All external parties such as clients, business partners and suppliers can submit a report.

All concrete observations can be reported that indicate

• criminal offences (in particular fraud and incorrect accounting, corruption)
• violations of other legal regulations
• Conduct that could cause significant damage to our company (e.g. disregarding conflicts of interest, i.e. business decisions are made in private interests).

Observations that merely indicate undesirable behavior in the company's interest that does not have a significant impact (e.g. unfriendly behavior in everyday work) should not be reported. Reports with such content will not be processed.

There are three possible internal reporting channels:

• IT platform
• telephone
• personal meeting

Through the platform, anonymous reports can also be made with additional anonymous communication, including the transmission of files.

The content of the report and the communication with the reporting office on the IT platform is protected against unauthorized viewing to a high standard. The platform can be used completely anonymously. If you disclose your personal data, it will be accessible to our case handlers, the case handlers of our independent consultant YPOG, and any other case handlers called in during an internal investigation to clarify the situation.

It cannot be ruled out that we may have to disclose to the affected individuals the source from which their personal data originated. If we know the identity of the reporting person, the person who is the subject of the report may learn who accused them. Therefore, we advise you to submit reports anonymously via the platform.

Please note that your IP address cannot be traced and is not stored. You can obtain further information on anonymity, the procedure and data protection directly on our platform.

The notification is received on our behalf by YPOG (www.ysolutions.legal) as an independent consultant. YPOG closely collaborates with our case handlers, communicates with the reporting person and advises us on any action that may be necessary to address the matter. Our case handlers also have direct access to the content of reports and communications with the reporting person.

Using the case ID and the associated password, the reporting person can log in to the platform at any time, communicate with the YPOG case handlers (also anonymously), respond to their questions, provide additional information if necessary, and upload files. Both the case ID and password are automatically assigned when submitting the report via the platform.

In the case of substantiated reports, we will investigate the matter to the extent possible and take the necessary actions.

The reporting person will promptly receive a confirmation of receipt of their report and will be informed of the outcome of the investigations and any consequences drawn, if applicable.

The Whistleblower Protection Act stipulates that external reporting offices be set up by the public sector in addition to the internal reporting offices of the respective employers.

A central external reporting office has been set up at the Federal Office of Justice (Bundesjustizamt). In addition, external reporting systems exist at the Federal Financial Supervisory Authority (BaFin) and the Federal Cartel Office (Bundeskartellamt).

The federal states are free to set up their own external reporting offices for reports concerning the respective state administration and the respective local governments.
In addition, there are corresponding reporting procedures for reports to institutions, bodies and other agencies of the European Union. These include external reporting channels of the Commission, the European Anti-Fraud Office (OLAF), the European Maritime Safety Agency (EMSA), the European Aviation Safety Agency (AESA), the European Securities and Markets Authority (ESMA) and the European Medicines Agency (EMA).

However, whistleblowers are encouraged to report to an internal reporting office in cases where the violation can be effectively addressed internally and they do not fear reprisals. We have made all arrangements for this.

You can find our joint privacy policy with YPOG at: Data protection