PROCEDURA ZGŁOSZEŃ WEWNĘTRZNYCH ORAZ PODEJMOWANIA DZIAŁAŃ NASTĘPCZYCH
effective at IT LeasingTeam sp. z o.o.

§ 1

1. The operating strategy of IT LeasingTeam sp. z o.o. in Warsaw (hereinafter referred to as “ITLT”) is based on accountability, prevention of corruption and prevention of other irregularities both within the organization and among cooperating entities, taking into account a number of aspects, in particular, social interests, environmental protection, relations with various groups of cooperators.
2. The procedure is a component of the management control system. Its primary purpose is to prevent irregularities in ITLT.
3. ITLT conducts its business based on absolute respect for the law, good practice and the highest ethical standards.
4. The primary goal of the Procedure is to establish a whistleblowing system for ITLT by creating secure reporting channels to prevent any retaliation against a so-called whistleblower.
5. The procedure sets forth the rules and procedures for reporting information on violations of law, including information on reasonable suspicion of an actual or potential violation of law that has occurred or is likely to occur at ITLT or information regarding an attempt to conceal such a violation of law.

§ 2

Whenever the Procedure refers to:

1. Legal entity – means ITLT;
2. Impartial Organizational Unit (hereinafter referred to as “BJO”) – means an impartial commission authorized by ITLT – an organizational unit within the organizational structure of the Legal Entity, authorized to receive reports, follow up and process personal data obtained in connection with an internal report, including verification of the report, communication with the Whistleblower. The BJO is the Committee on Violations;
3. Procedure – means the Procedure for receiving internal notifications and follow-up;
4. Law – the Law of June 14, 2024 on the protection of whistleblowers (Journal of Laws, item 928). Whistleblower – means an individual who reports a violation of the law and does not do so because of his/her own legal interest, regardless
   of his/her position, form of employment or cooperation, both before and after the termination of a legal relationship with ITLT (including: employee, former employee, applicant for employment, person providing work on a basis other than employment, including under a civil law contract, entrepreneur, shareholder or partner, member of a body of a legal entity, person providing work under the supervision and direction of a contractor, subcontractor or supplier, including under a civil law contract, trainee, volunteer);
5. Notification – it is understood as information about the violation of the law, made through the communication channels intended for this purpose;
6. Person affected by the notification – means the person identified in the notification as the person who committed the violation;
7. Follow-up – means the proceedings conducted in connection with the submitted application;
8. Submission Channel – it is understood as technical and organizational solutions that enable submission;
9. Retaliatory action – this is understood as a direct or indirect act or omission in a work-related context that is caused by a notification and that violates or may violate the rights of the Signatory or causes, or may cause, unjustified harm to the Signatory, including the groundless initiation of proceedings against the Signatory.

§ 3

1. The procedure and its provisions apply to the following groups of persons eligible to make an application:
   1. employees and associates and former employees and associates of ITLT,
   2. persons acting for and on behalf of ITLT,
   3. any other persons related to ITLT in any way, in particular:
      persons assisting in the filing of whistleblowing reports, trainees, interns or candidates for employment, if they obtained information regarding the irregularities during the recruitment or other pre-employment processes.
2. Notification of irregularities may concern in particular:
   1. ITLT affiliates,
   2. an individual authorized to represent ITLT,
   3. ITLT employees and associates in connection with the performance of work for it,
   4. subcontractor or any other entrepreneur who is a natural person, if his criminal act was in connection with the performance of the contract concluded with ITLT,
   5. an employee or associate or a person authorized to act in the interest of or on behalf of an entrepreneur who is not a natural person, if his act was in connection with the performance of a contract entered into by the entrepreneur with ITLT.
3. Przez nieprawidłowości należy rozumieć informacje, w szczególności mogące świadczyć o:
   1. suspicion of preparation, attempt or commission of a criminal act by entities referred to in par. 2,
   2. Failure to perform duties or abuse of powers by the entities indicated in paragraph (2). 2,
   3. Failure to exercise the due diligence required under the circumstances in the activities of the entities listed in paragraph (2). 2,
   4. irregularities in the organization of ITLT’s activities that could lead to the commission of a criminal act or the infliction of damage,
   5. violation of generally applicable laws under which ITLT operates,
   6. violation of internal procedures and ethical standards adopted at ITLT.
4. A violation of the law is an act or omission that is unlawful or intended to
   The purpose of circumventing the law, concerning:
   1) corruption;
   2) public procurement;
   3) financial services, products and markets;
   4) prevention of money laundering and financing of terrorism;
   5) product safety and compliance;
   6) transportation security;
   7) environmental protection;
   8) radiological protection and nuclear safety;
   9) food and feed safety;
   10) animal health and welfare;
   11) public health;
   12) consumer protection;
   13) privacy and data protection;
   14) security of ICT networks and systems;
   15) financial interests of the Treasury of the Republic of Poland, the entity
   Local government and the European Union;
   16) the internal market of the European Union, including public law rules
   competition and state aid and corporate taxation;
   17) constitutional freedoms and rights of man and citizen – occurring in the relations
   of the individual with public authorities and not related to the areas indicated
   in items 1-16.

