1. PURPOSE & SCOPE
This Policy of IAMEX S.A. aims to establish an internal system for reporting breaches of EU law, to protect persons who report such breaches and to organize the procedure for submitting, receiving and following up reports.
This Policy applies to persons who report information on breaches acquired in a work-related context, namely:
a) the employees of the Company, regardless of the type of contract binding them to the Company,
b) collaborators of any kind, under contracts for work, independent services or paid mandate,
c) the shareholders and the members of the Board of Directors of the Company,
d) persons whose employment relationship has ended for any reason, including retirement, as well as persons whose employment relationship has not yet begun, where information on breaches has been acquired during the recruitment process or at another stage of pre-contractual negotiations.
2. RESPONSIBLE PERSONS
2.1. Reports Receipt and Follow-up Officer (RRFO)
3. GENERAL
This Policy is aligned with the principles of Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law, which was transposed into the Greek legal order by Law 4990/2022, as well as with the international best practices developed for internal reporting.
This Policy applies to the protection of persons who report or disclose:
a) breaches of acts of EU law, as specifically set out in Part I of the Annex to Law 4990/2022, as well as of any acts subsequently adopted as secondary legislation thereunder, in the following areas: i) public procurement, ii) financial services, products and markets, and prevention of money laundering and terrorist financing, iii) product safety and compliance, iv) transport safety, v) protection of the environment, vi) radiation protection and nuclear safety, vii) food and feed safety, animal health and welfare, viii) public health, ix) consumer protection, x) protection of privacy and personal data, and security of network and information systems,
b) breaches affecting the financial interests of the Union as referred to in Article 325 of the Treaty on the Functioning of the European Union (TFEU), i.e. cases of fraud or any other illegal activity affecting the financial interests of the EU, as further specified in the relevant Union measures,
c) breaches relating to the internal market, i.e. the area of the EU within which the free movement of goods, persons, services and capital is ensured, as referred to in Article 26(2) TFEU, including breaches of Union competition and State aid rules, as well as breaches relating to the internal market in relation to acts which breach the rules of corporate tax or to arrangements the purpose of which is to obtain a tax advantage that defeats the object or purpose of the applicable corporate tax law.
4. DEFINITIONS
4.1. In this Policy, the following definitions apply:
a. "Report": the provision of information on breaches falling within the scope of this Policy to the Company's Reports Receipt and Follow-up Officer (RRFO).
b. "Person concerned": a natural or legal person who is named in the report as a person to whom the breach is attributed or with whom that person is associated, in relation to a breach falling within the scope of this Policy.
c. "Reporting person": the natural person who makes a report, providing information on breaches acquired in a work-related context.
d. "Retaliation": any direct or indirect act or omission which occurs in a work-related context, causes or may cause unjustified detriment to the reporting person or places them at a disadvantage, and is linked to a report.
e. "Reasonable grounds": the justified belief of a person with similar knowledge, training and experience as the reporting person that the information they hold is true and constitutes a breach of Union law falling within the scope of this Policy.
f. "Feedback": the provision to reporting persons of information on the action envisaged or taken as follow-up and on the grounds for such follow-up.
g. "Work-related context": current, past or prospective work activities at the Company, irrespective of the nature of those activities, through which persons acquire information on breaches and within which those persons could suffer retaliation if they reported such information.
h. "Breaches": acts or omissions that are unlawful under Union law or defeat the object or purpose of the rules of Union law falling within the material scope of this Policy.
i. "Information on breaches": information, including reasonable suspicions, about breaches which have been committed or are very likely to be committed at the Company, as well as about attempts to conceal such breaches.
j. "Reports Receipt and Follow-up Officer" or "RRFO": the officer responsible for receiving and following up reports on breaches falling within the scope of this Policy, whose duties are assigned to the head of the Compliance Key Function.
5. REPORTS RECEIPT AND FOLLOW-UP OFFICER
5.1. The RRFO is responsible for managing the system for internal and external reporting of breaches of EU law maintained and applied by the Company, in accordance with Article 9 of Law 4990/2022.
