Regulation on dealing with suspected misconduct or irregularities

Given the importance DigiTrust B.V. attaches to pursuing a sound integrity policy, this policy has been drafted.
_______________________________

Appointed confidant

Name : Ivonne Verkes

e-mail: info@zeddicus.nl

Article 2. Information, advice and support for employee

1. The reporter may consult the appointed confidant in confidence about suspected wrongdoing.
2. The employee or stakeholder may ask the confidential adviser for information, advice and support regarding suspected wrongdoing.

Article 3. Internal report by an employee of DigiTrust

1. An employee with a suspicion of misconduct or irregularity within his DigiTrust's organisation may report it to any manager who is hierarchically higher than him within the organisation. If the employee has a reasonable suspicion that the Management Board or confidential adviser is involved in the suspected abuse or irregularity, he may also make the report to the internal supervisory body. In that case, in these regulations, "the Executive Board or confidential adviser" should be read as "the internal supervisory body".
2. Employee can also report suspected wrongdoing or irregularities within his DigiTrust's organisation via the confidential adviser. The confidential adviser shall, in consultation with the employee, forward the report to a manager as referred to in the previous paragraph or the internal supervisory body, respectively.

Article 4. Protecting the reporter from harm

1. DigiTrust will not disadvantage the reporter in connection with reporting a suspicion of wrongdoing or irregularity in good faith and properly.
2. In any case, detriment as referred to in paragraph 1 means taking a detrimental measure, such as:
   1. granting resignation other than at his own request;
   2. interim termination or non-renewal of temporary employment;
   3. failure to convert temporary employment into permanent employment;
   4. taking disciplinary action;
   5. imposing an investigation, speaking, workplace and/or contact ban on the reporter or colleagues of the reporter,
   6. the imposed appointment to another position;
   7. extending or limiting the reporter's duties other than at his or her own request;
   8. moving or transferring the reporter, other than at his own request;
   9. refusing a request to move or transfer the reporter;
   10. changing the workplace or refusing a request to do so;
   11. withholding salary increases, incidental pay, bonuses, or awards;
   12. withholding promotion opportunities;
   13. not accepting a sick report, or leaving the employee registered as sick.
   14. rejecting a leave application;
   15. Granting leave other than at its own request;
3. There is also prejudice as referred to in paragraph 1 if a reasonable ground exists to address the reporter about his performance or to take a prejudicial measure as referred to in paragraph 2 against him, but the measure taken by DigiTrust is not in reasonable proportion to that ground.
4. If DigiTrust proceeds to take a detrimental measure as referred to in paragraph 2 vis-à-vis the reporter within a foreseeable time after making a report, it shall motivate why it considers this measure necessary and that this measure is not related to reporting a suspicion of wrongdoing or irregularity in good faith and properly.
5. DigiTrust shall ensure that managers and colleagues of the reporter refrain from any form of prejudice in connection with the reporting of a suspicion of wrongdoing or irregularity in good faith and properly, which hinders the reporter's professional or personal functioning. This includes in any case:
   1. bullying, ignoring and excluding the reporter;
   2. making unsubstantiated or disproportionate accusations about the reporter's performance;
   3. The actual imposition of an investigation, speaking, workplace and/or contact ban on the reporter or colleagues of the reporter, in whatever manner formulated;
   4. intimidating the reporter by threatening him with certain measures or behaviour if he follows through with his report.
6. DigiTrust will address employees who are guilty of harming the reporter and may impose a warning or disciplinary action on them.

Article 5. Preventing harm to the reporter

1. The contact person designated pursuant to Article 9 paragraph 6 shall immediately discuss, together with the reporter, the risks of harm, how those risks can be reduced and what the employee can do if he/she believes that harm has been done. The contact person ensures this is established in writing and submits this record to the reporter for approval and signature. The notifier receives a copy of this.
2. If the reporter believes that harm has been done, he may discuss this with the contact person without delay. The contact person and the reporter also discuss what measures can be taken to prevent harm. The contact person shall make a written record of this and submit this record to the reporter for approval and signature. The contact person forwards the report to the Executive Board or confidential adviser without delay. The notifier receives a copy of this.
3. The Management Board or confidential adviser shall ensure that measures necessary to counteract disadvantage are taken.

