Internal reporting of violations of the law

 

1. Purpose

This procedure describes the methods of receiving, examining and resolving internal reports regarding violations of the law, which have occurred or are likely to occur in a professional context, within Valrom Industrie SRL.

2. Scope

This procedure regulates the protection of persons who report violations of the law, which have occurred or are likely to occur, within the company.

This procedure establishes the procedure for receiving, examining and resolving reports, the rights and obligations of the persons who make reports or publicly disclose information regarding violations of the law, their protection measures, the rights of the persons concerned, as well as the duties of the designated person/designated third party.

This procedure applies to people who report and who have obtained information about violations of the law, in the professional context with the company. The category of these persons includes, at least, the following:

a) workers

b) shareholders and persons who are part of the company's administrative, management or supervisory body, including non-executive members of the board of directors, as well as paid or unpaid volunteers and interns;

c) any person who works under the supervision and management of the company with which the contract was concluded, its subcontractors and suppliers.

d) persons whose employment relationships have not yet begun and who make reports through internal or external reporting channels or publicly disclose information regarding violations of the law obtained during the recruitment process or other pre-contractual negotiations e) persons whose employment relationship or service report terminated.

f) persons who report or publicly disclose information regarding violations of the law anonymously.

3. Reference documents

       3.1. Law no. 361/2022 regarding the protection of whistleblowers in the public interest;

       3.2. DIRECTIVE (EU) 2019/1937 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 23 October 2019 on the protection of persons reporting breaches of Union law

       3.3. Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data

       3.4. Law 506/2004 regarding the processing of personal data and the protection of private life in the electronic communications sector.

       3.5. SR EN ISO 9001:2015 "Quality management systems. Requirements”;

       3.6. SR EN ISO 9000:2015 "Quality management systems. Fundamental principles and vocabulary";

       3.7. PG-VAL-01 "Control of documented information", current edition.

This procedure does not affect the provisions regarding:

       a) protection of classified information;

       b) professional secrecy of the lawyer;

       c) confidentiality of medical information;

       d) the secret nature of judicial deliberations;

       e) criminal procedure rules.

4. Terms and Definitions

Violations of the law –      facts that consist of an action or inaction that constitute non-compliance with legal provisions or that contravene the object or purpose of the law.
Information regarding the violation of the law –      facts that consist of an action or inaction that constitute non-compliance with legal provisions or that contravene the object or purpose of the law.
Public interest whistleblower –      the natural person who carries out a report or publicly discloses information related to violations of the law, obtained in a professional context;
Internal reporting

 

 – oral or written communication of information regarding violations of the law within the company through the means provided by the company for reporting violations of the law, these constituting the internal reporting channels
External reporting – oral or written communication of information regarding violations of the law carried out through external reporting channels represented by the competent authorities in the field (e.g. the National Integrity Agency)
Public disclosure – making available, in any way, in the public space information related to violations of the law;
facilitator –      the natural person who assists the public interest whistleblower in the reporting process in a professional context and whose assistance must be confidential;
Professional context – current or previous professional activities of any nature, remunerated or not, carried out within the company, on the basis of which people can obtain information about violations of the law and may suffer reprisals in case of reporting them;
Worker –      natural person who is in a work relationship or a service relationship, based on the provisions of common or special law in the matter, and provides work in exchange for remuneration.
Person targeted by reporting –      the natural or legal person mentioned in the report or in the public disclosure as the person to whom the violation of the law is attributed or with whom that person is associated;
Retaliation –      any action or omission, direct or indirect, occurring in a professional context, which is determined by internal or external reporting or public disclosure and which causes or may cause damage to the whistleblower in the public interest.
Subsequent actions –      any action taken by the recipient of an internal report or by the competent authority in order to resolve the report and, where appropriate, to remedy the reported violation;
Information – the transmission to the whistleblower in the public interest of information regarding the subsequent actions and the reasons for such actions;
Designated Person/Designated Third Party –     the person responsible for the attributions provided for in point 6.6. appointed at the company level. Depending on the number of employees, the duties can be exercised by a person, a department or they can be outsourced to a third party, hereinafter referred to as a designated third party.

