Bokio Whistleblowing Procedure

• Table of contents

• 1. Whistleblowing compliance
• 1.1 Objective
• 1.2 Definitions
• 2. Who can report
• 3. What can be reported
• 4. What cannot be reported
• 5. Where the reporting should be done
• 6. The process and actors
• 6.1 Report registration and case handler assignation
• 6.2 Whistleblowing case handling
• 6.3 Qualified or Non-Qualified report
• 6.4 Best practices for case handling
• 6.5 Follow-up
• 7. Documentation requirements
• 8. User access and management on Whistlelink

1. Whistleblowing compliance

Bokio will not tolerate any form of misconduct or critical conditions, such as violations of statutory rules, internal rules, policies or ethical standards, such as bullying, harassment, discrimination, corruption, money laundering or any other financial fraud, and will make efforts to ensure a safe, healthy and legal environment in all our business activities and legal units. 

Bokio will comply with all applicable laws and regulations and act ethically and socially responsibly. Breaches of any local and/or EU/EEA law may result in disciplinary actions, including termination / dismissal and reports to the relevant authorities. 

The Bokio Whistleblowing Channel is a tool enabling anonymous submission of any suspected breach of the local and/or EU/EEA law from both inside Bokio and outside. It fosters confidential communication between reporter and case handler.

Bokio Whistleblowing is compliant with the EU Whistleblower Directive (Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law) and the regulations regarding whistleblowing in the WEA (local working environment and protection laws). Bokio is also, in some jurisdictions, due to being licensed by local Financial Supervisory Authorities, obliged to have a specific whistleblowing system in place.

1.1 Objective

The objective of this procedure is to describe the handling of cases submitted to the Bokio Whistleblowing Channel, according to the EU Directive, local legislation and the internal procedures while at all times ensuring the protection of the Notifier.

The output of this process is that the reported case is handled with discretion and closed, with necessary actions taken.

This procedure is owned by Bokio VP of People and was last updated in March 2023.

1.2 Definitions

Case handler - assigned personnel who will handle the report.

Intake Management Service (IMS) - a third-party service facilitated by the Whistlelink vendor which receives the reports and assigns cases within one business day based on a predefined schema. 

Notifier -  is a person who reports a breach of EU/EEA or local law. They can be any employee, former or existing, or self-employed person in Bokio, a shareholder, or someone from outside of Bokio, e.g third persons connected with the Notifier or Bokio’s suppliers and customers who need to notify of a breach or a potential breach of the local or EU/EEA legislation or any of Bokio’s internal rules/policies.

Report - the reported whistleblowing case.

Viewer -  a case handler with temporary and limited access on Whistlelink, requested by the case handler to the Whistlelink Administrator.

Whistlelink - the chosen tool for handling whistleblowing reports.

Whistlelink Administrator - a Bokio employee who responds to user management requests at wladmin@bokio.se

2. Who can report

This procedure applies to a Notifier who needs to report a breach or a potential breach of the local or EU/EEA law or any of Bokio’s internal rules/policies. It also applies to third persons who are connected with the Notifier, and who could suffer retaliation in a work-related context, such as colleagues or relatives of the Notifier. 

As a Notifier, you are protected by law. You should not be treated unfairly or lose your job because you ‘blow the whistle’.

3. What can be reported

All reports shall be based on justifiable grounds of suspicion. Evidence is not necessary, but reporting must not be made with the intention to cause harm or with the knowledge that the accusation is false. Hence, the report you disclose must be made in the public interest. To identify if a report is in the public interest, you should look at the following criteria:

• the number of people affected
• the nature or impact of the harm
• who is the reported individual.

In a nutshell, the report should go beyond the employee’s personal circumstances.

Some examples, include the following:

• a criminal offense, for example, fraud
• someone’s health and safety are in danger
• risk or actual damage to the environment
• a miscarriage of justice
• the company is breaking the law – for example, it does not have the right insurance
• you believe someone is covering up wrongdoing
• #MeToo cases

Whistleblowing that fulfills this criteria shall be treated as a “Qualified Reporting” and handled in accordance with the Bokio Whistleblowing Procedure.

4. What cannot be reported

Types of cases other than those listed above should not be reported. Such cases that do not fulfill the criteria will be treated as “Non-qualified reporting”. A non-qualified reporting will not be handled within the Bokio Whistleblowing Procedure.

Examples of cases that should not be reported through the Bokio Whistleblowing Channel are

• General opinions on how the business is run
• General opinions on salary, leadership or other personnel matters

Such cases shall be handled by reporting to the relevant manager or any other relevant person within the management of the company in question.

This is the standard response the Notifier will receive in case of a “non-qualified reporting”:

5. Where the reporting should be done

Reporting shall be made at https://bokio.whistlelink.com which is the only and official Bokio Whistleblowing Channel. 

