Whistleblowing policy

What’s This All About?

Why It Matters:

Benefits for Everyone:

What to Do?

Useful links:

As part of Alokai's commitment to creating an open and transparent workplace, we’ve implemented a whistleblowing procedure based on the EU Whistleblower Directive (Directive 2019/1937) and the Polish Act of June 14th, 2004, on the protection of whistleblowers. This process is designed to give you a safe, confidential, and secure way to report any concerns or misconduct that you may come across at Alokai.

The EU introduced this directive to protect people like you – employee candidates, employees and collaborators who speak up about issues that might otherwise go unnoticed. The goal is to make sure that anyone who reports a problem, whether it’s unethical behavior or a violation of the law, is protected from any negative consequences or retaliation.

We are also happy to inform you that the Compliance Officer to whom you can report a problem or concern, acts as an impartial person within Alokai. Should a report involve the Compliance Officer, we provide the Alternative Contact Unit to serve as the alternative contact in an impartial capacity.

Your Voice Matters: By reporting any concerns, you’re helping to maintain the Alokai’s integrity and fostering a healthy work environment.
Confidential and Safe: You can report issues, knowing that your identity will be protected and any retaliation is strictly forbidden.
Support and Guidance: Our processes ensure that all reports are taken seriously and thoroughly investigated. You won’t be left wondering what happens next – we’re here to support you.

A Stronger, More Transparent Company: When we address issues early, we prevent bigger problems down the line.
Legal Compliance: By following the EU directive and Polish law, we’re not only staying on the right side of the law, but also making sure we’re a responsible and ethical company.
Positive Work Environment: The whistleblower process helps build trust, showing that we care about doing the right thing and that your contributions are valued.

If you ever notice something that doesn’t feel right, don’t hesitate to use this process. Together, we’re helping to create a better, more open workplace for everyone. Let’s work together to make sure our company stays a place where transparency, integrity, and trust come first!

If You need to take an action, here’s what to do:

If you need to discuss a concern in person, You can schedule a meeting with the Compliance Officer, or
Reach out to the Compliance Officer via ethics@alokai.com , or
If the issue involves the Compliance Officer - You can contact the Alternative Contact Unit at acu_ethics@alokai.com , and
Share the relevant details of the issue confidentially. Your identity and report will be protected.

Report number

Date of Receipt of the Report

Personal details of the Whistleblower (address – if applicable and necessary)

Details of the
person to whom
the report pertains

Object of
the violation of the law

Follow-Up Actions

Date of Case Closure

Procedure for reporting violations at Alokai

Procedure for conducting investigations at Alokai

Alokai Code of Conduct

EU Directive 2019/1937 (OJ L 305 of 26.11.2019, p. 17-56)

Act of June 14th, 2024, on the protection of whistleblowers (Journal of Laws 2024.928 of 2024.06.24) in Polish language

PLAIN TEXT of the Procedure for reporting violations at Alokai

PROCEDURE FOR REPORTING VIOLATIONS AT ALOKAI Sp. z o.o.

INTRODUCTION

Reporting information about violations is an expression of social responsibility and concern for the well-being of the Company, as well as the welfare of its employees and collaborators, and loyalty towards them.
Any person in a professional relationship with the Company who has witnessed or is aware of a violation should make a report in accordance with this Procedure. Utilizing this Procedure does not preclude the possibility of using the official reporting channels for the same purpose.
Reporting violations is both a right and a duty of the Company's employees and collaborators. Any person, particularly those holding managerial positions within the Company, who witnesses an obvious violation and fails to report it, may be held accountable under employment law. Such a person may especially be held liable if, by their omission, they endanger the life and health of others or contribute to significant material, social, or reputational damage.
This Procedure is in compliance with the Whistleblower Protection Act of June 14, 2024, and in matters not regulated by this Procedure, the provisions of the aforementioned Act shall apply.

PURPOSE

The purpose of this Procedure is to ensure the receipt of reports containing information about violations of legal regulations and the Company's internal policies through various reporting channels.
This Procedure is addressed to all employees, collaborators, suppliers of the Company, as well as other individuals who wish to submit a report concerning the Company's activities or persons associated with it.
The Procedure aims to guarantee that each report will be reviewed confidentially, with full protection of the identity of the whistleblower, the persons involved in the report, and any third parties mentioned in the report. It also introduces protective mechanisms aimed at preventing the risk of retaliatory actions.
The Procedure also ensures that each report will be examined thoroughly, based on transparent principles. Detailed rules for conducting investigative proceedings are outlined in the "Procedure for Conducting Investigative Proceedings at Alokai sp. z o.o.," which, together with this Procedure, forms the system for reporting violations.

DEFINITIONS

Company – Alokai sp. z o.o., headquartered in Warsaw at Przeskok 2, 00-032 Warsaw.
Compliance Officer – an impartial internal organizational unit or person within the Company's organizational structure authorized to perform the functions of the Company's Compliance Officer.
Ethics Committee – a committee appointed to review the Report, operating based on the principle of confidentiality.
Alternative Contact Unit – an impartial internal organizational unit or person within the Company's organizational structure authorized to perform the duties of the Compliance Officer under the Procedure in the case of a Report concerning the actions or omissions of the Compliance Officer.
Violation – an act or omission by individuals associated with the Company in the scope of their professional activity or related to it, violating legal regulations, internal Company regulations, or external regulations to which the Company is bound.
Person Assisting in the Report – a natural person, a legal person or an organizational unit without legal personality, to which the law confers legal capacity, identified in the Application as the infringer or as a person with whom the infringer is associated.
Person Related to the Whistleblower – a natural person who may experience retaliatory actions, including a colleague or a person closely related to the Whistleblower, as defined in Article 115 § 11 of the Penal Code.
Procedure – this Procedure for reporting violations at Alokai sp. z o.o.
Act – the Whistleblower Protection Act of June 14, 2024.
Whistleblower – a natural person who has made a Report.
Report – information regarding a Violation or suspicion thereof.

WHO CAN MAKE A REPORT

Any person who has information about a Violation may submit a Report.
In particular, the Report may be made by:

an employee (including a temporary employee),
a person employed under a non-employment contract, including a civil law contract,
an entrepreneur,
a shareholder,
a member of the Company's governing body,
a person performing work under the supervision and direction of a contractor, subcontractor, or supplier of the Company (including under a civil law contract),
an intern,
a volunteer,
a trainee.

The Whistleblower may submit a Report concerning a Violation they became aware of before establishing a relationship with the Company (e.g., during recruitment) as well as after such a relationship has ended.
The Report should concern actions or omissions related to the Whistleblower's work or cooperation with the Company.

WHAT CAN BE REPORTED

A Report may concern any information about a Violation related to the Company's activities or the actions of its employees or collaborators.
The Report may pertain to violations of legal regulations, internal Company policies, as well as external regulations that the Company has committed to follow.
The Whistleblower is not required to specify which law or regulation was violated. A description of the act or omission constituting the Violation is sufficient.
Examples of information that may be reported include:

unequal treatment,
harassment,
bullying,
discrimination,
breach of integrity,
bribery,
offensive comments,
fraud.

HOW TO SUBMIT A REPORT

All channels designated for receiving Reports ensure confidentiality. Confidentiality applies to the identity of the Whistleblower, the content of the Report, and even the fact that a Report has been made.
A Report can be submitted verbally or in writing.
Anonymous Reports will not be considered; however, the Company reserves the right to review an anonymous report if its content reveals significant issues related to a legal violation that should be reported.
A Report can be submitted via:

attending a personal meeting with the Compliance Officer or a designated representative, which can take place either at the Company’s headquarters or another location,
sending an email to:

ethics@alokai.com, accessible by the Compliance Officer,
acu_ethics@alokai.com, accessible by the Alternative Contact Unit.

The Report should include all information about the Violation that may help clarify the matter – a description of the event, date, location, and details of persons who may know about or have witnessed the incident. If the Whistleblower has any evidence or documents related to the Report, their submission would be helpful.
If the Report is made verbally, it must be documented by the person receiving it, either by recording, a transcript of the recording, or – if not recorded – a written protocol of the conversation. The Whistleblower may review the protocol and approve it by signing.

CONFIDENTIALITY

Confidentiality ensures that the personal data of the Whistleblower and other information that could reveal their identity will not be disclosed to unauthorized persons unless explicitly consented to by the Whistleblower, subject to the exception mentioned in paragraph 2 below.
The Whistleblower’s data may only be disclosed when it is a necessary and proportional legal obligation in connection with investigative proceedings conducted by public authorities or preparatory or judicial proceedings carried out by courts, including to guarantee the right of defense of the person the Report concerns. In such cases, the Whistleblower will be informed of the planned date of disclosure.
Confidentiality protection also extends to the data of third parties mentioned in the Report and the person whose actions or omissions are the subject of the Report.
Protecting confidentiality also means that a minimum number of people will be involved in the investigation of the case. All persons involved in the process will be required to have written authorization from the Company and to provide a written declaration of commitment to secrecy regarding the information they have obtained in the course of receiving and reviewing the report and conducting the investigation.

