Principles | Reporting possible violations and processing reports at Bosch.

1|6Principles
for reporting possible violations and processing reports
at Bosch.

Version 1.1 | 07.23

Principles | Reporting possible violations and processing reports at Bosch.

2|6

Table of content

1 Introduction and Scope

3

2 Reporting a possible violation

4

2.1 Who can report a possible violation? .................................................................................................................. 4
2.2 How can a possible violation be reported? ......................................................................................................... 4
2.3 What can be reported?........................................................................................................................................ 4
2.4 Is there the possibility to report anonymously? ................................................................................................... 4

3 Processing a report53.1 What happens when a report is submitted?........................................................................................................ 5
3.2 How is the report checked and processed? ........................................................................................................ 5
3.3 How long does it take to process a report?......................................................................................................... 5
3.4 What are the possible outcomes of a report? ..................................................................................................... 5

4 Further principles

64.1 How are reporting persons protected? ................................................................................................................ 6
4.2 How is confidentiality ensured? .......................................................................................................................... 6
4.3 How is personal data protected? ........................................................................................................................ 6

5 External Reporting Offices

Version 1.1 | 07.23

6

Principles | Reporting possible violations and processing reports at Bosch.

3|61 Introduction and Scope
Compliance with the principle of legality as well as responsible, fair, and sustainable business practices have always been
a top priority for our company and an integral part of the Bosch values. We firmly believe that entrepreneurial action likethis is the only way to ensure long-term success. In the face of global competition, however, we can only achieve this goalby working together with our business partners – which is why we insist that they comply with laws, human rights andenvironmental and social standards. We also expect the same from the entire supply chain.
Violations of applicable law or of internal regulations put the long-term success of Bosch at risk. Results may include
damage to the company’s reputation or other serious losses, such as compensation payments or penalties as well as theblocking or restriction of products due to debarment. The persons involved may experience consequences relating to laborlaw or find themselves exposed to claims for compensation or criminal proceedings. Reporting possible violations or risks
helps prevent negative consequences of this nature.
The Bosch reporting system including the below mentioned channels serves as an early warning scheme that can be used
to report possible violations of applicable law or of internal regulations. The Compliance organization is responsible for thissetup and its maintenance on behalf of the board of management. All submitted reports are immediately investigated. If theinvestigations determine a violation, it is immediately remedied, and appropriate measures are taken accordingly to prevent
future violations.
This rule of procedure defines principles on reporting possible violations at Bosch, provided the following channels areused to do so. These principles take into account various legal requirements, including those of Directive (EU) 2019/1937
on the protection of persons who report breaches of Union law or Germany’s Act on Corporate Due Diligence in Supply
Chains (also known as the “Supply Chain Act,” or LkSG).
In addition, the offices responsible for processing reports have issued internal rules and work instructions that further define
the internal processing procedure and responsibilities.

Version 1.1 | 07.23

Principles | Reporting possible violations and processing reports at Bosch.

4|6

2 Reporting a possible violation
2.1

Who can report a possible violation?

Anybody or an organization who has obtained knowledge of a possible violation of applicable law and/or internal rules may
submit a report of a possible violation within the company or throughout the supply chain.

2.2

How can a possible violation be reported?

Possible violations can be reported via the following channels managed by the central reporting office Corporate
Compliance Management Investigations: Bosch reporting system (IT tool)https://www.bkms-system.net/bosch-complianceThis IT tool is available in 15 languages and can be accessed 24 hours a day, seven days a week. It offers a secure meansof communication with the Compliance organization with the possibility of setting up a so called “postbox”.
 Telephone
Reports can be submitted in German or in English by calling +49 711 811-32609 during normal working hours. Our localand regional compliance officers can also be reached by phone. Detailed information can be found at https://www.bkmssystem.net/bosch-compliance, then by clicking on > “Select country” > “submission via telephone”.
 E-mail compliance.management@de.bosch.com
 Mail Robert Bosch GmbH, Compliance Management C/CM, Postbox 10 60 50, 70049 Stuttgart, Germany
 In person Make an appointment in advance by writing to compliance.management@de.bosch.com

2.3

What can be reported?

Possible violations of applicable law or of internal regulations can be reported. In addition, possible violations by business
partners can also be reported, in particular the behaviors of suppliers with human rights related or environmental
protection-related risks.
Examples: In particular, the following can be reported: possible violations by Bosch Group associates of applicable law (such as legislation or regulations) or internal rules,(such as the Code of Business Conduct), possible violations by business partners of applicable law or the Code of Conduct that applies specifically to them, or possible the Bosch Group or its direct or indirect suppliers attributable human rights or environmental related risks aswell as violations of human rights and environmental protection obligations according to the LkSG.

