Whistleblowing

Internal reporting system

Based on Act No. 171/2023 Coll., on the protection of whistleblowers, as amended (hereinafter also referred to as the "Act"), which is effective from 1st August 2023, in relation to Directive (EU) 2019/1937 of the European Parliament and of the Council of 23rd October 2019, on the protection of persons who report breaches of Union law, our company, as an obliged entity, has introduced an internal reporting channel for receiving the reports of breaches, following-up, ensuring confidentiality of the identity of the reporting person and third parties, protection of the information contained in the report and communication with the reporting person.

A "reporting person" means a natural person who reports a possible breach (which has the characteristics of a criminal offence or a misdemeanour or violates a legal regulation or an EU regulation in the areas defined by law) acquired in the context of their work-related or other similar activities. Such a reporting person is subsequently protected from any form of retaliation that our company may take against them (e.g., dismiss them, transfer them, reduce their salary, change their working hours, etc.). Not only is the reporting person themself protected in this way but also, e.g., persons close to the reporting person, colleagues or persons who helped the reporting person find out the information stated in the report.

In the meaning of Section 9 (2) (a) of the Act, our company does not exclude the receipt of a report from a person who does not work or perform other similar activities for us in accordance with Section 2 (3) (a), (b), (h), or (i) of the Act (i.e., dependent work performed in a basic employment relationship, service, volunteer activity, professional practice, internship).

Whistleblowing officer

Our company has appointed a designated person to act as an internal channel for reporting and subsequent follow-up within the scope of Section 9 (1) of the Act:

Veronika Kachyňová

tel.: 518 321 223, e-mail: whistleblowing@omnika.com

What the report must contain

The content of the report is:

the name, surname, and date of birth of the reporting person (or any other information from which the identity of the reporting person can be inferred); the report does not need to contain such information if it is made by a person whose identity is known to the whistleblowing officer;
information on breaches that have occurred or are very likely to occur in the company in which the reporting person, even indirectly, works or has worked or conducted other similar activities or in another company with which the reporting person is or was in contact through their work or other similar activity;
a description or summary of the substance of the report, incl. identification of the persons concerned;
the evidence, if any, on which the report is based.

Our company advises the reporting person that protection under the Act does not apply to knowingly false reports; filing such a report carries a fine of up to CZK 50,000.

Methods of reporting

in writing, by completing the form available here and sending it by post to our company´s address, marked "Whistleblowing – do not open – only to the whistleblowing officer";
electronically, by filling in the form available here and sending it to the above-mentioned e-mail address of the whistleblowing officer;
by phone using the whistleblowing officer’s telephone number listed above;
in person by prior arrangement (upon the request of the reporting person, the whistleblowing officer is obliged to receive the report in person within a reasonable period, but no later than 14 days from the request date).

The reporting person may also submit the report through the external reporting system of the Ministry of Justice, e.g., if they believe our company's internal reporting system is not functional or if they do not have sufficient confidence in it. The reporting person does not have to state the reason for preferring the external reporting system of the Ministry of Justice and is not even obliged to file the report first through our company's internal reporting system.

Publication of the report

The reporting person may publish the content of the report if they:

filed a report through the internal reporting system and with the Ministry of Justice or only with the Ministry of Justice, and appropriate action was not taken within the specified time limits (in particular, the whistleblowing officer did not assess the reasonableness of the report, our company did not take other appropriate measures to prevent or correct the illegal situation, or an employee of the Ministry did not assess the report);
has a legitimate reason to believe that the unlawful conduct specified in the report may lead to an immediate or obvious threat to internal order and/or safety, life and/or health, the environment and/or other public interest, and/or to irreparable damage;
has legitimate reason to believe that, in the case of filing a report with the Ministry of Justice, there is an increased risk of being subject to retaliatory measures or that the Ministry's authority is threatened due to the circumstances of the case.

Period for reports handling

upon receipt of the report, the reporting person shall be notified of the receipt of the report within 7 days from the date of receipt of the report by the whistleblowing officer; this shall not apply if the reporting person has explicitly requested not to be notified of the receipt of the report or the whistleblowing officer reasonably believes that the notification of the receipt of the report would jeopardise the protection of the reporting person's identity;
the whistleblowing officer communicates to the reporting person the final outcome and assessment of the investigation triggered by the report within 30 days of receipt of the report (in cases of factual or legal complexity, the period may be extended by another 30 days, but not more than twice); this shall not apply if the reporting person has explicitly requested not to be notified of the extension of the assessment period and the reasons for its extension, or if the whistleblowing officer reasonably believes that the notification of the extension of the assessment period and the reasons for its extension would jeopardise the protection of the reporting person's identity;
the date of delivery of the report is the date on which the report is delivered to our company´s address (stamp on the envelope). For e-mail reports, the delivery date is indicated in the e-mail´s header. In the case of reports made by telephone or in person, the delivery date is the date of the telephone or in-person meeting between the reporting person and the whistleblowing officer.

Methods of handling reports

If the whistleblowing officer finds that the report is:

justified, they will propose remedial actions to our company to address the issue raised to prevent and/or correct the illegal situation;
unjustified, they shall inform the reporting person in writing without undue delay that, based on the facts stated in the report and all circumstances, they do not find acts or omissions addressed by the report unlawful or that the report is based on false information, and shall inform the reporting person of the right to report to a public authority;
is not a report under the Act, they shall inform the reporting person thereof in writing without undue delay.

Whistleblowing and personal data

if our company receives a request for access to personal data and information relating to the whistleblower protection agenda, we will immediately forward it to the whistleblowing officer for processing;
the whistleblowing officer will then assess whether they process the applicant's personal data in accordance with the GDPR and decide whether it is possible to satisfy the applicant's request for access in accordance with the law. In particular, the whistleblowing officer will assess whether complying with the applicant's request for access could impede the investigation of the report, hinder the adoption of remedial actions or jeopardise the protection of the reporting person's identity. The whistleblowing officer shall inform the applicant of the result of the request assessment if such action is appropriate;
our company processes the personal data of the reporting persons and those mentioned in the report to fulfill legal obligations under Article 6 (1) (c) of the GDPR. The personal data will be processed exclusively and serve only for the report investigation purposes performed by the whistleblowing officer and for the protection of the reporting person from any form of retaliation for the strictly necessary period (i.e., 5 years from the date of receipt of the report); thereafter, the personal data will be anonymised or destroyed, unless otherwise provided by the law;
the personal data originate from the reporting person and are processed in electronic form using automated processing or in paper form using non-automated means. Our company does not carry out systematic and/or large-scale processing of personal data. Our company does not carry out automated individual decision-making with legal or similar effects, incl. profiling, within the meaning of Article 22 of the GDPR;
the reporting person and the persons concerned have the following data protection rights to the whistleblower protection agenda:

the right to information and access to personal data (Article 15 GDPR);
the right to rectification or completion of personal data (Article 16 GDPR);
the right to the erasure of personal data (Article 17 GDPR);
the right to portability of personal data to another data controller (Article 20 GDPR);
the right to limit the processing of personal data (Article 18 GDPR);
the right to object to processing (Article 21 GDPR);
the right not to be subject to automated individual decision-making with legal or similar effects, including profiling (Article 22 GDPR);
the right to submit a complaint to the Personal Data Protection Office (https://www.uoou.cz/);
if the reporting person has given their consent to our company, they may withdraw it at any time in writing to our company’s address and/or by e-mail to omnika@omnika.com (in whole or in part) – this does not affect the lawfulness of processing based on consent given prior to its withdrawal.