WHAT HAPPENS TO A REPORT

The Whistleblower shall receive an acknowledgment of receipt of the Report, which shall take place at the latest within 7 days of the receipt of the Report unless the Whistleblower has not provided a contact address to which the acknowledgment shall be forwarded.
Once received, the Report is analyzed (depending on the reporting channel, either first by the Alternative Contact Unit or by the Compliance Officer). If necessary, and if the Whistleblower has provided contact information, actions will be taken to supplement the content of the Report.
The Compliance Officer (or other person authorized by the Company) shall take the preliminary steps of registering the Report in the Internal Report Register and opening an investigation.

GENERAL PRINCIPLES OF THE INVESTIGATION PROCEDURE

The investigation procedure is conducted by the Compliance Officer (or a person authorized by him) or the Ethics Committee, depending on the subject matter of the Report.
Detailed rules for conducting the investigation are set out in the Procedure for conducting investigations at Alokai sp. z o.o.
The Compliance Officer preliminarily verifies the Report to determine whether it is clearly unfounded. If the Report is deemed clearly unfounded, the Compliance Officer informs the Whistleblower and closes the investigation.
The investigation is also closed if the information in the Report does not allow for further investigation, and the Whistleblower has not responded to clarifying questions or has not provided contact details.
In less complex or time-consuming cases, the investigation is conducted by the Compliance Officer (or a person authorized by him). For other cases, the investigation is led by the Ethics Committee.
The Ethics Committee consists of the Compliance Officer (or a person designated by him) and one or two additional persons appointed by the Compliance Officer, whose knowledge is useful for reviewing the Report.
The Compliance Officer or the Ethics Committee conducts a thorough investigation based on the following principles:

striving to determine the actual facts;
gathering and evaluating evidence fairly – including both evidence supporting and disputing the occurrence of the Violation;
ensuring confidentiality of personal data – if necessary, personal data is anonymized or deleted.

After completing the investigation, the Compliance Officer or Ethics Committee prepares a report concluding whether a Violation occurred or not. The report may also identify other Violations not specified in the original Report. It includes recommended actions based on the findings of the investigation.
The report is submitted to the Management Board and to the Compliance Officer (if they are not part of the Ethics Committee). If the Report concerns a Violation by a Board Member, the report is forwarded to the remaining Board Members (if any).
A designated person from the Management Board, the Compliance Officer, or the Chairperson of the Ethics Committee provides feedback to the Whistleblower. Feedback must be provided within 3 months of confirming the receipt of the Report (or, if no confirmation was sent, 3 months from the expiration of the 7 days after the Report was made), unless the Whistleblower has not provided contact information for feedback.

PROTECTION OF THE WHISTLEBLOWER AND OTHERS AGAINST RETALIATION

The Company protects the Whistleblower from retaliation. Any form of retaliation, attempts, or threats of retaliation are prohibited. Violation of this ban will result in disciplinary or contractual liability. The prohibition of retaliation will be strictly enforced. Retaliation harms not only the Whistleblower but also the Company’s interests.
Retaliation includes direct or indirect actions or omissions caused by the Report, which violate or may violate the rights of the Whistleblower or cause or may cause unjustified harm to the Whistleblower.
The provisions of the Procedure regarding protection from retaliation also apply to a Person assisting in making the Report and a Person associated with the Whistleblower if they have a professional relationship with the Company.
The Company prohibits any hindrance to reporting or attempts to impede it, particularly through violence, threats, or deceit.
Exercising the rights defined in the Procedure cannot be the basis for unfavorable treatment or any negative consequences. In particular, it cannot justify termination of employment or any other form of cooperation with the Company.
The Whistleblower is protected from retaliation provided they had reasonable grounds to believe that the information in the Report was true at the time of reporting and that it constituted information about a Violation.
Regardless of protection from retaliation, the Whistleblower may still face responsibility, especially workplace responsibility, if they participated in the Violation.
In the case of knowingly reporting false information or aiding in such a report, the individuals involved are not entitled to the protection outlined in this section. The Company may initiate disciplinary proceedings or take legal action against those who knowingly submit false information or assist in doing so.

REPORTS REGARDING A VIOLATION COMMITTED BY THE COMPLIANCE OFFICER

In cases where a Report concerns the actions or omissions of the Compliance Officer, the Report should be submitted through the reporting channel provided by the Alternative Contact Unit. In such cases, the Compliance Officer will not receive any information regarding the content of the Report or even its submission.
When a Report relates to the actions or omissions of the Compliance Officer, the responsibilities of the Compliance Officer outlined in the Procedure will be performed by the Alternative Contact Unit.
The provision in section 2 also applies in cases where the reporting person is the Compliance Officer.

FINAL PROVISIONS

The Procedure has undergone the required legal consultation with the social partners.
This Procedure comes into effect 7 days after the internal notification of its adoption by the Management Board.
The owner of this Procedure is the Compliance Officer, who is responsible for its periodic review, no less than once every two years.

PLAIN TEXT of the Procedure for conducting investigations at Alokai

PROCEDURE FOR CONDUCTING INVESTIGATIONS AT ALOKAI Sp. z o.o.

I. GENERAL REMARKS

1. Reporting information about Violations is an expression of social responsibility and concern for the Company’s well-being, as well as the well-being of its employees and collaborators, demonstrating loyalty towards them.

2. The Company shall provide various channels for making oral and written reports. Some of the available reporting channels allow for anonymous reporting. All reporting channels guarantee confidentiality - the identity of the Whistleblower as well as the person to whom the report concerns, is particularly protected. The Company ensures the protection of the personal data of all persons whose personal data are processed in connection with the recognition of the Report.

3. Detailed rules concerning the submission of reports, including the available reporting channels, are described in the Procedure for Reporting Violations at Alokai sp. z o.o.

4. The scope of this Procedure includes the principles governing the conduct of investigatory proceedings, particularly the rules, rights, and obligations aimed at ensuring the fair and thorough review of a Report.

5. This Procedure, together with the Procedure for Reporting Violations at Alokai sp. z o.o., constitutes the Company’s whistleblowing system. The purpose of this system is to ensure that:

a. Any individual can submit a Report through the method of their choice, which, in their view, is most appropriate for them;

b. The Report is directed to a limited group of individuals who will ensure its confidentiality, as well as the confidentiality of the process of reviewing the Report and conducting the investigatory proceedings;

c. Each Report is reviewed in a fair manner, based on transparent principles;

d. The summary report from the investigatory proceedings enables concrete actions to be taken to remedy the effects of the Violation and to prevent future Violations of the same nature.

II. DEFINITIONS

1. Company – Alokai sp. z o.o. with its registered office at 2 Przeskok Street, 00-032 Warsaw, Poland.

2. Compliance Officer - An impartial internal organizational unit or individual within the Company’s structure authorized to perform the duties of the Compliance Officer.

3. Ethics Committee – A committee established to review the Report, operating based on the principle of confidentiality.

4. Alternative Contact Unit – An impartial internal organizational unit or individual within the Company’s structure authorized to perform the Compliance Officer’s duties under the Procedure in the event that the Report concerns the actions or omissions of the Compliance Officer.

5. Violation – An act or omission by individuals associated with the Company, within the scope of their professional activity or related to the Company, that breaches legal regulations, internal Company regulations, or external regulations to which the Company is committed.

6. Procedure – This Procedure for Conducting Investigations at Alokai sp. z o.o.

7. Whistleblowing Procedures – Procedures regulating the whistleblowing system, namely the Procedure for Conducting Investigations at

Alokai sp. z o.o. and the Procedure for Reporting Violations at Alokai sp. z o.o.

8. Whistleblower – An individual who has made a Report.

9. Report – Information about a Violation or a suspicion of a Violation.

III. RECEIPT OF REPORT

1. The Compliance Officer is responsible for registering the Report and verifying its completeness. If the Report is incomplete, the Compliance Officer will request the Whistleblower to provide the necessary information.

2. The Compliance Officer must confirm receipt of the Report to the Whistleblower within 7 days from the date of its submission.

3. In the case of Reports submitted through a channel managed by the Alternative Contact Unit, that entity will confirm receipt of the Report within 7 days from the date of its submission or promptly forward the Report to the Compliance Officer if it does not concern the actions or

omissions of the Compliance Officer.

4. The confirmation of acceptance of the Application shall be accompanied by an information clause concerning the processing of the Whistleblower’s personal data, a specimen of which is attached as Annex 1 to the Procedure.

5. The information and requests mentioned in sections 1-4 will be sent to the Whistleblower, provided that the Whistleblower has left contact data allowing such information to be sent.

6. The Compliance Officer shall, immediately upon receipt of the Report, pseudonymize the data of the Whistleblower and assign an identifier (e.g. numerical) to be used during the investigation. Pseudonymization includes any type of information that allows the direct or indirect

identification of the Whistleblower, with particular regard to whether the content of the Report itself does not indicate the identity of the Whistleblower. There shall be no pseudonymization of the Whistleblower’s data if the Whistleblower has explicitly and unambiguously consented to his/her data being made public.

7. The Compliance Officer verifies the Report to determine whether it is not clearly unfounded. If the Report is found to be clearly unfounded, the Compliance Officer provides appropriate feedback to the Whistleblower and closes the case concerning the Report.

