Whistleblower Guide

The purpose of this guide is to define the principles and conditions for implementing the whistleblowing system (hereinafter referred to as the “Whistleblowing System“) made available to employees of the EFI
AUTOMOTIVE Group and third parties under the conditions described below, except in cases where this guide must be adapted to national legislation.

NB: This guide is based on French law and should be adapted locally where necessary to comply with applicable national legislation with the support of the Legal and Risk Management Department and the Group
Human Resources Department.

1 – PURPOSE OF THE WHISTLEBLOWING PROCEDURE

The purpose of the Whistleblowing Procedure is to strengthen the ethical approach and corporate responsibility of the EFI AUTOMOTIVE Group, but also to expand the means of expression available to all employees and third parties (hereinafter referred to as “Employees” and “Third Parties”) so that everyone can play an active role in risk prevention (whether these risks relate to corruption, crimes, offenses, discrimination, etc.).

The Whistleblowing Procedure is a reporting system available to Employees and Third Parties, the existence of which is mentioned in the internal regulations of the French entities of the EFI Automotive Group. It is not intended to replace other existing alert channels in accordance with the rules in force in each country, such as the hierarchical channel and employee representative bodies. Its use is optional and at the discretion of Employees and Third Parties.

The implementation of the Whistleblowing Procedure requires a high level of responsibility on everyone’s part. This system can only function based on information communicated in good faith.

The Whistleblowing Procedure enables the EFI AUTOMOTIVE Group Employees and Third Parties to:
• Obtain information and advice in the event of questions or doubts regarding the application or interpretation of compliance rules related to the ethics and the corporate responsibility approach desired by the EFI AUTOMOTIVE Group (such as the rules set out in the “Compliance Guide – Fight Against Corruption”);
• Exercise a right to alert to report concerns or misconducts noted in the areas defined in section II below.

The Whistleblowing Procedure guarantees confidentiality and respect of the rights of all parties involved.

2 – SCOPE OF THE WHISTLEBLOWING PROCEDURE

The Whistleblowing Procedure enables Employees and Third Parties to exercise the right to whistle blow in order to prevent and detect:
• Acts of corruption, influence peddling, embezzlement, illegal taking of interest, conflicts of interest, money laundering, fraud, etc.;
• Any breach of the principles of confidentiality and business secrecy, competition law, personal data protection, and more generally, business ethics;
• Any act of discrimination, harassment, and more generally any act that could constitute a serious violation of human rights, fundamental freedoms, or the health or safety of individuals;
• Any violation of applicable environmental regulations;
• Any concerns relating to forced labor or modern slavery, human trafficking, child labor, or the violation of indigenous peoples’ rights.
The Whistleblowing Procedure must be used in accordance with the laws and regulations applicable in the country where Employees and Third Parties reside or carry out their activities.

