Compliance in the W&W Group W&W Group's Whistleblower system

Violations of legal requirements can have a severe negative impact on the W&W Group. These impacts can include but are not limited to substantial financial damage and/or a significant loss of reputation. Compliance with legal requirements is therefore a top priority for the W&W-Group. We must be able to identify violations at an early stage in order to respond appropriately and avert risks or potential damage to our affiliated companies and our employees as well as our customers and business partners.

The W&W Group has set up a central whistleblower system. This whistleblower system enables employees of the W&W Group and external parties to confidentially and (upon request) anonymously report information on violations that have already been committed or are very likely to occur in connection with our companies. This allows the W&W Group to investigate in particular serious suspected cases (e.g. in the area of white-collar crime) and thus sustainably promote the long-term corporate success of the W&W Group and its affiliated companies. A functioning whistleblower system is a central component of good corporate governance. Only if we understand where problems arise are we in a position to effectively counteract (potential) violations and ensure compliance with regulations.

Of course, reporting of violations is voluntary. However, we encourage everyone inside and outside the W&W Group to use the W&W Group's whistleblower system open-mindedly and without fear of retaliation. Whistleblowers who report concerns in good faith are fully protected. Likewise we do not tolerate any behavior that aims to intimidate the whistleblower and influence their reporting behavior, including behavior aiming to prevent or restrict the submission of a report.

Whistleblowers can report any Information obtained in a professional context about actual or suspected violations in a W&W Group company.

These include, without limitation

• Violations that are punishable by law (e.g. fraud or corruption);
• Violations that are punishable by fines, insofar as the violated regulation serves to protect life, bodily injury, or health, or to protect the rights of employees or their representative bodies;
• Violations of federal and state laws and directly applicable legal acts issued by the European Union , e.g., in the areas of money laundering and counterterrorism, environmental protection, consumer protection, data protection, competition and antitrust law, shareholder rights in stock corporations and accounting in corporations, securities trading and banking and insurance supervisory law (including market manipulation and insider trading);
• Violations of internal company guidelines, in particular the W&W Group's Code of Conduct and the corporate values defined therein.

In certain cases, other reporting or complaint options within the W&W Group other than the central whistleblower system can be used instead.

In particular

• Reports of potential human rights and environmental risks within the scope of the Supply Chain Due Diligence Act (LkSG) or corresponding violations can be reported in a complaint procedure established in accordance with § 8 LkSG (information related thereto can be found on the W&W Group's website in the section „Sustainability“);
• Employees of our W&W Group can contact the complaints office in accordance with § 13 of the General Equal Treatment Act (AGG) and the respective employee representatives in the event of conflict situations or cases of discrimination which occurred in the working environment (relevant information is provided via the Group intranet/HR portal and can also be requested from the Group HR department).
• Suspected cases of money laundering must be reported to the W&W Group's money laundering officer in accordance with § 6 (5) of the Money Laundering Act (related information is provided via the W&W Group's intranet/compliance portal and can also be requested from the W&W Group's money laundering officer).

Please note that the W&W Group's central whistleblower system is not designed to receive customer complaints. If a concern relates to contractual relationships or services provided by affiliated companies within the W&W Group, our customers can contact their respective internal and external sales representatives or the complaints management department of the relevant business area of the W&W Group.

Compliance W&W Group

Digital whistleblower portal:

Reports to the Compliance function can be submitted via a digital whistleblower portal (EQS Integrity Line). Reports can also be submitted anonymously. This whistleblower portal enables secure and confidential communication.

No personal tracking (i.e. the targeted establishment of a connection between the reporting person and their report) takes place when the whistleblower portal is accessed. In particular, if the portal is accessed via the link provided on the W&W Group's website, no cookies are predefined.

The anonymity of the whistleblower in relation to our W&W Group is guaranteed regardless of the whistleblower using a computer belonging to their employer/a W&W company or a private device to submit a report. The same applies to devices connected to the company network/corporate intranet or external connections.

To communicate with the Compliance function, the whistleblower has the option to set up a mailbox included in the whistleblower portal, which may be anonymous upon request.

Additional information on the whistleblower portal is available on the homepage.

