1. Introduction and purpose
With this whistleblower scheme, the company has chosen to make a distinct, autonomous, and independent channel available where company employees, customers, and business partners can report suspected irregularities, violations, or presumed violations of the company’s policies and guidelines or applicable laws.
Rather than replacing direct company contact - which a whistleblower scheme cannot and should not - the system will create an appropriate space for serious incident reporting. That is, incidents that are either not suitable for existing communication route processing or occurrences in which anonymity is requested.
The following sections describe in greater detail how the whistleblower scheme works in practice, including the matters covered by the scheme and how filed reports are processed as part of the whistleblower scheme.
2. What circumstances and situations can be reported?
The whistleblower scheme may be used to report any suspected irregularities, violations, or presumed violations of the company’s policies and guidelines or applicable laws.
As a general rule, the following matters are not covered by the scheme:
- Complaints about cooperation difficulties, perceived incompetence, remuneration grievances, and other affairs that might be characterized as everyday or routine matters.
- Reports on the work environment, decision-making processes, or general management decisions.
The areas not covered by the scheme are not to be neglected but addressed in other ways.
It is not allowed to deliberately report false accusations or incorrect information about persons.
3. Who can file a report?
All employees, customers, and business partners can create anonymous reports as part of the scheme.
4. Who can be the subject of the report?
You can report any suspected irregularities or breaches of the law committed by the company or the company’s employees along with members of management, ownership, or the board of directors.
5. How is a report filed - and to whom?
Whistleblower scheme reports are filed electronically on the whistleblower portal via the link published by the respective company.
Reports may be submitted in Danish or English, and the following information is useful for the people processing the reported statement:
- The name, department, and contact details of the person the report is regarding,
- A description of the facts giving rise to the report, and
- Any and every documentation or evidence supporting the claim.
Initially, the report is processed by an external lawyer or partner assigned to the case. Said person is responsible for the screening and ensuing inquiry rejection or notification of the relevant individual in either company management or the whistleblower committee, alerting him or her to the filing.
6. Anonymity?
The person filing the report can do so anonymously or choose to make his or her identity known.
The whistleblower system does not log IP addresses nor machine ID’s and all the recorded data is fully encrypted from the moment of reception to transmission and storage. Only the external lawyer assigned to the case has access to the report processing part of the system.
When you have filed a report, you will have the opportunity to anonymously log on to the system at a later time to see if you have any pending questions that have been asked of you by the external lawyer or if further documentation has been requested.
Any and every subsequent dialogue to the filing is fully anonymous unless you (the reporter) explicitly renounce that anonymity - and it is based solely on your willingness to log on to the system and answer the external lawyer’s questions.
Regardless of whether you choose to disclose your identity, please be aware that the investigation into the incident or misconduct reported may compromise your anonymity if, for example, an employment law case or a lawsuit is initiated against the person subject to the report.
7. The post-reporting process
If the external lawyer or partner concludes that the reported incident or misconduct concerns a member of the company's management or board of directors, an alternative - relevant, appointed, and impartial - person in the company will be informed about the filing.
When a report is received by the external lawyer or partner, said lawyer/partner is obliged to open an investigation into the matter submitted.
If the reported statement is incorrect or proves to fall outside the scope of the scheme, it will immediately be rejected and deleted from the system and the reporter will be notified. If the report has been filed anonymously, said notification may be found by logging into the whistleblower portal using the provided username and password.
If the conclusion to the initial screening is that the filed report is likely to fall within the scope of the scheme, it will be subject to further investigation. Initially, the report is processed by an external lawyer or partner assigned to the case and subsequently by the company. The case may – or may not – have labor law consequences for the individual subject to the report, whether it be a member of management, the board of directors or somebody else entirely. The case will be deleted from the whistleblower portal once it is no longer required to have the information registered.
If the reported statement concerns specific persons, the company may be obliged to alert the given individual to the filing. For this reason, and every report filing, an accurate and concrete assessment is therefore made regarding when a possible notice can or should be made to ensure that the notification does not impact the investigation of the reported facts or the gathering of evidence.
