Ethics & Compliance

These proposed values translate Proline’s focus on reliable technology and responsible innovation into everyday conduct. They apply to commercial decisions as much as to engineering and service delivery.

Integrity

Tell the truth, keep accurate records and honour commitments. Raise concerns when a request would compromise ethical standards, even when a business opportunity is at stake.

Respect and Fairness

Treat people with dignity. Make employment and business decisions on relevant, objective grounds. Consider how our technology affects the people who use it and those whose data it processes.

Responsibility and Trust

Take ownership of decisions and their consequences. Protect confidential information and use resources carefully. Explain limitations honestly and correct mistakes promptly.

Responsible Innovation

Build security and privacy into our work. Test assumptions, assess foreseeable harm and improve products with evidence. Seek human oversight where technology can significantly affect people.

Values in Practice

A result is only acceptable when the way we achieve it is acceptable. Escalating a concern early is part of doing the job well.

Everyone contributes to an ethical workplace. Seniority does not create an exception, and an instruction from a manager does not remove personal responsibility.

Everyone Working for Proline

Understand the Code and the rules relevant to your role. Complete assigned training. Ask for guidance before taking a doubtful action, disclose conflicts and report suspected misconduct in good faith.

Managers and Project Leaders

Set realistic expectations and model the conduct you require. Make it safe to raise concerns. Respond promptly, protect confidentiality and refer issues to an appropriate, impartial decision-maker.

People Who Select or Manage Partners

Communicate ethical expectations before work begins. Check that the partner is suitable for the assignment. Monitor concerns during delivery and act on warning signs instead of relying only on contract wording.

In Practice

A manager asks you to bypass a required approval to meet a deadline. Explain the concern, keep a factual record and seek guidance through another appropriate manager if necessary. Do not bypass the control.

When a situation feels uncertain, pause before making a commitment. A short check can prevent harm to people, customers and the company.

01 Is It Lawful and Authorised?

Check the laws, contract terms and approvals that apply. Do not assume that a common local practice or a customer request makes an action acceptable.

02 Is It Fair and Consistent with Our Values?

Consider the effect on colleagues, individuals whose data we handle and business partners. Ask whether personal interests or commercial pressure are affecting your judgement.

03 Can the Decision Withstand Scrutiny?

Could you explain the facts and your reasoning openly to an independent reviewer? Keep enough information to show why you made the decision.

04 Have Concerns Been Resolved?

If any answer is no or uncertain, stop the affected activity and seek guidance. Resume only when the concern has been assessed and any required approval obtained.

A Useful Rule

Do not rely on silence as approval. For a sensitive decision, explain the issue clearly and obtain an explicit response from the person authorised to decide.

Raise a concern when you reasonably suspect misconduct or need advice. You do not need to prove a violation before reporting it in good faith.

Where to Start

Employees should approach their manager or Human Resources. If that route is unsuitable, contact another senior manager who is not involved. External partners should ask their Proline contact to arrange an appropriate senior contact, without sending sensitive case details to a general inbox.

What to Report

Describe what happened, when it happened and who may have relevant information. Preserve records you can lawfully access. Do not investigate secretly, access unauthorised systems or collect unnecessary personal data.

Protection and Confidentiality

The proposed Code prohibits retaliation against anyone who raises a concern honestly or cooperates with a review. Share information only with those who need it. Confidentiality will be protected as far as possible, but absolute secrecy cannot be promised.

If Your Manager Is Involved

Use another reporting route. Report any threat, exclusion or adverse treatment linked to speaking up. Nothing in this Code restricts lawful reporting to competent authorities.

Reporting roles must be confirmed before adoption. This draft does not establish an anonymous hotline.

A respectful workplace supports better judgement and better work. Our conduct must respect the dignity and rights of employees, partners and people affected by our operations.

Equal Treatment

Base recruitment, development and promotion on relevant qualifications and performance. Do not discriminate on grounds protected by applicable law. Support reasonable accessibility and accommodation needs.

