1. Purpose

The company “SEPTONA SOCIÉTÉ ANONYME INDUSTRIAL AND COMMERCIAL COMPANY OF PARAPHARMACEUTICAL PRODUCTS” (hereinafter referred to as the “Company”), in compliance with the provisions of Law 4990/2022 (“Protection of persons reporting breaches of Union law”), seeks to promote a transparent and responsible business environment and uphold a high level of business ethics.

This corporate policy (hereinafter referred to as the “Policy”) aims to define the procedures through which any employee may report acts or omissions, whether intentional or negligent, that constitute or may constitute violations or inducements to violate laws, regulations, values, and principles provided under the Company’s Internal Rules of Operation, applicable legislation, company policies and regulations, and which may, within the context of relationships formed, cause damage of any kind (for example financial, environmental, related to employee safety or health, etc.) to the Company’s reputation, customers, partners, suppliers, third parties, and, more broadly, to the public interest (hereinafter referred to as a “Report”).

2. Recipients and Officer Responsible for Receiving and Monitoring Reports (RRMO)

Recipients of this Policy (hereinafter referred to as the “Recipients” and/or “Reporters”) include members of the management body, employees of the Company, customers, suppliers, partners, consultants, and generally any interested parties associated with the Company (hereinafter referred to as “Third Parties”).

A prerequisite for falling within the protection scope of this Policy is that the Report must be made in good faith, meaning that individuals submitting reports must have reasonable grounds leading to the honest belief that the information they provide is true. In any case, bad-faith reports are excluded unless it is proven that the report was made maliciously. In the event of a malicious report, it is understood that the protection described under this Policy shall not be provided.

The Company has appointed as the Reports Receiving and Monitoring Officer (RRMO) the IT Manager. The RRMO must:
a) perform their duties with integrity, objectivity, impartiality, transparency, and social responsibility;
b) comply with confidentiality and secrecy obligations regarding matters brought to their attention during the performance of their duties; and
c) refrain from handling specific cases by declaring impediments whenever a conflict of interest arises.

The RRMO has the following responsibilities:

1. Providing appropriate information regarding the possibility of submitting a report and communicating relevant information visibly within the Company.
2. Receiving reports concerning violations that fall within the scope of this Policy.
3. Acknowledging receipt of the report to the recipient/reporter within seven (7) working days from the date of receipt.
4. Taking the necessary actions so that the competent bodies of the Company or, where applicable, the relevant authorities investigate the report, or closing the procedure by archiving the report if it is deemed incomprehensible or if the report does not relate to incidents that fall within the scope of violations of Union law, or where there are no serious indications of such violations. The reporter shall be informed accordingly, or, if necessary, the report may be forwarded to the National Transparency Authority (NTA) (hereinafter referred to as “E.A.D.” in Greek), which, as an external reporting channel, exercises the powers provided under Article 12 of Law 4990/2022.
5. Ensuring the protection of the confidentiality of the identity of the recipient/reporter and any third party named in the report, preventing access by unauthorized persons.
6. Monitoring reports and maintaining communication with the recipient/reporter and, where necessary, requesting additional information.
7. Providing updates to the recipient/reporter regarding the actions undertaken within a reasonable period of time, which shall not exceed three (3) months from the acknowledgment of receipt, or, if no acknowledgment has been sent to the recipient/reporter, within three (3) months from the expiry of seven (7) working days from the submission of the report;
8. Providing clear and easily accessible information regarding the procedures under which reports may be submitted to the National Transparency Authority (NTA) and, where applicable, to public bodies or institutions and agencies of the European Union.
9. Designing and coordinating training activities related to ethics and integrity, and participating in the development of internal policies aimed at strengthening integrity and transparency within the Company.

In cases where the RRMO performs additional duties, it shall be ensured that the exercise of such duties does not affect their independence or create conflicts of interest in relation to the responsibilities assigned above.