8. The case concerning the Report will also be closed if the information contained in the Report does not allow for the continuation of the investigatory proceedings, and the Whistleblower has not responded to clarifying questions (within 7 days from the date of receipt of the request for additional explanation) or has not provided contact details.

9. If the analysis conducted by the Compliance Officer does not reveal the obvious unfoundedness of the Report, the Compliance Officer will initiate investigatory proceedings.

IV. INVESTIGATORY PROCEEDINGS

A. Preliminary Analysis of the Report – Determining the Appropriate Entity for Conducting Investigatory Proceedings

1. Based on the preliminary analysis of the Report, the Compliance Officer assesses whether the matter addressed in the Report necessitates the appointment of an Ethics Committee or if it falls under the purview of the Compliance Officer. The Compliance Officer’s decision regarding the appropriate entity to conduct the investigatory proceedings must be based on the analysis of the following elements:

a. whether the Report concerns a Violation;

b. the type of Violation described in the Report;

c. the date of the Violation and its duration;

d. the number of individuals implicated in the Report;

e. the number of individuals affected by the Violation;

f. the number of individuals identified by the Reporter as potential witnesses.

2. In the case of Reports that will not be time-consuming and complex to investigate, the investigatory proceedings may be conducted by the Compliance Officer (or a person authorized by the Company). In other cases, the investigatory proceedings are conducted by the Ethics Committee.

3. If the preliminary assessment leads to the conclusion that the Compliance Officer is appropriate to handle the case, but during the investigatory proceedings it becomes necessary to change this decision, the Compliance Officer shall appoint the Ethics Committee. In such cases, the Ethics Committee shall take into account the actions already taken by the Compliance Officer and shall aim to avoid duplicating those actions, unless it is necessary to do so to ensure the principle of fair and thorough proceedings.

B. Ethics Committee

1. The Ethics Committee is appointed by the Compliance Officer, who serves as its Chair and appoints the remaining members. The Ethics Committee may consist of two to three members. In justified cases, the Ethics Committee may decide to expand its composition.

2. Members of the Ethics Committee may only be individuals whose expertise is pertinent to the examination of the Report.

3. If circumstances arise that cast reasonable doubt on an Ethics Committee member’s impartiality, that member is required to abstain from actions and notify the Chair of the Ethics Committee of these circumstances. The Chair of the Ethics Committee may, on their own initiative, exclude a person from the Ethics Committee if there are reasonable doubts about his/her impartiality.

4. Before undertaking any actions within the investigatory proceedings, members of the Ethics Committee:

a. receive written authorization from the Company to process personal data, and

b. provide a declaration committing to maintain confidentiality in connection with the proceedings, which obligation will remain in effect even after the termination of the legal relationship between the individual and the Company.

C. Investigatory Proceedings

1. The tasks of the Compliance Officer or the Ethics Committee in the investigatory proceedings are:

a. to conduct the investigatory proceedings to verify the content of the Report;

b. to prepare a report on the investigatory proceedings, including recommendations for further actions necessary to eliminate the effects of the Violation and to prevent future occurrences of similar issues.

2. The Compliance Officer or the Ethics Committee conducts the investigatory proceedings based on the following principles:

a. striving to establish the actual state of affairs;

b. gathering and evaluating evidence exhaustively—both evidence supporting and refuting the validity of the Report;

c. evidence cannot be disregarded simply because it may show a fact contrary to previous findings;

d. any doubts that cannot be resolved must be resolved in favor of the person to whom the Report pertains;

e. ensuring the confidentiality of personal data—actions are carried out in a manner that guarantees confidentiality; if necessary, personal data is anonymized or deleted;

f. respecting the rights of participants in the investigatory proceedings, especially the rights of the Whistleblower and the person to whom the Report pertains;

g. conducting the investigatory proceedings in a manner that ensures they are concluded within a reasonable time.

3. The Whistleblower’s data should remain confidential and may not be disclosed in the course of the proceedings to parties and participants in these proceedings without the express and unequivocal consent of the whistleblower. A template of the Whistleblower’s consent to disclosure of his/her identity is attached as Annex 2 to the Procedure.

4. Immediately after receiving express and unambiguous consent from the Whistleblower to the disclosure of his or her personal data making it possible to establish his or her identity, the Compliance Officer or the Ethics Committee shall provide the Whistleblower with the information

clause on the processing of his or her personal data set out in Annex 3 to the Procedure.

5. The Ethics Committee and Compliance Officer may seek support from external or internal experts.

6. The Compliance Officer or the Ethics Committee shall inform the person to whom the Report relates of the initiation of investigatory proceedings, this information is provided in a timely manner, taking into account the need for the unimpeded collection of evidence, preventing the

destruction or concealment of evidence, and taking into account the interests of the Whistleblower, the victim, and the witnesses. An information clause on the processing of personal Report relates, a model of which is attached as Annex 4 to the Procedure, shall be attached to the information on the initiation of the investigatory proceedings. The information of the person to

whom the Report relates about the initiation of an investigatory proceedings may be abandoned if the content of the Report proves to be manifestly unfounded or unconfirmed.

7. In the course of an investigatory proceedings, the Compliance Officer or the Ethics Committee is entitled to question witnesses and request the production of documents or information. Any person working or collaborating with the Company is obliged to comply with the requests of

the Compliance Officer or the Ethics Committee. The Compliance Officer or the Ethics Committee is required to provide witnesses and other third parties indicated in the Report with an information clause on the processing of their personal data, a model of which is attached as Annex 5 to the Procedure. The information clause shall be provided - in a form that makes it possible to demonstrate that the Company has complied with its information obligation - in a timely manner, taking into account the need for the uninterrupted collection of evidence, to prevent the destruction or concealment of evidence, and taking into account the interests of the Whistleblower and the provisions of Art. 13 or 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive

95/46/EC (General Data Protection Regulation) (OJ EU. L. 2016 No. 119, p. 1 as amended - the so-called GDPR).

8. The Compliance Officer or the Ethics Committee, in the course of fulfilling the information obligation concerning the processing of the personal data of the person to whom the Report relates or of other persons identified in the Report or the fulfillment of their request for access to their personal data, shall not be allowed to disclose the source of their personal data unless the Whistleblower does not meet the conditions indicated in Article 6 of the Law on the Protection of Whistleblowers or has previously given his/her express consent to the disclosure of his/her identity.

9. The parties to the proceedings (the Whistleblower and the person to whom the Report pertains) and individuals acting as witnesses must commit in writing to maintaining the confidentiality of everything learned in connection with the proceedings. This commitment does not apply if the disclosure of information is required by applicable law.

10. The statements referred to in section B, paragraph 4(b), and paragraph 9 above, are kept in the case files.

11. Witness’s interviews are recorded. Access to the witness’s interview record is restricted to individuals who participated in the interview. Access to the record is granted only immediately after the interview and does not permit copying of its contents.

12. The parties to the proceedings may be accompanied by one representative during the interview. The representative may be a family member, lawyer, legal advisor, or psychologist. The cost of the representative’s remuneration is borne by the party who appointed them.

13. The parties to the proceedings have the right to submit evidence requests to demonstrate the validity or invalidity of the allegations of the Violation. The entity conducting the investigatory proceedings is not bound by the evidence request and may decide not to proceed with it. The decision not to conduct the evidence must be justified.

14. All documents created during the work of the Ethics Committee are confidential.

D. Conclusion of Investigatory Proceedings

1. Upon completing the investigatory proceedings, the Compliance Officer or the Ethics Committee prepares a report which may state:

a. the occurrence or non-occurrence of the Violation or determine that, based on available evidence, it is unable to resolve the issue of the Violation; or

b. the occurrence of a Violation not mentioned in the Report.

2. The report should also include recommended actions based on the findings from the investigatory proceedings, particularly if a Violation is confirmed.

3. The report is submitted by the Compliance Officer or the Chairperson of the Ethics Committee to the Company’s Management Board and also to the Compliance Officer (if they are not a member of the Ethics Committee) unless the investigatory proceedings pertain to the

Compliance Officer or were initiated based on a Report made by the Compliance Officer. If the Report pertains to the actions or omissions of a Management Board Member, the report is shared with the other Members of the Management Board (if they have been appointed).

Disclosure of the report or any part of it to other individuals requires the Management Board’s consent. In cases where the Report involves a Management Board Member, that member does not participate in the decision-making process concerning the matter.

4. After the report is submitted, the Chairperson of the Ethics Committee or the Compliance Officer closes the investigatory proceedings.

5. The individual designated by the Management Board, the Compliance Officer, or the Chairperson of the Ethics Committee provides feedback to the Whistleblower.

6. The feedback must be provided within a period not exceeding 3 months from the confirmation of receipt of the Report (or if no confirmation is sent, within 3 months from the expiry of 7 days after the Report was submitted), unless the Whistleblower has not provided a contact address to which the feedback should be sent. The feedback may include information on the determination or lack of determination of the occurrence of a Violation or on the ongoing investigative actions if the investigation has not been completed.

7. The individual designated by the Management Board, the Compliance Officer, or the Chairperson of the Ethics Committee provides information to the person to whom the Report pertains about the outcome of the investigatory proceedings.