5. Abbreviations

Valrom Valrom Industry SRL
Report Internal reporting

6. Rules of procedure

The reporting methods are as follows:

a) internal reporting;

b) external reporting.

Reporting of violations of the law is primarily done through existing internal reporting channels. The public interest whistleblower reporting violations of the law may choose, however, between the internal reporting channel and the external reporting channel.

A public interest whistleblower can make the report nominally or anonymously. From a procedural point of view, the main differences between the 2 reporting methods are:

  • Within a nominal reporting there is the possibility of communication to clarify certain aspects presented in the reporting between the public interest whistleblower and the appointed person;
  • The person who reports violations of the law anonymously cannot benefit from exemption and protection in accordance with the provisions of Law no. 361/2022, except for the situation in which he is subsequently identified and suffers reprisals;
  • A person who reports violations anonymously and does not provide contact information may not be notified of the report's record, progress, and resolution.

       6.1. External reporting

External reporting is the process of oral or written communication through external channels of information including reasonable suspicions, regarding actual or potential violations of the law, which have occurred or are likely to occur within the company in which he works or has worked the whistleblower in the public interest or with whom he is or has been in contact through his activity, as well as information regarding attempts to hide such violations

The external reporting channels are represented by the following authorities:

a) the public authorities and institutions that, according to the special legal provisions, receive and resolve reports regarding violations of the law, in their field of competence;

b) The National Integrity Agency, hereinafter referred to as the Agency;

c) other authorities and public institutions to which the Agency forwards the reports for competent resolution;

To report a breach using the external channel to ANI, find details here – https://avertizori.integritate.eu/

       6.2. Internal reporting

Internal reporting is the process of oral or written communication through the company's internal channels of information including reasonable suspicions, regarding actual or potential violations of the law, which have occurred or are likely to occur within the company in which they work or the whistleblower worked in the public interest or with whom he is or has been in contact through his activity, as well as information on attempts to hide such violations.

Internal reporting is done by whistleblowers in the public interest to the Designated Person, according to the working method presented below.

       6.3. Methods of internal reporting

Reporting is done in writing, on paper or in electronic format (e-mail) or through a face-to-face meeting, at the request of the whistleblower in the public interest.

The reporting includes, at least, the following:

  • name and surname,
  • the contact details of the whistleblower in the public interest,
  • the professional context in which the information was obtained,
  • the data subject, if known,
  • the description of the act likely to constitute a violation of the law and, as the case may be, the evidence in support of the report,
  • date of reporting and signature.

By way of exception, reporting that does not include the name, surname, contact details or signature of the whistleblower in the public interest is examined and resolved to the extent that it contains substantial indications of violations of the law.

The employer must ensure that, at all times, at least one means of reporting is accessible.

 

The means of reporting at the level of the Valrom Industrie SRL Company are the following:

  • mailing address: the address of the company headquarters Bucharest Sector 6, Street: B-dul Preciziei no. 28, the envelope bearing the mention "For the third party designated under Law 361/2022".
  • E-MAIL: integrity@romstalgroup.com

The means of reporting must be made known to each employee, by posting on the company's website (company link: https://dev.valrom.ro) and by posting at the headquarters, in a visible and accessible place.

       6.4. Internal reporting records

The company, through the designated person or third party, has the obligation to keep records of reports in a register and has the obligation to maintain statistics regarding reports regarding violations of the law

The reports are registered in a Electronic register which includes:

  • the date of receipt of the report,
  • the name and surname, contact details of the whistleblower in the public interest,
  • the subject of the report
  • the solution method.

The company keeps records of all reports received in compliance with confidentiality requirements. Reports are kept for 5 years. After the expiration of the 5-year storage period, they are destroyed, regardless of the support on which they are stored.

