Whistleblowing at Early Bird

Background

At Early Bird, we strive to conduct business with high ethical standards where misconduct should not occur. We want the workplace to be so transparent and safe that employees want and dare to raise issues openly without worrying about reprisals. When it comes to misconduct and irregularities, there may still be situations where employees cannot or do not want to report openly. Therefore, it is important for us that there is clear information about how to report confidentially and securely. If there is suspicion of ongoing or past misconduct, there should be resources to expose them. By making it easy to report, we collectively work to promote the trust of employees, customers, and the public in us.

Our whistleblower cases are initially received and handled by an external and independent party. In some cases, specially appointed internal case handlers may be involved in the continued handling. Reporting and further communication take place through the whistleblower channel.

Definitions

• GDPR: The General Data Protection Regulation ((EU) 2016/679), which is a European regulation governing the processing of personal data and the free flow of such data within the European Union.

• Whistleblower Directive: Directive 2019/1936 on the protection of persons reporting on breaches of Union law.

• Whistleblower Act: Act (2021:890) on the protection of persons reporting on misconduct.

• Visslan: The Whistle Compliance Solutions AB's whistleblower service Visslan, which enables digital reporting of misconduct.

• Misconduct: Actions or omissions that have emerged in a work-related context that there is a public interest in revealing.

• Reporting: Verbal or written provision of information about misconduct.

• Internal reporting: Verbal or written provision of information about misconduct within a private sector company.

• External reporting: Verbal or written provision of information about misconduct to the competent authorities.

• Disclosure or disclose: Making information about misconduct available to the public.

• Reporting person: A natural person who reports or discloses information about misconduct acquired in connection with their work-related activities.

• Reprisal: Any direct or indirect act or omission that occurs in a work-related context and is prompted by internal or external reporting or by a disclosure, and which results in or may result in unjustified harm to the reporting person.

• Follow-up: Any action taken by the recipient of a report to assess the accuracy of the allegations made in the report and, if applicable, to handle the reported violation, including through actions such as internal investigations, investigations, prosecution, actions to recover funds, and closure of the proceedings.

• Feedback: Providing reporting persons (“whistleblowers”) with information about the actions planned or taken as a follow-up and the grounds for such follow-up.

1. Who can whistleblow?

You can whistleblow and receive protection from the Whistleblower Act if you are an employee, volunteer, intern, active shareholder, person otherwise available for work under our control and management or part of our management, governance, or supervision body. Contractors, subcontractors, and suppliers to us who have become aware of misconduct within the company can also report.

Ending your work-related relationship with us, or if it has not yet started, is not a barrier to reporting a misconduct.

2. What can I whistleblow about?

In case of suspicion of possible misconduct, legal and/or regulatory violations, we encourage you to report this to us as a whistleblower case. When reporting, it is important that you had reasonable grounds at the time to believe that the information about misconduct that was reported was true. In assessing whether reasonable grounds existed, the circumstances and information available to you at the time of reporting should form the basis for whether you could have assumed the misconduct was true. The above requirements must be met for you to receive protection under the whistleblower law.

Before you whistleblow, read 5 questions to determine if you are protected by the whistleblower law.

2.1 Misconduct of public interest

You can report information about misconduct that has come to light in a work-related context that there is a public interest in revealing. For other types of personal complaints that do not have a public interest in being revealed, such as disputes or complaints regarding the workplace or working environment, we encourage you to contact your nearest supervisor or HR. This is to ensure that these cases are handled in the best possible way.

Examples of serious misconduct that should be reported:

• Deliberate incorrect accounting, internal accounting control, or other financial crime.

• Occurrence of theft, corruption, vandalism, fraud, embezzlement, or data breaches.

• Serious environmental crimes or major deficiencies in workplace safety.

• If someone is subjected to serious forms of discrimination or harassment.

• Other serious misconduct affecting individuals' lives or health.

• Other serious misconduct affecting the company's vital interests.

2.2 Misconduct that violates EU law

There is also the possibility to report information about misconduct that has come to light in a work-related context that violates EU legal acts or regulations. If you suspect this occurs, please read the whistleblower law Section 2 and the whistleblower directive application area in Article 2 and Annex Part 1 for applicable laws.

3. How do I report?

3.1 Written reporting

In a written case, we use our digital whistleblower function Visslan. It is always available here. On the website, select “report” to then describe your suspected misconduct. Please describe what happened as thoroughly as possible, so that we can ensure appropriate measures can be applied. It is also possible to attach additional evidence, such as written documents, images, or audio files.

3.1.1 Sensitive personal data

Please do not include sensitive personal data about persons mentioned in your report unless it is necessary to be able to describe your case. Sensitive personal data includes information about; ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, a person's sex life or sexual orientation, genetic data, biometric data used to uniquely identify a person.

3.1.2 Anonymity

You can remain anonymous throughout the process without affecting your legal protection, but you also have the option to disclose your identity under strict confidentiality. Anonymity can in some cases complicate the follow-up possibilities of the case and the actions we can take, but in such cases, we may later ask you to disclose your identity under strict confidentiality.