5.2. In particular, the RRFO has the following responsibilities:
a) provides appropriate information on the possibility of submitting a report within the Company and posts such information in a prominent place within the Company,
b) receives reports, whether submitted in writing, orally or via an electronic platform, concerning breaches falling within the scope of Law 4990/2022,
c) acknowledges receipt of the report to the reporting person within seven (7) working days of the date of receipt,
d) takes the necessary steps for the report to be dealt with by the competent bodies of the Company or by the competent authorities, as the case may be, or closes the procedure by filing the report if it is incomprehensible, is submitted abusively, or does not contain facts which, even if assumed to be true, would constitute a breach of EU law, or if there are no serious indications of such a breach, and notifies the relevant decision to the reporting person, who, if they consider that the report has not been dealt with effectively, may resubmit it to the National Transparency Authority, which, as the external reporting channel, exercises the powers provided for in Article 12 of Law 4990/2022,
e) ensures the protection of the confidentiality of the identity of the reporting person and of any third party named in the report, by preventing access to it by unauthorized persons,
f) follows up the reports and maintains communication with the reporting person and, where necessary, requests further information from them,
g) provides feedback to the reporting person on the action taken within a reasonable timeframe, not exceeding three (3) months from the acknowledgment of receipt or, if no acknowledgment was sent to the reporting person, three (3) months from the expiry of seven (7) working days after the report was submitted,
h) provides clear and easily accessible information on the procedures for submitting reports to the National Transparency Authority and, where relevant, to public bodies or to institutions, bodies or agencies of the European Union,
i) designs and coordinates training activities on ethics and integrity and participates in drawing up internal policies to strengthen integrity and transparency within the Company, and
j) ensures that the performance of their duties does not jeopardize their independence as RRFO and does not give rise to a conflict of interest in relation to the above responsibilities.
k) maintains a register of reports.
5.3. The RRFO has a general obligation to: a) perform their duties with integrity, objectivity, impartiality, transparency and social responsibility, b) respect and observe the rules of discretion and confidentiality regarding matters that came to their knowledge in the performance of their duties, c) abstain from handling specific cases, declaring an impediment, where there is a conflict of interest.
5.4. The Company has appointed Ms. Maria Chronaki as RRFO for a term of three (3) calendar years, i.e. from 10 October 2024 to 9 October 2027.
6. REPORTING PROCEDURE
6.1. The Company establishes easily accessible reporting channels, encourages the reporting of incidents falling within the scope of this Policy and guarantees that all reports received are treated confidentially.
6.2. Reports may be submitted as follows:
a) in writing, by email to compliance@iamex.gr, b) in writing, by post addressed to the Company's RRFO at 5 Achaias Street, Nea Kifisia, Postal Code 145 64,
c) orally, by telephone at +30 210 6298412 or via another voice messaging system,
d) by means of a physical meeting with the RRFO within a reasonable timeframe, at the request of the reporting person, and
e) electronically, via the reporting platform accessible through the Company's website, by completing and submitting the dedicated Breach Reporting Form. The form allows reports to be submitted with full anonymity, as no personal details of the reporting person are required and there is no field for entering them.
6.3. Where a telephone line or other voice messaging system is used for reporting, recording of the conversation is permitted provided that the reporting person has lawfully consented. The RRFO has the right to document the oral report either by recording the conversation in a durable and retrievable form or by a complete and accurate transcript of the conversation, offering the reporting person the opportunity to check, rectify and agree the transcript of the conversation by signing it.
6.4. Where a telephone line or other voice messaging system without recording is used for reporting, the RRFO has the right to document the oral report in the form of accurate minutes of the conversation drawn up by the RRFO, offering the reporting person the opportunity to check, rectify and agree the minutes of the conversation by signing them.
6.5. Where a person requests a meeting with the RRFO in order to make a report, complete and accurate records of the meeting shall be kept in a durable and retrievable form, subject to the consent of the reporting person, either by recording the conversation in a durable and retrievable form or through accurate minutes of the meeting drawn up by the RRFO, offering the reporting person the opportunity to check, rectify and agree the minutes of the meeting by signing them.
6.6. Where a report is submitted anonymously via the electronic platform, the reporting person accepts that, due to the absence of contact details, it is not possible to inform them about the progress and/or outcome of the investigation of the reported incident.
