Guidelines on the procedure for whistleblowers in a professional context in accordance with the Whistleblower Directive 2019/ 1937/ EU and related national regulations

Preamble

The objective of this guideline is to inform potential whistleblowers* of the options available at VITA 34 AG (hereinafter: “VITA 34”) and its affiliated companies in accordance with §§ 15 et seq. AktG (“VITA 34 subsidiaries“), collectively referred to as the “VITA 34 Group“, to report violations in the professional context and to receive adequate protection against discrimination.

The VITA 34 Group has set up a central internal reporting office at VITA 34 for VITA 34 and for all subsidiaries belonging to VITA 34 with fewer than 50 employees, and separate internal reporting offices for the VITA 34 subsidiaries with at least 50 employees, as well as an alternative internal reporting office at VITA 34 for the latter.

Thus, VITA 34 voluntarily goes beyond the legal requirements of individual countries and installs the whistleblower system groupwide in the fulfillment of its corporate governance. VITA 34 places great value on compliance and the fight against corruption and misconduct in the Company and will grant in all VITA 34 subsidiaries the same opportunities to report violations.

The following subsidiaries currently have their own reporting offices:

• Polski Bank Komórek Macierzystych sp. z o.o. in Warsaw, Poland
• Stemlab S.A. in Cantanhede, Portugal
• Krio Intezet Zrt. in Budapest, Hungary

1. Reporting offices and order of use

By selecting the reporting channel, the whistleblower can decide for himself whether he wishes to remain anonymous or provide personal information. The employee of a subsidiary with its own reporting office may also contact the internal reporting office of VITA 34 as alternative internal reporting office. They are free to choose an internal or external reporting office. Confidentiality is also ensured at all times when contacting the internal reporting offices.

2. Contact central, alternative and decentralized internal reporting points of staffing

All internal reporting offices are staffed by employees with the appropriate expertise. The respective staffing of the internal reporting offices and the respective reporting channels can be found on the website, the intranet, if available, or in any other form accessible to all employees.

The following reporting channels are available:

Digital: for internal reports, the digital reporting system is installed, to which all employees have access. The system ensures that the anonymity of the whistleblower is guaranteed, cannot be technically traced and that all security requirements are met.

https://vita34.integrityline.app/

In addition, reporting channels are offered via e-mail and by post.

At the request of the whistleblower, there is also the possibility of a digital or personal exchange with those responsible at the internal reporting offices.

Only the designated persons responsible for the reporting centers will have access to the internal reporting centers. 

The internal reporting offices are designed to help the whistleblower and remedy the reported violation.

3. External reporting offices in Germany

The Federal Office of Justice (BfJ) acts as the central external reporting office. In addition, there are further external reporting offices at the Federal Financial Supervisory Authority (BaFin) and the Federal Cartel Office. Further information on the responsibilities of the external reporting offices can be found under the following links:

BfJ: https://www.bundesjustizamt.de/DE/MeldestelledesBundes/MeldestelledesBundes_node.html

BaFin: https://www.bafin.de/DE/DieBaFin/Hinweisgeberstelle/hinweisgeberstelle_node.html

Bundeskartellamt: https://www.bundeskartellamt.de/DE/Kartellverbot/Hinweise_auf_Verstoesse/Hinweise_node.html

4. External reporting offices in other countries

Information on the external reporting offices and their responsibilities in the other countries is published locally on the website, on the intranet, if available, or in another form accessible to all employees.

5. Scope of protection for the whistleblower

Persons who have obtained information about violations in connection with their professional activities or in advance are protected. This includes employees, self-employed persons, board members and also third parties who support the whistleblower or are in contact with them and have suffered reprisals in a professional context. Reports of private misconduct are not protected.

The aforementioned persons are protected from reprisals.

This includes all discriminatory actions or omissions, such as termination of employment or disciplinary measures (e.g. warning, denial of promotion).

6. Protected information facts

The following reported violations are protected:

• criminal offenses such as fraud, theft/embezzlement, violations of the Narcotics Act, bodily injury, physical abuse, corruption, sexual offenses, infidelity
• violations subject to fines, such as violations of occupational health and safety laws, health and safety regulations, which serve to protect employees
• data protection violations
• specifications on product safety and conformity, in particular on quality and safety standards for organs and substances of human origin such as umbilical cord blood or umbilical cord tissue.

Further infringements for which information can be provided can be found in the list in Art. 2 (1) of EU Directive 2019/1937 and the national requirements.

7. Data protection

When receiving and processing reports, personal data is collected, processed and stored by the central internal reporting office and/or the decentralized internal reporting offices. In this respect, the internal reporting offices act independently and without instructions as “responsible bodies within the meaning of data protection law”. The internal reporting offices are obliged to comply with all data protection regulations.

8. Implementation of the notification procedure

After receipt of the notification

• the reporting office confirms receipt of the report to the whistleblower within 7 days
• the reporting office checks whether it is a relevant and legally protected violation
• if necessary, the reporting office will obtain further relevant information from the whistleblower
• the reporting office informs the whistleblower of non-anonymous reports about the processing of their personal data

As a measure, the reporting office can

• have an internal investigation initiated and carried out by the responsible internal department
• refer the whistleblower to another competent body
• hand over the proceedings to a competent authority

The procedure is concluded

• by providing feedback on planned and taken measures as well as the reasons, at the latest three months after receipt of the notification or at the latest 3 months and seven days after receipt of the notification
• without feedback if this would compromise the investigation or the rights of the persons who are the subject of the report

As a rule, the documentation is deleted three years after completion of the procedure, unless longer-term storage is necessary and proportionate due to the requirements of the EU Whistleblower Directive, related national requirements or other legal regulations.

*The generic masculine terms used in this text are used solely to improve readability. They explicitly include all gender identities in a gender-neutral and non-judgmental way. No offense or sexism is intended.