§ 4

1. The person who exercises overall supervision over the receipt and processing of reports
   by the BJO, as well as maintains the register of violations, is the Violation Commissioner.
   The Violation Commissioner is appointed by the ITLT Board of Directors.
2. The BJO, responsible for receiving and recognizing notifications and authorized to
   follow up and communicate with the Whistleblower, is the
   Violation Commission, consisting of the Violation Commissioner and 2 members appointed
   by the ITLT Board of Directors, with their consent, from among the following persons: unrelated and not related, not in a common household, not maintaining close relations in the private sphere with the Board of Directors. The violation shall be analyzed by a Commission composed of one person, proposed by the Plenipotentiary.
   The Plenipotentiary shall not recognize applications, unless it is necessary due to the lack of members of the Commission able to perform this analysis.
3. The analysis of the notification may not involve persons who, from the content of the notification
   of irregularities, may be in any way negatively involved in the act or omission constituting the irregularity.
4. In the event that the whistleblower concerns the Violation Commissioner
   or the members of the Violation Committee in numbers that prevent the
   minimum of one person, the ITLT Board of Directors shall designate other persons responsible for this
   notification.
5. The Violation Commissioner and the Violation Commission are obliged to maintain
   secrecy with regard to the information and personal data they obtained in the
   acceptance and verification of the report and follow-up, including
   after the termination of the employment or other legal relationship under which
   performed these activities.

§ 5

1. The whistleblower can make submissions via email sent
   to the breach address ITLT@itlt.pl.
2. The submitted notification should contain a clear and complete explanation of the subject
   of the notification and should include at least the following information: the date and
   place of the occurrence of the violation of the law or the date and place of obtaining information about
   the violation of the law, a description of the specific situation or circumstances creating the possibility
   of the occurrence of the violation of the law, identification of the subject of the notification,
   identification of possible witnesses to the violation of the law, identification of all
   evidence and information available to the Signaller that may prove helpful in the
   process of examining the notification.
3. The entity will not recognize anonymous applications.
4. According to the principle of good faith, any person entitled to make a report
   should report an irregularity if there are reasonable grounds on his part
   to believe that the information provided is true.
5. Knowingly submitting false reports is prohibited.
6. In the event that it is determined that the
   truth was knowingly untruthful or concealed in the application, the person making the application may be held liable
   to the orderly liability specified in the provisions of the Labor Code and special regulations,
   including the orderly regulations in force at the Entity. Such behavior
   may also be qualified as a severe violation of basic
   obligations of employees or persons performing gainful employment on a basis other
   than a legal relationship and as such result in termination of the
   employment/civil contract without notice.
7. The decision to grant whistleblower status is made by the Violations Committee.
8. Whistleblower status can be obtained by any whistleblower, unless a preliminary analysis of the
   notification gives grounds to assume that the whistleblower clearly acted in bad faith
   (presumption of good faith).
9. For each notification, the BJO designates one person responsible for
   communication with the whistleblower in question. This person shall confirm receipt of the notification within
   7 days from the date of receipt by sending a message to the e-mail address from which
   the notification was sent.
10. If in the course of the investigation it turns out that the whistleblower, who previously
    received whistleblower status, acted in bad faith, he is deprived of the
    protection provided for a whistleblower.