6.7. Reports must be governed by the principle of good faith on the part of the reporting person, i.e. the reporting person must have reasonable grounds leading to a reasonable belief that the information provided is true.
7. REPORT MANAGEMENT PROCEDURE
Once any report (other than an anonymous one) is submitted, the following handling and investigation procedure shall be followed. The RRFO: 1) Acknowledges receipt of the report to the reporting person immediately and in any case within seven (7) working days of the date of receipt. 2) Takes the necessary steps for the report to be dealt with by the competent bodies of the Company or by the competent authorities, as the case may be, or closes the procedure by filing the report if it is incomprehensible, is submitted abusively, or does not contain facts which, even if assumed to be true, would constitute a breach of EU law, or if there are no serious indications of such a breach, and notifies the relevant decision to the reporting person, who, if they consider that the report has not been dealt with effectively, may resubmit it to the National Transparency Authority (NTA). Instructions on the procedure for submitting a report to the NTA are posted on its website www.aead.gr. 3) Provides feedback to the reporting person on the action taken within a reasonable timeframe, not exceeding three (3) months from the acknowledgment of receipt or, if no acknowledgment was sent to the reporting person, three (3) months from the expiry of seven (7) working days after the report was submitted. 4) Depending on the results of the investigation, the RRFO proposes corrective and/or disciplinary/legal action. Such action may include, without limitation: (a) additional training of employees, (b) introduction of new internal control mechanisms, (c) amendments to existing policies and/or procedures, (d) disciplinary sanctions, including permanent removal/dismissal, or (e) legal action.
8. RIGHTS OF THE REPORTING PERSON AND OF THE PERSON CONCERNED
8.1. The reporting person has the right to be informed both of the receipt of their report (within 7 working days at the latest) and of the outcome of the investigation (within 3 months at the latest).
8.2. The identity of the reporting person remains confidential. By way of exception, if the report proves to be malicious and the person concerned so requests, the person concerned may be informed of the identity of the reporting person in order to exercise their legal rights.
8.3. Persons named in reports have the right to be promptly informed of the misconduct of which they are accused, of the persons who have access to the data contained in the report or in the investigation report, and of their right to be heard in their defense.
9. PROTECTION OF PERSONS SUBMITTING REPORTS
9.1. The Company protects persons who report breaches falling within the scope of this Policy and ensures that no retaliation takes place. In this context, any form of adverse conduct/retaliation against anyone who has made a report is prohibited, including threats and acts of reprisal. In particular, the following forms of retaliation are prohibited: a) suspension, dismissal or other equivalent measures, b) demotion, or withholding or denial of promotion, c) removal of duties, change of place of work, reduction of salary, change of working hours, d) withholding of training, e) negative performance evaluation or negative employment reference, f) reprimand, imposition of disciplinary or other measure, including a financial penalty, g) coercion, intimidation, harassment or ostracism, h) discrimination or unfair treatment, i) failure to convert a fixed-term employment contract into an open-ended one, j) non-renewal or early termination of a fixed-term employment contract, k) intentional harm, including to the person's reputation, particularly on social media, or financial loss, including loss of business and loss of income, l) blacklisting on the basis of a sector-wide or industry-wide formal or informal agreement, which may entail that the person will not find employment in the sector or industry in the future, m) early termination or cancellation of a contract for goods or services, n) revocation or cancellation of a license or permit, o) referral for psychiatric or medical monitoring, p) refusal or denial of reasonable accommodation for persons with disabilities.
10. RECORD KEEPING
10.1. The Company, through the RRFO, keeps a register of reports, in compliance with the confidentiality requirements, for a reasonable and necessary period of time, so that the reports are retrievable and the requirements imposed by this Policy and by EU or national law are met, and in any case until the completion of any investigation or judicial proceedings initiated as a result of the report against the person concerned, the reporting person or third parties.
11. OBLIGATION OF CONFIDENTIALITY
11.1. Personal data and any information which leads, directly or indirectly, to the identification of the reporting person shall not be disclosed to anyone other than the authorized staff members competent to receive or follow up reports, unless the reporting person consents. To this end, the RRFO takes appropriate technical and organizational measures, such as pseudonymization techniques, when following up the report and communicating with the competent authorities.
