twoday Whistleblowing Channel

 

1. Whistleblowing compliance

twoday will not tolerate any form of misconduct or critical conditions, such as violations of statutory rules, internal rules, policies or ethical standards, such as bullying, harassment, discrimination, corruption, money laundering or any other financial fraud, and will make efforts to ensure a safe, healthy and legal environment in all our business activities and legal units.

twoday will comply with all applicable laws and regulations and act ethically and socially responsible. Breaches of any local and/or EU/EEA law may result in disciplinary actions, including termination / dismissal and reports to the relevant authorities.

The twoday Whistleblowing Channel is a tool enabling anonymous submission of any suspected breach of the local and/or EU/EEA law from both inside twoday and outside. It fosters confidential communication between reporter and case handler.

twoday Whistleblowing is compliant with the EU Whistleblower Directive (Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law) and the regulations regarding whistleblowing in the WEA (local working environment and protection laws). twoday is also, in some jurisdictions, due to being licensed by local Financial Supervisory Authorities, obliged to have a specific whistleblowing system in place.

 

 

1.1 Objective

The objective of this procedure is to describe the handling of cases submitted to the twoday Whistleblowing Channel, according to the EU Directive, local legislation and the internal procedures while at all times ensuring the protection of the Notifier.

The output of this process is that the reported case is handled with discretion and closed, with necessary actions taken.

This procedure is owned by HR Director at the twoday Group and was last updated in October 2022.

 

 

1.2 Definitions

Case handler - the Whistleblowing Country Manager or other assigned personnel who will handle the report.

Intake Management Service (IMS) - a third-party service facilitated by the Whistlelink vendor which receives the reports and assigns cases within one business day based on a predefined schema.

Notifier - is a person who reports a breach of EU/EEA or local law. They can be any employee, former or existing, or self-employed person in twoday, a shareholder, or someone from outside of twoday, e.g third persons connected with the Notifier or twoday’s suppliers and customers who need to notify of a breach or a potential breach of the local or EU/EEA legislation or any of twoday’s internal rules/policies.

Report - the reported whistleblowing case.

Viewer - a case handler with temporary and limited access on Whistlelink, requested by the case handler to the Whistlelink Administrator.

Whistlelink - the chosen tool for handling whistleblowing reports.

Whistleblowing Country Manager (WCM) - a twoday employee, typically from Management, HR, Legal or Finance, responsible for coordinating and managing whistleblowing for all the twoday companies in their assigned country. Each country has been assigned two Whistleblowing Country Managers for backup purposes.

Whistlelink Administrator - a twoday employee who responds to user management requests at whistlelink.admin@twoday.com.

 

 

2. Who can report

This procedure applies to a Notifier who needs to report a breach or a potential breach of the local or EU/EEA law or any of twoday’s internal rules/policies, such as twoday’s Code of Conduct.

It also applies to third persons who are connected with the Notifier, and who could suffer retaliation in a work-related context, such as colleagues or relatives of the Notifier.

As a Notifier, you are protected by law. You should not be treated unfairly or lose your job because you ‘blow the whistle’.

 

 

3. What can be reported

All reports shall be based on justifiable grounds of suspicion. Evidence is not necessary, but reporting must not be made with the intention to cause harm or with the knowledge that the accusation is false. Hence, the report you disclose must be made in the public interest. To identify if a report is in the public interest, you should look at the following criteria:

• the number of people affected
• the nature or impact of the harm
• who is the reported individual.

In a nutshell, the report should go beyond the employee’s personal circumstances.

Some examples include the following:

• a criminal offense, for example, fraud
• someone’s health and safety are in danger
• risk or actual damage to the environment
• a miscarriage of justice
• the company is breaking the law – for example, it does not have the right insurance
• you believe someone is covering up wrongdoing
• #MeToo cases

Whistleblowing that fulfills this criteria shall be treated as a “Qualified Reporting” and handled in accordance with the twoday Whistleblowing Procedure.

 

 

4. What cannot be reported

Types of cases other than those listed above should not be reported. Such cases that do not fulfill the criteria will be treated as “Non-qualified reporting”. A non-qualified reporting will not be handled within the twoday Whistleblowing Procedure.

Examples of cases that should not be reported through the twoday Whistleblowing Channel are:

• General opinions on how the business is run
• General opinions on salary, leadership or other personnel matters

Such cases shall be handled by reporting to the relevant manager or any other relevant person within the management of the company in question.