V. SUBSEQUENT ACTIONS TAKEN AS A RESULT OF CONDUCTING INVESTIGATORY PROCEEDINGS

1. The Management Board of the Company is obligated to undertake actions aimed at eliminating the irregularities identified as a result of the investigatory proceedings and to prevent their recurrence. The Management Board designates individuals responsible for implementing these actions.

2. In the event of a Violation committed by an individual who is an employee of the Company, the Management Board decides on disciplinary actions, which may include:

a. disciplinary penalties based on the Labor Code;

b. termination of the employment relationship with the employee (including dismissal without notice for employee fault).

3. For individuals who are engaged with the Company under a form of cooperation other than employment, the Management Board may apply measures provided under relevant legal provisions and agreements, including immediate termination of cooperation.

4. When implementing the actions and measures referred to in paragraphs 2 and 3 above, the Management Board must inform the Compliance Officer of such actions.

5. The Compliance Officer is obligated to verify the status of the implementation of the Ethics Committee’s recommendations six months after submitting the report to the Company’s Management Board. The Compliance Officer presents the Management Board with a report

on the status of the implementation of the recommendations. If necessary, further periodic verifications are conducted.

VI. PROTECTION OF THE RIGHTS OF THE PERSON CONCERNED BY THE REPORT

1. Until the conclusion of the investigatory proceedings and the determination of whether a Violation has occurred, the allegations of a Violation are considered unconfirmed.

2. The person who is the subject of the Report has the right to a fair investigatory process, including:

a. the right to be informed of the initiation of the investigatory proceedings in accordance with the provisions of section C, paragraph 6 above;

b. the right to appoint a representative and to submit evidence requests, as per the provisions of section C, paragraphs 12 and 13 above;

c. the right to be informed of the outcome of the investigatory proceedings.

VII. SPECIAL POWERS OF THE COMPLIANCE OFFICER AND THE ETHICS COMMITTEE

1. The Compliance Officer and the Ethics Committee are authorized to request actions aimed at preventing retaliatory actions. Such requests are directed to the Board Member overseeing the segment related to the Report, who makes the final decision based on the content of the request.

2. The Compliance Officer may delegate their responsibilities under the Whistleblowing Procedures to another person. The person authorized by the Compliance Officer must be someone who ensures confidentiality and conducts actions with due diligence.

3. The Compliance Officer has the right to initiate investigatory proceedings based not on a Report from a third party, but on information obtained in the course of their duties.

4. In justified cases, particularly to ensure the proper conduct of the investigatory proceedings, the Compliance Officer may initiate an agreement to relieve the person subject to the investigatory proceedings from work duties. This action should be taken after consulting with the person responsible for employee matters in the Company and the supervisor of the person subject to the investigatory proceedings. For collaborators, the decision to relieve them from service must be consulted with the person responsible for employment in the Company and the person managing the collaboration with the specific collaborator. If an agreement to relieve from work is made, the

Compliance Officer is required to promptly inform the HR department serving the Company.

VIII. PROCEDURE IN THE CASE OF A VIOLATION COMMITTED BY THE COMPLIANCE OFFICER

In the event of a Report concerning an action or omission by the Compliance Officer, the responsibilities of the Compliance Officer under this procedure will be carried out by the Alternative Contact Unit. This unit should be notified of the Report’s receipt without involving the

Compliance Officer. This provision also applies in cases where the Report is made by the Compliance Officer themselves.

IX. REGISTER OF INTERNAL REPORTS

1. The Compliance Officer is responsible for maintaining the internal reports register.

2. The Company is the data administrator for the information stored in the register.

3. The following information is recorded in the register:

a. Report number;

b. Personal data of the Whistleblower and the person the Report concerns, necessary for their identification;

c. Contact address for the Whistleblower;

d. Date of the report;

e. Subject of the Report;

f. Subsequent actions taken;

g. Date of case closure.

4. The information in the register is confidential and subject to a confidentiality obligation. Access to the register is granted only to individuals with written authorization for personal data processing.

5. The template for the register of reports is provided in Annex 6 to this Procedure.

X. SECURITY MEASURES, RETENTION PERIOD, AND OBLIGATION TO DELETE INFORMATION AND PERSONAL DATA RELATING TO THE IMPLEMENTATION OF THE PROCEDURE

1. The Compliance Officer or the Ethics Committee shall ensure the protection of information and personal data (including documentation) related to the implementation of the Procedure in particular by applying the following measures:

a) information and personal data processed in paper form shall be stored in a locked cabinet to which only persons authorized to process data related to the proceedings shall have access;

b) access to information systems in which information and personal data are processed shall be restricted to authorized users, and each action on the data (access, editing, deletion, etc.) shall be recorded;

c) information and personal data transmitted electronically shall be encrypted and/or pseudonymized beforehand;

d) information and personal data are deleted irretrievably from the IT systems once they are no longer useful, and paper data are destroyed in a shredder.

2. The personal data processed in connection with the acceptance of a Report, the conduct of an investigatory proceedings, or the undertaking of a follow-up action and the documents related to the Report shall be retained by the Company for a period of 3 years after the end of the

calendar year in which Report has been transmitted to the public authority competent to undertake the follow-up action or the follow-up action has been completed, or after the proceedings initiated by these actions have been terminated.

3. The Compliance Officer deletes the personal data and destroys the documents related to the Report after the expiry of the retention period. The Act of 14 July 1983 on the national archival resource and archives (Journal of Laws of 2020, item 164) shall not apply.

4. A report in documentary form shall be drawn up on the deletion or destruction of personal data and documents related to the Report.

XI. COMPLIANCE OFFICER’S DUTIES RELATED TO THE IMPLEMENTATION OF THE WHISTLEBLOWING PROCEDURES

1. Compliance Officer:

a. Ensures the currency of the Whistleblowing Procedures;

b. Coordinates the activities of the Company’s organizational units responsible for implementing the Whistleblowing Procedures;

c. Receives Reports;

d. Appoints the Ethics Committee and directs its work;

e. Oversees the process of handling reports and maintaining the register of reports in accordance with the provisions of the Procedure;

f. Recommends and subsequently informs the Company’s Human Resources Department about the conclusion of an agreement regarding exemption from the obligation to perform work;

g. Provides periodic reports to the Management Board regarding the implementation of the Whistleblowing Procedures;

h. Organizes training and other activities aimed at raising awareness among employees and collaborators regarding the reporting process for irregularities;

i. Ensures that each new employee, collaborator, and member of the statutory body is acquainted with the Whistleblowing Procedures before they are allowed to start work, begin collaboration, or assume their role;

j. Ensures that a job applicant, based on an employment relationship or another legal relationship constituting the basis for performing work or services, is informed about the Whistleblowing Procedure at Alokai sp. z o.o. before the commencement of recruitment or negotiations preceding the conclusion of an agreement;

k. Undertakes activities to ensure that each new employee, collaborator, and member of the statutory body is acquainted with the Whistleblowing Procedures before they are allowed to start work, begin collaboration, or assume their role;

l. Undertakes activities to ensure that a job applicant based on an employment relationship or another legal relationship constituting the basis for performing work or services is informed about the Whistleblowing Procedure at Alokai sp. z o.o. before the commencement of recruitment or negotiations preceding the conclusion of an agreement.

XII. FINAL PROVISIONS

1. The Procedure has undergone the required legal consultation with the employee representatives.

2. The Procedure shall come into effect 7 days after the date of sending the internal notification of the Management Board’s approval of this

Procedure.

3. The owner of the Procedure is the Compliance Officer.

Annexes:

1. Model information clause concerning the processing of the Whistleblower’s personal data (general clause);

2. Template of the Whistleblower’s consent to the disclosure of his/her identity;

3. Model information clause relating to the processing of the Whistleblower’s personal data (clause after consent to disclosure of the Whistleblower’s identity);

4. Model information clause concerning the processing of the personal data of the person to whom the Report relates;

5. Model information clause concerning the processing of personal data of a third party identified in the Report;

6. Model register of internal notifications.

Annex 1 - Model information clause concerning the processing of a Whistleblower’s personal data (general clause)

Information clause concerning the processing of a Whistleblower’s personal data

for the purpose of accepting a notification and conducting an investigatory proceeding under the whistleblower protection act

1. The controller of your personal data is ALOKAI Sp. z o.o. with its registered office in Warsaw, ul. Przeskok 2, 00-032 Warsaw, www.alokai.com, e-mail: ethics@alokai.com or acu_ethics@alokai.com (hereinafter: ‘the Controller’).

2. In all matters concerning the processing of personal data, please contact the Data Protection Officer appointed by the Controller, electronically at the following e-mail address: privacy@alokai.com or by postal mail to the Controller’s address marked ‘Data Protection Officer’.

3. Your personal data will be processed for the purpose of accepting a notification and conducting an investigatory proceedings or taking follow-up action on the basis of the legal obligation to which the Controller is subjected under the Act of 14 June 2024 on the protection of whistleblowers. Your personal data may furthermore be processed for the purposes of the Controller’s legitimate interests consisting, in particular, of the Controller’s ability to establish or assert possible claims or defend against such claims in connection with Article 6(1) para. f of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU. L. 2016 No. 119, p. 1 as amended) - hereinafter ‘GDPR’.