A Workplace Free from Harassment

Do not tolerate bullying, sexual harassment, threats or degrading behaviour, including in online meetings and messages. A joke or a claimed lack of intent does not excuse harmful conduct.

Fair Working Conditions

Reject forced labour, child labour and human trafficking. Respect lawful rights to freedom of association and collective bargaining. Observe applicable rules on wages, working time and rest. Raise concerns about labour practices in the supply chain.

In Practice

A colleague repeatedly makes humiliating comments in a project chat. If safe, ask for the behaviour to stop and preserve the relevant messages. Raise the issue through an appropriate reporting route.

Work should not place people at avoidable risk. We also have a responsibility to reduce the environmental impact of our offices, products and project activities.

Safe Work and Safe Sites

Follow site requirements, training and equipment instructions. Stop work when an immediate serious risk exists and alert the responsible manager. Report incidents and near misses promptly so that causes can be addressed.

Responsible Use of Resources

Avoid unnecessary energy use, travel and material waste. Consider durability, repairability and resource efficiency when selecting equipment or designing a solution.

Responsible Disposal

Use approved routes for electronic equipment, batteries and other regulated waste. Remove data securely before reuse or disposal. Make environmental claims only when reliable evidence supports them.

In Practice

A customer asks a technician to continue an unsafe installation. Pause the work, explain the risk and agree a safe method with the site lead and Proline manager before restarting.

Do not offer, promise, give, request or accept anything of value to improperly influence a decision. This standard applies in both public and private business, directly or through another person.

No Improper Advantage

Never use cash, employment offers, personal favours, donations or commissions to secure an improper benefit. Do not make unofficial facilitation payments to speed up routine official action.

Care with Intermediaries

Understand what an agent or consultant will do and why the fee is reasonable. Require a clear scope and evidence of legitimate services. Escalate unusual commissions, vague invoices or requests to pay an unrelated party.

Public Officials and Tender Activity

Apply particular care to dealings with officials and public entities. Obtain appropriate review before offering any benefit. A local custom or a partner’s assurance does not replace due diligence.

In Practice

An agent asks for a success fee to an offshore account and says it will help secure an identity project. Pause the payment and proposal. Escalate the request for independent review and document the facts.

If an immediate threat to personal safety forces a payment, prioritise safety and report and record the event as soon as safe.

Business courtesies must serve a legitimate purpose and must not create an obligation, influence a decision or give the appearance of improper influence.

Acceptable Only with Care

Any gift, meal, travel or entertainment must be lawful, reasonable, occasional and transparent. Follow applicable approval requirements and the recipient’s rules. Record the business purpose and actual value accurately.

Offers to Decline

Do not solicit gifts or accept cash or cash equivalents. Decline lavish entertainment, personal holidays and courtesies linked to a favourable decision. Avoid gifts or hospitality during sensitive procurement or tender decisions.

When Approval Is Unclear

Seek written guidance before making or accepting the offer. Benefits involving public officials require particular scrutiny. Do not split a gift or expense to evade an approval threshold.

In Practice

A supplier offers premium event tickets while you evaluate its bid. Decline politely and disclose the offer. An ordinary business relationship does not remove the risk of influence.

No monetary threshold is set in this draft. Proline should confirm approval roles and any limits before adoption.

A conflict can arise when a personal interest affects, or appears to affect, a business judgement. Prompt disclosure allows the situation to be managed fairly.

Recognising a Conflict

Examples include selecting a relative’s company, supervising a close personal relation, holding a significant interest in a supplier or taking outside work that competes with Proline.

Disclosure Before Action

Tell your manager or Human Resources about an actual, potential or perceived conflict before participating in the decision. Provide relevant facts and update the disclosure if circumstances change.

Independent Decisions

Do not approve your own conflict or manage it informally. Step aside from affected decisions until an authorised, impartial person has assessed the situation and recorded any safeguards.