2.4

Is there the possibility to report anonymously?

Anonymous reporting is generally possible, e.g., via the Bosch reporting system (IT-Tool) at https://www.bkmssystem.net/bosch-compliance, if permitted by law. The so called “postbox” enables a secure communication with heCompliance organization without revealing the identity. We recommend setting up a postbox, e.g., for any questions orreceiving information according to a whistleblower act or LkSG. The corresponding specifications for communication ofinformation as per “3. Processing of reports” can only be applied when there is the possibility of contacting the reporting
person.

Version 1.1 | 07.23

Principles | Reporting possible violations and processing reports at Bosch.

5|6

3 Processing a report
3.1

What happens when a report is submitted?

Depending on the reporting channel used and the possibility to contact the reporting person, the submission of a report isconfirmed in writing.

3.2

How is the report checked and processed?

Once the report is received, it is documented.
If the report involves possible misconduct in a division of the Bosch Group, it will be processed by the Complianceorganization or another responsible department (such as HR or Legal), according to the predefined internal responsibilities.
If the report involves misconduct on the part of a supplier, it is immediately forwarded to the responsible specialist
department. The reporting person is informed of the department responsible for processing the report.
If there are sufficient indications of a violation, the report will be followed up promptly and in strict compliance with existing
legal boundaries, particularly data protection restrictions, and in consideration of the compliance culture and ethics atBosch. The responsible department may also ask the reporting person questions throughout the processing stage in orderto clear up any unresolved matters and obtain further information, if necessary. Furthermore, assessments will be made ona case-by-case basis to decide on appropriate follow-up measures. These may involve the start of an internal investigationor, in the event of violations in the supply chain, meetings with suppliers or supplier audits.
The reporting person receives feedback on the status or outcome of the process, in accordance with the legal requirements
to be observed in the respective country. If measures are not introduced following the report of a supply chain violation due
to lack of evidence, or if the implementation of the follow-up measures is discontinued, the reporting person will be notified.

3.3

How long does it take to process a report?

Reports are generally treated with high priority. The processing time depends on the extent of the complexity of thecircumstances behind the report, which can sometimes mean that processing extends over several months.

3.4

What are the possible outcomes of a report?

If a violation of applicable law or of internal regulations is confirmed, the violation is promptly remediated, and appropriate
measures are initiated to prevent future violations of this nature (for example, processes are improved, or personnel
measures are taken).

Version 1.1 | 07.23

Principles | Reporting possible violations and processing reports at Bosch.

6|6

4 Further principles
4.1

How are reporting persons protected?

Any form of discrimination against reporting persons is prohibited and will not be tolerated. This includes, for example,
intimidation, negative consequences under labor law for associates, or other punitive measures due to the report.
In addition to the ban on discrimination, there are also internal processes in place to provide the best possible protection ofreporting persons, including the possibility of submitting reports anonymously, if permitted by law.
Any retaliation constitutes a violation of the Bosch Code of Business Conduct or applicable law and can be reported
through the channels mentioned above.
Only consciously filing a false report by the reporting person (such as falsely blaming a colleague) lead to consequences
for the reporting person.

4.2

How is confidentiality ensured?

The departments responsible for processing reports treat the information shared with them in strict confidence. This applies
to personal data in particular. Reports are processed on a need-to-know basis, which means that only the people or offices
necessary for the processing will be informed. Reporting persons may request to remain anonymous. In that case, theiridentities will not be disclosed, except where required by legal or regulatory reporting obligations.

4.3

How is personal data protected?

Any information submitted is treated in compliance with the EU General Data Protection Regulation (GDPR). Information
concerning the processing and accessing of personal data can be found in the Data Protection Notice for the reportingsystem.

5 External Reporting Offices
In our intranet https://inside-ws.bosch.com/FIRSTspiritWeb/permlink/wcms_c_-01_Compliance_Hotline_1-EN associates
can find important information on external reporting offices according the laws transposing the EU directive on
whistleblower protection (in Germany, this is the BfJ reporting office (bundesjustizamt.de).

Robert Bosch GmbH
Compliance Management C/CM
Postbox 10 60 50
70049 Stuttgart, Germany
compliance.management@de.bosch.com

Version 1.1 | 07.23