Article 6. Protection of other data subjects from harm

1. DigiTrust will not disadvantage the trustee for performing the duties described in these regulations.
2. DigiTrust will not disadvantage the Confidential Advisors employed by DigiTrust for performing the duties described in these regulations.
3. DigiTrust will not disadvantage any employee, or external stakeholder who is heard by the Confidential Advisor in connection with making a statement in good faith.
4. DigiTrust will not disadvantage an employee, or external stakeholder in connection with the disclosure by him to the Confidential Advisor of documents which, in his reasonable judgment, are relevant to the investigation.

Article 7. Confidentiality of the report and the identity of the reporter

1. DigiTrust shall ensure that the information on the report is kept in such a way that it is physically and digitally accessible only to those involved in handling this report.
2. All those involved in handling a report shall not disclose the identity of the reporter without the reporter's express written consent and shall treat information about the report confidentially.
3. If the suspicion of abuse or irregularity has been reported through the confidential adviser and the reporter has not given permission to disclose his identity, all correspondence regarding the report shall be sent to the confidential adviser and the confidential adviser shall forward it to the reporter without delay.

Article 8. Recording, forwarding and acknowledgement of receipt of the internal report

1. If employee, or external stakeholder, makes the report of a suspicion of wrongdoing or irregularity orally via the confidential adviser, or provides a written report with a verbal explanation, this confidential adviser shall, in consultation with the reporter, ensure a written record of this, and submit this record to the reporter for approval and signature. The notifier receives a copy of this.
2. The Executive Board or confidential adviser sends the reporter a confirmation of receipt of the report without delay. The confirmation of receipt shall include at least an objective description of the report, the date it was received and a copy of the report.
3. Upon receipt of the report, the Management Board or confidential adviser, in consultation with the reporter, shall immediately designate a contact person with a view to preventing harm.

Article 9. Treatment of the report by DigiTrust

1. The Executive Board or confidential adviser will investigate the reported suspicion of wrongdoing or irregularity unless:
   1. the suspicion is not based on reasonable grounds, or
   2. it is clear in advance that the reported does not relate to suspected wrongdoing or irregularity.
2. If the Management or confidential adviser decides not to investigate, he will inform the reporter of this in writing within two weeks of the internal report. This will also indicate the grounds on which the Executive Board or confidential adviser is of the opinion that the suspicion is not based on reasonable grounds, or that it is clear in advance that the reported suspicion does not relate to a suspicion of misconduct or irregularity.
3. The Management or confidential adviser shall decide whether an external body as referred to in article 14 paragraph 3 must be informed of the internal report of a suspicion of wrongdoing. If DigiTrust notifies an external body, the Management or confidential adviser will send the reporter a copy of this, unless there are serious objections to this.
4. The Management Board or Confidential Advisor shall assign the investigation to Confidential Advisors who are independent and impartial, and in any case shall not have the investigation conducted by persons who may be or have been involved in the suspected wrongdoing or irregularity.
5. The Board of Management or confidential adviser shall immediately inform the reporter in writing that an investigation has been started and by whom the investigation will be conducted. The most senior manager shall send the reporter a copy of the investigation order, unless there are serious objections to this.
6. The Executive Board or confidential adviser shall inform the persons to whom a report relates about the report and about informing an external body as referred to in paragraph 3, unless the investigative or enforcement interest may be harmed as a result.

Article 10. The conduct of the investigation

1. The Counsellor gives the Notifier the opportunity to be heard. The Counsellor will ensure a written record of this, and will submit this record to the Notifier for approval and signature. The Notifier will receive a copy of this.
2. The Confidential Advisor may also hear others. The Confidential Advisor will ensure a written record of this, and submit this record for approval and signature to the person who has been heard. The person heard will receive a copy of this.
3. The Confidential Advisor may inspect and request any documents within DigiTrust's organisation that they deem reasonably necessary to conduct the investigation.
4. Employees may provide the Confidential Advisor with any documents that they reasonably deem it necessary for the Confidential Advisor to see in the context of the investigation.
5. The Confidential Advisor prepares a draft investigation report and gives the notifier the opportunity to comment on it, unless there are serious objections.
6. The Confidential Advisors then adopt the investigation report. They will send a copy of it to the notifier, unless there are serious objections.