3. Reports

Recipients who identify or become aware in any way of potential unlawful conduct or irregularities committed during the course of their work activities, which affect such activities, by individuals who maintain relationships with the Company, are encouraged to submit a Report by providing all relevant facts, events, circumstances, and situations that, based on reasonable grounds, are considered to constitute a violation and/or conduct inconsistent with accepted practices.

As a “Report” means any notification concerning unlawful conduct, acts or omissions, whether intentional or negligent, that constitute or may constitute violations or inducement to violate laws and/or regulations, values and/or principles provided under the Company’s Internal Rules of Operation, applicable legislation, internal control principles, as well as corporate policies and/or rules.

Reports may concern issues such as fraud, bribery, conflicts of interest, fraud, harassment, intimidation, discrimination and retaliation, health and safety at work environmental damage, unfair competition practices, and violations of personal data.

More specifically, in accordance with the provisions of Article 4 of Law 4990/2022, the provisions of this Policy apply to the protection of persons who report or disclose violations concerning the following areas:

violations of Union law, particularly in the areas of:

public procurement,

financial services, products and markets, as well as the prevention of money laundering and terrorist financing,

product safety and compliance,

transport safety,

environmental protection,

radiation protection and nuclear safety,

food and feed safety, animal health and welfare,

public health,

consumer protection,

privacy and protection of personal data, as well as the security of network and information systems

violations affecting the financial interests of the Union under Article 325 of the Treaty on the Functioning of the European Union (TFEU) and as specifically defined in relevant Union measures;

violations relating to the internal market, as referred to in Article 26(2) of the TFEU, including breaches of Union competition and state aid rules, as well as violations concerning the internal market related to acts that breach corporate taxation rules or arrangements aimed at obtaining a tax advantage that defeats the object or purpose of applicable corporate tax law.

Reports falling within the above legal scope may include, but are not limited to, the following:

• Leakage of confidential information, trade secrets, designs related to strategic or broader financial interests of the Company. criminal activity • non-compliance with legal, professional, or regulatory obligations • environmental damage • bribery • corruption • fraud • theft • embezzlement • conspiracy • participation in illegal agreements • violations of the Company’s policies and procedures • conduct that may harm the reputation or financial well-being of the Company (or its subsidiaries) • unauthorized disclosure of confidential information • breach of trade secrets • human rights violations • discriminatory treatment (e.g. due to gender or race) • abuse or excessive use of authority • breach of trust • fraud in procurement procedures • conflict of interest • violation of the confidentiality of personal data • money laundering from criminal activities • violations of competition law • violations related to accounting and auditing matters • violations concerning health and safety issues • violations related to public contracts • violations of environmental legislation • violence and harassment within the meaning of Articles 3 and 4 of Law 4808/2021 • sexual exploitation and abuse • threats • intimidation • use of violence • intentional concealment of the above acts.

The Reporting Policy does not cover:

1. Disagreements regarding policies and management decisions
2. Personal matters and disputes with colleagues or supervisors
3. Rumors

Reports may be submitted anonymously. However, the Company recommends that they be named, so that the competent bodies may investigate them more effectively, applying in each case all measures provided for in the Reporting Procedure, provided that the anonymity of the reporter is not compromised. The Company encourages both employees and third parties to provide the necessary and accurate information to enable an effective review of the validity of the reported facts and facilitate the proper evaluation of the nature and extent of the events identified. It is particularly important that a report includes, if such information is known to the Reporter:

• a detailed description of the events identified and the manner in which they became known to the Reporter
• the date and location where the incident occurred
• the names of the employees or involved persons, or information that may help identify them
• the names of any other persons who may provide information regarding the event under review
• reference to any documents that may confirm the validity of the reported events

The competent body responsible for receiving and reviewing reports is the R.R.M.O. (Reports Receiving and Monitoring Officer).

The Report must be submitted in either the Greek or English language through the following methods:

• via e-mail to: reportall@septona.gr, access to which is restricted to the R.R.M.O.
• in writing, to the postal address: SEPTONA S.A., Oinofyta Viotias, Thesi Avgousta, P.C. 32011, under the attention of the Reports Receiving and Monitoring Officer (R.R.M.O.)