If the public interest whistleblower requests that the report be made in the presence of the appointed person/designated third party, he/she is obliged to draw up a recording protocol, in a durable and accessible form, subject to the consent of the public interest whistleblower . The designated person/designated third party offers the whistleblower in the public interest the opportunity to verify, rectify and express his agreement regarding the minutes of the conversation, by signing it.

       6.5. Obligation to maintain confidentiality

1. The person appointed/the third party appointed to resolve the report has the obligation not to reveal the whistleblower's identity in the public interest, nor the information that would allow his direct or indirect identification, except in the case where he has his express consent.
2. By way of exception, the identity of the whistleblower in the public interest and any other information may be disclosed only if this is an obligation imposed by law, in compliance with the conditions and limits provided by it.
3. In the case provided for in point 2, the whistleblower in the public interest is informed beforehand, in writing, about the disclosure of the identity and the reasons for the disclosure of the confidential data in question. The obligation does not exist if the information would jeopardize investigations or legal proceedings.
4. The information contained in the reports that constitute commercial secrets cannot be used or disclosed for purposes other than those necessary for the resolution of the report.
5. The obligation to maintain confidentiality does not exist if the whistleblower in the public interest has intentionally revealed his identity in the context of a public disclosure.
6. The obligation to maintain confidentiality is maintained even if the report mistakenly reaches another person within the authority, public institution, any other legal entity under public law, as well as within legal entities under private law other than the appointed person /designated third party. In this case, the report is forwarded, immediately, to the designated person/designated third party.

       6.6. Designated Person/Designated Third Party

A person/third party is appointed, with duties to receive, record, examine, take follow-up actions and resolve reports, to act impartially and to be independent in the exercise of these duties.

The designated person/designated third party is brought to the attention of each employee, by posting it on the company's website (company link https://dev.valrom.ro) and by posting at the headquarters, in a visible and accessible place.

The designated person/designated third party has the following duties, obligations and responsibilities:

  • the obligation to receive and record and keep records of reports in the register;
  • the obligation to send the whistleblower in the public interest the confirmation of receipt of the report, within no more than 7 calendar days from its receipt;
  • performing subsequent actions diligently;
  • the obligation to inform the whistleblower in the public interest about the status of the subsequent actions, within no more than 3 months from the date of confirmation of receipt or, in the event that the receipt of the report was not confirmed, from the expiry of the 7-day period, as and, subsequently, whenever developments are recorded in the subsequent actions, except in the case where the information could jeopardize their implementation;
  • the obligation to inform the managers of the company, regarding the method of solving the report;
  • the obligation to provide clear and easily accessible information regarding external reporting procedures to the competent authorities and, as the case may be, to the institutions, bodies, offices or agencies of the European Union;
  • the obligation to inform the whistleblower in the public interest regarding the method of resolving the report.
  • the obligation to maintain statistics regarding reports regarding violations of the law.

In the situation where the designated person/designated third party needs clarification from the company's staff within the specialized departments for the resolution of a report, an extract from the report can be disclosed to them for clarification, with the protection of the personal data of the whistleblower and the person concerned by the report.

       6.7. Classification of internal reporting

Reporting ranks when:

a) does not contain the elements provided for in point 6.3 other than the identification data of the public interest whistleblower, and the designated person/designated third party requested its completion within 15 days, without this obligation being fulfilled;

b) the report is submitted anonymously and does not contain sufficient information regarding violations of the law, which would allow the analysis and resolution of the report, and the appointed person requested its completion within 15 days, without this obligation being fulfilled.

  1. In the situation provided for  a), the classification solution is communicated to the public interest whistleblower, indicating the legal basis.
  2. If a person makes several reports with the same object, they are connected, the whistleblower in the public interest receiving only one information. If, after sending it, a new report is received with the same object, without presenting additional information to justify a different subsequent action, it is classified.
  3. The Designated Person/Third Party Designated in accordance with point 6.6 may decide to close the procedure if, after examining the report, it is found that the violation is clearly minor and does not require further subsequent actions other than closing the procedure. This provision does not affect the obligation to maintain confidentiality, to inform the whistleblower in the public interest and does not affect any other obligations or other applicable procedures to remedy the reported violation.
  4. The classification solution is communicated to the whistleblower in the public interest, with the indication of the legal basis.

