METALOR GRIEVANCE LINE /
DATA PRIVACY NOTICE

Please read carefully this Data Privacy Notice for the Metalor Grievance Line prior to reporting a concern or asking a question. Once you have read and understood it please check the box below, you will then be able to submit a report or a question on the Grievance Line. If you do not check the box below, you will not be able to submit a report or a question.

The Grievance Line is provided by Metalor as part of the Compliance program of the Metalor Group. The webpages through which you may report an incident or ask a question, as well as the email send to us in which the personal data and information that you report, are stored confidentially for this purpose only.

The use of the Grievance Line is voluntary.

You can report incidents regarding business integrity (bribery and corruption; conflict of interest; falsification of documents; manipulation of accounting or auditing; theft, fraud or embezzlement); human rights and labour conditions (child labour; foced labour; human trafficking; health and safety) and environment (pollution – land, air and water; waste), or any other concern related to any alleged illegal or unethical activity or behavior by the company or its employees. We encourage you to identify yourself to allow for a more productive and efficient investigation. Please be assured that the information provided by you will be treated confidentially.

If you report an incident or ask a question through the Grievance Line we process the following personal data and information:

• your name, contact details and position (provided the report is not anonymous);
• whether you are employed by Metalor;
• the name, contact details and position of the involved individuals;
• a description of the incident as well as a description of the circumstances of the incident, including time and place of the incident, and the affected Metalor entity;
• the investigation results;
• the follow-up after the investigation.

For handling your report, your personal data and information will be processed to respect Metalor ’s legal obligations and to meet Metalor ’s legitimate interest to comply with international standards regarding ethics and compliance.

Once Metalor is aware of your report or question, a confirmation of receipt will be sent to you. A first assessment is conducted to verify that the information you provided is sufficient and relevant enough to handle your report. This assessment will be conducted as soon as possible, and you will be informed of the admissibility of your report, maximum within thirty days from receipt of your report.

If the assessment reveals that your report does not have grounds enough to be investigated , your personal data will be deleted or archived after being anonymized. Conversely, if your report is admissible an investigation will be conducted by the authorized Metalor staff.

To this purpose, your personal data and information may be accessed, processed and used by Metalor Compliance Officers, Compliance committee members, , and/or by the IT department, always on a strict need to know basis only.

Metalor being a global group, personal data may be processed outside of your country of residence from a Metalor location, including outside of the European Union in countries which do not have the same standards for the protection of personal data. However, Metalor ensures that personal data are granted a high level of protection wherever it is processed in the world through its Binding Corporate Rules which apply across the Group. You may access Metalor Data Privacy Policy at: https://metalor.com/wp-content/uploads/2020/08/Metalor-DataPrivacy-Policy.pdf

If necessary, personal data and information may be disclosed to the police and/or other enforcement or regulatory authorities.

Please note that any person you identify through the Grievance Line may be notified in due time that a report has been filed. Your identity will not be disclosed.

According to the applicable Data Privacy regulations, we will inform these individuals about:

• the allegation(s) against them;
• how they can exercise any applicable rights to access and correct personal data and information. If providing these individuals with certain information will constitute a breach of the rights of others, they will not receive this information unless we are legally obliged to provide it.

The personal data you provide will not be kept longer than necessary to process your report (including any investigations by the competent department), and, if applicable to initiate sanctions or proceedings and for addressing of the statute of limitations. If your report does not lead to disciplinary measures, corrective actions or proceedings, personal data will be deleted or archived after being anonymized, within two months from the termination of the investigations. Conversely, if your report leads to disciplinary measures, corrective actions or proceedings, personal data will be kept until the termination of the proceedings, the termination of the disciplinary procedure or the implementation of the corrective actions.

As a data subject, you may exercise your right to access, correct or remove your personal data. Furthermore, you can request the restriction of the processing where it is legally authorized. To this end, please contact our Group Compliance, at Metalorgroup.legal@metalor.com

An individual using the Grievance Line in good faith will suffer no adverse consequences for the reporting of an alleged illegal or unethical conduct even if it later turns out to be incorrect.

Please be aware that the information you provide may result in decision that can have significant impact on other individuals, therefore Metalor reserves its right of action against anyone misusing the Grievance Line.

To download the Grievance Report, please confirm that you have read and understood this policy.