Recipients who, for any reason, receive information concerning an alleged violation must:

1. ensure the confidentiality of the information they receive,
2. direct the Reporter regarding compliance with the Reporting procedures, and

iii. in the event of an electronic Report, forward it promptly and exclusively to the email address reportall@septona.gr or, in the case of a written submission, to the address SEPTONA S.A., Oinofyta Viotias, Thesi Avgousta, P.C. 32011, for the attention of the Reports Receiving and Monitoring Officer (R.R.M.O.), and in any case refrain from undertaking any independent initiative for examination and/or investigation.

4. Confidentiality and Prohibition of Retaliation

The Company, in seeking to encourage Recipients to report potential unlawful conduct or irregularities in a timely manner, guarantees the confidentiality of the Report and the data it contains, as well as the anonymity of the Recipient/Reporter or their omission, provided that the Report is not proven to have been submitted maliciously, except in cases of malicious Reports where such protection shall not apply.

The Company does not tolerate any form of threat, retaliation, sanction, or adverse discriminatory treatment against the Recipient/Reporter, the Reported Person, or anyone participating in the investigation of the Report. The Company is committed to taking appropriate measures against those who threaten or engage in acts of retaliation against individuals who submit Reports under this Policy, without prejudice to the rights of persons against whom protective measures are taken in cases where it is determined that a knowingly false statement or report was made intentionally or through gross negligence.

Furthermore, pursuant to Article 17 of Law 4990/2022, any form of retaliation against the persons referred to above is prohibited, including threats and retaliatory actions. In particular, the following forms of retaliation are prohibited:

1. suspension, dismissal, or equivalent measures,
2. demotion, withholding, or denial of promotion,
3. reassignment of duties, change of workplace, salary reduction, modification of working hours,
4. denial of training opportunities,
5. negative performance evaluation or negative professional reference,
6. reprimand, imposition of disciplinary or other measures, including financial penalties,
7. coercion, intimidation, harassment, or ostracism,
8. discrimination or unfair treatment,
9. failure to convert a temporary employment contract into a permanent one,
10. non-renewal or early termination of a temporary employment contract,
11. harm, including damage to reputation, particularly on social media, or financial loss, including loss of business opportunities and income,
12. blacklisting on the basis of an informal or formal sectoral or industry agreement, which may result in the individual being unable to find employment in the sector or industry in the future,
13. early termination or cancellation of a contract for goods or services,
14. revocation or cancellation of a license or permit,
15. referral for psychiatric or medical monitoring,
16. refusal or denial of reasonable accommodations for persons with disabilities.

It is noted, furthermore, that pursuant to Article 18 of Law 4990/2022, Recipients/Reporters shall not incur any liability in relation to the acquisition of information or access to such information through a Report or public disclosure, unless such acquisition or access constitutes an independent criminal offense. In judicial proceedings, including but not limited to defamation, infringement of intellectual property rights, breach of confidentiality obligations, violations of personal data protection rules, disclosure of trade secrets, or claims for compensation under private, public, or collective labor law, Recipients shall not bear any liability in connection with reports or public disclosures made under this Policy, provided they had reasonable grounds to believe that the report or public disclosure was necessary to reveal a violation.

It is expressly stated that the Company may take appropriate disciplinary and/or legal measures to protect its rights, assets, and reputation against anyone who submits false, unfounded, or malicious Reports in bad faith and/or submits Reports solely for the purpose of defaming or causing harm to the Reported Person or other individuals mentioned in the Report. It is noted that the disclosure of facts in which the complainant is involved does not exempt them from any liability; however, this will be taken into consideration during the assessment of the Report.

