Whistleblowing policy

This policy is adopted in accordance with the act of 28 November 2022 (Belgian Official Journal of 15 December 2022) on the protection of persons who report breaches of national or Union law within legal entities in the private sector, which transposes the European Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law.

Fost Plus (hereinafter referred to as "the Company") intends to conduct its business ethically and with integrity, and therefore wishes to ensure that whistleblowers covered by the act have the opportunity to report, under the terms and conditions described below, any potential breach of the legal and regulatory standards referred to in section 4.1 of this policy as serenely and securely as possible.
 

Reports must be made in good faith and may not be based in particular on rumour or hearsay or display defamation. Any malicious, fanciful or abusive report will be inadmissible or unfounded.
Any person guilty of making such a report may be held criminally and civilly liable.
Whistleblowers benefit from the legal protection laid down in the regulations, provided that:

•    they had reasonable grounds for believing that the information they were reporting on breaches was true at the time it was reported and that this information fell within the scope of the regulations and this policy;
This criterion is assessed with regard to a person in a similar position having comparable knowledge.
•    and they have made an internal report, an external report or a public disclosure in compliance with the conditions of this policy and the law.

Any person referred to in section 4.2 of this policy who has information relating to any wrongdoing referred to in section 4.1 is requested to report this to the Company as soon as possible.
The Company considers that the whistleblower is in the best position to choose the most appropriate reporting channel depending on the particular circumstances of the situation with which he/she is faced.
However, internal whistleblowing is the most appropriate way of reporting, since it is a priori the most likely to ensure rapid follow-up of the case on site, within the Company, with supporting measures.
The following whistleblowing channels may be used:

1-
Within the Company, internal reports can be made by e-mail: whistleblowing@fostplus.be

Reports must be sent in French or Dutch. Any report sent in another language will have to be translated, which may alter the accuracy of the content of the report.
This whistleblowing channel is accessible at all times, 24 hours a day, 7 days a week. However, the whistleblowing manager can only be contacted directly during the Company's opening hours (Monday to Friday, 8.30 am to 12.30 pm and 1.30 pm to 5.30 pm, excluding public holidays).
This channel is managed securely, so that the confidentiality of the identity of the whistleblower and of any third party mentioned in the report is ensured, as unauthorised members of staff do not have access to the internal whistleblowing channel.
This channel ensures that the privacy and personal data of the whistleblower and any third parties mentioned in the report are protected at all times.
This channel is managed completely independently by the whistleblowing manager.

2-
Once a report has been submitted via the above-mentioned channel, the whistleblower will receive an acknowledgement of receipt of the report within 7 days of receipt by the whistleblowing manager. A case number will be issued to ensure that the report is followed up.

3-
The whistleblowing manager will ensure that the report is received and followed up and will maintain communication with the whistleblower. Where appropriate, he/she will ask the whistleblower for any additional information required to investigate the report.

4-
Follow-up refers to any action taken by the whistleblowing manager to verify and assess the accuracy of the allegations made in the report and, where appropriate, to remedy the reported breach, including measures such as an internal investigation.
The purpose of feedback within 3 months is to provide the whistleblower with information about the measures planned or taken as part of the follow-up and the reasons for this follow-up.
 

1-
We strongly recommend that you start with the internal channel via our whistleblowing manager before using any other channel. Your problem will be dealt with effectively and more quickly on site, within the Company, so that pragmatic and immediate action can be taken.

2-
The Federal Ombudsman (Rue de Louvain 48, box 6, 1000 Brussels) has been appointed by the Belgian legislator as the body responsible for coordinating whistleblowing through external channels.
Basically, this body will be responsible for receiving external reports, checking their admissibility and forwarding them to the competent authority for investigation. This will vary depending on the subject matter of the report.
For example, it could be the Public Procurement Service of the FPS Chancellery (for public procurement), the FSMA, the NBB or the Collège de supervision des réviseurs d'entreprise (Belgian Audit Oversight Board) (for financial services, products and markets), the FPS Economy (for consumer protection), the Data Protection Authority (for the protection of privacy and personal data), etc.
In exceptional cases, the Federal Ombudsman may also conduct the in-depth investigation.

Under the internal whistleblowing procedure, the Company is considered to be the controller of the personal data processed as part of the internal whistleblowing procedure.
In this respect, we refer you to the Data Protection Manager (DPM) via e-mail: privacy@fostplus.be for more information about the processing of your personal data by the Company.
Under the external whistleblowing procedure, the Company may not be considered to be the controller: this will be the competent authority or, in the absence of a competent authority, the Federal Ombudsman.

Any processing of personal data carried out under this policy shall be carried out in compliance with the applicable standards, and in particular with the requirements of the General Data Protection Regulation (GDPR).
The name, position and contact details of the whistleblower and of any person to whom the protective and support measures extend, as well as those of the person concerned, including, where appropriate, his/her company number, will be kept until the reported breach has been remedied.