Whistleblower policy

As part of this, the Company has established a whistleblower scheme. The whistleblower scheme is a supplement to the direct and daily communication in the workplace about errors and unsatisfactory conditions, etc.

Reports in the whistleblower scheme must always be made in good faith.

Reports are made electronically via the web portal “Safe2Whistle”, which is administered by the law firm Bech-Bruun, who also screens all reports. If the report is assessed to fall outside the Company’s whistleblower scheme, it is rejected and the reporter is notified via the portal. If the report is assessed to fall within the scheme, it is forwarded to the relevant internal administrator in the Company for internal processing and investigation of the report.

Reports in “Safe2Whistle” must, as far as possible, be transparent, i.e. you should state your identity and contact information. However, it is possible to submit an anonymous report if you feel more comfortable doing so. You can read more about this under the section “Anonymity” below.

The purpose of the whistleblower policy is to explain how the whistleblower scheme works.

Who can make reports?

All employees in the Company, as well as members of the Company’s management and board of directors, can use the whistleblower scheme. In addition, other persons, such as business partners or suppliers with a work-related connection to the Company, can use the whistleblower scheme.

What can be reported?

The whistleblower scheme can only be used to report on matters covered by the Whistleblower Act (Law No. 1436 of 29 June 2021 and any subsequent amendments). Thus, reports can be made to the Company’s whistleblower scheme regarding

• Certain violations of EU law and
• Serious violations of the law and serious matters in general

With regard to reports on violations of EU law, reports can be made on, for example

• Violations regarding the rules on public procurement, product safety and conformity, and environmental protection. Reference is made to the detailed rules in Article 2 of EU Directive 2019/1937 of 23 October 2019 on the protection of persons who report violations of EU law.

Serious violations of the law and serious matters in general include, for example:

• Financial crime, such as embezzlement, fraud and forgery
• Breach of good corporate governance, such as bribery or distortion of competition
• Breach of occupational health and safety
• Breach of environmental regulations and pollution of the environment
• Gross or repeated violations of significant internal guidelines, e.g. regarding gifts, accounting, etc.
• Serious personal conflicts in the workplace, such as physical violence or sexual harassment

Matters such as bullying, dissatisfaction with salary conditions, violation of alcohol policy, etc. or other HR-related personnel matters cannot, as a starting point, be reported via the whistleblower scheme, but must instead be reported to the reporter’s manager or directly to the Company’s HR manager.

Who processes the reports?

After Bech-Bruun’s initial assessment, reports are processed internally by Morten Beck Jørgensen, who is an external board member of the board of directors of Bagger-Sørensen & Co. A/S. Reports that may concern Morten Beck Jørgensen will be processed by Bech-Bruun in collaboration with Hans-Henrik Eriksen.

Bech-Bruun is informed via the whistleblower portal about the result of the investigation and assesses whether the case can be considered closed, or whether the report should give rise to further investigations.

How are the reports processed?

When a report is received, Bech-Bruun, as an external administrator, carries out an initial screening of the matter and sorts out the reports that do not fall within the purpose of the scheme. The external anchoring is intended to ensure impartiality and objectivity in the processing of the reports. In this connection, Bech-Bruun is a data processor on behalf of Bagger-Sørensen & Co. A/S, which is a data processor for the Company.

If the report does not fall within the scheme or proves to be manifestly unfounded, it will be rejected immediately and deleted from the system, and the person who reported the matter will be notified. In this connection, the person will be encouraged to contact the person relevant to the matter, e.g. the person’s immediate manager or that person’s manager.

If the initial screening concludes that the submitted report falls within the scheme, the report is forwarded to Morten Beck Jørgensen, who processes the case. Morten Beck Jørgensen is subject to a special duty of confidentiality.

No later than 7 days after the report has been received in the whistleblower portal, the reporter will receive confirmation that the report has been received. As a starting point, the reporter will, within 3 months after receiving this confirmation, receive a notification about the conclusion of the case.

If the processing of the report requires longer than 3 months, the person will receive an orientation about this as well as a justification for why further investigation time is necessary. As a starting point, the reporter will, within the framework of the legislation, be informed about the outcome of the investigations.