5. Investigation of the Validity of the Report

The investigation of the validity of the incidents described in the Report by the Company, subject to any specific laws applicable to the matter, constitutes the responsibility of the Reports Receiving and Monitoring Officer (R.R.M.O.), who, once informed of the validity of the Report, undertakes the conduct of a fair and impartial investigation in accordance with the principles of impartiality, fairness, and confidentiality, while avoiding conflicts of interest.

During the investigation process, the R.R.M.O. may contact the relevant departments of the Company and, where deemed necessary, external advisors with expertise in the subject matter of the submitted Report, ensuring the confidentiality of the Report.

Upon completion of the investigation process, the R.R.M.O. prepares a written report regarding the investigations carried out and the findings that emerged. Depending on the results, the Company’s competent bodies are informed in order to determine any action plans for implementation and the measures required to protect the Company. The results of the investigation are also communicated to the heads of the relevant departments who may be affected by the content of the Report.

Alternatively, if upon completion of the investigation no sufficiently substantiated evidence is found, the validity of the content of the Report cannot be confirmed.

The Report is archived along with the relevant assessment by the R.R.M.O.

6. Processing of Personal Data

The Company hereby declares that personal data (including any sensitive personal data, such as racial or ethnic origin, religious and philosophical beliefs, political opinions, participation in political parties, trade union membership, as well as personal data relating to criminal convictions and offenses, health status, and sexual orientation) of Reporters and any other potentially involved persons, collected during the handling of Reports, will be processed in accordance with applicable national legislation regarding the protection of personal data. Only data that is absolutely necessary for investigating the validity of the Report and processing it will be subject to processing.

The processing of personal data in relation to Reports is initially carried out by the R.R.M.O., acting in the capacity of Data Controller (subject to any specific laws applicable to the matter), solely for the purpose of carrying out the procedures provided under this Policy.

Specifically, for the proper management of submitted Reports, as well as for the full compliance with obligations arising from legislation and regulations, the Company will process personal data while ensuring the confidentiality, security, rights, and freedoms of the individuals involved.

The personal data contained in Reports may be disclosed by the R.R.M.O. to the Company’s competent bodies, external partners appointed to assist in the management of Reports, as well as judicial authorities, for the purpose of initiating the necessary legal procedures or taking appropriate administrative and/or disciplinary measures against the Reported Person(s), where evidence is collected during the investigation that confirms the validity of the reported incidents.

During activities aimed at verifying the validity of the Report, all necessary measures will be taken to protect personal data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

Furthermore, documents related to the Report will be retained in both hard copy and electronic form for a period not exceeding the time required for the proper completion of the procedures provided under this Policy.

7. Measures for the Protection of Reported Persons

Recipients/Reported Persons retain all rights to legal remedies and legal means and enjoy the rights to a fair trial and, in particular, the right to effective judicial protection before an impartial court, as well as the presumption of innocence and rights of defense, including the right to be heard and the right of access to their file.

The identity of the Reporter remains confidential. By exception, if the Report is proven to be malicious, and provided that this is necessary for the Reported Person to exercise their legal rights, the identity of the Reporter may be disclosed.

It is clarified that Reports proven to be manifestly malicious will be investigated further at the Company’s discretion in relation to the individuals involved, in order to restore any damage by any lawful means.

Additionally, in cases involving alleged civil or criminal offenses, the complainant will be informed in advance that their identity may eventually be disclosed to judicial authorities during legal proceedings.

8. Submission of External Reports to the N.T.A.

The Recipient/Reporter has the option to submit an external report/complaint directly to the National Transparency Authority (N.T.A.).

The specific complaint may be submitted in writing or through an electronic platform accessible to persons with disabilities, as follows:

Electronically: by sending an email to kataggelies@aead.gr or by completing the relevant complaint form: https://aead.gr/submit-complaint/ 

By post: by sending it to the postal address of the N.T.A.: 195 Lenormand & Amfiareou Street, P.C. 104 42, Athens 

In person (or through a legally authorized representative) by submitting the complaint at the premises of the N.T.A.: 195 Lenormand & Amfiareou Street, P.C. 104 42, Athens