Reporting of Irregularities

With a view to fostering a culture of responsibility and compliance in accordance with applicable legal and regulatory provisions, Novabase has adopted a Whistleblowing System For Reporting Irregularities (known as “SPI”) that may occur within its Group.

The SPI was established to receive and process the reporting of any irregularities that may occur at the Group’s companies, pursuant to article 21 of the Securities Code, following the principles of confidentiality and non-retaliation in relation to whistleblowers and third parties assisting or related to them.

Irregularities Reported through the SPI are routed to the Chairperson of the Audit Board, while this same board designates the entity or person who will follow up on reports received (“SPI Controller”).

The Chairperson and members of the Audit Board (as the entity responsible for receiving the complaint) and the SPI Controller must act under criteria of independence, impartiality, confidentiality, data protection and secrecy, while ensuring that there are no conflicts of interest.

According to the implemented system, whistleblowers have access to a direct and confidential channel for reporting to the Audit Board any potential irregularities occurring at the Novabase Group.

For these purposes, “Irregularities or Irregular Practices” are defined as the acts or omissions referred to in article 2 (1) of Law no. 93/2021 of 20 December and article 3 of the Annex to Decree Law no. 109-E/2021 of 9 December, namely in the following domains: i) public contracting; ii) financial markets, products and services; iii) prevention of money laundering and terrorist financing; iv) protection of privacy and personal data, and network and information system security; and v) prevention of corruption and related offences.

For the purposes of the SPI, “whistleblowers” are defined as the following natural persons who, in good faith, report an infraction based on information obtained while doing their job, even when the complaint is based on information obtained from a professional relationship that no longer exists: a) employees and members of managing and supervisory boards of Group companies; b) service providers, contractors, subcontractors and suppliers of the Group, and any other persons acting under its direction and supervision; c) shareholders of Group companies.

Novabase Group employees are guaranteed immunity from any kind of retaliation after submitting a claim in good faith, provided that, at the time of doing so, the employee has serious grounds for believing that the information is true.

The alleged irregularity must be reported, in a secure and strictly confidential manner, to the attention of the Chairperson of the Audit Board, by one of two means:

• to the private e-mail address (as applicable, according to the company involved in the complaint): whistle@novabase.com / whistle@celfocus.com / whistle@neotalent.com
• by posted letter to the attention of the Chairperson of the Audit Board, markedm “Confidential” and with reference to the Novabase Group company involved in the complaint, to the address: Av. D. João II, n.º 34, Parque das Nações, 1998-031 Lisbon.

After receiving the report, the SPI Controller will carry out the internal acts needed to verify the allegations and, if applicable, halt the reported infraction, including by means of opening an internal investigation or notifying the competent authority to investigate the infraction, including European Union institutions, bodies or agencies.

The Novabase Group company involved in the complaint shall, within 7 (seven) days, notify the whistleblower of its receipt of the complaint, stating in a clear and simple manner the requirements, competent authorities and form and admissibility of the external complaint, pursuant to article 7 (2) and articles 12 and 14 of Law no. 93/2021 of 20 December.

Anonymous reports will only proceed when containing sufficient evidence for opening an investigatory procedure.

Any complaints justifiably considered by the SPI Controller as being of minimal seriousness, insignificant or clearly irrelevant, together with recurring complaints without new information justifying a different approach than that of the previous complaint, shall also be archived, not subject to further proceedings.

Before proceeding with the final forwarding of the reports, the SPI Controller takes account of the reports for statistical purposes and maintains a record of the reports that exclusively covers the following aspects:

i. notification receipt date;
ii. essential nature of the facts reported, while redacting all information identifying any natural
persons;
iii. investigation completion date.

Once the investigation has been concluded, reports with an underlying probability of an irregular practice are forwarded by the SPI Controller to the Audit Board and, in turn, by the Audit Board to the Board of Directors of the company (or Novabase Group company) involved in the complaint so as to take the measures deemed appropriate.

Whenever the reporting of Irregular Practices results in evidence of a crime or serious disciplinary infraction, the Audit Board must recommend that the Board of Directors of the Novabase Group company involved in the complaint forward the matter

(i) to internal bodies for due process, and
(ii) to the competent external bodies pursuant to article 12 (1) of Law no. 93/2021 of 20 December, namely the police or the public prosecutor, in order to ascertain potential responsibilities. General rules of conflict of interest apply to the decisions to be approved by the Audit Board or by the Board of Directors regarding reports made within the scope of the SPI.

Whatever the circumstance, the confidentiality of the report will be guaranteed, unless its author expressly and unequivocally requests otherwise, together with the protection of the personal data of any natural persons involved.

The Novabase Group company involved in the complaint will notify the whistleblower of the measures planned or taken to follow up on the complaint, and the respective findings and justification, within 3 (three) months of receiving the complaint.

Access to reports submitted via the SPI is restricted to the individuals in charge of receiving or following up on reported irregularities.

Communications and information obtained during the investigation will be retained for 5 (five) years, after which time they will be deleted, unless they have resulted in legal or administrative proceedings, in which case they will be retained so long as these proceedings are pending.

Processing of personal data under the SPI shall comply with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”) and Law no. 58/2019 of 8 August (“Personal Data Protection Law”).

Whistleblowers shall be entitled to the rights of access, rectification and erasure of any data provided within the scope of the SPI, except when in conflict with the law, namely in cases of criminal liability.

Personal data which is clearly irrelevant to the processing of the complaint will be immediately deleted (or, whenever partial elimination is not technically possible, replaced by acronyms for the purposes of processing and following up on the complaint).