Whistleblower protection

Secure whistleblowing system

In accordance with the Whistleblower Protection Act of June 14, 2024, you can safely report legal violations. Fabryka Mebli WUTEH S.A. provides this option through the DGSygnalistaPRO system.

To report a legal violation, scan the QR code

Whistleblower reporting panel of Fabryka Mebli WUTEH S.A.

I. Whistleblower protection at Fabryka Mebli WUTEH S.A.

Fabryka Mebli WUTEH S.A., in order to fulfill its legal obligation to provide an internal reporting channel for violations of the law, arising from the Whistleblower Protection Act of June 14, 2024, uses a license for the DGSygnalistaPRO system – dedicated to receiving and supporting the handling of such reports.

https://detectio.pl/dgsygnalistapro/

The Whistleblower reporting panel of Fabryka Mebli WUTEH S.A. is available at the following address:

Kliknij https://c68e66d1009d4cfa8f98b3db085ac3ba4761a170.dgapp.pl/

In the internal legal violation reporting system, i.e., the DGSygnalistaPRO system, a technical solution has been implemented to ensure the confidentiality and integrity of the processed data.

On August 1, 2024, the Management Board of FM WUTEH S.A. adopted Uchwałę nr 1/24 regarding the implementation of the Regulations containing procedures for internal reporting of legal violations at Fabryka Mebli WUTEH S.A.

You can review the details of our procedures at the following link: Excerpt from the Regulations

The person appointed to conduct follow-up proceedings on behalf of FM WUTEH S.A. is Ms. Karolina Gasztold, who holds written authorization from the employer/Administrator regarding the processing of personal data during the performance of official duties related to the “whistleblower handling process.”

The external entity authorized to receive internal reports, manage the DGSygnalistaPRO system, implement procedures, and provide information about them is DETECTIO GROUP – Information Acquisition and Protection, NIP: 8791276291, with its registered office at 00-844 Warsaw, ul. Grzybowska 87, and a field office at 87-100 Toruń, ul. Koniuchy 8.

Additional internal reporting channels at Fabryka Mebli WUTEH S.A. include:

A 24-hour telephone line for providing supplementary information regarding previously submitted reports.

For individuals unable to use the whistleblower panel in the DGSygnalistaPRO system – a secure address has been provided for submitting information in a traditional (non-digital) form.

Notes:

The unique ID number—necessary to submit a report—was provided during the implementation of the internal reporting procedure in the work-related context. It is also made available on the premises of Fabryka Mebli WUTEH S.A.
To facilitate reporting, we provide a QR Code. This code is a direct link to the whistleblower panel.
Login credentials, required for accountability of the reporting entity, are included in the initial training certificate, a copy of which is kept in the employee’s personnel files or in the collaborator’s documentation.
Fabryka Mebli WUTEH S.A. does not accept anonymous reports. This rule is included in the internal Regulations.

II. Ochrona danych osobowych i zasady poufności danych sygnalisty, osób powiązanych z sygnalistą, świadków i osoby której dotyczy zgłoszenie

For the processing of personal data under the Whistleblower Protection Act, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR) applies.

We process personal data to the extent necessary to receive a report and to take any subsequent follow-up actions.

The legal basis for processing personal data in the “whistleblower handling process” is:

a. Art. 6(1)(a) GDPR – in cases where the whistleblower consents to the disclosure of their identity.

b. Art. 6(1)(c) GDPR – necessary for compliance with a legal obligation of the administrator, i.e., fulfilling obligations under the Whistleblower Protection Act of 14 June 2024.

c. Art. 6(1)(e) GDPR – in the case of ordinary data; processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the administrator. This means that legal entities (including private entities) conducting internal follow-up proceedings effectively perform public tasks related to protecting the public interest, preventing, and detecting breaches of law.

d. Art. 6(1)(f) GDPR – necessary for the purposes of the legitimate interests pursued by the Administrator, related to implementing and operating reporting systems, including investigating and defending against claims, except in cases where the interests or fundamental rights and freedoms of the data subject, requiring the protection of personal data, override those interests.

1. Personal data that are not relevant to the evaluation of the report are not collected, and if collected, they are permanently destroyed within 14 days from the moment this is determined.

2. The administrator of personal data processed in connection with this legal obligation is Fabryka Mebli WUTEH S.A., headquartered at 87-100 Toruń, ul. Chłopickiego 6/10.

3. The information obligation towards the whistleblower is fulfilled in the DGSygnalistaPRO system, and additionally in the form of an attachment to the acknowledgment of the report, which is automatically generated by the system upon submission.

