Procedure for receiving and processing whistle-blower reports

 

In application of Article 8 of the French Law of 9 December 2016 (the Sapin II Law), as amended by law no. 2022-401 of 21 March 2022 (the “Regulations”), Global Bioenergies (the “Company”) has introduced a procedure to receive concerns raised by whistle-blowers, as explained below.

 

For the purposes of this procedure and in accordance with the Regulations, a whistle-blower is defined as any “natural person reporting or divulging, without direct remuneration and in good faith, any crime or misdemeanour, any threat or harm to the general interest, or any breach or attempt to conceal a breach of an international commitment duly ratified or approved by France, of a unilateral act adopted by an international body based on such commitment, of EU law, or of law or regulations, (the “Information”)” it being specified that “unless the Information has been obtained in the course of their professional activities as described in Article 8 I of the French Law of 9 December 2016 [and listed in section 1.1 below], the whistle-blower must have personal knowledge of the Information.”

 

However, this procedure cannot be used to report facts, information or documents, of any kind and in any medium, whose revelation or disclosure is prohibited on grounds of national security, medical confidentiality, the confidentiality of judicial deliberations, confidentiality applying to inquiries or judicial investigation, or attorney-client privilege.

 

1. Whistleblowing channels

 

• Internal whistleblowing reports

 

The types of whistle-blower listed below, who have, in the course of their professional activities, obtained Information about events that have occurred or are very likely to occur in the Company, can choose to report this Information internally. This may be appropriate particularly when they think the problem can be effectively remedied through this route and they do not run a risk of retaliation:

• members of staff, former employees who obtained the Information in the course of their employment relationship, and applicants for a job in the Company who obtained the Information in the course of their application;
• shareholders, partners and holders of voting rights at the Company’s General Meeting of Shareholders;
• corporate officers and members of management or supervisory bodies;
• third-party and temporary employees;
• the Company’s co-contractors and sub-contractors or, where these are legal persons, their corporate officers, members of their management or supervisory bodies, and their staff.

 

• External whistleblowing reports

 

Any whistle-blower can also report an issue externally, whether or not they have previously reported it internally through the procedure set out in 1.1:

• to the competent authority as set out in the Regulations;
• to France’s Defender of Rights (Défenseur des droits) who will redirect the matter to the most appropriate authorities;
• to the legal authorities;
• to an EU body or institution competent to receive information on breaches of rules coming under the scope of EU Directive 2019/1937 of the European Parliament and Council of 23 October 2019.

 

• Public whistleblowing

 

Information can also be publicly revealed by whistle-blowers in the following circumstances:

• if, having reported the issue externally, whether or not this followed an internal report, no appropriate measures have been taken by the expiry of the response period set out in the Regulations or, if the issue has been reported to one of the authorities in 1.2, at the expiry of a period provided for in the Regulations;
• in the event of a serious and imminent threat;
• where reporting to one of the competent authorities listed in 1.2 would create a risk of retaliation for the whistle-blower or would not lead to an effective remedy of the issue due to the circumstances of the case, notably if proofs could be concealed or destroyed, or if the whistle-blower has serious grounds to think the authority may have a conflict of interest, being either in collusion with the instigator of the matters concerned or themselves implicated in the case.

 

As an exception to the above, the whistle-blowers listed in 1.1 can publicly reveal the Information if there is a clear or imminent threat to the general interest, notably where there is an emergency or risk of irreversible harm.

 

Unless the Information has already been reported externally, publication is prohibited where it would prejudice national defence or security.

 

 

2. Receiving internal whistleblowing reports

 

• Recipient of internal whistleblowing reports

 

Internal whistleblowing reports should be brought to the attention of one of the following:

• line manager (direct or indirect),
• employer,
• the officer nominated by the Company, i.e. the Company’s Chief Legal Officer.

 

• Sending internal whistleblowing reports

 

• Sending an internal whistleblowing report

 

The whistleblowing report must be sent by email to only one of the recipients listed in 2.1 (the “Recipient”) using the mandatory subject line: “signalement d’une alerte” (whistleblowing report).

 

The email must be sent to the work email address provided to the Recipient by the Company.

 

Any concerns initially raised by telephone or face-to-face with the Recipient must subsequently be confirmed in writing.

 

• Content of an internal whistleblowing report

 

The whistle-blower must lay out the facts underlying their concern clearly and objectively and provide any documents or information, in any format or medium, to substantiate their allegation. These items may also be referred to in the email and then made available to the Recipient promptly.

 

If the whistle-blower thinks it necessary, they can raise concerns about one or more persons in their report.

 

The facts reported should be expressed in terms that make clear the nature of the alleged wrongdoing.

 

Only facts that fall under the scope of the Regulations, cited in the introduction to this procedure, and the documents that support them will be considered. Data that fails to meet these criteria will be destroyed.