       6.8. Public disclosure

The whistleblower in the public interest who publicly discloses information regarding the violation of the law benefits from protection if one of the following conditions is met:

a) first reported internally and externally or directly externally, but considers that appropriate measures were not ordered;

b) has good reasons to consider that:

1. the violation may constitute an imminent or obvious danger to the public interest or the risk of irreparable damage; or

2. in the case of external reporting there is a risk of retaliation or a low probability that the violation will be effectively remedied given the specific circumstances of the reporting.

The notification regarding the violation of the law through public disclosure can be addressed to the media, professional, trade union or employer organizations, non-governmental organizations, parliamentary committees or by making available in any way in the public space information regarding violations of the law.

7. Safeguards, Supportive Measures and Remedial Measures

       7.1. terms

To benefit from protective measures, the public interest whistleblower must cumulatively meet the following conditions:

a) to be one of the persons reporting according to the provisions of point 6.3 who obtained information about violations of the law in a professional context;

b) to have had good reasons to believe that the information regarding the reported violations was true at the time of reporting;

c) to have carried out an internal report, an external report or a public disclosure.

To benefit from remedial measures, the whistleblower in the public interest must cumulatively fulfill the conditions provided above, as well as the condition that reprisals are the consequence of the report made.

The measures provided for in this chapter also apply:

a) facilitators;

b) to third parties who have connections with the whistleblower in the public interest and who could suffer reprisals in a professional context, such as his colleagues or relatives;

c) legal entities owned by the public interest whistleblower or for whom the public interest whistleblower works or with whom he has other types of connections in a professional context;

d) the public interest whistleblower who, anonymously, reported or publicly disclosed information about violations, but is later identified and suffers reprisals;

e) the public interest whistleblower who reports to the competent institutions, bodies, offices or agencies of the European Union.

       7.2. Disclaimer

The whistleblower in the public interest, as well as the persons from point 7.1 who carry out a report or public disclosure of information regarding violations of the law do not violate the legal provisions or contractual clauses regarding the disclosure of information and are not responsible for the reporting or public disclosure of such information, provided that they have made a public report or disclosure under the terms of this procedure and had reasonable grounds to believe that the report or disclosure was necessary to disclose a violation of the law.

       7.3. Prohibition of retaliation

Any form of reprisals against public interest whistleblowers, threats of reprisals or attempted reprisals is prohibited, especially those regarding:

a) any suspension of the individual employment contract or the service relationship;

b) dismissal or release from public office;

c) modification of the employment contract or service report;

d) salary reduction and change of work schedule;

e) relegating or preventing promotion in work or public office and professional development, including through negative evaluations of individual professional performance or through negative recommendations for the professional activity carried out;

f) application of any other disciplinary sanction;

g) coercion, intimidation, harassment;

h) discrimination, creating another disadvantage or being subjected to unfair treatment;

i) refusal to convert a fixed-term employment contract into an indefinite-term employment contract, if the worker had legitimate expectations that he would be offered a permanent position;

j) refusal to renew a fixed-term employment contract or early termination of such a contract;

k) causing damage, including to the reputation of the person in question, especially on social communication platforms, or financial losses, including in the form of loss of business opportunities and loss of income;

l) inclusion on a list or in a negative database, based on a sectoral or industry-level agreement, formal or informal, which may imply that the person in question will not find a job in the future the respective sector or in the respective industry;

m) the unilateral out-of-court termination of a contract for goods or services, without meeting the conditions in this regard;

n) cancellation of a license or a permit;

o) the request for a psychiatric or medical evaluation.

