Whistleblowing policy
1. General
At Foreship (Foreship Oy and other legal entities in the same of group of companies) we are committed to high level of ethics and integrity in conducting our business operations. We understand that this is crucial to our continued success and reputation. Our values, principles and policies guide our everyday business operations. We have a professional responsibility to speak up, report any possible corrupt, illegal or other undesirable conduct and take required actions after such conduct is discovered. This Foreship’s Whistleblowing Policy (Policy) is an important tool in discovering such conduct. Foreship strongly encourages you to speak up if you suspect or witness any such behavior, activities or conduct. Foreship will take all reports made under this Policy seriously.
If you make a whistleblowing report in accordance with this Policy, we have a responsibility to protect you, including not disclosing your identity and ensuring you are not subject to any retaliations.
The Policy sets out how Foreship provides you with an effective, objective, confidential and secure reporting channel, Whistleblowing Channel (Whistleblowing Channel), allowing you to openly and safely express your concerns or suspicions. On the Whistleblowing Channel you are also advised how to make a report, how you are informed on the follow-up actions and how you are protected. Foreship reviews the Policy and the Whistleblowing Channel from time to time in order to ensure their accuracy and proper and reliable functioning.
The Whistleblowing Channel is not for reporting your personal work-related grievances such as grievances that relate to your employment contract or to occupational safety and health. Other Foreship’s policies and ways to report apply to such. Accordingly, the Whistleblowing Channel is not to be used for giving general feedback to Foreship.
2. Concerns and Suspicions to be Reported
The breaches to be reported through the Whistleblowing Channel include actual or potential crimes, breaches, misconducts and other acts or omissions that are infringements of the EU-regulation specified here: [Link]. Further, the breaches to be reported through the Whistleblowing Channel cover also areas specified in the applicable national laws – in relation to Finland, the areas specified here: [link to section 2§ of the Finnish Act to be added when law is in place]. Given the business area and operations of Foreship, to Foreship’s understanding, the most relevant areas and potential issues to be reported relate to privacy and personal data, security of network and information systems and competition rules. All infringements to be reported under the applicable legislation are later referred to as Breach(es).
When you have information or reasonable suspicion about actual or potential Breach and such Breach has occurred or is very likely to occur in Foreship or about an attempt to conceal such Breach, kindly report this through the Whistleblowing Channel. Through the Whistleblowing Channel you can also request a separate meeting where you can provide information on such Breach.
If you are uncertain, you can also send first question through the Whistleblowing Channel to ask whether or not the type of information you intend to disclose falls within the scope of the regulation and can be disclosed through the Whistleblowing Channel. In such case kindly remember to provide at least your email address (options 4. (a) or (b) below) in connection with the filing so that the person handling your request is able to answer to you through the Whistleblowing Channel.
The Whistleblowing Channel is available to you 24/7. The questions presented in the Whistleblowing Channel in connection with filing of your report will guide you to give information that is necessary for investigating and handling your report. Kindly answer to all questions as accurately as possible.
3. Eligible Whistleblower
Persons who are eligible to act as a whistleblower and file a report concerning Foreship include all persons who by virtue of their work-related activities, irrespective of the nature of such activities and of whether they are paid or not, have access to information on Breaches, including but without limitation, Foreship’s all current and former partners, directors, officers, freelancers, employees, secondees, contractors, suppliers (or their employees or subcontractors), agency workers, job applicants, volunteers and trainees as well as shareholders (who have an active role within Foreship) and persons belonging to the administrative, management or supervisory body of an undertaking, including non-executive members.
Your right to report on the Breaches is unlimited and cannot be, for instance, restricted or waived by any agreement, policy or form or conditions of your employment.
4. Anonymity
You can file a report on suspected Breach and its potential perpetrator anonymously through our Whistleblowing Channel. All reports coming through the Whistleblowing Channel are confidential meaning that Foreship has the obligation to protect and keep your identity and the identity of any third party possibly mentioned in your report confidential.
Alternatives for Anonymity
On the Whistleblowing Channel you have the possibility to choose the level of anonymity of your report from the following three alternatives (a) - (c).
(a) Providing email address allowing communication through the Whistleblowing Channel
The Whistleblowing Channel proposes by default that you should enter your email address so that you may be contacted in relation to your report. Your email address is needed to send a confirmation of receipt of your report to you, to request further information from you, to send feedback concerning the follow-up actions envisaged or taken by Foreship to you and to inform you of the grounds for the choice of those follow-up actions. In all of these cases your email address is only used by the technical platform of the Whistleblowing Channel. Foreship and the ones authorized to receive and handle your report do not see or receive information on your email address. Your email address is deleted from the technical platform of the Whistleblowing Channel permanently after the handling of your report in the Whistleblowing Channel is closed. This normally takes a maximum of three months.