Article 12. Position of DigiTrust

1. Within eight weeks of the report, the Executive Board or confidential adviser informs the reporter in writing of the substantive position regarding the reported suspicion of an abuse or irregularity. This will also indicate what steps the report has led to.
2. If it becomes clear that the opinion cannot be given within the set term, the Management Board or confidential adviser shall inform the reporter of this in writing. This shall include an indication of the term within which the reporter can expect to receive the opinion. If the total term exceeds twelve weeks as a result, the reasons why a longer term is necessary are also indicated.
3. After completion of the investigation, the Management Board or confidential adviser shall decide whether an external body as referred to in article 14 paragraph 3 should be informed of the internal report of suspected wrongdoing and of DigiTrust's investigation report and position. If DigiTrust informs an external body, it will send the reporter a copy of this, unless there are serious objections to this.
4. The persons to whom the report relates shall be informed accordingly as the reporter under paragraphs 1 to 3, unless the investigative or enforcement interest may be prejudiced as a result.

Article 13. Hearsay on investigation report and position of DigiTrust

1. DigiTrust shall give the reporting party the opportunity to respond to the investigation report and DigiTrust's position.
2. If, in response to the investigation report or DigiTrust's position, the reporter indicates in a substantiated manner that the suspicion of an irregularity or wrongdoing has not been investigated effectively or properly, or that the investigation report or DigiTrust's position contains substantial inaccuracies, DigiTrust shall respond to this in terms of content and, if necessary, institute a new or supplementary investigation. Articles 10 to 13 shall apply mutatis mutandis to this new or additional investigation.
3. If DigiTrust informs or has informed an external body as referred to in article 14 paragraph 3, it shall also send the above-mentioned reaction of the notifier to the investigation report and DigiTrust's position to that external body. The notifier shall receive a copy of this.

Article 14. External reporting

1. After making an internal report of suspected wrongdoing, the reporter may make an external report if:
   1. the reporter disagrees with the position referred to in Article 12 and considers that the suspicion has been wrongly set aside;
   2. the notifier has not received a position within the time limit referred to in Article 12(1) or (2).
2. The reporter may immediately make an external report of a suspicion of wrongdoing if first making an internal report cannot reasonably be required of him. This will in any case be the case if this follows from any statutory regulation or if:
   1. acute danger, where a serious and urgent social interest requires immediate external reporting;
   2. a reasonable suspicion that the most senior responsible person within DigiTrust's organisation is involved in the suspected wrongdoing;
   3. a situation where the reporter may reasonably fear countermeasures in connection with making an internal report;
   4. a clearly identifiable threat of misappropriation or destruction of evidence;
   5. a previous report in accordance with the procedure of the same wrongdoing, which did not eliminate the wrongdoing;
   6. a duty of immediate external reporting.
3. The reporter may make the external report to an external body that, in the reporter's reasonable opinion, is most appropriate. External body means in any case:
   1. A body charged with investigating criminal offences;
   2. a body responsible for monitoring compliance with the provisions of or under any statutory provision;
   3. another authorised body where the suspicion of wrongdoing can be reported, including the House of Whistleblowers investigation department.
4. If, in the reasonable opinion of the reporter, the public interest outweighs DigiTrust's interest in confidentiality, the reporter may also make the external report to an external third party who, in his reasonable opinion, may be considered capable of directly or indirectly removing or having removed the suspected malpractice.

Article 15. Internal and external investigation into harm to the reporter

1. The reporter who believes that he has been disadvantaged in connection with making a report of suspected wrongdoing may request the Management Board or confidential adviser to investigate how he is treated within the organisation.
2. Articles 10 to 13 shall apply mutatis mutandis.
3. Paragraphs 1 and 2 shall apply mutatis mutandis to the persons referred to in Article 7 paragraphs 1 to 6.
4. The reporter may also request the investigation department of the House for Whistleblowers to investigate the way DigiTrust has behaved towards him in response to the report of suspected wrongdoing.

Article 16. Publication, reporting and evaluation

1. The Management Board or confidential adviser shall ensure that these regulations are published on the intranet and made public on the DigiTrust website.
2. The Executive Board or confidential adviser shall prepare an annual report on the policy on dealing with the reporting of suspected abuse and irregularities and the implementation of this regulation. This report shall in any case contain:
   1. information on the policy pursued in the past year on dealing with the reporting of suspected wrongdoings and irregularities and the policy to be pursued in the coming year in this area;
   2. information on the number of reports and an indication of the nature of the reports, the outcomes of the investigations and DigiTrust's views;
   3. general information on the experience of countering disadvantage to the reporter;
   4. information on the number of requests for investigations for prejudice in connection with the reporting of suspected wrongdoing and an indication of the outcomes of the investigations and DigiTrust's views.

Article 17. Entry into force scheme

1. This scheme will enter into force on 1 September 2022.