3 – EXERCISING THE RIGHT TO WHISTLEBLOW

All Employees of the EFI AUTOMOTIVE Group and Third Parties may exercise their right to report any concern or facts related to one of the areas covered by the Whistleblowing Procedure (as defined in section II above).
Consequently, the right to alert may be exercised by:
• Employees, those whose employment relationship has ended when the information was obtained in the course of that relationship, and those who have applied for a job with the entity concerned, when the information was obtained in the course of that application;
• Shareholders, partners, and holders of voting rights at the entity’s General Assembly Meeting;
• Members of the administrative, management, or supervisory body;
• External and occasional collaborators;
• The co-contractors of the entity concerned, their subcontractors or, in the case of legal entities, the members of the administrative, management or supervisory body of these co-contractors and subcontractors, as well as their staff.
To issue an alert and thus be considered a “Whistleblower“, the Employee or Third Party must be a natural person who has direct or indirect knowledge of facts that he believes should be disclosed or reported.
However, when the information was obtained outside the professional context, the Whistleblower must have had personal knowledge of facts that he believes should be disclosed or reported.
The Whistleblower must be acting selflessly, i.e. he must not derive any direct benefit, particularly financial, from the alert, and he must be acting in good faith, i.e. he must have reasonable grounds to believe that the concerns or misconduct reported are true and have occurred.
The Whistleblower may report information relating to a crime, a misdemeanor, a threat, or harm to the public interest, a violation or attempted concealment of a violation of an international commitment duly ratified or approved, a unilateral act by an international organization taken on the basis of such a commitment, European Union or foreign law, legislation or regulations, or a violation of the company’s ethical standards (e.g., code of conduct).
The Whistleblower may be assisted by an employee designated as a “facilitator“, the term “facilitator“ is understood here to mean any employee who assists Whistleblower in making an alert as specified in the first paragraph of this article.
The Whistleblower may freely choose to submit its report through the internal channel or to report externally (directly to an administrative or judicial authority, a professional body, an authorized legal entity, the ombudsman, etc.).
The managerial channel (hierarchical channel) is recommended.
However, if the Whistleblower considers that informing his direct manager could present difficulties or that the alert may not result in an appropriate response, he can contact the compliance team directly by email at the following address: compliance@efiautomotive.com
As a reminder, the compliance team is part of the Group Legal and Risk Management Department responsible for compliance.
The recipients of emails sent to this address are:
• The Group Chairman,
• The Head of Legal,
• The Compliance Officer.

4 – IDENTITY AND PROTECTION OF THE WHISTLEBLOWER

The Whistleblower can either identify himself or report anonymously (at its discretion) and decide to continue the exchanges while remaining anonymous.
If the Whistleblower decides to report an alert anonymously, he will be responsible for taking the necessary precautions to preserve his anonymity (for example, by reporting the alert via a non-personalized email address). It is also specified that if his or her identity is subsequently revealed, the Whistleblower will still benefit from the same protections.
The alert can either be reported verbally or in writing. Regardless of how it is reported, the alert will be treated as strictly confidential in accordance with local rules applicable to the processing of personal data.
The Whistleblower can therefore rest assured that every precaution will be taken to ensure that his identity (if the alert is not submitted anonymously) and the facts reported in the report are kept strictly confidential at all stages of the investigation and processing of the situation.
Consequently, the identity of the Whistleblower (if the alert is not submitted anonymously) will not be disclosed to any person likely to be targeted or investigated, even if that person requests it.
As a Group, we reaffirm our commitment to protecting those who, in good faith, report acts of corruption, serious breaches of ethics, or violations of the law. Any form of retaliation—such as dismissal, demotion, or harassment—is strictly prohibited. No attempt to waive the rights of whistleblowers is tolerated.
Individuals who raise an alert in accordance with the applicable procedures are also shielded from
unfounded civil or criminal proceedings. Support measures—whether financial, psychological, or related to professional reintegration—can be provided when needed.
This protection also extends to those who assist whistleblowers or have a professional connection with them.
Together, we are committed to handling every alert with the utmost confidentiality, fairness, and diligence.

5 – PROCEDURE

Any alert reported via compliance@efiautomotive.com will be handled as follows:

PRELIMINARY ASSESSMENT:
We will acknowledge receipt of your alert within 7 days.
Each alert will be subject to a preliminary assessment, which will be handled confidentially by the Compliance Officer in order to determine, prior to any verification, whether it falls within the scope of the Whistleblowing Procedure.
Any alert that clearly falls outside the scope of the Whistleblowing Procedure, is not serious, is not made in good faith, or constitutes an abusive or defamatory accusation, as well as any alert relating to unverifiable facts, will be destroyed without delay. The Whistleblower will then be notified.

