PROCEDURE FOR RECEIVING AND PROCESSING INTERNAL REPORTS

Table of Contents

1. Preamble
2. Purpose and Scope
3. Definition of a Whistleblower
4. Reporting Channel
5. Contents of a Report
6. Acknowledgment of Receipt
7. Eligibility Review and Processing of Reports
8. Informing the Whistleblower of the Outcome of the Report
9. Protection of Whistleblowers
10. Notification of a Person Named in a Report
11. Distribution of the Procedure

Preamble

As part of the protection of whistleblowers established by Law No. 2016-1691 of December 9, 2016, as amended by Law No. 2022-401 of March 21, 2022, CLAREO has established an internal procedure for receiving and processing whistleblower reports, taking into account the requirements of Decree No. 2022-1284 of October 3, 2022.

This procedure takes effect on June 26, 2025.

This reporting system supplements traditional reporting channels, and its use is entirely optional for employees and other staff members.

1. Purpose and Scope

The purpose of this internal procedure for receiving and processing reports is to encourage and govern the reporting of facts that may constitute:

• a criminal offense;
• a serious and manifest violation of a law or regulation;
• a violation, or an attempt to conceal a violation, of an international commitment duly ratified or approved by France, or of a unilateral act of an international organization adopted on the basis of such a commitment;
• a threat or harm to the public interest.

A report may not concern information protected by national defense secrecy, medical confidentiality or attorney-client privilege.

2. Definition of a Whistleblower

A whistleblower is an individual who reports, without seeking personal gain, in good faith and without malicious intent, facts of which they have personal knowledge and which may fall into the categories listed in Section 1 above.

The following persons may act as whistleblowers:

• Company employees, former employees and job applicants;
• Shareholders, partners and holders of voting rights at the general meeting;
• Company executives;
• External or occasional staff members;
• The company's contractors and subcontractors or, where a contractor or subcontractor is a legal entity, members of its staff and its administrative, management or supervisory bodies.

3. Reporting Channel

Reports may be submitted through the following channels:

• Dedicated email address: [email protected]
• Depending on the nature of the alleged misconduct and their respective areas of responsibility, your report will be handled by either Vincent FOURNIER (Managing Director) or Maud PANIS (Human Resources Director).
• You may also request a meeting, by appointment, with either of the two officers named above.

Reports received by other persons or departments must be forwarded to one of the Whistleblowing Officers without delay.

If a report is made during a meeting with a Whistleblowing Officer, the person receiving the report records it in writing and prepares an accurate account of the conversation.

The person making the report may review, correct and approve the written record by signing it.

Written records may be retained only for as long as is strictly necessary and proportionate to process the report and protect the person making it, the persons named in it and any third parties mentioned.

4. Contents of a Report

The person making the report is asked, where possible, to:

• state the date and location of the reported events, identify the person or persons involved, and provide a detailed description of the facts;
• provide any evidence, regardless of its form or medium, that may support a report concerning the matters listed in Section 1 that have occurred or are very likely to occur within the company;
• provide contact details so that the recipient of the report can communicate with them (email address, telephone number, postal address, etc.).

Information submitted through a reporting system must be factual and directly related to the subject of the report.

When submitting a report, the person making it must also provide evidence that they belong to one of the categories of persons listed in Section 2.

5. Acknowledgment of Receipt

The person making the report will receive a written acknowledgment within seven business days of receipt of the report.

6. Eligibility Review and Processing of Reports

Each report undergoes a preliminary review to determine whether it meets the eligibility criteria set out in Sections 1 and 2.

In particular, the report must fall within the scope of the reporting system, be presented objectively and without malicious intent, and concern facts directly observed by the whistleblower that can be verified. To this end, the person making the report may be asked to provide additional information.

The person making the report is informed whether their report is eligible and, if it is not, why it is considered not to meet the eligibility criteria.

The Whistleblowing Officer processes reports in collaboration with the legal department and, if necessary, management. The process is based on the following principles:

• Confidentiality: The identities of the whistleblower, the persons named in the report and any third parties mentioned are strictly protected. Only persons authorized to receive and process reports may access the information collected. The information may be shared with third parties if doing so is necessary to process the report.
• Information identifying the person making a report may be shared with third parties only with that person's consent. It may, however, be shared with a judicial authority if those responsible for receiving or processing reports are required to report the facts to that authority. The whistleblower is then informed, unless doing so could jeopardize the judicial proceedings.
• Under no circumstances is the identity of the person making a report disclosed to a person named in that report without the reporting person's express consent.
• Information that could identify a person named in a report may be disclosed, except to a judicial authority, only once the report has been found to be substantiated.
• Impartiality and Objectivity: Reports are analyzed impartially. The accuracy of all recorded information is verified. The whistleblower may be asked for additional information.
• Handling Anonymous Reports: As a rule, anonymous reports are ineligible and cannot be processed unless the seriousness of the reported facts is established and the factual information is sufficiently detailed. Even then, the recipient must first review the report to determine whether follow-up is warranted.

7. Informing the Whistleblower of the Outcome of the Report

The company has three months from the acknowledgment of receipt of the report to investigate and inform the whistleblower of the measures taken or that the investigation has been closed.

If a report is closed because the allegations are inaccurate or unfounded, or because the report is no longer relevant, the person who made it is notified in writing that the case has been closed.

8. Protection of Whistleblowers

Under Article L. 1121-2 of the French Labor Code, no direct or indirect retaliatory action (disciplinary action, dismissal, intimidation, etc.) may be taken against a whistleblower who has reported facts in good faith.

A whistleblower is not criminally liable for disclosing information protected by law if the disclosure is necessary and proportionate to safeguarding the interests at stake, complies with the reporting conditions established by law, and the person meets the criteria for being a whistleblower (French Criminal Code, Article 122-9).

Disclosing a whistleblower's identity without their consent is punishable by two years of imprisonment and a fine of €15,000 (Law No. 2016-1691 of December 9, 2016, Article 9).

Anyone who obstructs the submission of a report in any way is liable to one year of imprisonment and a fine of €15,000 (Law No. 2016-1691 of December 9, 2016, Article 13(I)).

9. Notification of a Person Named in a Report

The person responsible for processing the report informs anyone named in it:

• of the allegations against them so that they can exercise their right to a defense;
• how they can exercise their rights to access and correct their personal data.

This notification is provided in a manner that ensures it is properly delivered to the person concerned. It contains no information about the identity of the person making the report or any third parties. The notification must be provided within a reasonable period not exceeding one month.

However, notification may be delayed if it could seriously compromise the investigation, particularly where there is a risk that evidence may be destroyed.

10. Distribution of the Procedure

This procedure is available on the CLAREO website.

Signed in Paris on June 25, 2025

Vincent FOURNIER, Managing Director