4. Protection of the whistleblower’s identity: As a result of the requirement to provide personally identifiable information in the notification, your personal data, shall not be disclosed to unauthorized persons (i.e. persons outside the team responsible for the investigatory proceedings of the notified case), except with your express consent.

5. Specific cases where whistleblower’s data may be disclosed: In connection with investigations carried out by public authorities or pre-trial or judicial proceedings carried out by courts, including for the purpose of guaranteeing your rights of defense, your data may be disclosed when such action is a necessary and proportionate obligation under the law. Before such disclosure is made, the competent public authority or the competent court will notify you by sending you an explanation in paper or electronic form of the reasons for the disclosure of your personal data. The notification will not be provided if it may jeopardize the explanatory, preparatory, or judicial proceedings.

6. The Controller shall ensure the confidentiality of your data, in relation to the notification received. Therefore, the data may be disclosed only to entities authorized to do so under the provisions of law and to entities to which the Controller has entrusted data processing, i.e. entities providing services to the Controller in relation to the receipt of a notification or investigation, including, in particular, entities which are providers of IT systems and services, postal or courier operators, entities providing legal services.

7. Personal data processed in connection with the acceptance of a notification, investigatory proceedings or follow-up and documents relating to that notification shall be retained for a period of 3 years after the end of the calendar year in which the notification was transmitted or the follow-up was completed, or after the proceedings initiated by those proceedings have been terminated. Personal data that are not relevant to the processing of the notification shall not be collected and, if accidentally collected, shall be deleted immediately. The deletion of such personal data shall take place within 14 days of the determination that it is not relevant to the case.

8. You have the right to request access to your personal data, as well as to have it rectified (amended). You also have the right to request erasure or restriction of processing, as well as the right to object to processing, but you only have this right if further processing is not necessary for the Controller to comply with a legal obligation and there are no other overriding legal grounds for processing.

9. You have the right to lodge a complaint against the processing carried out by the Controller to the President of the Personal Data Protection Office (www.uodo.gov.pl) if you consider that the processing of personal data concerning you violates the provisions of the GDPR.

10. The provision of data is voluntary and does not constitute a condition for us to accept your notification. If you do not provide your contact data, we will not be able to confirm acceptance of your notification and process your notification.

11. Your personal data will not be subject to profiling nor, on the basis of this data, will decisions be taken in an automated manner.

Contacting the Ombudsman

The Ombudsman can be contacted by anyone who believes that their rights have been violated by the state, that they are being treated unequally.

Citizens’ information line: 800 676 676, e-mail biurorzecznika@brpo.gov.pl,

Correspondence address: Office of the Ombudsman, Solidarności Avenue 77, 00-090 Warsaw.

It is also possible to submit a notification in sign language, anonymously through the contact form on the website or in person at one of the branches.

Annex 2 - Template of the Whistleblower’s consent to the disclosure of his/her identity

CONSENT TO DISCLOSURE OF THE WHISTLEBLOWER’S IDENTITY

..............................................

Name

..............................................

Address of residence

..............................................

E-mail address or telephone number

I hereby give my consent to the disclosure of my personal data, allowing for the establishment of my identity, to unauthorized persons by ALOKAI Sp. z o.o. with its registered office in Warsaw, 2 Przeskok Street, 00-032 Warsaw (hereinafter: the ‘Company’). I acknowledge that giving consent is voluntary and that consent may be withdrawn at any time; withdrawal of consent does not affect the lawfulness of the processing carried out before its withdrawal.

Whistleblower Statement:

I acknowledge that:

- my consent does not apply where disclosure is a necessary and proportionate legal obligation in connection with investigations carried out by public authorities or in connection with preliminary or judicial proceedings carried out by the courts, including in order to guarantee the right of defense of the reported person, I am informed that the disclosure of my personal data in this case entails the possibility of identification of my identity by the authorities, institutions and their representatives to which the report will be forwarded/notified/initiated or otherwise acted upon in connection with such follow-up action;

- I have been informed that if I consent to the disclosure of my identity to unauthorized persons by the Company, the data may be made available to unauthorized persons by the Company, i.e. the persons indicated in the notification or the persons affected by the notification (in the exercise of the information obligation under Article 14 of the GDPR by the Company or in the exercise of the right of such persons to access their personal data under Article 15 of the GDPR).

........................................................................

(legible signature)

Annex 3 - Model information clause on the processing of the Whistleblower’s personal data (clause after consent to disclosure of the Whistleblower’s identity)

Information clause regarding the processing of whistleblower’s

personal data in connection with the consent to disclose their personal data

3. Personal data will be processed on the basis of Article 6(1)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ. EU. L. 2016 No. 119, p. 1 as amended) - hereinafter ‘the GDPR’ (consent to disclosure of identity), in connection with the provisions of the Act of 14 June 2024 on the protection of whistleblowers (Journal of Laws No. 928), in order to perform tasks related to the handling of internal notifications, including the disclosure, in justified cases, of the identity of the whistleblower.

4. Personal data will be made available only to entities authorized to process them under the law. Personal data will be made available to entities providing, on the basis of contracts concluded by the Controller support for the Controller’s activities (e.g. IT service providers). Personal data may be made available to external entities supporting the Controller in receiving internal requests. Personal data will be made available to separate controllers, i.e. competent authorities, in the event of follow-up, personal data allowing for the identification of the whistleblower may be made available to the persons affected by the notification or indicated in the notification.

5. The personal data will be kept for a period of 3 years after the end of the calendar year in which the follow-up actions have been completed or the proceedings initiated by these actions have ended.

6. You have the right of access to the content of your data and the right to rectification, deletion in cases provided by law and restriction of processing, and to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out before its withdrawal. If you withdraw your consent to the disclosure of your identity, your personal data will not be shared (from the moment you withdraw your consent).

7. You have the right to lodge a complaint against the processing carried out by the Controller to the President of the Personal Data Protection Office (www.uodo.gov.pl), if you consider that the processing of personal data concerning you violates the provisions of the GDPR.

8. The provision of personal data is voluntary.

9. Personal data will not be subject to profiling nor, on the basis of such data, will decisions be taken in an automated manner.

Annex 4 - Model information clause concerning the processing of the personal data of the person to whom the Report relates

Information clause on the processing of personal data of the person to whom the Report relates

3. Your personal data will be processed on the basis of Article 6(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU. L. 2016, No. 119, p. 1, as amended) - hereinafter the ‘the GDPR’ - obligation of the controller, in connection with the provisions of the Act of 14 June 2024 on the protection of whistleblowers (Journal of Laws No. 928), in order to perform tasks related to the handling of internal notifications.

4. The Controller will process the following personal data, indicated in the whistleblower’s notification: .................... (to be completed according to the facts) - as personal data relating to the person to whom the notification concerns, understood as the natural person indicated in the notification as a person who has committed a violation of the law, or as a person with whom the person who has committed a violation of the law is associated.

5. Your personal data has been provided by the whistleblower, i.e........................ (provide the data of the whistleblower if the whistleblower has consented to the disclosure of his/her identity or if the whistleblower has not fulfilled the requirements set out in Article 6 of the Law on the Protection of Whistleblowers. Otherwise delete).

6. Personal data will only be shared with entities authorized to process them under the law. Personal data will be made available to entities providing, on the basis of contracts concluded by the Controller, support for the Controller’s activities (e.g. IT service providers). Personal data may be made available to external entities supporting the Controller in receiving internal requests. Personal data will be shared with separate controllers, i.e. competent authorities, in case of taking follow-up actions.

7. Personal data will be retained for a period of 3 years after the end of the calendar year in which the follow-up action is completed or after the proceedings initiated by the follow-up action are completed.

8. You have the right of access to the content of your data, with the proviso that the provision of Article 15(1)(g) of the GDPR regarding the provision of information about the source of the personal data does not apply, unless the whistleblower does not meet the conditions indicated in Article 6 of the Act of 14 June 2024 on the protection of whistleblowers or has expressly consented to such provision.

9. You have the right to rectification of personal data, deletion in cases provided for by law and restriction of processing.

10. You have the right to lodge a complaint against the processing carried out by the Controller to the President of the Personal Data Protection Office (www.uodo.gov.pl), if you consider that the processing of personal data concerning you violates the provisions of the GDPR.

11. The provision of your personal data to the Controller is voluntary and occurred in the whistleblower notification.

12. Your personal data will not be subject to profiling nor, on the basis of such data, will decisions be taken in an automated manner.

Annex 5 - Model information clause relating to the processing of personal data of a third party indicated in the Report

Information clause regarding the processing of personal data of a third party indicated in the whistleblower’s notification

3. Your personal data will be processed on the basis of Article 6(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ. EU. L. 2016 No. 119, p. 1 as amended) - hereinafter the GDPR - the obligation of the controller, in connection with the provisions of the Act of 14 June 2024 on the protection of whistleblowers (Journal of Laws No. 928), in order to perform tasks related to the handling of internal notifications.

4. The Controller will process the following personal data, as indicated in the whistleblower notification: …………………….

(to be filled in according to the facts)

- as personal data of the so-called third party indicated in the notification.

