The Whistleblowing Channel is a safe and confidential space through which a person can report violations within article 2 of Law No. 93/2021 of December 20 (only available in Portuguese).
In the context of the Whistleblowing Channel, violations are acts or omissions arising in the areas of:
The report can also pertain to breaches of the Code of Conduct, which is available for reference. Whistleblowing may relate to violations that have been committed, are being committed or which can reasonably be expected to be committed, as well as attempts to conceal such violations.
Whistleblowers can use the internal whistleblowing channel, and are considered to be any natural person who reports a violation based on information obtained in the course of their professional activity and who has a relationship with Critical Manufacturing, such as workers, former workers, suppliers, clients, job applicants, holders of shareholdings and members of Critical Manufacturing’s governing bodies.
The Whistleblowing must act in good faith and have a solid basis, at the time of reporting, to believe that the information is true. In the event that Critical Manufacturing concludes that the whistleblower acted in bad faith and/or the whistleblowing is unfounded and/or does not correspond to the truth, the report will be dismissed, without prejudice to any other legal or disciplinary consequences that may apply.
These provisions are without prejudice to the right of workers to consult their representatives or unions’ representatives and to the rules of protection associated with the exercise of this right.
To benefit from the protection conferred by the General Whistleblowing Protection Regime approved by Law No. 93/2021 of December 20 (only available in Portuguese), the whistleblowing must comply with the precedence regime provided in Article 7 of this law. Therefore, as the company provides an internal whistleblowing channel, any whistleblowing must always be submitted through the respective means. Furthermore, external whistleblowing shall only be admissible when the requirements of paragraph 2, of the mentioned article, are observed.
The protection afforded by the aforementioned law extends to natural persons who assist the whistleblower in the whistleblowing procedure and whose assistance must be confidential (including union representatives or workers’ representatives), third parties who are connected to the whistleblower, such as a work colleague or family member, and may be the target of retaliation in a professional context, and legal persons or similar entities owned or controlled by the whistleblower, for which the whistleblower works or with which the whistleblower is otherwise connected in a professional context.
Whistleblowing is registered on its own platform to ensure:
The entire whistleblowing management system is based on technical and organizational measures aimed at the protection of data and other information. Namely, the integrity of the persons providing the information and the persons concerned in the whistleblowing.
The retention of information is ensured for a period of 5 years. Additionally, regardless of this period, information is retained during the pending judicial or administrative proceedings relating to the whistleblowing.
The Whistleblowing channel is operated internally by the Compliance Officer to receive and follow up on reports. Access to the Whistleblowing Channel platform is only available for duly authorized persons.
The identity and information that could identify the whistleblower are restricted to individuals responsible for receiving and/or monitoring reports. The whistleblower’s identity is only disclosed to fulfil a legal obligation or following a court decision to that effect. In this case, the whistleblower is notified in writing of the reasons for disclosing the relevant confidential data, unless providing this information would compromise investigations or related judicial proceedings.
Individuals responsible for receiving and/or monitoring reports, as well as anyone who has received information about reports (even if not competent for that purpose), are bound by a duty of confidentiality.
Confidentiality, anonymity, and transparency are the pillars of Critical Manufacturing’s Whistleblowing Channel. Therefore, in the process of confidentiality and anonymity, whistleblowing must follow the process that was designed for this purpose.
Critical Manufacturing SA is the Data Controller for personal data, processing it in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (General Data Protection Regulation – “GDPR”) and Law No. 58/2019 of August 8.
Without prejudice to the possibility of anonymity, when the whistleblower provides Critical Manufacturing with their personal data and/or third-party data in the context of the internal whistleblowing channel, Critical Manufacturing processes such data for the receipt and processing of reports, as required by legal obligations arising from Law No. 93/2021 of December 20.
Reports and any associated personal data may be processed by third-party service providers of Critical Manufacturing for the purpose of receiving reports and technical support. Such third parties, as processors, process personal data on behalf and according to the instructions of Critical Manufacturing, being bound by a data processing agreement concluded in accordance with the GDPR. When necessary, personal data may be disclosed to competent authorities, acting as Data Controllers, for the investigation of the reported violation.
Critical Manufacturing retains the record of received reports and associated personal data for a period of 5 years, unless it is necessary to keep them for a longer period in the context of a judicial or administrative process related to the report. Personal data that are clearly irrelevant for the processing of the report are immediately deleted, unless collected by means of a record in a durable and retrievable format, to comply with the legal retention period specified in the preceding paragraph.
Under the applicable legal conditions according to the GDPR, the data subject has the right to request from Critical Manufacturing access to personal data concerning them, rectification or erasure, or restriction of processing, as well as the right to lodge a complaint with Comissão Nacional de Proteção de Dados (CNPD).
Data subjects can contact Critical Manufacturing regarding personal data matters through the following contact: [email protected], or by post to Critical Manufacturing SA, Rua Engº Frederico Ulrich, nº 2650, 4470-605 Moreira da Maia, Portugal.
Critical Manufacturing will not engage in or tolerate acts of retaliation against the whistleblower who submits internal reports. Retaliation is considered any act or omission – as well as the threat and attempt of such act or omission – that, directly or indirectly, occurring in a professional context and motivated by an internal report, causes or may cause unjustified material or non-material harm to the whistleblower.
The provisions herein are without prejudice to any procedural rights or guarantees granted to individuals referred to as perpetrators of the violation or associated with it. The rights and guarantees provided for herein cannot be waived or limited by agreement.
