Whistleblowing Procedure

Milexia is committed to the highest standards of transparency, honesty, integrity, impartiality, and responsibility. These principles are part of our culture, promoting ethical behavior and safely reporting and investigating irregularities.

Milexia’s whistleblowing policy encourages and protects employees, former employees, and other business partners to report any allegations of illegal or improper conduct. It includes the necessary information to report serious concerns while ensuring confidentiality and protection.

Scope

This policy applies to all employees (current, former, and candidates), consultants, contractors, agents, or any other persons associated with us, including third parties, subsidiaries, or their employees.

Third parties, in the context of this policy, refer to any person or organization our company meets and works with. This includes actual and potential customers, suppliers, distributors, business contacts, representatives, and public bodies.

The procedure applies to allegations about:

• Bribery and any form of corruption
• Breach of a legal obligation
• Breach of public health and safety regulations
• Improper or unethical conduct
• Breach of product safety regulations
• Environmental damage
• Financial malpractice, impropriety, or fraud
• Criminal activities
• Attempts to conceal any of the above

Out of Scope

This procedure does not replace any other policy or procedure. Complaints about personal grievances, such as harassment or bullying, are usually not covered by the whistleblowing policy. If an employee is concerned about a colleague’s conduct in the workplace, they should first raise it with their superior or HR manager.

Confidentiality

All reports will be treated confidentially, and every effort will be made not to disclose the whistleblower’s identity unless requested otherwise. However, if the matter is later dealt with through another procedure or legal process, the whistleblower may be required to testify.

Milexia will not disclose the whistleblower’s identity without their consent, except to those involved in the investigation, within the limits defined by applicable laws and regulations.

Anonymous Reports

Whistleblowers are encouraged to provide their name whenever possible, as anonymous reports are often difficult to substantiate or prove. Anonymous reports carry less weight but will be considered based on:

• The seriousness of the issue raised
• The credibility of the allegation
• Whether it can realistically be investigated based on other factors or sources besides the whistleblower

False Reports

Reports include “proven” violations, malpractice, and reasonable suspicions within this policy’s scope. No disciplinary or other action will be taken against a whistleblower who makes an allegation in the reasonable belief that the information provided is true and in the public interest, even if the allegation is not corroborated by an investigation. However, disciplinary action may be taken against a whistleblower who makes a report without the reasonable belief that it is in the public interest, for example, if a report is made maliciously or for personal gain where there is no public interest element.

Procedure

Reports should preferably be directed to the line manager first. However, this may depend on the gravity and sensitivity of the issue(s) concerned and who is alleged to have committed the irregularity. The whistleblower may then direct their report to the next responsible person or the Compliance Director by emailing compliance@milexia.com.

Anonymous reports can be made via the anonymous site https://anonymousemail.me by sending an email to compliance@milexia.com with as much information as possible. No personal data will be attached to this email.

Once the report is received, it will be examined by the compliance team. After careful consideration, it will be discussed with the whistleblower, and if they wish to proceed with the report, it will be investigated. If the report is anonymous, the compliance team will determine whether an investigation should be carried out.

Reporting

Whether a report is written, oral, or anonymous, it is important to provide all relevant information, including:

• The background and history of the report, including relevant dates, names, and positions of people who may contribute to the report or investigation.
• The specific reason for the report. While the person making the report is not expected to prove the truth of the allegation, they should provide information that demonstrates reasonable grounds for it.
• The name of the person making the report and a contact point if it is not anonymous.

Investigation and Actions

Once a concern is raised, it will be investigated if there are reasonable grounds. If you did not make the report anonymously, you will be asked to attend a meeting as part of this investigation and will be informed of its progress as far as possible and appropriate, considering applicable confidentiality obligations. Note that you will not be given details of any disciplinary action taken unless deemed appropriate.

If the report reveals evidence of a crime, it will be decided whether to inform the police or a regulatory body.

Timelines

Acknowledgment of the report will be provided within seven days.

Follow-up, communication, and impartial feedback will occur within three months of the report submission. This will include, among other things:

• An indication of whether any initial investigation has been carried out
• Allowing the whistleblower to review and edit the report and interview notes
• An indication of how Milexia proposes to address the matter
• An estimate of the time it will take to give a final response
• An indication of whether further investigations will be carried out or not. If not, an explanation of why.

This does not apply to anonymous reports, as communication is not possible.

Dissatisfaction with Process Outcome

If you are dissatisfied with the investigation outcome, you can explain your reasons to the person to whom you made the report or the investigation leaders. They must respond in writing, notifying whether the investigation will proceed and the reasons for this decision.

Breach of This Policy

Milexia reserves the right to take disciplinary action if it is discovered that anyone has subjected a whistleblower to any form of detrimental treatment. Likewise, if the whistleblower has intentionally misled us regarding any matter, has breached this policy in any other way, and/or we believe they have made a false report maliciously.

The aim of this policy is to ensure compliance with our obligations under the European Parliament Directive 2019/1937 on the protection of persons who report breaches of Union law and the UK’s Public Interest Disclosure Act 1998, which “protects workers from detriment or victimization by their employer if, in the public interest, they blow the whistle on wrongdoing.”

All personal data, both of the whistleblower and those accused, will be treated following MILEXIA’s Privacy Policy.

Maria Gonzalez Müller, Compliance Director

Updated: September 2022