Whistleblower protection policy

1. General provisions

1.1 The purpose of this internal regulation (hereinafter also referred to as the "Policy“) is to set out rules for the safe and effective reporting of conduct that threatens or harms legally protected interests pursuant to the relevant whistleblower protection legislation in the companies comprising the Purple Group as defined in sec. 1.2, so as to effectively prevent such conduct or minimise its harmful effect if the conduct has already occurred.

1.2 Purple Group is led by its parent company Purple Holding a.s., reg. no.: 06528554, with its registered office at Masarykova 409/26, Brno-město, 602 00 Brno, and consists of, inter alia, the following entities:

• Purple Technology s.r.o., reg. no.: 29364973, registered office at Masarykova 410/28, Brno-město, 602 00 Brno
• Purple Solution s.r.o., reg. no.: 06706444, registered office at Masarykova 409/26, Brno-město, 602 00 Brno
• Purple Trading s.r.o., reg. no.: 06047033, registered office at Masarykova 409/26, Brno-město, 602 00 Brno
• Purple Next s.r.o., reg. no.: 08105103, registered office at Masarykova 409/26, Brnoměsto, 602 00 Brno
• Purple Real Estate s.r.o., reg. no.: 10758003, registered office at Masarykova 409/26, Brno-město, 602 00 Brno
• Purple Ventures s.r.o., reg. no.: 05775574, registered office at Masarykova 409/26, Brno-město, 602 00 Brno
• Purple Foundation, nadační fond, reg. no.: 07316917, registered office at Masarykova 409/26, Brno-město, 602 00 Brno.

1.3 The members of the Purple Group shall, pursuant to this internal regulation, implement a uniform internal reporting system in accordance with the relevant legislation, in particular Act No. 171/2023 Coll., on the protection of whistleblowers, as amended ("Whistleblower Protection Act" or “WPA”), the Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of whistleblowers ("Whistleblower Protection Directive"). This system will be used jointly by all members of the Purple Group.

1.4 The members of the Purple Group declare that they approach the issue of whistleblowing with all due respect and with awareness of the social importance of whistleblowers contributing to the prevention of unlawful conduct or minimizing its harmful consequences. The members of the Purple Group undertake that the receipt of reports, the manner in which they are handled and the processing of the reported facts and other relevant information will be carried out strictly in accordance with the law and with due regard for the confidentiality of the information transmitted and the protection of whistleblowers and jointly protected persons.

2. Definitions

2.1 For the purposes of this Policy, the following definitions apply:

a) “report” means an oral or written communication from a natural person containing information on an imminent, ongoing or completed offence within the meaning of section 2(1) of the WPA, if it contains information which the person has become aware of in the course of, or in connection with, his activity for a member of the Purple Group;

b) "protected regulations" means regulations the violation of which may be the subject of a report under the WPA;

c) “reporting person” means a natural person that is, in relation to a member of the Purple Group, in a position of:

i. an employee employed within one of the basic employment relationships pursuant to Section 3 of Act No. 262/2006 Coll., the Labour Code, as amended,

ii. a member of the corporate body pursuant to Section 44 of Act 4/7 No. 90/2012 Coll., on Business Corporations, as amended, or a member of the board, or

iii. persons carrying out activities for a member of the Purple Group within another contractual relationship,

and has made a report pursuant to subsec. a);

d) “recipient"means a person who meets the conditions for performing the function of a recipient pursuant to sec. 10 of the Whistleblower Protection Act (i.e., in particular full legal age, full legal capacity, being of good repute), and has been entrusted by the members of the Purple Group with the management of the internal notification system;

e) “jointly protected person“ omeans a person who falls within one of the categories defined in sec. 4(2) of the WPA and who, together with the reporting person, cannot be subjected to retaliation;

f) “employer“ means a member of the Purple Group in respect of whom the reporting person is in a legal position defined in subsec. c) para. i. to iii. of this section;

g) “retaliation“ means any conduct in connection with the reporting person’s work or other similar activity that was triggered by the report and that may cause harm to the reporting person or a jointly protected person; a demonstrative list of possible measures of retaliation is given in sec. 4(1) WPA.

2.2 For the purposes of the Policy, a person shall also be deemed to be the reporting person who:

a) became aware of the facts reported while employed by a member of the Purple Group within the meaning of sec. 2.1 subsec. c) and his/her legal relationship with that member of the Purple Group has already ended;

b) became aware of the facts being reported during recruiting process or pre-contractual negotiations, even if the legal relationship with a member of the Purple Group has not (yet) come into existence.