§ 6

1. Access to the whistleblowing channels is available only to the
   Violations Commissioner and other members of the Violations Committee, possibly other
   persons responsible for the report.
2. Upon receipt of a notification, within no more than 7 days from receipt of the notification,
   the Infringement Commission shall conduct a preliminary verification of the notification, i.e., in terms of
   actual probability of the truthfulness of the notification) of the
   violation (“Preliminary Verification”). A positive Initial Verification results in confirmation
   of the Infringement Commission’s acceptance of the notification and the granting of whistleblower status.
   The confirmation is made to the email address from which the notification was sent.
3. The Infringement Committee, pursuant to paragraph 2., above, i.e. after Preliminary
   Verification, may decide not to conduct
   Clarification Proceedings, in a situation where the notification is manifestly false or
   it is impossible to obtain from the Signatory additional information necessary for
   verification of the Notification.
4. The Violations Committee shall recognize the notification and follow up without
   undue delay.
5. In justified cases (in accordance with paragraphs 2 and 3 above), the Infringement Commission
   shall initiate an investigation (the “Investigation”) and then, within
   a period of no more than 30 days, make a decision on the merits of the application, subject to
   the possibility of the hearing entity to collect the necessary
   documents and evidence within this time.
6. In particularly complex cases, the processing of the
   notification of irregularities may take place within a period of no more than 90 days from the date of initiation of
   Investigation.
7. Subject to paragraph 2, if the Notification allows for follow-up –
   including abbreviated investigation, this shall be done
   immediately after receipt of the Notification.
8. Specialists and independent consultants
   may be involved in the Clarification Proceedings, if warranted by the facts
   described in the application, e.g. by preparing an opinion on the subject of the application, including a legal opinion.
9. Information on planned or undertaken follow-up actions and the reasons
   for such actions shall be provided to the Signatory no later than within 3 months from
   confirmation of acceptance of the notification (in case of failure to provide confirmation
   of acceptance of the notification, within 3 months from the lapse of 7 days from submission of the notification).
   Feedback shall be provided to the e-mail address from which the notification was sent.
10. The Violations Committee may make recommendations on appropriate
    corrective or disciplinary actions against the violator
    of the law, as well as recommendations aimed at eliminating and preventing
    identical or similar violations to those described in the notification, in the future.
11. From the findings of the Investigation, the Violations Commission
    shall prepare a report and submit it to the Violations Commissioner, unless the Commissioner
    is the author of the report as the investigator.
12. The investigation report includes a description of the established facts,
    including the established irregularities and their causes, scope and consequences, as well as the persons
    responsible for them.
13. The Commission attaches proposals for further
    actions to the report on the Investigation. Depending on the findings, these actions may include actions against
    violators, actions to prevent violations and to strengthen
    the entity’s internal control system. Such measures may include, in
    particular:
    1) closing the procedure without taking further action (in case
    the report is not confirmed);
    2) conducting an interview, drawing the employee’s attention;
    3) admonishing the employee, depriving him of a bonus, etc.
    4) changes or rotations in positions;
    5) changes in internal procedures;
    6) taking civil law actions regarding, for example, concluded contracts, repairing
    damage, paying compensation;
    7) filing a request for disciplinary action;
    8) filing a notice of reasonable suspicion of a crime (in
    case of gathering evidence);
    9) informing relevant services (in case of gathering circumstantial evidence).
14. The ITLT Board of Directors determines further actions and those responsible for their implementation.
    The Plenipotentiary monitors the implementation of these actions and provides assistance to those
    responsible for them.
15. The Commission shall inform the whistleblower of the findings and the approved
    measures immediately after the ITLT Board approves the proposals, no later than
    30 days after the conclusion of the Investigation.
16. Arrangements made, measures approved and their implementation are recorded in
    Register of notifications.
17. In particular, the whistleblower’s record includes:
    1) contact information of the whistleblower,
    2) all detailed information held about the whistleblower,
    3) the course of analysis and processing of the whistleblower’s report,
    4) persons and bodies involved in the process of analysis and processing of the report,
    5) any decisions and escalations (if any).
18. The Register of Applications is kept confidential, and the personal data
    and other information in the Register of Applications are kept for a period of 3 years after
    the end of the calendar year in which the follow-up actions were completed or after
    the completion of the proceedings initiated by these actions.