All communication between the reporter and Bech-Bruun takes place via the whistleblower portal. It is therefore important that the person follows the case if they wish to receive confirmation of receipt of the report, a justification for longer case processing time and wish to receive an orientation about the outcome of the investigations of the report.

It is important that the whistleblower scheme is not used for false accusations, where suspicion is directed at innocent persons. All reports must therefore be submitted in good faith. If a report is submitted in bad faith, and the report turns out to be an expression of personal negative feelings, desire for revenge, etc., an unfounded report may have employment law consequences for the reporter.

How do you report?

Reports are made via the internet portal “Safe2Whistle”. A report cannot be made in any other way. If you wish to make a report, you must insert the following in your browser: https://report.whistleb.com/da/baggersorensen

This gives access to the “Safe2Whsitle” portal.

It is recommended that reports are made from a private device (PC, Tablet or similar).

If a report is made, the following information will normally be useful in the further investigation of the case:

• Description of the matter, including date, place and the name(s) of the person(s) involved
• Any documents or evidence regarding the violation or other information that may facilitate an investigation of the case

Anonymity

The reporter chooses whether they submit the report in their own name or anonymously.

If the reporter wishes anonymity, it is important that they do not write their name anywhere in the report. In addition, the reporter should be aware that it cannot be ruled out that their identity can be deduced from the information provided in the report.

Subsequent clarification and collection of further documentation

When you make a report, you may be asked for further information by Bech-Bruun. Furthermore, you can at any time be informed of the status of the case. This takes place via Safe2Whistle. It is therefore important that the reporter continuously keeps informed about their report within the whistleblower portal.

We recommend that the reporter makes themselves available with further information, as the case may not be completed without supplementary information.

Protection against retaliation

All reports submitted in good faith are protected against any form of retaliation. Anyone who attempts to exert retaliation against a reporter who has made a report in good faith may be met with employment law sanctions. Reference is otherwise made to the Whistleblower Act (Law No. 1436 of 29/06/2021 with any subsequent amendments).

Duty of confidentiality

Bech-Bruun, as an external administrator, together with Morten Beck Jørgensen and Hans-Henrik Eriksen, together with the persons who may be involved in connection with investigations of the report, are subject to a special statutory duty of confidentiality with regard to the information that is or has been the subject of processing in the whistleblower scheme.

Notification of the person to whom the report relates and of other persons

1. The following applies to Arcedi Biotech, GRISOGKO, For Emma, Fiberpartner, Niels Burchart, Bøgeris Transportbånd, Rampe Sluseteknik, Flex Wind DK, Grene Wind Industry Supplies, Nos and MPASIA

If information about you has been reported in the whistleblower scheme, and the report is assessed to fall within the Company’s whistleblower scheme, you will be notified as soon as possible, taking into account the investigations of the report.

If, on the other hand, the report is assessed to fall outside the Company’s whistleblower scheme, you will be notified in accordance with the rules of the Data Protection Regulation and the Data Protection Act.

2. The following applies to all other companies in the Company that are not mentioned under point 1

If information about you is reported in the whistleblower scheme, and the report is assessed to fall within the Company’s whistleblower scheme, you will, as a starting point, not receive a notification about this.

If, on the other hand, the report is assessed to fall outside the Company’s whistleblower scheme, you will be notified in accordance with the rules of the Data Protection Regulation and the Data Protection Act.

IT security

The system used to register the reports is operated by Whistleblowing Centre AB, which is an independent party and which guarantees the security and anonymity (if desired) in the system.

Registered persons’ rights

Persons about whom information has been registered in connection with the whistleblower scheme, including the reported person, may request access to the registered personal data in order to check the accuracy thereof and correct inaccurate, incomplete or outdated information.

In addition, registered persons have the right to object to the processing and request restriction of the processing of the registered person’s personal data. In addition, registered persons have the right to request rectification or deletion of the registered person’s information, if necessary. Under certain circumstances, the registered person may also request that the Company provide a copy of their personal data in a structured, commonly used and machine-readable format, and request that we transmit the information to another data controller.