5. Your personal data has been provided by the whistleblower, i.e........................

(provide the data of the whistleblower if the whistleblower has consented to the disclosure of his/her identity or if the whistleblower has not fulfilled the requirements set out in Article 6 of the Law

on the Protection of Whistleblowers. Otherwise delete).

8. You have the right of access to the content of your data, with the proviso that the provision of Article 15(1)(g) of the GDPR regarding the provision of information about the source of the personal data does not apply unless the whistleblower does not meet the conditions indicated in Article 6 of the Act of 14 June 2024 on the protection of whistleblowers or has given his/her express consent to such provision.

9. You have the right to rectification of personal data, deletion in cases provided for by law and restriction of processing.

11. The provision of your personal data to the Controller is voluntary and occurred in the whistleblower notification.

12. Your personal data will not be subject to profiling nor, on the basis of such data, will decisions be taken in an automated manner.

Annex 6 - Sample Internal Report Register

PLAIN TEXT of the Alokai Code of Conduct

ALOKAI SP. Z O.O.

CODE OF CONDUCT

Introduction

Alokai Sp. z o.o. with its headquarters in Warsaw and its related entities: Alokai Inc. (together the “Company”) is committed to acting ethically and conducting business in compliance with all applicable laws. This Code of Conduct (the “Code”) sets out basic guidelines, rules, and principles for how employees, co-workers, contractors and consultants of the Company, as well as management staff (“Co-workers”) are expected to act when conducting business on behalf of the Company.

The Company may have additional principles and procedures which supplement this Code. Further, Co-workers may sign a separate agreement with the Company to protect Confidential Information and to transfer intellectual property. Each Co-worker is obliged to comply with such principles, procedures and agreements.

In case of any questions about any provision of this Code, each Co-worker can seek guidance from the Company’s People & Culture Department (“P&C Department” or “People & Culture Department”).

Compliance with Laws, Rules & Regulations

The Company takes its responsibility to comply with applicable laws very seriously. The Co-worker must follow all applicable provisions of law. Each Co-worker should know the significant laws, rules and regulations that apply to the Co-worker’s performance of duties for the Company.

Conflicts of Interest

While performing duties for the Company, the Co-worker is obliged to act in the Company’s best interest at all times and avoid conflicts of interest.

A conflict of interest is a situation where an opportunity for personal gain is contrary to the Company's best interests. The Co-worker must use good judgment and, when in doubt, consult the matter with the P&C Department in order to avoid situations that create actual, potential, or perceived conflicts of interest. The Co-worker shall consult the situation with their supervisor and the People & Culture Department before taking any action that may cause conflict of interest.

A potential conflict of interest must be appropriately disclosed by the Co-worker and then discussed and managed by the Co-worker’s supervisor and the People & Culture Department.

Conflicts of interests can appear in many different forms, including:

holding shares in companies conducting (or intending to conduct) activities which compete with the Company, performing advisory functions or sitting on bodies of such companies;

any form of cooperation with companies conducting (or intending to conduct) activities which compete with the Company, in particular providing work or services to these companies;

conducting the Company’s business with the family members of the Co-worker or other related persons or entities;

accepting financial benefits related to performance of official duties for the Company, directly or indirectly through a family member or other related person; and

entering a personal relationship with a subordinate or supervisor, unless such relationship is disclosed to the appropriate supervisor and the P&C Department.

If a Co-worker believes a conflict of interest may exist, they should promptly notify their supervisor and the P&C Department. The P&C Department will consider all the facts and circumstances of the situation to decide what action is appropriate in order to avoid such conflict of interest. If the Company determines that that activity interferes with the Co-worker’s ability to perform their duties for the Company or it poses an actual conflict of interest for the Company, the Co-worker may be asked to terminate such activity.

Safe and Healthy Workplace (Only Applies to Employees)

Company operates with a part of the employees working remotely (outside of the Company’s designated office), in particular from their homes. Due to the above, employees are expected to follow the appropriate rules for occupational health and safety (i.e. keeping workspace well lit, ensuring correct monitor settings and that the electric cords are safely secured, etc.). Employees who have suffered an accident while performing their work duties remotely are required to immediately notify the P&C Department of the accident, if possible.

Professional Work Environment

The Company strives to maintain a professional work environment. Use of alcohol, illegal drugs, or any psychoactive substances, whether on or off the job, can negatively affect work performance, efficiency, safety, and health and, directly or indirectly, seriously impair the Company’s image, interests and activity.

Specifically, this Code prohibits:

● possession, use or being under the influence of alcohol, illegal drugs or any psychoactive substances while performing duties for the Company

● driving a vehicle while under the influence of alcohol, illegal drugs or any psychoactive substances while performing duties for the Company; distribution, sale, or purchase of alcohol, illegal drugs or any psychoactive substances while performing work duties for the Company.

Moderate consumption of alcohol by legal-age individuals at Company-sponsored events is permitted. Everyone involved must exercise good judgment, act professionally and responsibly, and follow directions provided for the Company event. Attendance at Company social events is not mandatory. Furthermore, attendees should not be pressured to consume alcoholic beverages.

Anti-Harassment and Anti-Discrimination Policy

The Company believes that a supportive and respectful workplace, where everyone feels comfortable and included, is key to success. The Company undertakes to combat discrimination at the workplace, in particular discrimination based on age, sex, race, nationality, sexual orientation, health condition, disability, ethnic background, religion, creed or lack thereof, political beliefs, family status, lifestyle, scope and basis of employment or other types of cooperation. The Company believes that diversity of backgrounds, perspectives and opinions fuels innovation and creates a supportive work environment.

The Company does not discriminate in any employment decisions, including decisions on hiring, cooperation, compensation, promotion, discipline, or termination of agreements.

The Company strives to maintain a professional environment based on respect, tolerance and equal opportunities. Discrimination or harassment will not be tolerated and appropriate consequences will be imposed on the perpetrators of such behaviours. Co-workers undertake to assist in maintaining a respectful workplace culture that is based on respect, free of harassment, bias, and unlawful discrimination of any kind. The Company has implemented an Anti-Harassment and Anti-Discrimination Policy attached as Appendix 1 to this Code.

Outside Employment (Only Applies to Employees)

Employees are fully committed to performing their duties for the Company. A Co-worker may not start their own business if it competes with the Company’s business, or cooperate with any entity competing with the Company’s business.

Protection of Intellectual Property

The Company's trademarks, logos, copyrights, trade secrets, "know-how", and patents ("Intellectual Property") are the Company’s valuable assets. Unauthorized or inappropriate use of the Intellectual Property can lead to its loss and significant loss of value. Co-worker is obliged to use the Company's Intellectual Property in accordance with the nature and intended use of the Company’s Intellectual Property. Co-worker must respect the Intellectual Property of third parties, in particular, refrain from infringing Intellectual Property rights of other parties and use the intellectual property of third parties in a manner agreed with these third parties and in accordance with the applicable provisions of law.

Protection of Confidential Information and the Company’s Assets

The Company is committed to keep all confidential and proprietary information ("Confidential Information") confidential. While implementing its confidentiality obligations, the Company exercises the utmost care and acts in accordance with applicable provisions of law.

While performing duties for the Company, Co-workers routinely gain access to Confidential Information of the Company or the Company’s business partners. Accordingly, Co-workers are also obligated to maintain the confidentiality of the Company’s (and its business partners’) Confidential Information, which they learn of during their collaboration with the Company, particularly trade secrets. Breach of trade secrets, according to EU Directive 2016/943 and the applicable laws in the respective country, constitutes an offense or crime. The Company's Confidential Information includes any undisclosed technical, technological, commercial, or organizational information (know-how) of the Company, for which the Company or its authorized persons have taken necessary actions to maintain confidentiality, and such information does not need to be explicitly marked as confidential.

In particular, Co-workers may not disclose Confidential Information to third parties, including family, friends, and other Co-workers, unless the disclosure of Confidential Information is justified by the duties performed by these Co-workers or has been approved by the Company. Generally, the disclosure of Confidential Information should be subject to a non-disclosure agreement.

Before accepting any Confidential Information from third parties, the parties must sign a non-disclosure agreement approved by the law firm or in-house or external legal counsel cooperating with the Company. If a Co-worker believes that they inadvertently came into possession of a third party's Confidential Information, the Co-worker is obliged to seek advice from the P&C Department.

Upon termination of the Co-worker’s employment or cooperation with the Company, irrespective of the grounds for the termination, the Co-worker must return or destroy all Confidential Information in their possession, as instructed by the Company.

Protection of the Company’s Assets

As part of the performance of work or services by the Co-worker for the Company, the Company may provide the Co-worker with access to a computer, cell phone or other devices, as well as access to the Company’s e-mail system, the Internet, and other third party applications ("Devices"). Co-worker must use the Devices solely for the benefit of the Company, for purposes in connection with the performance of work or services for the Company. The Company may monitor anything created, stored, sent, or received in using such Devices. Co-worker shall not use the Devices, including the use of business e-mail, to violate the law or principles of the Company. Further, creating, storing or sending content that others might find offensive is prohibited.