3. Submission of report

3.1 Reporting persons are encouraged to make reports of facts that should be reported in accordance with the Whistleblower Protection Act and this Policy without undue delay after obtaining information relevant to the report.

3.2 Reports may be submitted to the recipient through the internal notification system set up by the employer in the form of:

a) written communication for the attention of the recipient addressed to Purple Technology s.r.o., Masarykova 410/28, 602 00 Brno,

b) oral communication by phone or in person directly addressed to the recipient, or

c) via the internal secure platform for submission of reports allowing remote access available at this link; this method may be used only by reporting persons pursuant to art. 2, sec. 2.1 subsec. c) para. i. and ii. of this Policy.

Members of the Purple group have appointed the following persons as the recipients:

1) Petra Ragulová, mailing address Masarykova 410/28, phone no. +420 721 983 765,

2) Filip Řehoř, mailing address Masarykova 410/28, phone no. +420 538 891 553

3.3 If a conflict of interest exists, or could reasonably be assumed to exist, in relation to the recipient(s) with respect to their relation to the subject matter of the report, the following shall apply:

a) if a conflict of interest may be assumed to exist in relation to one of the recipients, then the report in question shall be received and handled by the other recipient,

b) if a conflict of interest may be assumed to exist in relation to both of the recipients, the reporting person shall be entitled to request his Employer to appoint an ad hoc recipient to deal with the report.

If the (potential) existence of recipients’ conflict of interest is revealed subsequently to the submission of a report, the recipient(s) shall immediately:

a) ensure that such report is forwarded for resolution to the other recipient, under the condition that he/she is not in a conflict of interest as well, or

b) initiate the appointment of an ad hoc recipient by the Employer and subsequently forward the resolution of the report to the appointed person.

The recipient appointed in accordance with sec. 3.3 to deal with a particular report (the "Ad Hoc Recipient") shall exercise the rights and duties of the recipient under this Policy and the WPA without limitation, but only in relation to the report for which he/she has been appointed. Upon conclusion of a given case, the Ad Hoc Recipient shall forward any and all documentation obtained for archiving within the internal notification system.

Reports should always provide sufficient information to allow a proper inquiry by the recipient. The report should always include at least:

a) a description of facts relevant to the situation being reported,

b) reason(s) why the situation constitutes an alleged violation or impending violation of the protected regulations, and

c) the name, surname and date of birth of the reporting person, or other information from which his/her identity may be deduced.

Supporting material and evidence may be attached to the report.

3.6 Reports which are incomplete due to lack of factual information or which are incomprehensible will not be further investigated within the scope of this Policy; this does not apply if such deficiency will be remedied. The reporting person shall only be contacted to complete or clarify the content of the report provided that such action does not compromise the protection of his/her identity or personal data.

3.7 Anonymous reports, or reporting persons thereof, do not enjoy protection under the WPA. Nevertheless, members of the Purple Group undertake to give due consideration to anonymous reports and to apply the rules contained in this Policy or the WPA reasonably in relation to these reports and to the reporting persons, should their identity be subsequently revealed.

3.8 The provisions of sec 3.7 shall apply similarly to reports whose subject matter is not a violation of protected regulations but other potentially harmful or otherwise inappropriate conduct related to the reporting person’s activities for the employer (e.g. workplace bullying, sexual harassment, etc.).

4. Assessment of report

4.1 The recipient must accept all reports made through the internal notification system and assess their merits.

4.2 If the report was made orally, an audio recording thereof or a written record, which accurately reflects the substance of the report, shall be made by the recipient. The audio recording of an oral report may only be taken with the consent of the reporting person. The recipient shall allow the reporting person to acquaint himself/herself with the recording or record and to comment thereon; any comment shall be attached to the recording or record.

4.3 Where the report has been made in writing and unless otherwise specified below, the recipient shall notify the reporting person in writing of its receipt within 7 days thereof.

4.4 The recipient shall, within 30 days of receipt of the report, assess its merits and inform the reporting person in writing of the results of this assessment. In factually or legally complex cases, the period may be extended by up to 30 days; such extension may occur up to two times. The reporting person shall be notified before the extension takes place.