VERIFICATION PROCESS:
If, after analysis by the Compliance Officer, the reported facts fall within the scope of the Whistleblowing Procedure, the Group Chairman will then set up an Ad Hoc Committee and chair it.
This Ad Hoc Committee will carry out the verification process.
The Compliance Officer will be responsible for coordinating the verification process. He will also notify the Whistleblower of the admissibility of his report. This Ad Hoc Committee must be composed of a limited number of individuals with expertise in the subject matter. Depending on the complexity and technical nature of the report, external experts may be called upon as needed.
The Ad Hoc Committee (in its capacity as data controller) shall investigate the case in accordance with the rules applicable to the processing of personal data.
The members of the Ad Hoc Committee are subject to strict confidentiality obligations, and they will take all appropriate measures to preserve the security of data processed within the framework of the Whistleblowing System.
As part of the verification process, the employee(s) targeted will be interviewed to give their version of the reported facts.
The Ad Hoc Committee will then ensure that the data collected is adequate, relevant, and not excessive in relation to the purposes for which it is collected.
The Whistleblower will be informed on a regular basis by the Compliance Officer of the progress of the verification process. This right to information will depend on the sensitivity of the matter.
For the purposes of this guide, any response sent to the Whistleblower within three months of the Compliance Officer receiving the report will be considered a reasonable response time in terms of the admissibility of the report.

CONCLUSIONS:
At the end of the verification process, the Ad Hoc Committee will draft a report (conclusions).
If the verification process finds that the person(s) targeted by the alert has/have behaved in a manner that is not in line with the ethical rules in the areas mentioned above, the Ad Hoc Committee will forward its findings to the human resources manager of the company concerned. The human resources manager will initiate disciplinary proceedings if deemed necessary.
Depending on the seriousness of the findings, the report of the Ad Hoc Committee may also be communicated to the senior management of the company, in particular if the findings require legal proceedings to be brought against the Targeted Employee(s).

The report of the Ad Hoc Committee must be delivered within a reasonable time frame, which will depend on the level of complexity and technicality of the facts reported in the Alert.
The Whistleblower is informed of the closure of the alert in writing.
When the alert is anonymous, its author must be aware that he/she will not be able to exercise his/her rights (access, rectification, opposition) or be informed of the follow-up given to his/her alert.
At the end of the verification process, the Internal Audit and Control Service shall implement or verify the tools implemented to prevent the practices described in Article III from recurring and shall also, ensure that the above process is relevant and efficient.

6 – INFORMATION OF THE TARGETED PERSON

Once the admissibility of the alert has been established, and as soon as the information has been recorded, whether in electronic form or not, the Targeted Person shall be informed by one of the members of the Ad Hoc committee of the verification process in progress, so that they may object, on legitimate grounds, to the processing of the information.
However, when precautionary measures are necessary, in particular, to prevent the destruction of evidence relating to the alert, the Targeted Person shall not be informed until after such measures have been taken.

7 – STORAGE OF THE EVIDENCE COLLECTED

Information relating to alerts shall be destroyed, retained or archived in accordance with the applicable provisions in force.
Thus, as soon as they are collected by the Compliance Officer, information relating to alerts that are considered to fall outside the scope of the Whistleblowing Procedure shall be destroyed without delay.
When the alert is not followed by disciplinary or legal proceedings, where applicable, the information relating to the alerts shall be destroyed or archived within two months of the closure of the investigation, which shall be formalized by the drafting of a report.
When disciplinary or legal proceedings are initiated against the Targeted Person, the information relating to the alerts shall be retained by the Compliance Team until the end of the proceedings.

8 – EXTERNAL REPORTING

Whistleblowers may report concerns or misconduct directly to one of the following authorities, if possible:
• The Defender of Rights,
• The competent judicial authorities, if applicable,
• European Union institutions, if applicable.

9 – PUBLIC DISCLOSURE

Public disclosure of an alert is only possible if the Whistleblower has previously made internal and external reports and no action has been taken in response to the report (cumulative conditions).
Public disclosure of an alert can only be done in the following limited cases:
• When the external authority has not provided an appropriate response in a timely manner;
• When referral to the competent authority (referred to in §8) would expose the Whistleblower to the risk of retaliation, or would not allow the alert to be eff ectively addressed due to specific circumstances;
• In the event of serious and imminent danger;
• Information obtained in a professional context where there is an emergency situation or a risk of irreversible harm to the public interest.