In Practice

Your sibling’s business bids for a service contract. Disclose the relationship before reviewing proposals and withdraw from the selection process. A competitive price does not eliminate the conflict.

Win business through the quality of our products, service and proposals. Deal honestly with customers, suppliers and competitors and respect applicable competition rules.

Independent Commercial Decisions

Never agree with competitors to fix prices, coordinate bids, divide customers or markets, or restrict supply. Do not exchange non-public pricing, margins, strategy or future bidding intentions.

Lawful Market Intelligence

Use legitimate public sources and properly authorised information. Do not misrepresent your identity, encourage a breach of confidentiality or seek a competitor’s confidential documents from a new employee.

Fair Procurement

Use objective criteria and protect tender information. Do not tailor a process to benefit a favoured bidder or disclose one bidder’s confidential proposal to another. Seek advice before accepting unusual boycott-related requests.

In Practice

At an industry meeting, a competitor suggests agreeing who will bid for a public contract. Object clearly, leave the discussion and promptly report what happened. Make a factual record of your response.

International projects can involve different laws, restrictions and business practices. Check the transaction and the people involved before committing company resources.

Trade Controls and Sanctions

Assess applicable restrictions on products, software, technical data and services. Verify the destination, end user and intended use. Obtain any required authorisation before shipment, remote access or technology transfer.

Suitable Business Partners

Use due diligence proportionate to the risk. Understand ownership, qualifications and the commercial purpose. Include appropriate ethical expectations in contracts and monitor material changes during the relationship.

Payments and Warning Signs

Use accurate invoices and verified payment details. Escalate unexplained third-party payments, cash requests, concealed ownership or attempts to reroute a restricted transaction. Do not proceed until material concerns are resolved.

In Practice

A distributor changes the destination after an order is approved. Pause fulfilment and reassess the end user, destination and permissions. An earlier check does not automatically cover a different transaction.

Identity and biometric data require particular care. Handle personal data only for a defined, lawful purpose and protect the people to whom the data relates.

Purpose and Minimum Data

Confirm the relevant legal basis and responsibilities before collection or use. Provide required information to individuals. Limit collection and access to what the task needs and avoid unnecessary copies.

Use, Sharing and Retention

Use data only for authorised purposes. Check applicable requirements before sharing it with a supplier or moving it across borders. Follow justified retention periods and delete or return data securely when the purpose ends, unless lawful preservation is required.

Requests and Incidents

Refer rights requests and suspected breaches promptly to the responsible internal contact. Preserve relevant facts. Do not make external notifications or promises unless authorised, except where law requires otherwise.

In Practice

An engineer wants to copy live customer biometric records into a demonstration. Use synthetic data or an appropriately approved test dataset. Customer access alone does not authorise a new use of personal data.

Protect the confidentiality, integrity and availability of company and customer information throughout its lifecycle. Security is part of every role, including work away from the office.

Secure Access and Handling

Use approved systems and only the access your role needs. Protect credentials, use required authentication controls and follow secure transfer rules. Do not share accounts or move sensitive files to personal storage.

Protection of Sensitive Material

Safeguard source code, keys, credentials and customer configurations. Secure devices and physical workspaces. Share confidential material only with authorised recipients for a legitimate purpose, including after employment ends.

A Prompt Response

Report lost devices, suspicious messages, unexpected access and suspected data exposure immediately through the available internal support or management route. Follow containment instructions and preserve evidence. Do not conceal a mistake.

In Practice

You send a confidential file to the wrong recipient. Report it immediately with the time, file and recipient details. Do not wait to see whether the recipient responds before seeking help.

Technology that recognises or verifies people can affect access to services and individual rights. Consider its purpose, performance and foreseeable consequences before deployment.

Appropriate Purpose and Safeguards

Assess whether the proposed use is lawful, necessary and proportionate. Examine foreseeable misuse and potential harm. Escalate requests that could enable unlawful surveillance, discriminatory treatment or other rights abuses.