4.5 If the recipient finds that the report:

a) is reasonable,he/she shall immediately propose to the relevant employer measures to prevent or remedy the violation of the protected regulations,

b) is unfounded, he/she shall without undue delay inform the reporting person in 6/7 writing that, on the basis of the facts set out in the report and all the circumstances known to the recipient, the reported facts do not pose a violation of the protected regulations or that the report is based on false information, and inform the reporting person of the possibility of making a report to a public authority,

c) is not a report within the meaning of this Policy or does not contain relevant information for a proper assessment, he/she shall without undue delay notify the reporting person in writing of this conclusion and invite the reporting person to complete the report within a reasonable period of time, while also informing such person that if the report is not completed, the recipient shall dismiss it.

For the purposes of sec. 4.3, 4.4 and 4.5, electronic communication by e-mail shall also be deemed to be in writing if the encryption of the message in question is applied.

4.7 Notification of the reporting person by the recipient in the cases provided for in this Article shall not be given if:

a) the identity of the reporting person is unknown to the recipient because the report has been submitted anonymously,

b) the identity of the reporting person could be disclosed by the provision of the notification,

c) the reporting person has expressly stated in the report that he/she does not wish to be notified of the receipt of the report or of its processing.

5. Recording of reports

5.1 The recipient shall keep an electronic record of the reports received, in the following scope:

a) the date of receipt of the report,

b) the name, surname, date of birth and contact address of the reporting person, if known to the recipient,

c) a copy of the written report, or a summary of the content of the oral report and the identification of the person allegedly breaching the Protected Regulations, if such person can be identified on the basis of the report’s content or on the basis of the facts established during the assessment of the report,

d) the result of the assessment of the report and

e) the date of completion of the report assessment process.

5.2 Records of report shall be kept for a period of 5 years from the date of receipt of the report; only the recipient shall have access to the records.

6. Protection of reporting persons

6.1 The identity of the reporting person will be kept strictly confidential at all times. Depending on the circumstances of the case, the identity of the person allegedly violating the protected regulations shall also be kept confidential; this does not apply where the employer has a legal obligation to report the commission or preparation of a criminal offence to the relevant public authorities.

6.2 If the reporting person could have justifiably assumed, at the time of submitting the report, that the report was reasonable, the report shall not be deemed to be a breach of banking secrecy or of any contractual or statutory duty of confidentiality, unless the WPA provides otherwise.

6.3 The employer undertakes to protect the reporting persons as well as jointly protected persons from retaliation. Appropriate protection shall also be provided to the persons allegedly violating the Protected Regulations; however, if the report proves to be founded, the employer shall be entitled to take actions against such persons that will prevent an imminent violation of the protected regulations or the recurrence of such a violation. These actions may include termination of the employment or other legal relationship of the employer with the persons concerned.

6.4 Persons, who believe they are being subject to retaliation after submitting a report, are entitled 7/7 to contact the recipient or members of the employer's statutory body at any time to seek protection or redress. Such persons may also seek compensation, to the extend provided by the law, for the harm caused by the retaliatory measures.

6.5 A person who has knowingly made a false report cannot claim protection from retaliation.

6.6 The right to protection from retaliation may not be waived and the reporting person may not be compelled to do so by the employer.

6.7 The recipient shall maintain the confidentiality of all facts of which he/she has become aware during the performance of his/ her duties under this Policy; this obligation lasts even after the termination of those duties, unless provided otherwise by applicable law.

7. Final provisions

7.1 The processing of personal data in connection with the submission, assessment and recording of reports under this Policy shall be governed by the relevant legislation, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ("GDPR"), and by a specific internal regulation of the employer.

In the case of transfer of personal data to third parties, the employer shall apply procedures to ensure that the transfer of personal data does not compromise the confidentiality of the reporting person’s identity or the identity of the person allegedly violating the protected regulations. This does not apply to situations when data is transferred for the purpose of further investigation or subsequent legal proceedings, or the reporting person gives explicit consent to the disclosure of his/her personal data.

7.2 Reports in accordance with the WPA may also be made through an external notification system to the Ministry of Justice, in the form of:

a) written communication addressed to: Ministry of Justice of the Czech Republic, Vyšehradská 16, 128 10 Prague,

b) e-mail to: oznamovatel@msp.justice.cz,

c) oral communication by phone at +420 221 997 840.

Further details may be found on the website: https://oznamovatel.justice.cz/chci-podat-oznameni//

This Policy is issued in writing and is accessible electronically via the Employers' internal system and through the websites of the individual members of the Purple Group, including the parent company Purple Holding, i.e.:

• www.purple-holding.com
• www.purple-technology.com
• www.purple-solution.com
• www.purple-trading.com
• www.purple-realestate.cz
• www.purple-ventures.com
• www.purple-foundation.com

7.4 This Policy shall come into effect on 05.12.2023.