This is the standard response the Notifier will receive in case of a “non-qualified reporting”:

______________________________________________________________

Thank you again for your report.

After a careful review, we do not consider this to be a whistleblowing matter and will close the case. Our recommendation is to speak with your closest manager or contact HR/other.

Please note that you will not be able to respond to this message. Should you not be happy with how your case was managed you are welcome to submit a new one.

Kind regards,

twoday Whistleblowing

_______________________________________________________________

 

 

5. Where the reporting should be done

Reporting shall be made:

• https://www.twoday.com/whistleblowing/ will take the Notifier to an external secure page which is the only and official twoday Whistleblowing Channel. 

Reporting is made by submitting a form either anonymously or with a full name. Providing your full name might in some cases increase the chance of resolving the reported case, however, it is fully the Notifier’s decision to disclose their identity or not. 

If you are reporting anonymously please make sure that you put down as much information about the matter as possible and at least the following:

• The twoday company connected with the misconduct/breach of local/EU/EEA law
• Description of the misconduct/breach and who’s involved
• Facts, evidence or proof of the misconduct/breach

Note! If an alert is received through a different channel than the official one, the recipient shall use the twoday Whistleblowing Channel to register the case or contact the relevant Whistleblowing Country Manager. The same steps shall be used in handling the case.

 

 

6. The whistleblowing process and its actors

 

Figure 1. Overall process and process actors’ responsibilities

 

 

6.1 Report registration and case handler assignation

When twoday receives a report submitted through the Whistleblowing Channel, the third-party Intake Management Service (IMS) will immediately receive a notification for channeling the alert to the designated Whistleblowing Country Managers which are always two people either from Management, HR or Finance.

twoday uses this set-up also to ensure impartiality and transparency.

Each country has two Whistleblowing Country Managers assigned for backup reasons which include vacation or any type of leave, or if one of them is mentioned in the report, then IMS will assign the case to the other one.

Once the case is assigned to the main Whistleblowing Country Manager, the Notifier will receive an acknowledgement of receipt. According to our contract with the IMS provider, this will happen within one business day after the report was submitted.

The standard automatic response which will be sent to the Notifier is this one:

_________________________________________________________________

Thank you for submitting your concerns. We hereby confirm that we have received your case and we will review it carefully.

All future communications from us will be sent via this channel, so make sure you save and store your case and verification numbers.

Best regards,

twoday’s Whistleblowing

___________________________________________________________________

 

 

6.2 Whistleblowing case handling

The provision in Article 8(3) of the EU Directive 2019/1937 specifies that each twoday company with 50 or more workers is required to set up channels and procedures for internal reporting, where such legal entities belong to a group of companies (please see Figure 3. below).

Article 8(6) allows medium-sized companies to share resources as regards the receipt of reports and any investigation to be carried out. It should be underlined that the responsibility to maintain confidentiality, give feedback, and address the reported breach remains, however, with each medium-sized company concerned. Only medium-sized companies can benefit from this possibility, and companies that belong to the same group.

The Whistleblowing Country Managers have the responsibility to create local procedures for internal reporting, while the local channels are facilitated through case handler assignment.

All cases reported through the official Whistleblowing Channel will be tracked through logs that can’t be tampered with, hence, cases can’t be deleted from the system.

 

 

6.3 Qualified or Non-Qualified report

The case handlers on the platform, i.e. the Whistleblowing Country Managers or the relevant personnel assigned to handle the case, will need to decide as per each internal procedure and local legislation whether the report is to be treated as Qualified or Non-Qualified report.

If the case handler decides that it is a Non-Qualified report, the report can be immediately closed by sending a standardized communication to the Notifier through the platform and by unticking the “​​Whistleblowing case” box which will exclude it from statistics.

________________________________________________________________________

Thank you again for your report.

After a careful review, we do not consider this to be a whistleblowing matter and will close the case. Our recommendation is to speak with your closest manager or contact HR/other.

Please note that you will not be able to respond to this message. Should you not be happy with how your case was managed you are welcome to submit a new one.

Kind regards,

twoday’s Whistleblowing Function

______________________________________________________________________

If the report is considered to be Qualified, the relevant case handlers are obliged to start the investigation process. The report will be marked as a “​​Whistleblowing case” on the platform so it will count in the statistics.

 

 

6.4 Case handling per company size

Figure 2. Company size and type-specific requirements

 

For twoday companies with more than 250 employees, the Intake Management will forward the report to the assigned contact points in these legal units.