Evidence and Human Oversight

Test performance in relevant conditions and consider differences across user groups. Explain limitations and error risks accurately. Provide suitable human review and routes for resolving errors where a decision can significantly affect someone.

Responsible Development Tools

Use approved AI tools and authorised datasets. Do not upload confidential code, biometric data or customer information to unapproved services. Review generated outputs for accuracy, security, rights and licensing issues before use.

In Practice

A proposed deployment has no workable process for people the system fails to recognise. Raise the access and fairness risks before acceptance. Agree suitable alternatives and oversight with the responsible project team.

Customers depend on accurate claims and reliable delivery. Preserve the integrity of our engineering work and respect the intellectual property behind it.

Honest Product Claims

Describe capabilities, limitations and compatibility accurately. Refer to certifications or compliance only where current evidence supports the specific product and scope. Never alter test results or hide a material defect.

Controlled Delivery

Follow agreed requirements and release controls. Document tests and changes so that others can review them. Raise safety, security or quality concerns before acceptance and communicate material issues through authorised channels.

Respect for Ownership and Licences

Protect Proline’s work and respect third-party rights. Check permissions for software, open-source components, images and documentation. Do not bring a former employer’s confidential material into a project.

In Practice

A bid deadline arrives before a performance test finishes. State the verified result and the remaining limitation accurately. Do not present an expected outcome as a completed test.

Reliable records support sound decisions and accountability. Use company resources for legitimate purposes and protect them from theft, misuse and avoidable loss.

Complete and Accurate Records

Record transactions, expenses, working time and project progress honestly. Do not create false invoices, undisclosed funds or misleading acceptance records. Retain records according to applicable requirements and authorised schedules.

Protection and Preservation

Safeguard equipment, money and information. Follow purchasing and payment controls. Preserve records relevant to a dispute, audit or investigation, even when routine deletion would otherwise apply.

Inside Information

Do not trade securities, recommend trading or tip another person on the basis of material non-public information about Proline-related businesses, customers or partners. Seek guidance before acting where the status of information is uncertain.

In Practice

A colleague asks you to date a customer acceptance record earlier to bring revenue into the current period. Refuse and report the request. The record must reflect what actually happened.

Communicate accurately and protect confidential information. The way we speak about our work should be consistent with the way we perform it.

Authorised Public Statements

Only authorised people may speak on behalf of Proline. Refer media, investor and sensitive customer enquiries to the appropriate company representative. Obtain permission before publishing customer names, project details or images.

Responsible Social Media

Make clear when you express a personal view. Do not disclose non-public information or imply company endorsement without authority. Treat people respectfully and correct material errors through the proper channels.

Community and Political Activity

Keep personal political activity separate from company work and resources. Obtain proper approval for donations and sponsorships and check the recipient and purpose. Never use a contribution to influence a business or official decision improperly.

In Practice

You want to post a photo from a customer’s secure facility. Check the customer’s permission and internal approval first. Screens, access badges and equipment in the background may reveal sensitive information.

Consistent application makes this Code meaningful. The governance arrangements below are proposed and require confirmation as part of formal adoption.

Fair Review of Concerns

Assign concerns to a qualified person without a conflict of interest. Assess the facts promptly and fairly, protect relevant records and limit access to those who need it. Cooperate honestly and respect the privacy of everyone involved.

Response to Misconduct

Take proportionate corrective or disciplinary action under applicable law and company procedures. Depending on the facts, this may include training, control changes or termination of employment or a business relationship. Do not prejudge allegations.

Ownership and Review

The approving authority should appoint a Code owner, confirm reporting and escalation routes and communicate the effective version. Review the Code periodically and when risks change. Record authorised amendments or exceptions. No exception may permit unlawful conduct.

Acknowledgement

On adoption, employees should confirm that they have read and understood the Code, know how to seek guidance and will follow it. An acknowledgement does not replace training or access to advice.

