WHISTLEBLOWING POLICY OF UMARUTTI S.R.O.

Purpose: To establish rules and procedures for submitting, receiving, assessing, and addressing reports of potential unlawful conduct within Umarutti s.r.o. (hereinafter referred to as the "Company") and to ensure the protection of whistleblowers in accordance with Act No. 171/2023 Coll. (hereinafter referred to as the "Act").

Personal Scope: This Policy establishes the rights and obligations for the Company, the Relevant Person, and the Whistleblower. Whistleblowers may include (but are not limited to) employees (current and former), job applicants, members of governing bodies, clients and users of the AreteApp platform, suppliers, service providers, interns, and other individuals who perform or have performed work or similar activities for the Company, or who have been or are in contact with it in connection with such activities, in accordance with § 2 of the Act.

Material Scope: Regulates the entire process from submission to resolution of reports.

Temporal Scope: Applies to reports concerning conduct regardless of when it occurred.

Key terms such as: Whistleblower, Report, Unlawful conduct (with reference to § 2 of the Act), Retaliation (with reference to § 4 of the Act), Relevant Person, Company, Related Person, Tool (FaceUp platform), Act. (Based on the template and the Act).

Whistleblower: An individual who makes a Report under the Act because they became aware of Suspected Facts in connection with work or other similar activities performed for the Company (or in contact with it in connection with such activities), including clients of the Company and users of the AreteApp platform.

The Company designates Mr. Vladimír Kondratěnko, the managing director of the company, as the Relevant Person. The contact details of the relevant person are [email protected] and the phone number +420 606 751 525.

The Relevant Person meets all legal requirements set out in § 10 of the Whistleblower Protection Act, namely that they are of good character, of legal age, and fully competent. In the course of their duties, they receive and assess reports of potential unlawful conduct, propose corrective measures to the company's management to address identified deficiencies, handle reports impartially and objectively, and maintain confidentiality regarding all facts they learn in connection with the performance of their function, in accordance with § 11 of the Act.

The Company guarantees that the relevant person will not be subject to any penalties for the proper performance of their duties arising from this role, as stipulated in § 11 of the Whistleblower Protection Act. This protection includes, in particular, a prohibition on any sanctions, discrimination, or other negative consequences related to the proper fulfillment of the relevant person's duties.

Who can report: Any individual who has become aware of potential unlawful conduct in connection with work or other similar activities for the Company (or in contact with it), as defined in § 2 of the Act, may submit a report. This explicitly includes employees (current and former), job applicants, members of the Company's governing bodies, clients and users of the AreteApp platform, suppliers, service providers, interns, and other collaborating individuals.

What can be reported: See Material Scope and § 2 of the Act. It should be noted that it does not apply to knowingly false reports (§ 7 para. 3 of the Act). Exclude information according to § 3 of the Act.

Methods of submission (§ 9 of the Act):

• Preferred: FaceUp Tool: https://www.app.faceup.com/cs/c/xgidfb2s/ – in writing and orally (voice message), anonymously or non-anonymously.
• Email: [email protected]
• Phone: +420 606 751 525
• In person: By arrangement with the Relevant Person (within 14 days).
• Externally: Option to report to the Ministry of Justice.

Content of the report: Data about the first name, surname, and date of birth, or other data from which the identity of the whistleblower can be inferred (if not anonymous and provided), and information about possible Illegal Conduct (§ 2 para. 2 of the Act).

Acknowledgment of receipt: Within 7 days, with exceptions (§ 12 para. 2 of the Act).

Record keeping: Keeping records in the FaceUp Tool to the extent according to § 21 of the Act.

Retention: For a period of 5 years (§ 21 para. 2 of the Act).

Access: Only the Relevant Person (§ 21 para. 3 of the Act).

Recording of oral reports: Recording (with consent) or transcript, option for the whistleblower to express themselves (§ 19 of the Act).

Deadline: Within 30 days, with the possibility of extension twice by 30 days (§ 12 para. 3 of the Act).

Procedure: The relevant person assesses impartially, gathers information, and may request cooperation.

Unfounded report: Notification to the whistleblower, information about the right to file with a public authority (§ 12 para. 6 of the Act).

Founded report: Proposal for corrective measures by the Company (§ 12 para. 5 of the Act).

Notification to the whistleblower: Information about the outcome of the assessment (§ 12 para. 3 of the Act).

Adoption: The Company shall take appropriate measures to remedy or prevent illegal situations (§ 9 para. 2 letter g) of the Act).

Examples: Process changes, training, disciplinary proceedings, termination of relationship, compensation for damages, filing a criminal complaint.

Informing the whistleblower: About the measures taken (§ 12 para. 5 of the Act).

Prohibition of retaliation: Strict prohibition of any form of retaliation against the whistleblower and other protected persons (§ 4 of the Act).

Identity protection: Obligation of the Relevant Person to maintain confidentiality about the identity, exceptions according to § 20 of the Act.

Confidentiality: Obligation to maintain confidentiality about the content of the report (§ 11, § 20 of the Act).

Processing of personal data in accordance with GDPR and the Company's Privacy Policy. Informing whistleblowers about the processing.

The Company shall ensure that this Directive and information on whistleblowing are available to all relevant persons (e.g., on the intranet, website).

The Company shall provide training for employees and Relevant Persons.

The effectiveness of the directive from 25.05.2025