Report Form (RF)

1. GENERAL INFORMATION

Legal basis

Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (EU Whistleblowing Directive)
Act of 14 June 2024 on the protection of whistleblowers

Date of completing the form Reported party Enter the first and last name or the company name to which the Report relates
Subject of the Report In accordance with Art. 3(1) of the Act of 14 June 2024 on the protection of whistleblowers

2. CONTACT DETAILS OF THE PERSON REPORTING A BREACH OF LAW

Type of Report Anonymous report
If this form of Report is selected, the reporting person will not receive feedback regarding the Report.

Non-anonymous report
If this form of Report is selected, the reporting person will receive feedback regarding the Report. The reporter’s data are confidential and will not be disclosed publicly.

non-anonymousanonymous

First and last name* Phone* E-mail* Correspondence address

3. INFORMATION ABOUT THE REPORT OF A BREACH OF LAW

Date of the incident subject to the Report Date when the information about the incident subject to the Report was obtained Place where the incident subject to the Report occurred Enter the exact location of the Incident — address, room, name of the Organizational Unit Potential witnesses of the Report Enter the names of potential witnesses of the incident; if there were none, enter “No witnesses” First and last name

Description of the Report A detailed description of the Report, including the persons involved, the place, and the circumstances of the Report

4. EVIDENCE CONCERNING THE REPORT

Enter the name and type of evidence confirming the breach. Describe the circumstances in which the evidence was obtained and attach supporting documentation, e.g., photos, videos, audio files, e-mails, screenshots, notes, text messages, or other documents.

Do you have evidence concerning the Report? yesno

Name/type of evidence Information about the evidence Indicate information about the attached evidence (what it shows / what the evidence concerns, date of obtaining the evidence, etc.)

5. ATTACHMENTS CONCERNING THE REPORT

Attach photos, documents, video recordings

Attachment

6. NOTICES

LIABILITY

Pursuant to Art. 57 of the Act of 14 June 2024 on the protection of whistleblowers (Journal of Laws 2024, item 928, as amended), anyone who submits a Report or makes a Public Disclosure knowing that no breach of law has occurred is subject to a fine, restriction of liberty, or imprisonment for up to 2 years. Other criminal provisions regarding reporting and disclosure of identity are set out in Articles 54 to 59 in Chapter 6 “Criminal provisions” of the Act of 14 June on the protection of whistleblowers (Journal of Laws 2024, item 928, as amended). Other provisions regarding liability are set out in Articles 16 to 17 in the chapter “Prohibition of retaliatory actions and protective measures” of the Act of 14 June on the protection of whistleblowers (Journal of Laws 2024, item 928, as amended), which indicate information on the grounds for and exclusions from liability.

COMPENSATION

Pursuant to Art. 15. of the Act of 14 June 2024 on the protection of whistleblowers (Journal of Laws 2024, item 928, as amended), a person who has suffered damage due to a knowingly false Report or Public Disclosure by a Whistleblower has the right to compensation or redress for infringement of personal rights from the Whistleblower who made such a Report or Public Disclosure. Pursuant to Art. 14 of the Act of 14 June 2024 on the protection of whistleblowers (Journal of Laws 2024, item 928, as amended), a Whistleblower who has been subjected to retaliatory actions has the right to compensation in an amount not lower than the average monthly remuneration in the national economy in the previous year, announced for pension purposes in the Official Gazette of the Republic of Poland “Monitor Polski” by the President of the Central Statistical Office, or the right to redress.

PROCESSING OF PERSONAL DATA

Information clause for the person submitting the Report

Pursuant to Art. 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the “General Data Protection Regulation”; “GDPR”), we inform you that: PPF HASCO-LEK S.A., with its registered office in Wrocław, ul. Żmigrodzka 242 E, registered in the District Court for Wrocław-Fabryczna, 6th Commercial Division of the National Court Register under KRS no. 0000020657, share capital PLN 329,944,036.00 – fully paid, NIP 895-17-29-489, REGON 932249169, BDO 000037234, is the personal data Controller (hereinafter: the Controller). The Controller has appointed a Data Protection Officer, who can be contacted in matters related to personal data protection at the following e-mail address: iod@hasco-lek.pl. The personal data of the person submitting the Report are processed for purposes related to conducting explanatory proceedings in connection with reported cases of breaches of law. The legal basis for the Controller’s processing of the personal data of the person submitting the Report for the purposes indicated above is: (a) compliance with legal obligations (pursuant to Art. 6(1)(c) GDPR) incumbent on the Controller under applicable law; (b) the Controller’s legitimate interest (pursuant to Art. 6(1)(f) GDPR), which is the defense against claims and the pursuit of its rights; (c) the establishment, exercise and defense of claims (pursuant to Art. 9(2)(f) GDPR). The personal data of the person submitting the Report may be disclosed by the Controller to authorized entities, if necessary in connection with the verification of the Internal Report, in the manner provided for by peremptory provisions of law. Personal data and other information in the Internal Reports Register are stored for 3 years after the end of the calendar year in which Follow-up Actions were completed or after the completion of proceedings initiated by those actions. Providing personal data by the person submitting the Report is voluntary but necessary to receive feedback on the actions taken by the Controller. The person submitting the Report has rights related to the processing of personal data: (a) the right to access their data; (b) the right to rectify personal data; (c) the right to erase personal data or restrict processing; (d) the right to data portability; (e) the right to object — an objection may be submitted due to a particular situation to the e-mail address: iod@hasco-lek.pl or to the Controller’s address with the note “Data Protection Officer”. The person submitting the Report has the right to lodge a complaint with the President of the Personal Data Protection Office. The personal data of the person submitting the Report will not be transferred to a third country or an international organization.

7. DECLARATIONS OF THE PERSON SUBMITTING THE REPORT

Liability for providing false information I declare that I submit the Report voluntarily and that I am aware of the liability for making false statements.

Good faith I declare that I am making the Report of a Breach of Law, being an act or omission contrary to the law or intended to circumvent the law, in good faith.