Bribery and Improper Benefit

The direct or indirect offering, promising, giving, requesting, or accepting of money or any other benefit for the purpose of influencing a duty or decision or obtaining an unfair advantage.

This definition determines the scope of this Procedure. The classification of any act under criminal law shall be assessed separately.

Corruption

The misuse of entrusted duties, authority, information, or resources to obtain an improper benefit for oneself or others.

Benefits include discounts, loans, free services, employment or internship opportunities, donations, travel, entertainment, and advantages provided to relatives or other closely associated persons.

Public Official

Individuals participating in public activities in Türkiye or foreign countries, as well as officials of international public organizations.

For the purposes of the precautionary control approach adopted under this Procedure, relevant representatives of publicly controlled organizations shall also be subject to the same review.

This broader internal control scope does not mean that all such individuals are legally classified as public officials under criminal law.

In cases of uncertainty, the Legal Department shall assess the individual’s status.

Gifts and Hospitality

Products, services, refreshments, meals, event tickets, transportation, accommodation, and similar benefits provided or received without full payment of their value.

Complimentary licenses for Company products, personal usage rights, and discounts outside normal commercial conditions are also included within this definition.

Conflict of Interest

A situation in which personal, family, financial, or other relationships actually influence, could influence, or could reasonably appear to an external observer to influence impartial decision-making on behalf of the Company.

A closely associated person includes a spouse, partner, relative, or another person with whom a relationship involving personal or financial interests exists.

Facilitation Payment

A payment requested to perform or expedite a routine action that should ordinarily be carried out, without an official tariff or legal basis.

A properly established, publicly available, and documented official expedited service fee is distinct from a facilitation payment.

3.1. Employees must explain the purpose of a transaction, the counterparty involved, the amount, and any associated risks, and obtain the necessary approval before proceeding.

The “Relevant Manager” is the manager to whom the employee reports and who has approval authority over the relevant budget or transaction.

If the manager does not have the necessary authority, the request shall be forwarded to a higher-level authorized manager.

Existing signature and expenditure authorization rules shall continue to apply.

3.2. Ordinary decisions concerning gifts, hospitality, and business relationships fall under the responsibility of the Relevant Manager.

The manager must verify the business justification, budget, applicable limits, and the existence of any conflict of interest.

Transactions exceeding established limits and special circumstances specified in this Procedure require the written approval of the General Manager.

Approval provided by email or through the corporate approval system is sufficient. Transactions may not proceed solely on the basis of verbal approval.

3.3. The Legal Department is an independent advisory and legal assessment function. It is not responsible for approving or recording routine expenditures.

The Legal Department provides opinions on special transactions involving public officials, the management of conflicts of interest, suspected bribery, and legal uncertainties.

Responsibility for commercial decisions and their implementation remains with the authorized manager.

Transactions identified by the Legal Department as unlawful must not proceed. Where a risk can be remedied, the transaction may proceed only after the specified conditions have been fulfilled.

3.4. The Finance Department is responsible for verifying expenditure documentation, approvals, and compliance with applicable limits.

Human Resources is responsible for communicating the Procedure to employees, providing relevant information, and administering necessary disciplinary processes.

No person may approve a transaction involving themselves or a closely associated person.

In such circumstances, the decision shall be made by a higher-level manager who has no conflict of interest.

Matters involving the General Manager shall be referred to members of the Board of Directors who have no conflict of interest.

4.1. No benefit may be offered, provided, requested, or accepted for the purpose of improperly influencing a public official or private sector representative, obtaining or retaining business, altering the outcome of an inspection, or obtaining an unauthorized payment or advantage.

Indirect benefits provided to relatives or designated third parties are also prohibited.

4.2. Secret commissions, kickbacks, fictitious consultancy fees, success-based payments disproportionate to actual services, false invoices, off-the-books funds, and personal donations linked to securing business are prohibited.