Privacy and Data Protection

The Company undertakes to protect the data privacy of the Company’s Co-workers, customers, potential customers, business partners, suppliers and Company’s website visitors. A Co-worker who gains access to personal data is obliged to be familiar with the internal policies that apply to privacy and personal data protection, as well as with the obligations that apply to privacy and personal data protection arising from the agreement between the Co-worker and the Company. Co-worker is obliged to comply with the above indicated principles and obligations, as well as with the applicable provisions of law regarding privacy and personal data protection.

Business Meals, Company Events and Other Business Events

The Company expects everyone acting on its behalf to perform their duties honestly, reliably and ethically, in accordance with the applicable provisions of law and the Company’s principles.

Co-workers may participate in infrequent and moderate business meals and company events with customers, suppliers and other business partners as part of building business relationships with these entities (“Business Events”). Business Events should be occasional, appropriate and moderate. Co-Worker undertakes to duly represent the Company during Business Events, in particular to act in a responsible and professional manner. Before offering or accepting an invitation to a company event of the customer, supplier or another business partner, Co-worker must obtain Company’s permission.

Giving and Receiving Business Gifts

Co-workers and members of their families may accept appropriate and moderate business gifts as part of building relationships with other Co-workers, customers, suppliers or business partners of the Company (“Business Gifts”), subject to the following conditions:

● Cash and gift cards with a value greater than reasonable are not Business Gifts;

● the Business Gift is consistent with customary business practices;

● the Business Gift is appropriate, specifically, there is not any subtext directed at the recipient of the gift, and the gift is not a bribe; the Business Gift should be reasonable in value;

● Granting of the Business Gift does not violate any rights of third parties, applicable provisions of law or the Company’s principles.

Except for symbolic gifts, Co-worker may not receive any income or material gain from a third party in connection with the Co-workers’ performance of duties for the Company. The above described material gain shall not be considered as Business Gifts.

Anti-Corruption Policy

Co-worker undertakes to be truthful and transparent during interactions with customers, suppliers, and business partners. Influencing the decisions of a customer, supplier or business partner through improper payments or making other illicit offers is strictly prohibited. The Company believes that acting with integrity is the basis of conducting business activity and the only way to acquire and preserve the trust of customers, suppliers or other business partners.

In particular, the following shall be prohibited:

Bribery - offering or giving any material gain in order to influence the actions of the recipient of the bribe. Bribe can take the form of cash, as well as its equivalents, such as expensive gifts, i.e. plane tickets, vouchers for expensive hotels, charitable contributions and offers of employment.

Facilitation payments - offering or giving tips or small monetary benefits to a government official or any public official in order to obtain or expedite the issuance of a decision.

Kickback - returning of a sum paid (or due to be paid) in connection with business cooperation, which is or can be construed as a reward for fostering a business arrangement.

Fair Competition

The Company believes in free and open competition and outperforming the Company’s competitors fairly and honestly with products and services of superior quality. Co-worker must adhere to all applicable laws, as well as obligations that apply to fair trading arising from the agreement between the Co-worker and the Company.

In particular, the following conduct is prohibited:

undertaking any activities deemed as unfair competition, in accordance with general competition law principles applicable in the relevant jurisdiction, including international antitrust standards and competition regulations.
agreeing with competitors about prices;
concluding agreements with entities competitive to the Company;
hindering other entities’ access to the market, in particular concluding agreements which would restrict free trade;
agreeing with competitors on prices, bids or to allocation of customers or markets;
agreeing with competitors to boycott a supplier or a customer;
violating the intellectual property rights of third parties;
violating business secrets, i.e. disclosure or the use of Confidential Information, and
entering a business arrangement or pursuing a strategy with the sole purpose of harming a competitor of the Company.

Company offers products and services which are competitive because of their quality. Communication with customers or potential customers of the Company must be transparent and reliable at all times. Statements made on behalf of the Company about its products and services must be truthful. All marketing, promotional and advertising materials must be approved by the competent authority of the Company or an entity authorized by the Company through an appropriate approval process before they are published.

Import and Export Controls

The Company and the Co-workers must adhere to provisions of law and other applicable regulations when delivering products or services internationally.

Co-workers must be familiar with appropriate provisions of law and procedures for imports and exports, and they must adhere to them. If a Co-worker is involved in international transactions, they must know what steps are required to ensure that the Company complies with the law, in particular, the Co-worker should be familiar with any requirements related to taxes, licensing and appropriate permits.

Questions and Reporting a Violation of this Code

In case of any questions or doubts regarding this Code, and in case of uncertainty whether the Co-worker’s complies with this Code, this Co-worker or another Co-worker who has such doubt, shall seek guidance from their supervisor and the P&C Department.

Co-worker must report, in good faith, any actions or events which may be possible violations of this Code, regardless if the action or event turns out to be a violation or not. The Company undertakes not to draw any negative consequences from such notices made in good faith by the Co-worker. The Company will investigate reports respectfully and professionally, as promptly and confidentially as possible. A Co-worker asked to participate in an investigation is obliged to cooperate fully.

Violations of this Code are taken very seriously and may bring about consequences, which can cause the Company to terminate the agreement between the Company and the Co-worker. In cases of particularly egregious or significant breaches of the provisions of this Code of Conduct, the Company shall be entitled to terminate the contract with the Co-worker immediately, without notice

Furthermore, violation of applicable provisions of law may entail disciplinary action.

Appendix No. 1 to the Code of Conduct at Alokai Sp. z o.o.

Anti - Harassment and Anti - Discrimination Policy

at Alokai Sp. z o.o.

Chapter I

§ 1

General principles

Alokai Sp. z o.o. is a company that does not tolerate discrimination harassment and workplace bullying. These behaviors are contrary not only to the law, but also to our values. We want to ensure that each Co-worker has the right to perform work or provide services in a professional environment, full of tolerance, respect and equal opportunities.
Drawing consequences for the perpetrators of harassment, discrimination and unequal treatment is of fundamental importance to us and is an expression of our opposition to such behavior.
The purpose of introducing Anti-Harassment and Anti-Discrimination Policy in the Company is to prevent workplace bullying, harassment, discrimination and unequal treatment, and to establish rules of conduct in case of reporting a suspicion of the occurrence of one of the above mentioned unwanted behaviors.

§ 2

Definitions

The following meanings are hereby adopted for the following capitalized terms, whether used in the singular or plural:

Direct Discrimination - a situation in which a person, in particular on the basis of age, sex, race, nationality, sexual orientation, health condition, disability, ethnic origin, religion, creed or lack thereof, political beliefs, family status, lifestyle, scope and basis of employment or other types of cooperation, is treated less favourably than is or was treated by another person in a comparable situation;
Indirect Discrimination - a situation where, on one or more of the grounds set out in (a) above, an apparently neutral provision, criterion applied or action taken results in, or could result in, a disadvantageous disparity or a particular disadvantage, unless the provision, criterion or action is objectively justified in view of the legitimate aim to be achieved and the means of achieving that aim are appropriate and necessary;
(Anti-Harassment) Committee - Anti-Mobbing and Discrimination Committee established in the Company to review reports of suspected Unwanted Behavior;
Workplace Bullying - actions or behaviors concerning an Co-worker or directed against a Co-worker, consisting of persistent and prolonged harassment or intimidation of a Co-worker, causing them to be undervalued in terms of professional usefulness, causing or aimed at degrading or ridiculing a Co-worker, isolating them or eliminating them from the team of the Co-worker. This includes, but is not limited to:

Harassment and intimidation: repeated offensive comments or threats.
Degradation and ridicule: actions aimed at humiliating or mocking a Co-worker.
Isolation: deliberately excluding a Co-worker from team activities.
Excessive micromanagement: unjustified oversight of a Co-worker’s work.
Unrealistic deadlines: setting unachievable deadlines.
Unfair criticism: excessive or unjust criticism.
Lack of support: deliberately withholding necessary resources or assistance.
Intentional misleading: providing false or misleading information.
Insubordination: ignoring directives or authority.
Insulting behavior: using derogatory language and actions.
Lying and manipulation: deliberate misinformation or manipulation.
Unwarranted contact: making systematic and persistent work-related calls or sending messages to Co-workers outside of working hours without valid reason;

Sexual Harassment - any Unwanted conduct of a sexual nature or relating to the sex of a person which has the purpose or effect of violating the person's dignity, in particular, creating an intimidating, hostile, degrading, humiliating or derogatory environment towards them; this conduct may consist of physical, verbal or non-verbal interactions;
Unwanted Behavior - Any form of Workplace Bullying, Direct Discrimination, Indirect Discrimination, Sexual Harassment or other ‘unsocial’ behavior (aggressive attitudes, rudeness, neglect of responsibilities, or inappropriate actions);
Attorney - a person who is an Attorney against workplace bullying, harassment and discrimination appointed by the Management Board;
Policy - this Anti-Harassment and Anti-Discrimination Policy of the Company;
Supervisor - a person who has managerial authority in the Company's organization and who has the authority to give orders to personnel subordinate to the organizational hierarchy;
The Company - Alokai Sp. z o.o. with its registered office in Warsaw;
Co-worker - an employee, co-worker, contractor and consultant of the Company who is a natural person;
Management Board - the Management Board of the Company;
Notice - an application submitted by a Co-worker made in accordance with this Policy.