For this reason, one of the fields in the report that should be filled in is “Please select the twoday company this report pertains to.” This is not a mandatory field, which is why if this information is not provided, the Whistleblowing Country Manager should double-check with the Notifier if the report does not pertain to one of the large twoday companies, or they are not comfortable providing this information. It should be made clear that this information is important so their case is better handled by the relevant people and in accordance with the EU directive.

The Whistleblowing Country Managers will include in their internal procedures an overview of all the twoday companies in their assigned responsibility. This will include contact persons such as HR, legal, financial or environmental matters.

For all twoday companies that are regulated by a financial supervisory authority and required by any specific regulations other than the EU Directive referred to above to provide for a whistleblowing Channel, the Whistleblowing Country Managers will send the report to the local contact point who will inform about the receipt of the report the company's Board of Directors and keep them informed throughout the process. The case will be handled locally, according to twoday Whistleblowing procedure and the local specific regulation.

 

 

6.5 Best practices for case handling

If the Notifier decides to submit the case by presenting their identity they should be invited to a meeting to discuss the content of the report and to provide more background information regarding the relationship and/or discussion of further handling of the case. In this meeting, agreements shall be made on how to communicate in the further course of the case, including consideration to immediately inform the relevant twoday Company's Board and/or the twoday Group Board, as per the local internal procedures.

If the report is submitted anonymously through the whistleblowing channel, the Whistleblowing Country Managers will coordinate the best course of action for handling the case, depending on the specifics of the reported issue. 

To collect more information, the Whistleblowing Country Managers or any other assigned case handler on the case, can and are encouraged to contact the notified in confidentiality using the whistleblowing platform as all messages pertaining to the report will be stored on the platform for further reference.

_____________________________________________________________

Important to remember

• Involve external assistance depending on the degree of impartiality and persons involved (e.g. the management)
• The method should be adapted to the nature of the problem, the content and the persons involved. Methods that may be used:
• Document analysis
• Conversations
• Use of experts
• Consultation with immediate contradiction (gather both parties in one room, when possible - get the facts on the table)
• Interviews with key persons that may have information regarding the suspicion or the case
• Review of documents, e.g. accounting, project implementation
• Keep the Notifier informed - they need to receive at least one follow-up notice within 90 days
• When the Notifier discloses their identity, their manager shall ensure that any retaliation is prevented
• If at any point the Whistleblowing Country Manager or the case handlers encounter whistleblowing reports including but not limited to reputational damage, litigation, financial risk, etc. they should involve twoday’s Group Crisis Team, for support.
• Ensure the wellbeing of the Notifier by providing them:
• Legal aid
• Health care (often necessary)
• Leave of absence (when necessary)

_____________________________________________________________

 

 

6.6. Follow-up

As per the requirements of the EU Directive, the main case handler who can be the Whistleblowing Country Manager or assigned personnel, needs to provide follow-up communication to the Notifier within 90 days since the report was submitted, even if the case is not concluded within that time frame.

• Depending on the severity, the Whistleblowing Country Manager or relevant Board of Directors will consider contacting the local National Authority for Investigation and Prosecution of Economic and Environmental Crime.
• Appropriate measures should be taken (mitigation or/and prevention regarding future similar cases).

 

 

7. Documentation requirements

All activities related to the case must be documented. Necessary documentation must be gathered by the case handlers or the Board of the twoday company (when applicable) who shall document everything during the process.

All documentation shall be stored on the Whislelink platform which allows tracking all changes made in relation to a report (e.g. document added, messages sent, etc.) 

Even though the whistleblowing reports can be exported from the platform in a pdf format, we don’t recommend doing so, because we lose track of changes and progress in handling them.

Personnel data will be processed in accordance with the twoday Privacy Statement.

 

 

8. User access and management on Whistlelink

The whistleblowing platform has four types of users: owner, administrator, case handler and viewer.

For safety reasons, there are only two users that have elevated rights: the Whistlelink  Administrator and the Intake Management Service.

Permanent access on the platform is provided only for the Whistleblowing Country Managers, while any temporary access (e.g. viewing rights) shall be requested by them to the Whistlelink Administrator who will add and remove user access as per an as-needed basis.

The Whistlelink Administrator shall be contacted at whistlelink.admin@twoday.com who will resolve the request in one business day.

 

 

9. Onboarding new companies

For onboarding companies the Whistlelink Administrator needs the following info: country, company size, whether they are financially regulated (running under a license).