Payments must not be made for services that were not performed or products that were not delivered.

4.3. Facilitation payments are prohibited.

If such a payment is requested, the employee must not make the payment. The employee must ask for the official basis of the request and the authorized institutional payment channel, safely document the incident, and immediately inform the Legal Department.

In the event of an imminent and serious threat to personal safety, protecting the individual’s safety shall take priority.

Any payment made under coercion must be reported and accurately recorded at the earliest safe opportunity.

This provision does not constitute prior authorization to make such payments.

5.1. Communications with public institutions shall be conducted by authorized employees for legitimate business purposes and, wherever possible, through official corporate channels.

5.2. Personal gifts must not be provided to public officials or their relatives.

Personal travel, holidays, entertainment, or other private expenses of public officials and their relatives must not be covered.

The monetary limits established for private sector relationships do not apply to public officials.

New Year celebrations, religious or national holidays, changes in official positions, or expressions of appreciation do not create exceptions to this prohibition.

5.3. Ordinary refreshments such as tea, coffee, and water may be provided during official meetings, provided that they comply with the institution’s rules, are offered equally to all participants, and are not intended to influence a decision.

Other business meals, technical visits, training activities, travel, or accommodation may be considered only after reviewing the institution’s written assignment or acceptance, the specific business justification, and applicable legislation, and obtaining a favorable opinion from the Legal Department and/or prior written approval from the General Manager.

Acceptance by the public institution alone does not establish legal compliance.

5.4. The program of an authorized technical visit must be limited to legitimate business activities.

Expenses relating to relatives, tourism extensions, and luxury expenditures must not be covered.

Whenever possible, payments shall be made directly to the service provider.

Cash, personal allowances, or undocumented payments must not be provided to individuals.

Discretionary meals and hospitality must not be offered during tender, permit, inspection, acceptance, or payment stages where a decision in favor of the Company is pending.

Expenses relating to contractual technical acceptance or mandatory visits must be separately documented and reviewed in accordance with Section 6.3.

5.5. During tender or procurement processes, employees must not request confidential bids, competitor pricing, evaluation notes, or privileged information from public officials.

Contacts intended to influence technical specifications or tender outcomes through personal benefits are prohibited.

Requests for employment or internship opportunities must be assessed on merit through the ordinary Human Resources process and must not be granted in exchange for a public decision.

5.6. Donations to public institutions, complimentary trial products, and demonstration licenses must not be allocated for personal use.

The institution’s acceptance, purpose, duration, inventory or license records, and return conditions must be documented.

Donations are additionally subject to the approval requirements set out in Section 9.

6.1. Gifts and hospitality provided or received in private sector relationships must be business-related, reasonable, infrequent, and capable of transparent documentation.

No reciprocal benefit may be expected, impartial decision-making must not be compromised, and the counterparty’s rules must be respected.

Cash, gold, cryptocurrencies, gift cards, personal loans, and personal discounts outside ordinary commercial conditions are prohibited.

6.2. Gifts and discretionary hospitality must not be exchanged between relevant parties during periods when they could influence a decision, including tender processes, bid evaluations, supplier selection, negotiations, contract renewals, or disputes.

If a business partner does not attend an event, a ticket provided to that partner shall be considered a gift rather than hospitality.

The use of personal funds by an employee or the arrangement of a transaction through another person does not alter these rules.

Managerial Approval Limits

• Gift – per person, per occasion TRY 2,500
• Gift – annual total for the same external individual TRY 7,500
• Business meal or hospitality – per person, per event TRY 2,500
• Business meal or hospitality – total cost per event TRY 20,000
• Hospitality – annual total for the same external individual TRY 15,000

6.3. These amounts are proposed approval thresholds for internal Company controls and shall apply upon adoption of this Procedure.

They do not constitute statutory exemptions or automatic spending entitlements.

A prohibited transaction may not be carried out even if its value falls within the specified limits.