(b) Disclosure of your identity
When you provide your name/identity in addition to your email address in the Whistleblowing Channel, only the ones authorized to receive and handle your report will receive this information. The ones authorized to receive and handle your report, are obliged to keep your name and identity confidential unless you give an explicit consent to reveal your name and identity. In this case information on your name and identity and your email address are also deleted from the technical platform of the Whistleblowing Channel permanently after the handling of your report in the Whistleblowing Channel is concluded.
(c) Full anonymity
You may also leave a report in the Whistleblowing Channel without disclosing your name/identity and providing your email address at all. In this case the person(s) authorized to receive and handle the report will not be able to contact and communicate with you at all through the Whistleblowing Channel (or otherwise). If you choose not to disclose your name and identity and provide email address to the person(s) authorized to receive and handle the report, this may prevent the handling of your report and performing follow-up actions as effectively as Foreship would like to. Correspondingly, this may prevent ensuring that there exists no conflict of interest between you and the chosen representatives specified in section 7 below.
5. Offered Protection
In case you have reasonable grounds to believe, in light of the circumstances and the information available to you at the time of reporting, that the matters reported by you are true and fall in within the scope of Breaches, you will be given protection against retaliation i.e. any negative consequences or threats and attempts of retaliation due to your report.
In order to receive protection, you shall primarily use our Whistleblowing Channel to file your report. Further, if you are employed by Foreship, please note, in order to comply with your statutory duty of loyalty towards your employer under the law, you should primarily use our Whistleblowing Channel to file the reports.
However, you do not need to use our Whistleblowing Channel in order to receive protection, if you have reasonable grounds to believe that:
- our Whistleblowing Channel and handling of reports are not credible wherefore there may be retaliation against you e.g. due to breach of confidentiality;
- the Breach or related evidence could be destroyed when using our Whistleblowing Channel; or
- the Breach requires urgent actions to safeguard e.g. the life, health or safety of persons or to protect the environment.
In such situations you are entitled to file your report also through the public channel (in Finland to the Chancellor of Justice) and still receive protection. When using the public channel, you cannot file your report anonymously.
In practice the protection provided to you includes:
- identity protection;
- protection from retaliation;
- possible compensation and remedies e.g. due to retaliation; and
- civil, criminal and administrative liability protection.
Please note that you do not need to prove your suspicions or allegations correct. If you have had reasonable grounds to believe that the matters reported by you are true and fall in within the scope of Breaches, you are entitled to protection even if your disclosure later turns out to be incorrect. Please note that a mere allegation or a hear say with no supporting information is unlikely to meet the required standard of reasonable grounds.
Filing a knowingly false report is a breach of whistleblowing legislation and our Principles of Business Conduct and may result in disciplinary action. There may also be other legal consequences if you make a knowingly false report.
In addition to protection provided to the whistleblower, Foreship provides protection also to person(s) who are suspected of having committed the Breach. Such protection includes, for instance, that such person(s) is treated in equal and non-discriminating manner and the consequences of the Breach are based on Foreship’s policies and the applicable laws. Such person(s) is also granted a possibility to review and comment the alleged Breach and the relevant material.
6. Receiving and Initial Handling of Report
Our Whistleblowing Channel is designed, established and operated in a secure manner that ensures confidentiality of your identity and any third party possibly mentioned in your report. Access to your report is prevented from persons who are not authorized to receive and handle the reports.
In order to create a credible channel for filing whistleblowing reports, to ensure objectivity of handling of reports and to avoid the possibility that the report would be handled by a person somehow connected to the reported Breach, Foreship has chosen to use the following third-party service providers to provide and maintain the Whistleblowing Channel:
(a) Lantero AB, a reputable provider of whistleblower systems; and
(b) HH Partners Attorneys-at-law Ltd. acting as initial handler of the whistleblowing reports
(jointly Service Provider).
Due to this chosen third party service provider arrangement the persons who are authorized to receive and perform the initial handling of your report are impartial, independent and professional.
All whistleblowers who have allowed communication through the Whistleblowing Channel will receive confirmation of receipt of their reports as soon as their reports have been received and at the latest within seven (7) days of delivery of their reports.