The digital whistleblower portal can be accessed via the following link: https://ww.integrityline.app

Compliance Officers, W&W Group:

Reports can also be submitted confidentially and anonymously by telephone, e-mail, or letter directly to the compliance officers of the W&W Group (a personal meeting is also possible at the request of the person filing the report):

Christian Beutel
Phone: +49 7141 16755142
Email: christian.beutel@ww-ag.com or hinweis@ww-ag.com

Personal/Confidential
Christian Beutel
W&W / Compliance and Money Laundering (W&W/CG)
W&W-Platz 1
70806 Kornwestheim


Dr. Peter Vaclavicek
Phone:: +49 711 662722217
Email: peter.vaclavicek@wuestenrot.de or hinweis@ww-ag.com

Personal/Confidential
Dr. Peter Vaclavicek
W&W / Compliance and Money Laundering (W&W/CG)
W&W-Platz 1
70806 Kornwestheim

External reporting offices

Alternatively, reports can also be submitted outside the W&W Group to the following external reporting offices (information on the respective areas of responsibility of the external reporting offices and on submitting reports to them is available on the websites listed below).

Nevertheless, we recommend whistleblowers to file all reports via the W&W Groups whistleblower system in order to ensure a fast and effective investigation and remediation of any potential violation

• Federal Office of Justice (BfJ):
  BfJ website (www.bundesjustizamt.de), “Whistleblower Office” section

• Federal Financial Supervisory Authority (BaFin):
  BaFin website (www.bafin.de), section “Whistleblower Office”

• Bundeskartellamt (BKartA):
  BKartA website (www.bundeskartellamt.de), section “Prohibition of Cartels”

Every report received by the Compliance function is taken seriously and investigated thoroughly with utmost care. In order to effectively clarify and evaluate the reported circumstances, it is necessary to describe them in detail. As many details as possible should be provided and any available evidence that sufficiently substantiates the allegations should be specified or made available.

Communication between the whistleblower and the Compliance function is possible at any time, even after the report has been submitted and the receipt has been confirmed. This, however, requires that communication is not possible due to factual reasons (e.g. in the case of an anonymous report submitted by letter). If necessary, the whistleblower can subsequently add further information to the report submitted.

Initially, the Compliance function checks the plausibility of the report in order to determine if it is based on a material violation and if it contains sufficient factual evidence to support the allegations. Depending on the results, further investigation may be carried out. If necessary, other organizational units of companies within the W&W Group may be involved - always in strict compliance with the principle of confidentiality. The whistleblower will be informed about investigation and about any measures planned or implemented; in any case, the whistleblower will receive final feedback.

In the course of any investigation, special emphasis is placed on fairness and adherence to the principle of proportionality — considering both, whistleblowers and the persons affected by the allegations.

Whistleblowers are subject to the best possible protection with regard to the confidentiality of their identity and protection from retaliation. This also applies even if the alleged violation is finally not confirmed. However, there are specific exceptions to this under certain legal conditions. Thus, in the case of deliberately filed false reports, there is neither confidentiality proception nor protection against reprisals; and actions against the reporting person may be taken. Furthermore, the identity of whistleblowers or persons affected by the report may be disclosed upon formal request by a public authority or court order.

The Management Board of the W&W Group reaffirms the legally guaranteed protection of whistleblowers against retaliation and expressly states:

Anyone who reports suspected violations or potential misconduct to the W&W Group's whistleblower system in good faith can do so without fear of negative consequences.

• No retaliatory measures may be taken against individuals who, acting in good faith regarding the accuracy of their information, submit reports to the W&W Group's whistleblower system or assist with an investigation. Any form of discrimination, intimidation, or retaliation against these persons will not be tolerated and is strictly prohibited.
• Violations of this principle of non-retaliation will be consistently pursued and sanctioned (e.g. by disciplinary actions). Any whistleblower who alleges to be a victim of retaliation due to the submission of a report to the W&W Group's whistleblower system or any person who has cooperated in this process can also contact the respective reporting office.

The protection of personal data is of utmost importance to the W&W Group. As a matter of course we comply with all legal provisions on data protection within the framework of the W&W Group's whistleblower system.

The following data protection information applies to the processing of personal data within the scope of the W&W Group's whistleblower system. Additional data protection information from Wüstenrot & Württembergische AG can be found at https://www.ww-ag.com/en/data_protection or in the data protection information provided by the respective responsible companies of the W&W Group.

• The entity responsible for data processing is the W&W Group company affected by the notification.
  
• The data protection officer for the companies of the W&W Group can be contacted as follows:
  
  Wüstenrot & Württembergische AG
  data protection officer
  W&W-Platz 1
  70806 Kornwestheim
  Phone: 07141 16-0
  Email: dsb@ww-ag.com
  
  
• The processing of whistleblowers' personal data, persons who are the subject of a report, and other persons named in the reports received through the W&W Group's whistleblower system, is carried out solely for the purpose of receiving and investigating reports regarding compliance or legal violations and their respective sanctioning.
  