Deletion of personal data

Personal data processed in connection with the Company’s whistleblower scheme is stored for as long as it is necessary for the purposes for which the information was collected.

Reports that fall outside the scheme or otherwise prove to be unfounded are deleted immediately.

If the outcome of a specific case is that there is no evidence of irregularities, the personal data will be deleted immediately and usually within two months after the conclusion of the case.

Reports that are processed but do not lead to a police report are deleted 2 years after the end of the investigation.

If a report is made to the police or other relevant authorities, the personal data will be deleted 5 years after the conclusion of the case.

Information can also be saved if it is made anonymous.

Data protection

The Company can process the following personal data about the reported person and others mentioned in the report:

• Name, position, contact information and reported information
• Description of the alleged violation

The personal data is processed for the purpose of administering the whistleblower scheme and handling reported incidents, including clarification of potentially criminal matters.

For Arcedi Biotech, GRISOGKO, For Emma, Fiberpartner, Niels Burchart, Bøgeris Transportbånd, Rampe Sluseteknik, Flex Wind DK, Grene Wind Industry Supplies, Nos and MPASIA, the processing of personal data in connection with a report in the whistleblower scheme takes place with reference to the balancing of interests rule in Article 6(1)(f) of the Data Protection Regulation, as the Company has a legitimate interest in investigating reported matters. For criminal matters, the processing basis is section 8(3) of the Data Protection Act, as it is necessary for the purposes of pursuing a legitimate interest that clearly overrides the interests of the data subject. For sensitive information in general, the processing of personal data in connection with a report in the whistleblower scheme takes place with legal basis in section 12(2) of the Data Protection Act.

For all other companies in the Company, the processing of personal data in connection with a report takes place with legal basis in Article 6(1)(c) of the Data Protection Regulation, as the Company is subject to a legal obligation to have a whistleblower scheme. For criminal matters, the processing basis is section 8(3) of the Data Protection Act, as it is necessary for the purposes of pursuing a legitimate interest that clearly overrides the interests of the data subject. For sensitive information in general, the processing of personal data in connection with a report in the whistleblower scheme takes place with legal basis in Article 6(1)(f) and Article 9(2)(g) of the Data Protection Regulation, cf. section 22 of the Whistleblower Act.

In order to fulfil the above purposes, the Company may give third parties who, on the basis of a contractual relationship with the Company, provide relevant services, access to the personal data. This may, for example, be IT suppliers or other suppliers who process personal data for the Company. Such suppliers will only process personal data in accordance with the Company’s instructions pursuant to data processing agreements entered into. Under certain circumstances and in accordance with the legislation, it may be necessary to pass on your personal data to, for example, the police, lawyers, courts, other public authorities and group-affiliated companies.

The personal data may be transferred to data processors established in countries outside the EU/EEA. Such a transfer will only take place when a transfer basis has been secured. Furthermore, the transfer will be based on the EU-US Data Privacy Framework or the EU Commission’s standard contracts, which you have the right to access.

The individual companies in the Bagger-Sørensen Group are each individually responsible for data processing of personal data. If you are in doubt about who the data controller is, you can always contact Bagger-Sørensen & Co. A/S, Tabletvej 1, 7100 Vejle.

Questions

All questions about the whistleblower scheme can be directed to TMI, HHE or Morten Beck Jørgensen.

Vejle, November 2023

Contact information

Thomas Mikkelsen: tmi@baggersorensen.com tel. 20 60 79 24

Hans-Henrik Eriksen: hhe@baggersorensen.com tel. 20 60 79 81

Morten Beck Jørgensen: mbej@novo.dk tel. 30 67 47 83

If you want to complain about the processing of personal data, you must contact the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, dt@datatilsynet.dk.

If you do not feel comfortable using the Company’s whistleblower scheme, or for other reasons would rather use an external whistleblower scheme, you have the option of using the Danish Data Protection Agency’s external whistleblower scheme, where it is possible to make written and oral reports. The Danish Data Protection Agency’s whistleblower scheme can be accessed via the Danish Data Protection Agency’s website.