Whistleblowing

Oznamovací systém Mindsquared a.s.

Mindsquared actively encourages employees, business partners, and members of all the communities in which it operates to utilize the internal whistleblowing system in compliance with Act No. 171/223 Coll. on the protection of whistleblowers (so-called “Whistleblower Protection Act”) to report any concerns about potential unethical or illegal conduct in the business activities.

Reporting options

Use of an external online platform “FaceUp” by clicking on this link: https://www.nntb.cz/c/ta9svvql

The platform is available around the clock, allowing anonymous reports in written form and voice recordings. To submit a report via the FaceUp form, use also the code: ta9svvql. After making a report, we recommend that you retain the twelve-digit access code, generated after the report was sent, for possible further communication.

By contacting the designated competent person on the telephone number listed below during business hours from 9:00 a.m. to 5:30 p.m.
In person with one of the designated persons listed in the subsequent paragraph, preferably following an appointment.
Via a letter addressed to the designated person listed below at Mindsquared a.s. Evropská 866/63, 160 00 Prague 6. Please mark the envelope "DO NOT OPEN - WHISTLEBLOWING".

Designated person in charge of follow-up on the report

Jakub Burian, legal counsel

phone: 703 456 494

e-mail: whitleblowing@mindsquared.cz

What to expect after notification

The designated person will issue an acknowledgement of receiving the report to the reporting person within 7 days of its receipt.

Within 30 days of receiving the report, the reporting person will be informed of the assessment of the report and propose corrective actions. In complex reports that demand high time consumption for investigation, the period may be doubled to a total of 60 days.

Whistleblower protection

The whistleblower is protected from any retaliation under the Whistleblower Protection Act and his identity remains known only to the designated person in charge of investigating the case.

The whistleblowers need to submit their reports in good faith, based on credible facts and factual evidence. They must not deliberately submit false information through the internal whistleblowing system. Such unfounded reporting is not under the protection of Whistleblower Protection Act and may result in a) disciplinary actions from the employer, or b) a potential fine of/up to CZK 50,000 in an administrative proceeding for committing an offence.

Reporting to the Ministry of Justice

A report of unlawful conduct can also be submitted through the reporting system of the Ministry of Justice of the Czech Republic, available at the following website: https://oznamovatel.justice.cz/chci-podat-oznameni/.

Information on the processing of personal data in the context of whistleblowing

In light of personal data being processed during the use of this system, we aim to inform you of the details of this processing and about your rights. Additionally, we provide contact information, through which you can exercise your rights or inquire detailed information about the processing of personal data.

Personal data is obtained and processed in accordance with relevant legal regulations, particularly Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ("GDPR") in connection with the fulfilment of obligations under Act No. 171/2023 Coll., on the protection of whistleblowers ("the Act"), especially in connection with the receipt of reports.

1. Identity and contact details of the controller

The controller of personal data is Mindsquared a.s., with its registered office at Evropská 866/63, 160 00 Prague 6, Vokovice, ID No. 271 07 744 ("Mindsquared"). In the interest of a thorough investigation of each Report and in the interest of protecting the whistleblower, Mindsquared has appointed designated person to receive, assess the validity, and verify the substance of the Report. The designated person is Jakub Burian (whistleblowing@mindsquared.cz).

In case of questions on the processing of personal data or exercising your rights under Article 7 outlined below, please contact us at gdpr@mindquared.cz. .

2. Purpose of Processing and Legal Basis

As a whistleblower, you can decide what information will be processed about you. The provision of your personal data is voluntary and is not a condition for submitting a report. The processing of personal data only takes place in correlation to the specific purpose of processing, namely:

(a) acceptance, assessment, and recording of reports and compliance with other obligations under the Act, based on the legal reason of the fulfilment of a legal obligation;

(b) if it is not a report within the meaning of the Act, we process the relevant personal data based on the legal reason of legitimate interest to properly investigate the report;

3. Personal Data or Categories of Personal Data

Personal data, that is processed to the extent of the aforementioned purposes, is the following:

(a) name, surname, date of birth, and contact address of the whistleblower, or other data from which it is possible to deduce the identity of the whistleblower (e.g. address, position in the company, etc.), if this information is known to us;

(b) name, surname, or other identifying data (e.g. date of birth, address, position in the company, etc.) of the person against whom the report was directed, or of other persons listed in the report, if their identity is known to us;

(d) all information necessary to investigate the report.

4. Recipients or categories of recipients of personal data

Personal data is processed in accordance with the Act, by the designated person, in charge of investigating the report. The designated person is legally obliged to keep all the facts, obtained in connection with the submitted report and its investigation, confidential. Some personal data, except for the whistleblower's identification, may be disclosed to other persons to the extent necessary for safeguarding a proper investigation of the report.

For the receipt of reports, Mindsquared uses the FaceUp communication platform provided by Faceup Technology s.r.o., ID No.: 06142630, with its registered office at Údolní 567/33, Brno-město, 602 00 Brno. Through submission of a report via the FaceUp platform, you are required to acknowledge having read the Information on the processing of personal data before sending it. If your report was submitted through a different method, we advise you to get acquainted with this Information. The reason for this is that the FaceUp platform is used to record all received reports, irrespective of their submission method. All communication via the FaceUp platform is encrypted.

Under certain legal circumstances, Mindsquared is required to share personal data with national authorities and state administration bodies as regulated by applicable laws. In line with the Act, we will notify you in advance of any such data transfer, as well as the reasons for such sharing.

5. Transfer of personal data to third countries

As part of processing personal data through Mindsquared internal whistleblowing system, personal data is not transferred to third countries.

6. Personal Data storage period

In accordance with Article 2 above, personal data will be processed for as long as necessary to fulfil the purpose of processing. Under the Act, based on the legal reason of compliance with the legal obligation, the designated person is obligated to keep the report, as outlined in Article 3, section a) through f), submitted via the internal reporting system under the Act, for five years from the date of receipt of the report.

In addition to the aforementioned (and specifically, only for the reports not covered by the Act), personal data relevant to resolving a potential dispute will be processed based on legitimate interest. The processing for such reasons will be processed no more than ten years after the relevant event commenced the limitation period in the particular case. In the case of an ongoing dispute, the duration will continue until the dispute is settled.

Once the purpose of processing has been fulfilled, your personal data will be securely deleted.

7. Rights of the data subject

If you have given consent for processing, it was given freely, and you have the right to withdraw or limit this consent at any time by using the contact information in Article 1 of this document.

If your personal data is processed on the basis of Mindsquared legitimate interest, you have the right to object to the processing at any time.

Your other legal rights include:

Right to request access to personal data
Right to rectification or erasure of personal data
Right to restriction of processing
Right to data portability
the right to submit a complaint against Mindsquared, as the controller, with the Office for Personal Data Protection.
You also have the right to complain about the processing of your personal data with the Office for Personal Data Protection, www.uoou.cz, with its registered office at Pplk. Sochora 27, 170 00 Prague 7.

However, the exercise of these rights may be subject to additional terms or conditions. Regarding the Act, some of the above-mentioned rights may be restricted, in particular the right of access to personal data. The reason stems from the legal obligation to protect the identity of the whistleblower and other persons listed in the report to prevent potential obstruction of the investigation of the reported information, in accordance with Sections 11 and 6 (1) of the Act. 2 of Act No. 110/2019 Coll., on the Processing of Personal Data.

Last Updated: May 1, 2024