Chapter II

§ 3

Obligations of the Company

The Company is committed to ensuring that the work environment is free of Unwanted Behavior, and reminds Co-workers that it is their primary responsibility to foster correct principles of social intercourse in the work environment and its business environment.
All of the Company's decisions regarding hiring, co-op, promotion or salary increases are based on objective evaluations of experience, skills and performance.
The Company conducts activities aimed at raising the awareness of its Co-workers on Unwanted Behaviors by, among others:

Conducting trainings on anti-bullying and anti-discrimination issues, including information on current anti-discrimination and anti-bullying legislation,
Allowing Co-workers to evaluate relationships with Co-workers in the workplace,
familiarize each Co-worker with the contents of the Policy prior to beginning work or collaboration.

The statement confirming that the Co-worker has reviewed the Policy and commits to adhering to it is stored as an electronic document review confirmation and is kept in the Co-worker’s personnel file.

§ 4

Responsibilities of the Co-worker

The use of any of the Unwanted Behavior constitutes a serious breach of basic duties, both on the part of management and those in such roles.
The Co-worker is required to:

comply with the rules set forth in the Policy,
treat each other with kindness, respect, and dignity, demonstrating empathy, offering support, acknowledging contributions, and communicating openly and constructively,
not to abuse a privileged professional position, including in the Co-worker-Supervisor relationship. Co-workers must maintain professionalism, be punctual, meet deadlines, and work effectively in teams.
avoid conflicts, try to resolve any disagreements in an amicable manner without undue delay and without escalating the problem,
Participate in training sessions organized by the Company on anti-bullying and anti-discrimination issues,
immediately react and inform the Company of any noticed signs of Unwanted Behavior.

All Company executives have a special obligation to carefully observe the behavior of Co-workers and to respond appropriately and in a timely manner to Unwanted Behavior. In addition, their role is to make subordinates aware of the impact they have on those around them.
Each and every Co-worker who recognizes an Unwanted Behavior or who notices the Unwanted Behavior towards another Co-worker or the fact of encouraging the Unwanted Behavior is obliged to notify the Attorney in accordance with the procedure described below. In the case of lack of such notification, the Company may take appropriate consequences against such a Co-worker, including termination of the employment or other service agreement between the Co-worker and the Company, with immediate effect.

Chapter III

§ 5

Notice to Attorney

Notices of suspected Unwanted Behavior must be reported:

in writing to the Attorney's address: ethics@alokai.com,
directly to the supervisor or other representative of Management,
or through the Supervisor in writing to the Attorney's address: ethics@alokai.com .

The Notice should include:

A statement of the facts, including a description of events, if possible including time and place of events, frequency of events, surrounding circumstances,
Identify supporting evidence, including the names of persons who can demonstrate that the acts or conduct described in the Notice actually occurred;
identifying the person or persons by name who engaged in the Unwanted Behavior and identifying the person harmed by such action.

The Notice should be signed with your name.
An anonymous Notice may be recognized when its content allows, in particular: the scope of information about Unwanted behaviors and about the perpetrator of these behaviors and the person harmed by the perpetrator's Unwanted Behaviors.
Upon receipt of the Notice, the Attorney shall promptly record the Notice.

§ 6

Entitlement of the Company and the Attorney

The Company or the Attorney shall undertake actions indicated in the Policy also in the event of obtaining information on a suspicion of Unwanted Behavior from a source other than the Notice referred to in § 5 of the Policy.

§ 7

Actions of the Attorney

Upon receipt of a Notice, the Attorney shall take reasonable steps to investigate the validity of the Notice. In particular, the Attorney may initiate the proceedings referred to in §8 and §9 below.
In minor cases, the Commissioner may decide to take action without going before the Commission. In such a case, the Attorney shall hold explanatory or disciplinary talks with the parties concerned. The Attorney shall further take all necessary action to remedy the situation and prevent Unwanted Behavior in the future.

§ 8

Proceedings at the (Anti-Harassment) Committee

As a result of the filing of the Notice, if warranted by the contents of the Notice, the Committee shall, within not more than 14 business days after receipt of the Notice, convene a meeting.
The Committee's role is to objectively and fairly review the Notice and determine whether the Unwanted Behavior described in the Notice occurred.
The Committee consists of:

Attorney as Chairman of the Commission,
The Director of HR or his/her authorized designee,
an impartial Co-worker appointed by the Board,
other persons, including independent experts (e.g., legal counsel, psychologist), if their appointment by the Board of Directors is deemed necessary by the Chair of the Committee.

No member of the Committee shall be a person who has filed a Notice, a person whose conduct is the subject of proceedings before the Commission, or a person who is reasonably believed not to be impartial in the matter.
The members of the Committee shall act in accordance with the principles of confidentiality, impartiality, fairness, with the aim of comprehensively explaining the case and solving the problem.

§ 9

Work of the Committee

The Anti-Harassment Committee shall commence proceedings without undue delay and no later than 14 days after the first meeting.
The Committee shall endeavor to consider the Notice within a period not exceeding 30 days. The Committee may extend the proceedings in particularly justified cases.
The proceedings before the Committee, including evidence and facts established in the course of such proceedings, constitute Confidential Information. Proceedings before the Committee shall be conducted with respect for the rights and with particular care for the protection of participants in the proceedings.
At the request of the Committee, the Company must make available to the Committee required documents and provide all necessary information to establish the circumstances of the case.
The parties to the proceeding (i.e., the person who filed the Notice, the person alleged to have engaged in unwanted conduct, and the aggrieved person) have an equal right to be heard by the Committee.
After hearing the parties to the proceeding and other persons called as witnesses, the Committee shall decide on the merits of the Notice.
A report shall be drawn up on the work of the Committee and signed by all members of the Committee. The report shall include: a description of the facts, the evidence carried out, the Committee's decision together with the reasons for its position, the proposed remedial and corrective measures for the identified violations.
The report will be provided to the Management Board immediately.
The Committee shall acquaint the parties to the proceeding with the conclusions and recommendations of the report.

§ 10

Activities of the Management Board

On the basis of the Anti-Harassment Committee's report, the Management Board takes actions aiming at eliminating identified irregularities and prevents their recurrence, following the principle of proportionality to the occurring violation of the Policy's provisions and the law.
If the Notice is found to have merit, the Board may:

with reference to an employee, with whom the Company is bound by the employment contract - apply the legal measures of disciplinary character provided by the law with reference to the perpetrator of the Unwanted Behavior, in particular, order penalties, termination of employment and remuneration conditions, termination of employment;
in relation to Co-workers with whom the Company is bound by a cooperation agreement - the Management Board may immediately terminate cooperation with such a person,
refer the perpetrator to training on preventing Unwanted Behavior or disparate treatment,
transfer the aggrieved Co-worker, at the Co-worker's request or with the Co-worker's consent, to another position appropriate to the Co-worker's qualifications, which will prevent direct contact between the aggrieved Co-worker and the perpetrator of the Unwanted Behavior;
deprive the perpetrator of rights under labor laws that are contingent on not violating employee obligations, such as bonuses or awards.

The Board shall be entitled to apply the measures referred to in paragraph 2 above also to persons who intentionally slander the commission of Unwanted Behavior.

Chapter IV

§ 11

Confidentiality

Proceedings triggered by the filing of a Notice are confidential and will not be disclosed to other Co-workers or third parties except as necessary to investigate and conduct proceedings in connection with the Notice or as required by law.
All persons participating in the proceedings caused by the Notice, are obliged to maintain secrecy of all the facts and circumstances, with which they became acquainted in the course of the proceedings. Violation of this rule shall constitute a violation of the obligations of an employee or arising from the cooperation agreement with the Co-worker and may result in liability for disciplinary action or termination of the employment relationship or cooperation agreement with immediate effect.
The contents of the documentation of the proceedings are confidential. It can be viewed by the Attorney, members of the Committee, the Management Board and, if necessary, persons additionally authorized by the Management Board.
Members of the Committee, Parties to the proceeding and persons who are witnesses in the case are required to submit a written statement of confidentiality of everything they learn in the course of the proceeding. A template of the declaration is attached as Appendix No. 1 to this Policy.

Chapter V

§ 12

Final provisions

The exercise of the rights set forth in the Policy, in particular the filing of a Notice, shall not be a basis for adverse treatment and shall not result in adverse consequences, in particular it shall not constitute a reason justifying termination of employment by the Company.
The policy is effective as of June 01, 2022.

Appendix No. 1

ANTI-HARASSMENT PARTICIPANT CONFIDENTIALITY STATEMENT

I the undersigned

.................................................................

(name of Participant)

I hereby certify that as a Member of the Committee/Party to the Proceeding/Witness/other character of Participant: [NAME] in a case from a report of Unwanted Behavior (within the meaning of the Anti-Harassment and Anti-Discrimination Policy at Alokai Sp. z o.o.) Mr./Ms. [NAME] submitted to the company Alokai Sp. z o. o. with its registered office in Warsaw and examined by the appointed Anti-Harassment Commission, I oblige myself - both during my testimony and after the Anti-Harassment Commission has examined the complaint - to keep it secret and not to disclose to third parties any information possessed in this matter.

on date …………………………………….

………………………………………………….. (legible signature of the Participant)