4. Personal data concerning the circumstances described in the report, the reporter, and other individuals, including the natural person to whom the internal report relates, are legally protected in accordance with the provisions of the General Data Protection Regulation (GDPR) and the Act on the Protection of Personal Data of 10 May 2018 (Journal of Laws of 2019, item 1781), in connection with the fulfillment of the legal obligation arising from the Whistleblower Protection Act of 14 June 2024.

5. Personal data of the reporter and other information allowing the identification of the reporter are confidential, except where disclosure is necessary and proportionate under the law in connection with investigative proceedings conducted by public authorities, preparatory proceedings, or judicial proceedings.

6. The whistleblower has the right to consent to the disclosure of their personal data.

7. Whenever it is necessary to disclose personal data identifying the whistleblower, they will be informed about the circumstances under which disclosure of their identity became necessary.

8. If it is found that the personal data provided in the report form are not true, the report will be treated as an anonymous report.

9. Personal data processed in connection with receiving the report or taking follow-up actions, as well as documents related to the report, are stored for a period of 3 years after the end of the calendar year in which the follow-up actions were completed or after the conclusion of proceedings initiated by these actions.

Notes:
Documentation collected as a result of an internal report:

It cannot be disclosed or processed for any purpose other than fulfilling this legal obligation, with the sole exception being situations where disclosure is required by law.
The confidentiality of the personal data of the reporter and other individuals, including the person(s) to whom the reported violation relates, individuals assisting in the report, and witnesses, is protected under the Whistleblower Protection Act of 14 June 2024.
This also applies to circumstances and information related to the subject of the report. The principle of confidentiality is limited in cases where personal data and details of the violation must be disclosed to authorized authorities under applicable law.
To minimize the risk of unauthorized access, the Administrator will store processed personal data on encrypted media, and physical documents will be kept in a securely protected room that prevents access by unauthorized personnel.
Due to the necessity of ensuring the confidentiality of the reporter’s personal data, individuals assisting in the report, the person(s) to whom the report pertains, and the circumstances and data obtained during follow-up proceedings, the Administrator is exempt from the obligation to provide information about the source of personal data (as stated in Article 14(2)(f) GDPR).
The exemption above is also legally based on Articles 3–5 of the Act of 10 May 2018 on the Protection of Personal Data, if it serves the performance of a public task, and failing to apply this exemption would prevent or significantly hinder the proper execution of that public task, provided that the interest or fundamental rights and freedoms of the data subject are not overriding in relation to the interest arising from performing this public task.
The exemption stated in point 1 does not apply if the whistleblower explicitly consents to the disclosure of their identity.

III. Information for Whistleblowers:

Persons entitled to make internal reports are:

Employees
Temporary employees
Individuals performing work on a basis other than an employment relationship, including under civil law contracts
Entrepreneurs
Proxies (Prokurent)
Shareholders or partners
Members of the governing body of a legal entity or an organizational unit without legal personality
Individuals working under the supervision and management of a contractor, subcontractor, or supplier, including under civil law contracts
Interns
Volunteers
Trainees
Individuals reporting or providing information about a violation of the law obtained in the context of work, before entering into an employment or other legal relationship forming the basis for the provision of work, services, or performing functions for or on behalf of a legal entity
Former employees

Information about a violation of the law should be understood as information that indicates or may indicate:

Suspected preparation, attempt, or commission of a violation of the law in a work-related context;
Failure to fulfill duties or abuse of powers;
Failure to exercise due diligence required in the given circumstances in a work-related context;
Irregularities in the organization of activities that could lead to the commission of a prohibited act or cause damage;
Violation of generally applicable laws under which the legal entity operates.

IV. Prohibition of retaliation against whistleblowers at FM WUTEH S.A.

a. Any form of adverse treatment in a work-related context toward a reporter who has been granted whistleblower status is strictly prohibited, with protection provided under applicable law.

b. The prohibition of retaliation also applies to: Individuals assisting in the report, Persons associated with the reporter, Entities owned by the reporter, or employees reporting a legal violation.

c. Any retaliatory actions against the reporter are strictly forbidden, including threats or attempts to carry out such actions.

SDetails of these provisions can be found in the Information on the Prohibition of Retaliation.

V. Right to Make an External Report

If you are unable to identify the competent authority for making an external report, you may always submit information regarding a legal violation in a work-related context to the Ombudsman (Rzecznik Praw Obywatelskich) at: 00-090 Warsaw, Al. Solidarności 77.

External reporting should be carried out in accordance with the procedures of the relevant authority.

Please refer to the detailed provisions in our Information on the Possibility of External Reporting.