The persons authorized to receive and handle the reports may also request further information from whistleblowers who have allowed communication through the Whistleblowing Channel. You as whistleblower are not obliged to provide further information, however, this would be highly appreciated.
Again, whistleblowers who have allowed communication through the Whistleblowing Channel will receive feedback concerning their reports within three (3) months from the confirmation of receipt (please see section 6). Feedback means information on the follow-up actions envisaged or taken by Foreship and the grounds for the choice of those follow-up actions. Please note that Foreship may be unable to disclose details in its feedback, especially due to possibly applicable mandatory legal requirements.
7. Internal Handling of Report
After your report has been initially received and handled by the Service Provider, the Service Provider may further report the case to at least one of the chosen representatives of Foreship. The report will be made by maintaining confidentiality. The chosen representatives are:
- Chairman of the Board and/or Members of the Board of Foreship Group
- CEO Foreship Group
- General Manager Foreship OÜ
- CEO US Operations
Since this Policy and Whistleblowing Channel cover - in addition to Foreship Oy - all legal entities in the Foreship group of companies, in case the reported case involves a specific subsidiary or parent company, the Service Provider will take this into consideration when choosing the correct person and, for instance, will report the case also to representative, such as managing director or board member, of such legal entity.
The Service Provider will make the decision whether the report is further investigated and to whom such report is then delivered with the objective that there cannot exist any conflict of interest between the chosen representative of Foreship, you and the person(s) mentioned in your report or related the possible Breaches mentioned in your report.
The chosen representative(s) of Foreship will decide on the required further investigations and actions to be taken by Foreship. All such investigations and possible follow-up actions will be performed diligently and by preserving confidentiality. Foreship will report all potential crimes to the police.
8. Data Protection
Data protection legislation is applied in relation to our Whistleblowing Channel.
The collected data depends on the information you have chosen to provide in connection with filing of your report. The collected data can be divided to content data, system data, your name and email address. The content data includes the content of your report and timing of your report, excluding your name and email address. The system data includes technical logs on the usage of the Whistleblowing Channel, excluding your name and email address.
Data is handled for the purposes of managing the Whistleblowing Channel, processing reports and proving fulfilment of legal requirements. In case a report leads to further inquiry, the related content data is passed on to the inquiry. The legal basis for processing the data is law and our rightful interests.
The content data is recorded. Content data shall be stored for no longer than it is necessary and proportionate in order for Foreship to comply with its applicable legal requirements. The retention time period is based on whether the applicable legal grounds persist. The applicable legal grounds are: proving compliance until the relevant limitation of time has passed, submitting complaints/information to relevant authorities and managing possibly arising legal processes. In case there is an on-going inquiry or legal case when the retention time would be exceeded, the retention time will be prolonged to the end of the inquiry and any legal case.
The system data will not be part of the stored content data, and system data will be deleted when the processing of your report in the Whistleblowing Channel system ends. Typically, this happens when you are informed of the follow-up actions taken by Foreship, which normally happens within three (3) months of your initial report.
Your name and email address, if you have disclosed your identity, will be deleted together with the system data, which normally happens within three (3) months of your initial report. In other cases, your name and email address are deleted once there is no longer any need to process the name or email address. That may be in connection with deleting the system data, or later, depending on case-by-case appraisal on a need to process basis. At the latest, your name and email address will be deleted when content data is deleted.
See our data protection policy [link to policy in Finnish]. Foreship has conducted a data protection impact assessment as required by the applicable whistleblowing legislation.
9. Raising concerns about Actions taken by Foreship
If you are concerned that:
- you may be, are being, or have been subjected to retaliation;
- there has been a disclosure of your identity contrary to this Policy; or
- your report has not been handled in compliance with this Policy;
we kindly ask you to proceed as follows:
Kindly send a new report to Whistleblowing Channel with a clear reference “Concerns about Actions taken”. The Service Provider will after receiving such report make the decision to whom the report is delivered with the objective that there cannot exist any conflict of interest between the chosen representative of Foreship and you. The chosen representatives are defined in section 7 of this Policy. Also, as explained in section 5 “Offered Protection”, you have in certain situations also right to report the matter using other external channels besides Foreship’s Whistleblowing Channel.
Please note that by choosing to keep your identity confidential in the situation where you are concerned that you may be, are being, or have been subject to retaliation, Foreship may not be able to investigate and respond to the suspected retaliation against you as effectively as Foreship would like to.