11.2. By way of exception only, the identity of the reporting person and any other related information may be disclosed where required by EU or national law, in the context of investigations by competent authorities or of judicial proceedings, and where this is necessary to serve the purposes of this Policy or to safeguard the rights of defense of the person concerned. In such cases, any disclosure shall be made after the reporting person has been informed in writing of the reasons for disclosing their identity and other confidential information, unless such information would undermine the investigations or judicial proceedings. Unjustified failure to provide such information constitutes a disciplinary offense.
12. PROCESSING OF PERSONAL DATA
12.1. Any processing of personal data carried out under this Policy, including the exchange or transmission of personal data by or to the competent authorities, is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), without prejudice to the more specific provisions of this Policy and to the more specific rules governing the processing of personal data by the competent authorities.
12.2. Any processing of personal data carried out under this Policy is performed in order to comply with the obligation to establish reporting channels and to take the necessary measures to follow up on them. Such processing of personal data includes, in particular, any information on breaches in the context of internal and external reports, including their exchange and/or transmission. The information contained in the reports may be transmitted to the competent supervisory and investigating authorities and may be used as evidence in administrative, civil and criminal investigations and proceedings.
12.3. In this respect, the Company acts as Data Controller in accordance with Law 4990/2022 and within the meaning of the personal data protection legislation.
12.4. The Data Controller takes appropriate technical and organizational measures to ensure that, when reports are submitted and followed up, only personal data that are strictly necessary and adequate for the purposes of this Policy are collected. Personal data which are manifestly not relevant for the handling of a specific report, or are excessive, are not collected or, if collected accidentally, are deleted without undue delay.
12.5. By way of derogation from point (a) of Article 5(1), Articles 12 and 13, Article 14(1) to (4) and Article 34 GDPR, no information on the processing of personal data is provided to the person concerned or to any third party, in their capacity as data subjects, who is named in the report or whose personal data resulted from follow-up measures, in particular as regards the source of the data under point (f) of Article 14(2) GDPR, pursuant to Article 14(5) GDPR in conjunction with Article 23 GDPR, for as long as required and where deemed necessary for the purpose of preventing and addressing attempts to hinder reporting, to impede, frustrate or delay follow-up measures, in particular as regards investigations, or attempts to identify the reporting persons, as well as for their protection against retaliation.
12.6. The Data Controller may refrain from satisfying the rights provided for in Articles 15 to 22 GDPR when these are exercised by persons concerned and third parties named in the report or whose data resulted from follow-up measures, in accordance with paragraph 12.5.
12.7. In cases where the rights of data subjects are restricted as provided for in the two preceding paragraphs, the Data Controller takes all necessary technical and organizational measures to protect the rights and freedoms of the persons.
12.8. As regards, more specifically, the rights of natural persons in relation to the processing of their personal data and the manner of submitting relevant requests, the Company, as Data Controller, hereby refers to its Privacy Policy and to the specific privacy notices it provides, on a case-by-case basis, to the natural persons with whom it transacts.
12.9. In the event of a personal data breach, the Data Controller does not communicate it to the data subject under Article 34(1) GDPR where such communication may be detrimental to the purposes of this Policy, and informs the Hellenic Data Protection Authority (HDPA) accordingly, which may, after examining whether the grounds invoked are met, request that the communication be made if it considers that the conditions for omitting it are not fulfilled.
13. CONSEQUENCES OF VIOLATING THIS POLICY
13.1. The Company reserves the right to take any appropriate measure against any employee or collaborator of any kind if it emerges or is established in any way that they: a) hindered or attempted to hinder the submission of a report on breaches falling within the scope of this Policy, b) subjected any person who submitted a report under this Policy to adverse treatment of any form, c) retaliated against or brought malicious proceedings against a person who submitted a report under this Policy, d) breached the obligation to maintain the confidentiality of the identity of the reporting person. The same procedure may also be applied where an employee, contractor or collaborator of any kind intentionally misled the Company on any matter under investigation under this Policy or made false allegations against a colleague, contractor or collaborator of the Company.
14. COMMUNICATION OF THIS POLICY
The RRFO ensures that all persons to whom this Policy applies are expressly informed of its content. Such information is provided by circulating informational material, by email, through newsletters or by any other appropriate means.