Reporting is made by submitting a form either anonymously or with a full name. Providing your full name might in some cases increase the chance of resolving the reported case, however, it is fully the Notifier’s decision to disclose their identity or not. 

If you are reporting anonymously please make sure that you put down as much information about the matter as possible and at least the following:

• The Bokio company connected with the misconduct/breach of local/EU/EEA law
• Description of the misconduct/breach and who’s involved
• Facts, evidence or proof of the misconduct/breach

6. The whistleblowing process and its actors

Figure 1. Whistleblowing case handling process overview

Figure 2. Process actors’ responsibilities and tasks

6.1 Report registration and case handler assignation

When Bokio receives a report submitted through the Whistleblowing Channel, the third-party Intake Management Service (IMS)  will immediately receive a notification for channeling the alert to the designated Whistleblowing Case handler which is Legal or HR.

Bokio uses this set-up also to ensure impartiality and transparency. 

Once the case is assigned to the main Whistleblowing Case handler, the Notifier will receive an acknowledgement of receipt. According to our contract with the IMS provider, this will happen within one business day after the report was submitted. 

The standard automatic response which will be sent to the Notifier is this one:

6.2 Whistleblowing case handling

The provision in Article 8(3) of the EU Directive 2019/1937 specifies that each Bokio company with 50 or more workers is required to set up channels and procedures for internal reporting, where such legal entities belong to a group of companies (please see Figure 3. below).

Article 8(6) allows medium-sized companies to share resources as regards the receipt of reports and any investigation to be carried out. It should be underlined that the responsibility to maintain confidentiality, give feedback, and address the reported breach remains, however, with each medium-sized company concerned. Only medium-sized companies can benefit from this possibility, and companies that belong to the same group.

All cases reported through the official Whistleblowing Channel will be tracked through logs that can’t be tampered with, hence, cases can’t be deleted from the system.

6.3 Qualified or Non-Qualified report

The case handlers on the platform or the relevant personnel assigned to handle the case, will need to decide as per each internal procedure and local legislation whether the report is to be treated as Qualified or Non-Qualified report. 

If the case handler decides that it is a Non-Qualified report, the report can be immediately closed by sending a standardized communication to the Notifier through the platform and by unticking the “​​Whistleblowing case” box which will exclude it from statistics.

If the report is considered to be Qualified, the relevant case handlers are obliged to start the investigation process. The report will be marked as a “​​Whistleblowing case” on the platform so it will count in the statistics.

6.4 Best practices for case handling

If the Notifier decides to submit the case by presenting their identity they should be invited to a meeting to discuss the content of the report and to provide more background information regarding the relationship and/or discussion of further handling of the case. In this meeting, agreements shall be made on how to communicate in the further course of the case, including consideration to immediately inform the relevant Bokio Company's Board and/or the Bokio Group Board, as per the local internal procedures.

If the report is submitted anonymously through the whistleblowing channel, the Whistleblowing Case handlers will coordinate the best course of action for handling the case, depending on the specifics of the reported issue. 

To collect more information, the Whistleblowing Case handlers or any other assigned case handler on the case, can and are encouraged to contact the notified in confidentiality using the whistleblowing platform as all messages pertaining to the report will be stored on the platform for further reference.

6.5 Follow-up

As per the requirements of the EU Directive, the main case handler or assigned personnel, needs to provide follow-up communication to the Notifier within 90 days since the report was submitted, even if the case is not concluded within that time frame.

• Depending on the severity, the Whistleblowing Case handler or relevant Board of Directors will consider contacting the local National Authority for Investigation and Prosecution of Economic and Environmental Crime.
• Appropriate measures should be taken (mitigation or/and prevention regarding future similar cases).

7. Documentation requirements

All activities related to the case must be documented. Necessary documentation must be gathered by the case handlers or the Board of the Bokio company (when applicable) who shall document everything during the process.

All documentation shall be stored on the Whislelink platform which allows tracking all changes made in relation to a report (e.g. document added, messages sent, etc.) 

Even though the whistleblowing reports can be exported from the platform in a pdf format, we don’t recommend doing so, because we lose track of changes and progress in handling them.

Personnel data will be processed in accordance with the Bokio Privacy Statement.

8. User access and management on Whistlelink 

The whistleblowing platform has four types of users: owner, administrator, case handler and viewer.

For safety reasons, there are only two users that have elevated rights: the Whistlelink  Administrator and the Intake Management Service.

Permanent access on the platform is provided only for the Whistleblowing Main case handlers, while any temporary access (e.g. viewing rights) shall be requested by them to the Whistlelink  Administrator who will add and remove user access as per a need basis.

Whistlelink Administrator shall be contacted at wladmin@bokio.se who will resolve the request in one business day.