No information on the reporter’s identity will be offered even if the given reporter has chosen to make his or her identity known. However, attention must be drawn to the fact that a non-anonymous reporter risks being called upon as a witness in the event of a trial. Also, please be aware that even as an anonymous reporter the company’s investigation into the incident or misconduct reported may compromise your anonymity.
The reported circumstance or offense may be so serious that it must be passed on to the police for further investigation. Once the police (and possibly the courts) have brought the case to an end and any appeal period has expired, the filing will be deleted from the whistleblower portal.
Depending on the nature of the circumstance or offense, the case may end up in court and the person subject to the report may, again depending on the severity, risk a fine and/or imprisonment.
The whistleblower portal must never be used for making false accusations in which innocent people are suspected. All reports must therefore be submitted in good faith. If a report is filed in bad faith and it turns out to be the result of negative personal feelings, vengeance, or similar, said report can have labor law consequences for the reporter, if the person is identified.
8. Employee protection
All persons submitting reports to the whistleblower scheme are protected from any and every reprisal in consequence of the reporting itself, including dismissal and unfavorable treatment, provided that the reports are filed in good faith.
If the report involves circumstances worthy of criticism concerning the reporter him- or herself, or if the entity becomes aware of such points of criticism in connection with the reported statement, the reporter will not be exempt from adverse consequences regarding these matters.
If the reporter deliberately files a false accusation against a person or acts in bad faith, the reporter is not protected from negative consequences.
9. Confidentiality
All reports submitted to the whistleblower scheme are processed strictly confidentially by the company and the lawyer or partner administering the given scheme.
At any given time, the reporter can ask the system manager to delete the personal data entered into the report.
10. IT security
The whistleblower system is administered by Legalsys ApS, which is an independent party ensuring system security and anonymity. A data processing agreement has been entered into with Legalsys ApS.
You can read more about system security in the whistleblower portal.
11. Personal data
The personal data provided within the confines of the whistleblower scheme, as well as the processing thereof, is subject to the applicable laws on data protection.
As the whistleblower scheme is administered by an external lawyer/partner, he or she acts as the data processor on behalf of the company responsible for the data.
A data processing agreement has been entered into by the company and the lawyer or partner, in which, among other things, the lawyer is instructed not to disclose any personal data on the reporter to the company, unless the reporter has explicitly renounced his or her anonymity by agreeing to have personal data disclosed.
If a report is not filed anonymously, the external lawyer will process the personal data on the reporter, whilst personal data on the person subject to the report, in any case, is processed by the lawyer or partner together with the company. In general, said information usually includes the person’s name in addition to the description of the reported circumstance, which may – or may not – concern one or more criminal offenses and/or incriminating matters under the applicable labor law.
The lawful basis for the processing of general personal data is set out in Article 6(e) of the General Data Protection Regulation (GDPR), according to which the processing of personal data may be carried out where necessary as a means to perform tasks in the public’s interest or if said data processing falls within the scope of the public authority entrusted to the party responsible for the data. For this reason, the company is allowed to, for example, process personal data within the confines of the filed reports to ensure that suspected irregularities, violations, or presumed violations of applicable laws are brought to a stop and to restore confidence in the company.
Sensitive personal data may be processed on the lawful basis of Article 9(2)(f) of the General Data Protection Regulation (GDPR), according to which data processing is necessary for legal claims to be established, enforced, and defended as well as for courts to act in their capacity as a court.
Personal data confined within or associated with the report filings are retained for as long as this is deemed necessary considering the underlying cause based on which the report was filed. Also, the specific retention period will depend on the content of the reported statement.
The reporter, as well as the person subject to the report, has a right to complain about the personal data processing within the context of the whistleblower scheme. Such a complaint can be submitted to Datatilsynet, i.e. the Danish Data Protection Agency, at 28 Borgergade,1300 Copenhagen K, tel. +45 33193200, or by e-mail: dt@datatilsynet.dk.
12. Commencement
The whistleblower policy will enter into force as soon as it has been made public within the company and is reviewed at least once a year.
13. Questions
Questions about this whistleblower scheme may be directed to the relevant people listed in the whistleblower portal.