Knystaforsen Whistleblower Policy

Knystaforsen’s whistleblower policy

The purpose of this whistleblower policy is to explain how Knystaforsen's whistleblower scheme works. This scheme allows you to make reports about Knystaforsen. A good understanding of this scheme can therefore prevent potentially important matters from being left unreported.

Introduction to Knystaforsen's whistleblower scheme

Knystaforsen is dedicated to act and do business in a way that is right to our employees, customers, partners and society in general. In order to continuously make sure that Knystaforsen does just that, Knystaforsen encourages that concerns are shared.

Knystaforsen employees and volunteers may always and is strongly supported to share concerns with their direct manager. However, concerns may rise which an employee does not find suitable to raise through those channels. Hence, the objective of the whistleblower scheme is to ensure that all Knystaforsen employees as well as customers, partners and others have a channel where they can report any potential breaches of laws or regulations applicable to Knystaforsen.

Knystaforsen's whistleblower scheme ensures protection for individuals who report serious offenses and matters. This scheme can be used if you experience, are aware of or have reasons to suspect the occurrence of such breaches in Knystaforsen both in the past, present or near future. Reports can be filed either anonymously or confidential.

Who can use this Whistleblowing scheme?

Knystaforsen's whistleblower scheme can be used by anyone who has information about Knystaforsen which they have acquired in the course of their work- related activities with Knystaforsen.

The categories of people who can use this whistleblowing scheme are broad. Reports can thus be filed by:

• Employees. This entails both full and part-time employees as well as employees working under an unlimited or fixed-term contract.
• Job applicants
• Paid or unpaid trainees
• Volunteers
• Self-employed persons
• Shareholders
• Members of the management, supervisory board, or other governing board of IO Interactive
• Persons working under the supervision and direction of contractors, subcontractors, and suppliers of IO Interactive
• Customers
• Suppliers
• Other business partners

Persons falling under these categories can make use of the whistleblowing scheme regardless of whether their employment relationship with Knystaforsen has ceased, is still ongoing or has not yet begun.

What can you report?

The whistleblower scheme can be used to address any information about serious violations of the law, attempts to conceal such violations or other serious matters that have occurred or are likely to occur in Knystaforsen. Also in case of reasonable suspicion of the occurrence of these violations or matters, this information can be reported. It is required however that reports are submitted in good faith, and that this reporting scheme is not used for unfounded accusations towards innocent people.

The violations which can be reported about through the whistleblower scheme relate to specific breaches of EU law or other serious offenses and matters according to Swedish law. Less serious matters or ordinary employment issues, such as dissatisfaction with salary or minor collegial issues are not meant to be reported through this whistleblower scheme.

Activities that can be reported through this scheme relate for example to corruption, protection of the environment, public health, privacy and personal data or sexual harassment and sexual abuse. These are only examples. Also other matters or violations of the law of a serious nature can be reported.

If you are in doubt about whether your observation or suspicion is of a serious nature and should be reported or not, you are encouraged to do so. All inquiries will be answered and processed.

Protection of the whistleblower

Anyone who reports matters as described above in good faith is protected from any form of retaliation. Actions of retaliation entail direct or indirect actions or omissions which occur in a work-related context as a result from the report and which cause or may cause unjustified harm to the whistleblower. Such actions can take multiple forms, such as for example dismissal, change of location of work, reduction in wages or harming the reputation of the whistleblower.

If a whistleblower suffers any form of retaliation by Knystaforsen, they will be compensated for this. In case of dismissal, the dismissal shall be annulled and the employment relationship shall be maintained or re-established if the whistleblowers so wishes. Knystaforsen may also be subject to other sanctions.

How to report?

Reports that lie within the scope of this policy are processed by:

Klara Rolfart – Lawyer, Ludvig & Co.

Only this person is authorised to investigate. However, in some cases, the investigation may be carried out with the help of external parties.

How are the reports processed?

You will receive an acknowledgement of receival of the report within seven days. After this, an initial examination of the report will be conducted. If the report turns out to be notably unfounded, it will be rejected. The person who reported the case will be notified of this as soon as possible. However, if the initial examination determines that the report cannot be characterized as notably unfounded, it will be further investigated. The case will then be processed internally. The whistleblower will receive feedback on any updates or outcomes as soon as possible and under no circumstances later than 3 months from the whistlerblower has received the acknowledgement of receival of the report. This internal investigation may have consequences for the person or persons who are involved. If the case is of particular serious nature, it may also be passed on to the police for further investigation. After conducting all investigations and imposing potential sanctions, the case will be closed. It will then be deleted from the system.

Subsequent clarification and collection of additional documentation

When you create a report, you get the opportunity to log in to the system and see if the caseworker has asked additional questions about the case or requests additional documentation. Any subsequent dialogue depends solely on the whistleblower's willingness to log in to the system and answer the caseworker's questions.

Confidentiality and IT security

A report can be made either anonymous or confidential. Whereas the former entails that no personal information is shared, the latter includes the sharing of personal information by the whistleblower. If personal information is shared in your report, only those who are authorised to investigate the case will have access thereto. The confidentiality of the submitted report will therefore in any case be respected.

The whistleblower reporting channel is operated by Walor ApS, which is an independent third party who guarantees the safety and security of the system. The system does not log IP addresses and machine-IDs and will encrypt all data processed. Only the responsible caseworker has access to the report.

Notice of person concerned

The recipient of the report might be obliged to provide the person being reported with information about the reported event. In each individual case, an assessment will be made of when this notice can be passed on, so that the notice will have no consequences for the collection of evidence.

No information, either direct or indirect, will be specified about who made the report towards the person concerned, even if the reporter has chosen to report confidentially.

Questions

All questions about the whistleblower scheme can be directed to Knystaforsen’s Management.

The process for whistleblowing is as follows:

1. You select the recipient of the report and describe your case. If you choose not to remain anonymous, you can provide your name in the description.

2. A notification is sent to the recipient that there is a report to review.

3. An (anonymous) dialogue can then be initiated between the whistleblower and the recipient.

4. Notifications are sent to the recipient and the whistleblower when there is any activity in the case or if there is something to act upon, with a link to the report.

5. The recipient has two options:

   • Reject the report (e.g., if something unrelated to whistleblowing has been reported).

   • Resolve/close the case. In this case, messages and any attached files/documents are compiled and stored in Evity for a maximum of 2 years.

You have the right to receive confirmation from the recipient within seven days that your report has been received and follow-up and feedback within three months.

In addition to the selected recipient, the board may also have access to the report.