§ 7

1. There is an absolute prohibition on retaliation against
   Signaller who made a report (both internal and external), and
   also public disclosure – in accordance with the Law.
2. Taking any retaliatory action, discriminatory
   or any other type of unfair treatment against the Signatory, will be treated
   as a violation of the Procedure and may result in disciplinary liability or
   termination of the contract linking the retaliator with ITLT.
3. In particular, unacceptable with respect to the Signaller is: refusal to establish a
   employment relationship, termination or termination without notice of the employment relationship,
   reduction in salary for work, withholding of promotion or omission from the
   Promotion, omission in the award of benefits other than salary
   work-related, transfer of the employee to a lower position, suspension of the
   In the performance of employee or official duties, transfer to another
   employee’s previous job duties, an unfavorable change
   place of work or work schedule, negative evaluation of work performance
   or negative opinion of work, the imposition or application of a disciplinary measure, in
   including a financial penalty, or a measure of a similar nature, withholding participation or
   omission in typing for participation in training to improve
   professional qualifications, unjustified referral to a medical examination, including
   psychiatric examination, if separate regulations provide for the possibility to refer an employee
   to such an examination, action aimed at making it difficult to find
   employment in the future.
4. Adverse treatment due to the filing of a report shall also be considered a threat
   or an attempt to apply the measure specified in paragraph 3 above.
5. Protection does not apply to a whistleblower who is also a perpetrator/ co-perpetrator/
   an accessory to irregularities.

§ 8

1. Maintaining confidentiality is intended to guarantee a sense of security
   to the Whistleblower and to minimize the risk of retaliation or
   reprisal. A Whistleblower who has made a report and whose personal information has been
   unauthorizedly disclosed should immediately
   notify the ITLT Board of Directors or the Violations Committee of the situation, which are obligated
   to take action to protect the Whistleblower.
2. The identity of the whistleblower, as well as all information that allows
   to identify the whistleblower, will not be disclosed to the subjects of the notification,
   third parties or other employees and associates of the subject. In particular:
   1) The identity of the whistleblower shall not be disclosed in any of the documents related to
   the proceedings;
   2) The identity of the whistleblower shall not be disclosed at the request of the parties or participants in the proceedings;
   3) The identity of the whistleblower shall not be included in the distributions of documents related to
   the proceedings;
   4) The whistleblower shall not be a witness in the proceedings to be initiated
   as a result of his/her report, nor shall he/she be a participant or a party to the initiated
   proceedings.
   The identity of the Signaller, as well as other information enabling his/her identification
   may be disclosed only if such disclosure is a necessary and
   proportionate obligation under generally applicable
   laws in the context of proceedings conducted by national authorities (e.g.
   courts).
3. The entity processes personal data to the extent necessary to accept the application and
   follow up. Personal data that are not relevant to the recognition
   of the application are not collected, and if collected, they are deleted. The deletion of such
   personal data shall take place within 14 days after the determination that it is not
   relevant to the case.

§ 9

1. Notification may also be made to the Ombudsman in any case
   Civil or public body bypassing the procedure provided for in the
   Procedure, in particular when:
   1) within the deadline for feedback established in the ITLT Procedure, no
   Will provide feedback to the Signaller or
   2) The whistleblower has reasonable grounds to believe that a violation of the law may constitute a
   direct or obvious threat to the public interest, in particular
   there is a risk of irreparable harm, or
   3) making an internal report will expose the Signaller to retaliation, or
   4) if an internal notification is made, there is little
   likelihood of ITLT
   successfully countering the violation due to the special circumstances of the case, such as the possibility of concealment or
   destruction of evidence or the possibility of collusion between ITLT and the perpetrator
   of the violation or ITLT’s participation in the violation.
2. A notification made to the Ombudsman or a public body with
   omitting internal notification does not result in depriving the Signatory of the protection
   guaranteed by the Law.

§ 10

The procedure goes into effect on September 25, 2024.