRKAN understands that data subjects may still have questions or require additional clarifications regarding the processing of their personal data. AIRKAN therefore understands the importance of the rights and will comply with these rights taking into account the legal limitations in exercising these rights. The various rights are described in more detail below.

Right of access/inspection

You have the right to obtain confirmation from AIRKAN as to whether or not its personal data are being processed. In the positive case, the data subject may request access to his/her personal data.

AIRKAN will inform the data subject of the following:

1. the purposes of processing;
2. the categories of personal data concerned
3. the recipients or categories of recipients to whom the personal data have been disclosed;
4. transfers to recipients in third countries or international organisations;
5. if possible, the period for which the personal data are expected to be stored, or if that is not possible, the criteria for determining that period;
6. that the data subject has the right to request the organisation to rectify or erase personal data or to restrict the processing of personal data concerning him, as well as the right to object to such processing
7. that the data subject has the right to lodge a complaint with a supervisory authority;
8. where personal data are not collected from the data subject, any available information on the source of those data
9. the existence of automated decision-making, including profiling, and useful information on the logic underlying such decision-making and the significance and expected consequences of such processing for the data subject.

AIRKAN shall also provide a copy of the personal data being processed. If the data subject requests additional copies, AIRKAN may charge a reasonable fee.

Right of rectification

If the data subject finds that AIRKAN holds inaccurate or incomplete personal data about him, the data subject always has the right to report this to the organisation so that the necessary steps can be taken to correct or complete this data. It is the responsibility of the data subject to provide correct personal data to the organisation.

Right to be forgotten

You can request the erasure of his personal data if the processing does not comply with data protection legislation and within the limits of the law (Art. 17 AVG).

Right on restriction of data processin

You may request that processing be restricted if

1. the accuracy of the personal data has been questioned and for the period to verify the accuracy
2. the processing is unlawful and the data subject does not wish the data to be erased;
3. the organisation no longer needs the data, but the data subject requests that they not be deleted as they need them in the exercise or substantiation of a legal claim;
4. objection to the processing is made pending the explanation of legitimate interests that outweigh the interests of the data subject.

Right of transferability

You have the right to obtain his personal data provided to the organisation in a structured, common and machine-readable form. The data subject has the right to transfer this personal data (directly by the organisation) to another controller. This is possible if the processing is based on your consent and based on processing through an automated process.

Right of objection

When personal data are processed for direct marketing purposes (including profiling), you can always object to the processing.

You can also object to the processing due to a specific situation related to the data subject. The organisation will stop the processing unless the organisation invokes compelling legitimate grounds for the processing which outweigh the interests of the data subject or which relate to the exercise or substantiation of legal claims.

Automated individual decision-making

You have the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects for him or otherwise affects him significantly, such as evaluating personal aspects relating to job performance, reliability, creditworthiness, etc.

This right not to be subjected to such automated decision-making does not exist if the decision is authorised by a mandatory legal provision.

Nor can you invoke this right when the decision is necessary for the establishment or performance of the contract between you and AIRKAN or is based on your express consent. In the latter two cases, you do have the right to human intervention by someone from AIRKAN and the right to express your point of view and to challenge the automated decision.

Right of withdrawal of consent

If you have given your consent to AIRKAN to process your data for a specific processing purpose, you may withdraw this consent at any time by sending an e-mail in accordance with the procedure explained in the following article.

10. How can you exercise your rights ?

To exercise the rights mentioned above, please send us a written request, dated and signed, with a copy of the front of your identity card.

The request can be sent:

• by e-mail: whistleblowing@airkan.be or gdpr@airkan.be ;
• in writing to the following postal address: Berchemweg 105, 9700 Oudenaarde, Belgium.

When exercising your right, please indicate clearly which right you wish to invoke.

The request to obtain a copy of the data will be processed within one month. This deadline may be extended by two months, taking into account factors such as the complexity and number of requests. If the deadline is extended, you will be informed of this and the reasons for the extension.

We will inform third parties to whom the data has been disclosed of any rectification, erasure or restriction carried out, unless this is not possible or requires a disproportionate effort.

We are committed to working with you to find a fair resolution of any complaint or concern about your privacy. However, if you feel that we have not been able to help you with your complaint or concern, you have the right to lodge a complaint with the data protection authority of the country in which you live using their website.

If you live in Belgium, you can complain to the Belgian Data Protection Authority. Full information on this can be found at https://www.dataprotectionauthority.be/.

11. Changes

We may amend or supplement this Statement if necessary. If significant changes are made to this Privacy Statement, the date it is changed will be updated and we will also notify you.

We also encourage you to regularly review this Statement to read the latest version around how we process and protect your personal data.

Date last updated: 20 december 2023