3.1.3 Follow-up & login

After you report, you will receive a sixteen-digit code, which you will be able to log in to Visslan here. It is very important that you save the code, as otherwise you will not be able to access the case again.

If you lose the code, you can submit a new report referring to the previous report.

Within seven days you will normally receive confirmation that the report has been received. The report is handled by independent and self-sufficient case handlers. Communication with the case handlers takes place through the platform's built-in and anonymous chat function.

It is important that you, with your sixteen-digit code, log in regularly to answer any follow-up questions case handlers may have. In some cases, the case cannot proceed without answers to such follow-up questions from you as the reporting person.

3.2 Oral reporting

It is also possible to conduct an oral case by uploading an audio file as an attachment when creating a case on here. You then choose “Yes” to the question about evidence to be able to upload your file. In the audio file, describe the same circumstances and details as you would in a written case.

Additionally, a physical meeting with case handlers can be requested via Visslan. This is best done by either requesting it in an existing case or creating a new report.

3.3 External reporting

We encourage you to always first report misconduct internally, but if difficulties exist or it is deemed inappropriate, it is possible to conduct external reporting instead. We then refer you to contact competent authorities or, where applicable, EU institutions, bodies, or agencies. Contact information for these is available at the following web address: External whistleblowing reporting channels

4. What are my rights?

4.1 Right to confidentiality

During the processing of the case, it is ensured that the identity of you as the reporting person is treated confidentially and that access to the case is prevented for unauthorized personnel. We will not disclose your identity without your consent unless applicable legislation compels us, and we will ensure that you are not exposed to reprisals.

4.2 Protection against reprisals

In whistleblowing, there is protection against negative consequences from having reported misconduct, in the form of a reprisal ban. The protection against reprisals also applies in relevant cases for persons at the workplace who assist the reporting person, your colleagues and relatives at the workplace, and legal entities that you own, work for, or are otherwise associated with.

This means that threats of reprisals and attempts at reprisals are not allowed. Examples of such are if you were to be fired, have your work tasks changed, subjected to disciplinary action, threatened, discriminated against, blacklisted in your industry, or similar due to whistleblowing.

Even if you were identified and subjected to reprisals, you are still covered by the protection, if you had reasonable grounds to believe that the reported misconduct was true and within the scope of the whistleblower law. Note, however, that no protection is given if it is a crime in itself to obtain or have access to the information reported.

The protection against reprisals also applies in legal proceedings, including with regard to defamation, copyright infringement, breach of confidentiality, violation of data protection rules, disclosure of trade secrets, or regarding claims for compensation based on private, public, or collective labor law, and you shall not be held liable of any kind as a result of reports or disclosures provided you had reasonable grounds to believe that it was necessary to report or disclose such information to uncover misconduct.Skyddet mot repressalier gäller även i rättsliga förfaranden, inbegripet avseende förtal, upphovsrättsintrång, brott mot tystnadsplikt, överträdelse av dataskyddsregler, röjande av företagshemligheter eller avseende ersättningsanspråk som bygger på privaträtt, offentlig rätt eller kollektiv arbetsrätt, och du ska inte åläggas ansvar av något slag som en följd av rapporter eller offentliggöranden under förutsättning att du hade rimliga skäl att tro att det var nödvändigt att rapportera eller offentliggöra sådan information för att avslöja ett missförhållande.

4.3 Disclosure of information

The protection also applies when disclosing information. It is then assumed that you have reported internally within the company and externally to an authority, or directly externally, and no appropriate action has been taken within three months (in justified cases six months). Protection is also granted if you had reasonable grounds to believe there may be an apparent danger to the public interest if not disclosed, for example, in an emergency. The same applies when external reporting poses a risk of reprisals or if it is unlikely that the misconduct will be remedied effectively, for example, when there is a risk that evidence may be concealed or destroyed.

Note, however, that this protection does not apply if you as the reporting person disclose information directly to the media in accordance with another applicable protection system for freedom of expression and information. You still have notification protection and acquisition freedom where applicable.

4.4 Right to review documentation during meetings with case handlers

If you request a meeting with case handlers, they will with your consent ensure that complete and accurate documentation of the meeting is retained in a durable and accessible form. This can be done, for example, by recording the conversation or by keeping minutes. Afterwards, you will have the opportunity to review, correct, and approve the minutes by signing it.

If the conversation is not recorded, the case handlers have the right to document the conversation through minutes. Afterwards, you will have the opportunity to review, correct, and approve the transcription by signing it.

We recommend that this documentation is kept in Visslan's platform by the whistleblower creating a case where the information can be collected securely.

5. GDPR and handling of personal data

We always do our utmost to protect you and your personal data. We therefore ensure that our handling of these is always in accordance with the General Data Protection Regulation (“GDPR”).

In addition, all personal data irrelevant to the case will be deleted and the case will only be saved as long as it is necessary and proportionate to do so. A case may be processed for a maximum of two years after its conclusion. For more information about our handling of personal data see the company's Policy on Personal Data.