7.1. The amounts stated in the table include VAT, service charges, and other incidental expenses.

For gifts received, a reasonable market value shall be used.

Annual limits relating to the same external individual shall be monitored separately for gifts and hospitality provided and received, taking into account all Company employees.

Changes in employees or departments during the year do not reset the annual totals.

A gift sent to an organization for shared use shall be treated as a single gift, and the annual gift threshold shall apply to that organization.

7.2. The per-person cost of hospitality shall be calculated by dividing the total expenditure by the number of participants.

The per-person limit, total event limit, and relevant annual limit must all be verified.

Amounts denominated in foreign currencies shall be converted using the foreign exchange selling rate published by the Central Bank of the Republic of Türkiye (CBRT) on the approval date.

The actual expenditure must also be recorded.

Where no applicable exchange rate is available, a reference rate documented by the Finance Department shall be used.

7.3. Where a transaction falls within all applicable thresholds, prior written approval from the Relevant Manager is sufficient.

If any threshold is exceeded, prior written approval from the General Manager must be obtained, with an explanation of the business justification and total amount.

A legal opinion is not routinely required solely because of the value of a transaction.

However, the Legal Department must also be consulted where there is a connection to public officials, a conflict of interest, a risk of influencing a decision, or another legal concern.

No exceptions may be granted to prohibited activities.

7.4. Travel and accommodation provided to private sector business partners require the General Manager’s prior written approval, regardless of the amount.

A business itinerary and itemized expense statement must be available.

Personal holidays, accompanying persons, and luxury expenses must not be covered.

Business travel undertaken by Company employees in the performance of their duties remains subject to the applicable travel procedure.

7.5. Approval requests must identify the individual and organization involved, business purpose, date, estimated cost, participants, and any ongoing decision-making process.

Within five business days after the transaction, the actual amount and supporting documents must be submitted to the Finance Department.

The Finance Department shall maintain a centralized gifts and hospitality register based on information provided by the relevant departments.

Managers must verify annual totals before granting approval.

Benefits received free of charge and offers that have been declined must also be recorded.

7.6. An unsolicited gift must be reported to the Relevant Manager within two business days and must not be used until a decision has been made.

The Relevant Manager shall evaluate whether an acceptable gift may be retained.

Gifts exceeding the established limits shall be evaluated by the General Manager.

Inappropriate gifts must be returned with an explanation.

If returning a gift is not possible, the Relevant Manager shall determine a method that does not provide personal benefit, subject to the General Manager’s approval.

Where prohibited benefits or legal uncertainties are involved, the Legal Department must be consulted.

Subsequent disclosure does not automatically remedy a violation.

7.7. Transactions must not be divided into smaller amounts to remain below approval thresholds.

Repeated practices, such as regularly providing benefits to different employees of the same counterparty, must be assessed by the manager in terms of their overall risk.

The limits shall be reviewed annually upon the recommendation of the Finance Department and with the approval of the General Manager.

Updated limits shall be communicated to employees.

Until new amounts are announced, the existing limits shall remain applicable.

8.1. A conflict of interest arises when an employee’s or closely associated person’s financial, family, or personal relationships affect, could affect, or could reasonably appear to affect impartial decision-making on behalf of the Company.

Examples include purchasing goods or services from a relative’s business, participating in the recruitment of a relative, obtaining a personal loan from a business partner, or undertaking an external position with a competitor.

8.2. Employees must disclose potential conflicts of interest in writing to their manager as soon as they become aware of them and before the relevant decision is made.

Until the assessment is completed, the employee must withdraw from selection, negotiation, approval, and payment processes related to the matter.

After consulting the Legal Department, the manager shall determine and document appropriate safeguards, such as appointing an independent decision-maker, comparing alternative offers, or changing responsibilities.

Matters involving senior management or significant financial interests shall be referred to the General Manager.

Where the General Manager is involved, the matter shall be referred to members of the Board of Directors who have no conflict of interest.