At the request of the public interest whistleblower subject to disciplinary investigation, within a maximum of one year from the date of the report, the bar association in the constituency of the public interest whistleblower's activity provides free legal assistance during the disciplinary procedure.

       7.4. Challenging retaliatory measures

(1) The public interest whistleblower, as well as the persons from point 7.1. may challenge the measures provided for in point 7.3. through a request addressed to the competent court, depending on the nature of the litigation, in whose territorial constituency he is domiciled.

(2) In the disputes provided for in para. (1) the burden of proving that the contested measure is justified by reasons other than those related to reporting or public disclosure to the employer.

(3) At the request of the public interest whistleblower who wishes to contest the measures provided for in point 7.3. the bar in the constituency of the place where the whistleblower's activity is carried out in the public interest provides free legal assistance.

(4) If the court finds that the measure was ordered as retaliation in consideration of reporting or public disclosure, it may order, as the case may be, the abolition of the measure, the restoration of the parties to their previous situation, the reparation of the damage, the termination of the measure and its prohibition in the future, as well as any other measures to stop the forms of reprisals.

       7.5. Advice, information and assistance

(1) The Integrity Agency provides advice and information in relation to protection measures, rights, procedures and applicable reparative measures.

(2) The Integrity Agency provides public interest whistleblowers with assistance in relation to their protection against reprisals before any authority.

8. Protection of the identity of the data subject and third parties

(1) The provisions relating to the protection of the identity applicable to whistleblowers in the public interest, provided for in 6.5 point 1 and in Annex 3, apply to the person concerned, as well as to the third parties referred to in the report.

(2) The identity of the person concerned is protected while the actions following the reporting or public disclosure are in progress, unless, as a result of the resolution of the reporting or disclosure, it is established that the person concerned is not guilty of the violations of the law that were the subject of the report or disclosure.

(3) The persons concerned have the right to defense, including the right to be heard and the right of access to their own file.

9. Penalties

       9.1. If the whistleblower became aware that the information reported was not true:

  • does not benefit from the protection provided for by Law 361/2022 (neither the whistleblower nor the other persons provided for in art. 20 par. 3 of the law), nor those from chapter 5;
  • may be penalized for contravention with a fine from 2.500 lei to 30.000 lei by ANI.
  • the employer can apply disciplinary sanctions and request coverage of the damage caused by the worker, under the terms of the Labor Code
  • any other legal remedies remain available, including possible criminal liability.

       9.2 If it turns out that the information was false, and the whistleblower had no reasonable grounds to believe it to be true, but it was not shown that he knew it to be false:

  • does not benefit from the protection provided by Law 361/2022 (neither the whistleblower nor the other persons provided for in art. 20 paragraph 3 of the law), nor those provided for in ch. 5.
  • cannot be penalized for contravention with a fine from 2.500 lei to 30.000 lei by ANI.
  • depending on the circumstances of the act, the employer may apply disciplinary sanctions as a result of the report.
  • the employer can benefit from the coverage of the damage caused by the worker, under the terms of the Labor Code, depending on the factual situation.
  • any other legal remedies remain available.

10. Responsibilities

Designated person

According to point 6.6 of this instruction

11. Responsibilities

       11.1 The reports are archived for a period of 5 years.

       11.2 The records in the electronic register are archived for a period of 5 years

12. Access to records, archives

It is carried out according to the general procedure PG-VAL-01 "Control of documented information".

13. Distribution

This procedure, in the version in force, is distributed by the developer in a controlled manner on electronic and/or paper support to internal VALROM and external users (as applicable). All workplace bosses have the obligation to train their subordinates with the requirements of this procedure.

