UMARUTTI S.R.O. COMPANY DIRECTIVE ON THE HANDLING OF REPORTS

Purpose: To establish rules and procedures for submitting, receiving, assessing, and handling reports of potential unlawful conduct within Umarutti s.r.o. (hereinafter the "Company") and to ensure the protection of whistleblowers in accordance with Act No. 171/2023 Coll. (hereinafter the "Act").

Personal scope: This Directive sets out the rights and obligations of the Company, the Competent Person, and the Whistleblower. Whistleblowers may include, in particular (but not limited to), employees (current and former), job applicants, members of corporate bodies, clients and users of the AreteApp platform, suppliers, service providers, interns, and other persons who perform or have performed work or similar activities for the Company, or who have been or are in contact with it in connection with such activities, in accordance with Section 2 of the Act.

Material scope: It governs the entire process from submission to the handling of a report.

Temporal scope: It applies to reports concerning conduct regardless of when it occurred.

Key terms will be defined here, such as: Whistleblower, Report, Unlawful conduct (with reference to Section 2 of the Act), Retaliatory measure (with reference to Section 4 of the Act), Competent Person, Company, Related person, Tool (FaceUp platform), Act. (Based on the template and the Act).

Whistleblower: A natural person who makes a Report under the Act because they learned of the Suspected facts in connection with work or other similar activity performed for the Company (or while being in contact with it in connection with such activity), including the Company’s clients and users of the AreteApp platform.

The Company designates Mr. Vladimír Kondratěnko, the company’s managing director, as the Competent Person. The contact details of the competent person are whistleblowing{'@'}areteapp.eu and telephone number +420 606 751 525.

The Competent Person meets all statutory requirements set out in Section 10 of the Whistleblower Protection Act, i.e., is of good character, of legal age, and has full legal capacity. Within the scope of their duties, they receive and assess reports of potential unlawful conduct, propose remedial measures to the company management to eliminate identified deficiencies, handle reports impartially and objectively, and maintain confidentiality regarding all facts learned in connection with the performance of their function, in accordance with Section 11 of the Act.

The Company guarantees that the competent person will not be subject to any adverse action for the proper performance of their activities arising from this function, as provided in Section 11 of the Whistleblower Protection Act. This protection includes, in particular, a prohibition of any sanctions, discrimination, or other negative consequences related to the proper fulfilment of the competent person’s duties.

Who may submit: A report may be submitted by any natural person who learned of potential unlawful conduct in connection with work or other similar activity for the Company (or while in contact with it), as defined in Section 2 of the Act. This expressly includes employees (current and former), job applicants, members of the Company’s bodies, clients and users of the AreteApp platform, suppliers, service providers, interns, and other cooperating persons.

What may be reported: See the Material scope and Section 2 of the Act. Mention that it does not apply to knowingly false reports (Section 7(3) of the Act). Exclude information under Section 3 of the Act.

Methods of submission (Section 9 of the Act):

• Preferred: FaceUp Tool: https://www.app.faceup.com/cs/c/xgidfb2s/ – in writing and orally (voice message), anonymously and non-anonymously.
• E-mail: whistleblowing{'@'}areteapp.eu
• Telephone: +420 606 751 525
• In person: By arrangement with the Designated Person (within 14 days).
• Externally: Option to submit to the Ministry of Justice.

Content of the report: Information on the first name, last name and date of birth, or other information from which the identity of the reporting person can be inferred (if not anonymous and if provided), and information on possible Unlawful conduct (Section 2(2) of the Act).

Acknowledgement of receipt: Within 7 days, with exceptions (Section 12(2) of the Act).

Records: Keeping records in the FaceUp Tool to the extent required under Section 21 of the Act.

Retention: For a period of 5 years (Section 21(2) of the Act).

Access: Only the Designated Person (Section 21(3) of the Act).

Recording of oral reports: Audio recording (with consent) or transcript; the reporting person may comment (Section 19 of the Act).

Time limit: Within 30 days, with the possibility of extension twice by 30 days (§ 12(3) of the Act).

Procedure: The Competent Person assesses impartially, gathers information, and may request cooperation.

Unfounded report: Notification of the whistleblower, instruction on the right to submit to a public authority (§ 12(6) of the Act).

Founded report: Proposal of remedial measures to the Company (§ 12(5) of the Act).

Notification of the whistleblower: Information on the outcome of the assessment (§ 12(3) of the Act).

Adoption: The Company shall adopt appropriate measures to remedy or prevent an unlawful situation (§ 9(2)(g) of the Act).

Examples: Change of processes, training, disciplinary proceedings, termination of the relationship, compensation for damage, filing a criminal complaint.

Informing the whistleblower: On the measures adopted (§ 12(5) of the Act).

Prohibition of retaliatory measures: Strict prohibition of any form of retaliation against the whistleblower and other protected persons (§ 4 of the Act).

Protection of identity: Obligation of the Competent Person to maintain confidentiality regarding identity, exceptions pursuant to § 20 of the Act.

Confidentiality: Obligation to maintain confidentiality regarding the content of the report (§ 11, § 20 of the Act).

Processing of personal data in accordance with the GDPR and the Company’s Personal Data Protection Policy. Informing whistleblowers about the processing.

The Company shall ensure that this Directive and information on whistleblowing are available to all relevant persons (e.g., on the intranet, website).

The Company shall ensure training for employees and the Competent Person.

This Directive shall enter into force on 25.05.2025