Disclosure of a conflict does not, in itself, constitute a violation. However, disclosure does not automatically authorize the transaction.

9.1. Before engaging a consultant, representative, or business partner, the relevant department must verify the party’s identity, ownership structure, the necessity of the services, and the reasonableness of the proposed compensation.

Ordinary selection and engagement decisions shall be conducted with managerial approval in accordance with the existing authorization framework.

Where risks arise, including representation before public authorities, unexplained high commissions, vaguely defined services, payments to personal accounts, or guarantees of results, the Legal Department must be consulted and the General Manager’s approval obtained.

No transaction may proceed until the concerns have been resolved.

9.2. Relevant contracts must include appropriate provisions prohibiting bribery and corruption, requiring record-keeping and violation reporting, and allowing termination where justified.

Payments must correspond to genuine services or deliveries and be supported by approvals and documentation.

False invoices, off-the-books payments, concealment of the true purpose of expenses, and commissions unrelated to genuine services are prohibited.

The Finance Department shall suspend incomplete or suspicious payments and notify the relevant manager and, where legal risks exist, the Legal Department.

9.3. For donations and sponsorships, the beneficiary, purpose, and amount must be documented.

Approval must be obtained from the General Manager and any other authorities required under the existing authorization framework.

The Legal Department must be consulted where there is a connection to a public official or a closely associated person, a request for a benefit in exchange for a decision, a conflict of interest, or legal uncertainty.

Payments must not be made to personal accounts.

No contributions shall be made on behalf of the Company to political parties, candidates, or political campaigns.

10.1. Any violation or reasonable suspicion of misconduct must be reported without delay to the Relevant Manager or directly to the Legal Department.

Managers must forward reports involving bribery, corruption, or serious legal risks to the Legal Department and non-conflicted senior management on the same day.

Where the manager is involved in the matter, that manager must be bypassed.

Reports concerning the Legal Department shall be submitted to the General Manager.

Reports concerning the General Manager shall be submitted to non-conflicted members of the Board of Directors.

Independent external legal assistance may be obtained where necessary.

10.2. Reports submitted without identifying the reporting individual shall also be assessed to the extent permitted by the available information.

Individuals who report concerns in good faith or participate in an investigation must not be subjected to pressure, threats, or retaliation.

The fact that an allegation is not substantiated does not, by itself, indicate bad faith.

Knowingly submitting false allegations or fabricating evidence shall be assessed separately.

10.3. The authorized manager shall organize an impartial investigation and any necessary interim measures, after obtaining appropriate legal advice.

An initial assessment of the report shall be completed within five business days.

Urgent matters involving personal safety or the risk of evidence being lost must be addressed without delay.

Relevant individuals shall be given an opportunity to provide explanations.

The outcome, justification, and corrective actions shall be documented.

The Legal Department shall assess any statutory reporting or notification obligations.

Internal investigations do not restrict statutory deadlines or individuals’ legal rights to submit complaints or reports.

10.4. Relevant documents must be preserved.

Information shall be shared only with individuals who need access to it for the performance of their duties.

Absolute confidentiality must not be promised.

Personal data must be processed in accordance with applicable law.

Record retention shall be governed by applicable legislation and the Company’s retention arrangements, depending on the document type.

Records relating to an investigation or dispute must not be destroyed until the applicable legal preservation obligation has ended.

11.1. Violations shall be assessed with consideration given to the nature of the incident, degree of fault, right of defense, and applicable legislation.

Where necessary, disciplinary action, termination of contracts, or legal proceedings may be considered.

An employee who causes the Company to lose business by refusing to participate in a transaction that violates these rules must not be penalized for that reason.

11.2. This Procedure shall enter into force upon approval by the General Manager.

Human Resources shall communicate the Procedure to employees, and managers shall oversee its implementation.

The monetary amounts specified in this document have been established as proposed internal Company limits and are not statutory thresholds prescribed by legislation.