14. Appendices

Annex 1 – Internal reporting form

Annex 2 – Internal reporting process flow

Annex 3 – Information note regarding data processing carried out as a result of reports received through the internal channel

APPENDIX 1 – Internal reporting form

Internal reporting of violations of the law

Whistleblower Data
Name and surname  
Phone Number  
The home address  
The professional context from which the information originates
The target person
The object of the report (the description of the facts that may constitute a violation of the law and, as the case may be, the evidence in support of the report)
Date of reporting Signature whistleblower
 
The solution method

 

 
Date of settlement Designated person/designated third party signature
 

APPENDIX 2 – Internal reporting process flow


APPENDIX 3 – Information note regarding the data processing carried out as a result of the reports received through the internal channel

INFORMATION NOTE

regarding the data processing carried out as a result of the reports received through the internal channel

Given the marriage Valrom Industry SRL has the legal obligation to create internal communication channels for reporting violations of the law, which have occurred or are likely to occur, in accordance with the provisions of Law no. 361/2022, below we present important information about how we process this data.

Please go through this information carefully to properly understand how Valrom Industry SRL processes your data, the purposes and period for which we do it, as well as the rights you enjoy and how you can exercise these rights.

  1. Types of data processed and purposes of processing

1.1 Valrom Industry SRL, with headquarters in Bucharest, Sector 6, Street: B-dul Preciziei no. 28, processes personal data related to the type of notification, the category to which the reporter belongs and details related to the notification itself (e.g. anonymous or assumed whistleblower, name, first name of the reporter, mailing address, telephone number, quality of the reporter of employee/supplier/customer/shareholder/others, the name/position of the suspect, the date of the incident/deed, the type of deed, any other details).

1.2. The data mentioned above are used for the purpose of analyzing the reports and investigating the reported facts, for requesting additional data and information necessary to take appropriate measures, and if the results of internal investigations lead to the need to inform the competent authorities, the data provided by you will be used and to this end.

  1. Duration of data processing

2.1. The reports will be kept for a period of 5 years, according to art. 7 para. 2 of Law 361/2022.

  1. Data transfer

3.1. The only people able to access the data covered by this policy are those who need it for their professional activity (the person designated to receive the reports and the extended team, in the situations mentioned in the reporting procedure). Data is not distributed informally, either internally or externally to the organization, except where Valrom Industry SRL is legally obliged to do so or when the transmission is necessary to achieve the purpose for which the data are processed (for example when it is necessary for the reporting to be analyzed at the level of the group of which the company is a part).

3.2. In all the cases described above, the disclosure of your personal data is carried out on the basis of a contract concluded with the recipients of the data, whereby they undertake to use the data exclusively for the purpose for which they were entrusted, to comply with the obligation of confidentiality and insurance of data security, as well as to comply with all the provisions of the legislation in force regarding the protection of personal data.

3.3. We can also disclose the data related to the reports sent by you to public authorities, based on and within the limits of the legal provisions and as a result of express requests made by them.

  1. The rights of data subjects

4.1. As a natural person whose data is processed by Valrom Industry SRL you have the following rights which you can exercise free of charge:

– To be informed whether or not the company processes your personal data and what they are;

– To request the correction of the transmitted data, if they are incorrect or incomplete;

– To request the restriction of processing or to oppose the processing of your data, for well-founded and legitimate reasons related to your particular situation;

– To request the deletion of your data, except where the law prohibits deletion.

– If you have given us your consent for the processing of some personal data, you can withdraw your consent at any time, without affecting the legality of the processing carried out prior to the withdrawal.

– You have the right to file a complaint with a supervisory authority when you consider that the legal provisions on the protection of personal data have been violated.

4.2. You can exercise the rights mentioned above by contacting us at dataprotection@romstal.ro. To protect your personal data and your interests, we may ask you for additional information to identify you when you wish to exercise your rights above.

To avoid processing sensitive data without a valid basis, please do not include the following categories of data in your report if they are not related to the reported breach:

  • racial or ethnic origin
  • political opinions
  • religious confession
  • philosophical beliefs
  • union membership
  • health data
  • data regarding sex life or sexual orientation

*The internal procedure regarding the internal reporting of violations of the law may undergo changes and may be updated by Valrom Industrie SRL, as necessary.