 

 

3. Processing internal whistleblowing reports

 

• Acknowledging receipt of an internal whistleblowing report

 

The Recipient must promptly acknowledge receipt of the report by replying to the whistle-blower’s email.

 

The Recipient’s reply must specify:

• the reasonable amount of time likely required to decide whether the report should be accepted for investigation,
• how the whistle-blower will be informed of actions taken in response to their report.

 

• Deciding whether the internal report is accepted for investigation

 

The Recipient must conduct a preliminary review to establish whether the facts reported fall within the scope of application of the Regulations and whether the report was correctly submitted in accordance with this procedure and the Regulations. If they find this is not the case, they shall inform the whistle-blower immediately.

 

This preliminary review shall take no more than one (1) month.

 

However, if it becomes apparent the Recipient needs more time due to the complexity of the report, they should email the whistle-blower specifying the new forecast period.

 

• Verifying the substance of the internal report

 

Once the whistleblowing report has been duly issued in accordance with paragraph 2.2 the Recipient may ask the whistle-blower to flesh out their allegation with additional explanations or further documents.

 

In processing the report, the Recipient may conduct any investigations they consider necessary to verify whether the facts alleged are as stated. To this end, they can involve the management (assuming the person concerned is not implicated in the case) or any other employee whose intervention they deem necessary, always in strict compliance with the obligation of confidentiality.

 

Any written exchanges between the Recipient of the report and the whistle-blower must take place via the Recipient’s work email and the email address chosen by the whistle-blower.

 

When processing whistleblowing reports the recipient must give both sides a fair hearing and comply with applicable labour law regulations throughout the process.

 

• Outcome of internal whistleblowing reports

 

Once the validity of the report has been reviewed and, if accepted, the substance of the allegations has been investigated, the Recipient must inform the whistle-blower by email of the action taken as a result.

 

However, if it becomes apparent the Recipient needs more time due to the complexity of the report, they should email the whistle-blower specifying the new forecast period.

 

 

4. Confidentiality in internal whistleblowing

 

• Scope of confidentiality

 

The following information must remain strictly confidential:

• identity of the whistle-blower,
• identity of those implicated by the report,
• information collected by the Recipient of the report.

 

No items likely to identify the whistle-blower may be disclosed without their consent. However, they may be disclosed to the legal authorities where the Recipient is under a legal obligation to do so. In such cases, the whistle-blower must be informed unless this would risk compromising the legal proceedings. When informing the whistle-blower the situation must be explained in writing.

 

No items likely to identify the person against whom wrongdoing is alleged can be disclosed until the substance of the report has been verified.

 

• Measures taken to ensure confidentiality

 

To guarantee the confidentiality of the information listed in 4.1, the Recipient must take all necessary and useful steps to keep confidential all items submitted by the whistle-blower when they are collected, processed and stored.

 

In particular, access to IT files relating to each report must be secured, namely by using individual user names and passwords, which are regularly changed, or by any other secure means of authentication. Any access to such files shall be recorded and checked to ensure it is proper and correct.

 

If third parties are given information about the report for the purpose of processing it, the Recipient must make sure this will not breach confidentiality.

 

The whistle-blower shall at all times refrain from revealing to third parties the report’s existence, content or the identity of the persons implicated.

 

 

5. Destruction of items relating to an internal whistleblowing report

 

Items relating to a report that the Recipient considers outside the scope of the Regulations shall be destroyed immediately.

 

If it is decided to take no action in response to a report falling within the scope of the Regulations, all items that might identify the whistle-blower and/or the persons implicated in the allegation shall be destroyed within two (2) months of the end of the validation or investigation process.

 

Where a disciplinary or dispute procedure is initiated against a person implicated by a whistle-blowing report or against the whistle-blower for a malicious allegation, all items relating to the report shall be retained until the conclusion of the procedure or expiry of the permitted period for appeal.

 

Except in cases where no action is taken in response to a report, the Recipient may retain the items collected temporarily for up to one (1) year to protect the whistle-blower or to help detect any ongoing wrongdoing. This storage period must be no longer than is needed for the intended purposes and must be notified to the persons concerned.

 

Items can be temporarily retained for longer periods where the Recipient is required to do so by law (for instance to meet accounting, corporate or tax obligations).

 

As an exception to the above, items relating to a whistle-blowing report can be retained indefinitely if the natural persons concerned are neither identified nor identifiable.

 

All items must be destroyed, regardless of their format and medium, including data stored on digital media.

 

The whistle-blower and persons implicated in the allegation shall be informed that the matter has been closed.

 

 

6. Declaration to the Commission Nationale de l’Informatique et des Libertés (CNIL)

 

As the processing of whistleblowing reports is not automated by the Company, the Company need therefore only file a declaration that the procedure complies with law and regulations, which it has done.