  In general, it is possible to use the W&W Group's whistleblower system without providing any personal data. However, whistleblowers may voluntarily disclose personal data as part of the whistleblowing process, in particular information about their identity, first and last names, country of residence, telephone number, or email address.
  
  We likewise do not request or process any special categories of personal data, such as information on racial and/or ethnic background, religious and/or ideological beliefs, trade union memberships, or sexual orientation. However, such specific categories of personal data may be disclosed voluntarily by the whistleblower or any person providing information.
  
  
• The processing of personal data within the framework of the &W Group's whistleblower system is based on the EU General Data Protection Regulation (EU GDPR), in particular Art. 6 (1) (b) (performance of a contract, in the case of an employment contract also based on § 26 (1) sentence 2 BDSG), (c) (fulfillment of a legal obligation), lit. e) (public interest in processing anonymous reports) and lit. f) (safeguarding legitimate interests), in each case in conjunction with § 10 of the German Whistleblower Protection Act (HinSchG). We have a legitimate interest in data processing pursuant to Art. 6 para. 1 lit. f) EU GDPR in the prevention, detection, and sanctioning of violations within companies of the W&W Group, in reviewing the legality of internal processes, and in maintaining the integrity of companies of the W&W Group. If we are provided with special categories of personal data, we process this data pursuant to Art. 9 (2) (g) EU GDPR and § 10 sentence 2 HinSchG. We also anonymize personal data for statistical purposes.
  
  
• The scope of data processing is largely based on the provisions of the HinSchG, in particular those relating to the protection of confidentiality. We treat personal data received through the W&W Group's whistleblower system as strictly confidential. Only persons who are responsible for receiving reports or taking follow-up measures, as well as persons supporting in the accomplishment of these tasks, are subject to the processing of the respective data received. All persons authorized to access the data are expressly bound to confidentiality requirements. Data may be disclosed to public authorities (so-called “competent authorities” within the meaning of the HinSchG) based on legal provisions or orders issued by public authorities.
  
  
• We store personal data only as long as necessary to process a report (in particular, investigation through to final assessment and response) or if we have a legitimate interest in storing the personal data (e.g. in the context of legal proceedings). Data may also be stored if this has been provided for by European or national legislators to fulfill legal obligations, including but not limited to retention obligations. Depending on the individual reason for storage of data, all personal data will be blocked or deleted.
  
  
• Whistleblowers or other persons (e.g. persons named as witnesses or accused persons in the report) whose personal data is collected via the W&W Group's whistleblower system are entitled to execute their rights set out in Articles 15 through 18, 20, 21 of the EU GDPR (right to information, rectification and erasure, right to restriction of processing and data portability and right to object). The identity of whistleblowers or other persons is generally excluded from the right to information (Article 15(4) EU GDPR, § 29(1) sentence 2 BDSG). Furthermore, the right to information and erasure may be subject to restrictions according to §§ 34 and 35 BDSG.
  
  These rights may be exercised by contacting Compliance, acting as the reporting office through the W&W Group’s whistleblower system.
  
  Other affected persons may only be informed of the processing of individual personal data stored in the W&W Group's whistleblower system if it does not affect the course of the respective investigation of the underlying report and if there is no serious concern that the clarification of the facts will be impaired (prevention of concealment measures) (cf. Art. 14 (5) (b) EU GDPR). The person affected by a report will be granted the right and opportunity to make a statement about the allegations stated in the respective report. However, after the person affected by a report has been informed the identity of the whistleblower will remain confidential. No information is disclosed to the person affected by the report – to the extent legally possible – and the report will be used without compromising confidentiality (cf. § 29 (1) sentence 1 BDSG).
  
  
• If a report is submitted via the digital whistleblower portal (“EQS Integrity Line”), the following shall also apply:
  
  
  • The technical implementation of the digital whistleblower portal (“EQS Integrity Line”) is carried out on our behalf by EQS Group AG (“EQS”), Karlstraße 47, 80333 Munich. Insofar as we transfer personal data to EQS for the purpose described above, a data processing agreement with EQS applies to ensure adequate data protection measures. EQS provides technical systems for W&W AG as a processor, but itself has no access to the respective data.
  • The EQS Integrity Line allows anonymous communication via an encrypted connection. When using this feature, the IP address and current location of the whistleblower are neither tracked nor stored at any time. After submitting a report, the whistleblower receives access data to access the EQS Integrity Line mailbox at a later point in time and to ensure the opportunity to continue with the W&W Group's Compliance function in a protected environment.
    We maintain appropriate technical measures to ensure data protection and confidentiality. The data provided by the whistleblower is stored in a specially secured EQS database. All data stored in the database is encrypted by EQS using state-of-the-art technology.