WHISTLEBLOWING

Internal reporting system

Based on Act No. 171/2023 Coll., on the protection of whistleblowers, as amended (hereinafter also referred to as the "Act"), which is effective from 1st August 2023, in relation to Directive (EU) 2019/1937 of the European Parliament and of the Council of 23rd October 2019, on the protection of persons who report breaches of Union law, our legal office, as an obliged entity, has introduced an internal reporting channel for receiving the reports of breaches, following-up, ensuring confidentiality of the identity of the reporting person and third parties, protection of the information contained in the report and communication with the reporting person.

A "reporting person" means a natural person who reports a possible breach (which has the characteristics of a criminal offence or a misdemeanour or violates a legal regulation or an EU regulation in the areas defined by law) acquired in the context of their work‑related or other similar activities. Such a reporting person is subsequently protected from any form of retaliation that our legal office may take against them. Not only is the reporting person themself protected in this way but also, e.g., persons close to the reporting person, colleagues or persons who helped the reporting person find out the information stated in the report.

Whistleblowing officer

Our legal office has appointed a designated person to act as an internal channel for reporting and subsequent follow-up within the scope of Section 9 (1) of the Act:
Mgr. Bc. Iveta Šandalová, telephone: +420 734 328 719, email: whistleblowing@svojanovska.cz

What the report must contain

The content of the report is:

• the name, surname, and date of birth of the reporting person (or any other information from which the identity of the reporting person can be inferred); the report does not need to contain such information if it is made by a person whose identity is known to the whistleblowing officer;
• information on breaches that have occurred or are very likely to occur in the company in which the reporting person, even indirectly, works or has worked or conducted other similar activities or in another company with which the reporting person is or was in contact through their work or other similar activity;
• a description or summary of the substance of the report, incl. identification of the persons concerned;
• the evidence, if any, on which the report is based.

The report may also be submitted anonymously; however, in such a case, the whistleblowing officer will not be able to contact the reporting person, in particular, to notify them in writing of the receipt of the report (unless otherwise specified below).
If the report is submitted anonymously but via an (active) contact details at which the reporting person can be contacted in writing (e.g., universal e-mail address, registered mail with the reporting person’s identification on the envelope), the whistleblowing officer shall inform the reporting person in writing via this (active) contact details (unless otherwise specified below).

Our legal office advises the reporting person that protection under the Act does not apply to knowingly false reports; filing such a report carries a fine of up to CZK 50,000.

Methods of reporting

• in writing, by completing the form available here and sending it by post to our legal office´s address, marked "Whistleblowing – do not open – only to the whistleblowing officer";
• electronically, by filling in the form available here and sending it to the above-mentioned e‑mail address of the whistleblowing officer;
• by phone using the whistleblowing officer’s telephone number listed above;
• in person by prior arrangement (upon the request of the reporting person, the whistleblowing officer is obliged to receive the report in person within a reasonable period, but no later than 14 days from the request date).

The reporting person may also submit the report through the external reporting system of the Czech Bar Association.

Publication of the report

The reporting person is not entitled to publish information included in the report, which is subject to the duty of confidentiality under Act No. 253/2008 Coll., on certain measures against money laundering and the financing of terrorism, as amended.

Period for reports handling

• upon receipt of the report, the reporting person shall be notified of the receipt of the report within 7 days from the date of receipt of the report by the whistleblowing officer; this shall not apply if the reporting person has explicitly requested not to be notified of the receipt of the report or the whistleblowing officer reasonably believes that the notification of the receipt of the report would jeopardise the protection of the reporting person's identity;
• the whistleblowing officer communicates to the reporting person the final outcome and assessment of the investigation triggered by the report within 30 days of receipt of the report (in cases of factual or legal complexity, the period may be extended by another 30 days, but not more than twice); this shall not apply if the reporting person has explicitly requested not to be notified of the extension of the assessment period and the reasons for its extension, or if the whistleblowing officer reasonably believes that the notification of the extension of the assessment period and the reasons for its extension would jeopardise the protection of the reporting person's identity;
• the date of delivery of the report is the date on which the report is delivered to our legal office´s address (stamp on the envelope). For e-mail reports, the delivery date is indicated in the e-mail´s header. In the case of reports made by telephone or in person, the delivery date is the date of the telephone or in-person meeting between the reporting person and the whistleblowing officer.

Methods of handling reports

If the whistleblowing officer finds that the report is:

• justified, they will propose remedial actions to our legal office to address the issue raised to prevent and/or correct the illegal situation;
• unjustified, they shall inform the reporting person in writing without undue delay that, based on the facts stated in the report and all circumstances, they do not find acts or omissions addressed by the report unlawful or that the report is based on false information, and shall inform the reporting person of the right to report to a public authority;
• is not a report under the Act, they shall inform the reporting person thereof in writing without undue delay.

Whistleblowing and personal data

• if our legal office receives a request for access to personal data and information relating to the whistleblower protection agenda, we will immediately forward it to the whistleblowing officer for processing;
• the whistleblowing officer will then assess whether they process the applicant's personal data in accordance with the GDPR and decide whether it is possible to satisfy the applicant's request for access in accordance with the law. In particular, the whistleblowing officer will assess whether complying with the applicant's request for access could impede the investigation of the report, hinder the adoption of remedial actions or jeopardise the protection of the reporting person's identity. The whistleblowing officer shall inform the applicant of the result of the request assessment if such action is appropriate;
• our legal office processes the personal data of the reporting persons and those mentioned in the report to fulfill legal obligations under Article 6 (1) (c) of the GDPR. The personal data will be processed exclusively and serve only for the report investigation purposes performed by the whistleblowing officer and for the protection of the reporting person from any form of retaliation for the strictly necessary period (i.e., 5 years from the date of receipt of the report); thereafter, the personal data will be anonymised or destroyed, unless otherwise provided by the law;
• the personal data originate from the reporting person and are processed in electronic form using automated processing or in paper form using non-automated means. Our legal office does not carry out systematic and/or large-scale processing of personal data. Our legal office does not carry out automated individual decision-making with legal or similar effects, incl. profiling, within the meaning of Article 22 of the GDPR;
• the reporting person and the persons concerned have the following data protection rights to the whistleblower protection agenda:
  • the right to information and access to personal data (Article 15 GDPR);
  • the right to rectification or completion of personal data (Article 16 GDPR);
  • the right to the erasure of personal data (Article 17 GDPR);
  • the right to portability of personal data to another data controller (Article 20 GDPR);
  • the right to limit the processing of personal data (Article 18 GDPR);
  • the right to object to processing (Article 21 GDPR);
  • the right not to be subject to automated individual decision-making with legal or similar effects, including profiling (Article 22 GDPR);
  • the right to submit a complaint to the Personal Data Protection Office
  • if the reporting person has given their consent to our legal office, they may withdraw it at any time in writing to our legal office’s address and/or by e-mail to info@svojanovska.cz (in whole or in part) – this does not affect the lawfulness of processing based on consent given prior to its withdrawal.