WHISTLEBLOWING NOTICE
Lenovo (Italy) S.r.l. and Lenovo Global Technology Italy S.r.l. (hereinafter jointly "Lenovo") arecommitted to maintaining high standards of openness, transparency, integrity and accountability.
Lenovo encourages reporting of any conduct that appears inappropriate, immoral or unlawful, i.e,behaviours, acts or omissions that harm the integrity of Lenovo and that consist of relevant unlawful
conduct pursuant to Legislative Decree 231/2001 and/or violations of Lenovo's Code of Conduct
and/or Lenovo's Organization, Management and Control Model (available on the website
http://www.lenovo.com/it), or otherwise unlawful acts that fall within the scope of European Unionor national laws, or acts or omissions that affect the exercise of healthy competition within theEuropean single market or the national market, committed by Lenovo personnel and/or third parties
acting in Lenovo's business context (hereinafter "Unlawful Conduct").
To this end, Lenovo expects and strongly encourages all Lenovo personnel (permanent, temporary,full-time and part-time, directly employed or on temporary contracts), as well as consultants working
on behalf of Lenovo, as well as anyone (whether as a customer, supplier, or partner) who works
directly with Lenovo personnel, to report, if they have become aware of any Unlawful Conduct using
the internal Whistleblowing reporting channels as found here: https://lenovo.whispli.com/speakup,
as specified in the Lenovo Whistleblowing Policy attached to this notice.
Reports will be handled in compliance with confidentiality and the legislation on the protection of thewhistleblower's personal data. In order to benefit from all the protection measures for thewhistleblower provided for pursuant to Legislative Decree 24/2023, whatever the form of the report,
please include in the subject of the communication (or to point it out to the recipient in the case of anoral report) that it is an "internal report pursuant to Article 4 of Legislative Decree 24/2023 on
Whistleblowing".
In addition to internal reporting channels, the whistleblower may also report concerns through thereporting channel made available by the National Anti-Corruption Authority accessible from thefollowing web page: https://whistleblowing.anticorruzione.it/#/ .
Please note that the whistleblower may make an external report if, at the time of its submission, oneof the following conditions is met:a) the mandatory activation of the internal reporting channel is not envisaged within his/her work
context, i.e., this, even if mandatory, is not active or, even if activated, does not comply with theprovisions of Article 4 of Legislative Decree 24/2023;b) the reporting person has already made an internal report pursuant to Article 4 of Legislative Decree
24/2023 and the same has not been followed up;(c) the reporting person has reasonable grounds to believe that, if the reporting person were to makean internal report, it would not be effectively followed up or that the report would lead to a risk ofretaliation;(d) the reporting person has reasonable grounds to believe that the breach may constitute animminent or obvious danger to the public interest.
This notice is updated to 27/11/2023 and is provided pursuant to Article 5, paragraph 1, letter e) of
Legislative Decree no. 24 of 10 March 2023 implementing Directive (EU) 2019/1937 of the European

Parliament and of the Council of 23 October 2019 on the protection of persons who report breachesof Union law and laying down provisions on the protection of persons who report breaches of nationallegal provisions.
For more information on the relevant legislation, it is recommended to visit the website of theNational Anti-Corruption Authority at www.anticorruzione.it/-/whistleblowing.

Policy Sponsor: Shama PatariContact: spatari@lenovo.com
Effective Date: February 14, 2023

Type: Global Policy
Category: Corporate Policy
Policy No: CP-00024

Lenovo Whistleblowing and Investigations Policy
1. Principles
1.1

Lenovo Group Limited (including all of its subsidiaries present and future, hereinafter“Lenovo” or the “Company”) is committed to maintaining high standards of openness,transparency, probity and accountability. The Company strongly encourages and expects allemployees (including full-time, part-time, temporary and supplemental), as well as
contractors and consultants who perform work on Lenovo’s behalf, to report concerns andactual or suspected conduct that seem unethical, illegal, suspicious or that may violate
Lenovo’s Code of Conduct, policies or procedures, including misconduct, malpractice orimproprieties by any employee and/or external parties in any matter relating to the Company.

1.2

Employees of the Company at all levels should conduct themselves with integrity, impartiality
and honesty.

1.3

If and when appropriate, Lenovo will conduct an internal investigation to determine whether
specific behavior is consistent with applicable laws and Lenovo standards. This Policy applies
to all Lenovo internal investigations.

2. Purpose
2.1

This Whistleblowing and Investigations Policy (this “Policy”) aims to complement Lenovo’s
Code of Conduct and to govern, deal with and address fair and proper concerns raised byWhistleblowers (as defined below) and actual or suspected conduct reported by them thatseem unethical, illegal, suspicious or that may violate Lenovo’s Code of Conduct, policies orprocedures, including misconduct, malpractice or improprieties by any employee and/or
external parties in any matter relating to the Company. It also provides guidance with respect
to the way internal investigations will be conducted by the Company.

3. Definitions and Scope
3.1

Whistleblowers (each a “Whistleblower”) may include: (1) employees of the Company; (2)business counterparts of the Company, including but not limited to (a) vendors of goods orservices to the Company (including their employees); (b) customers of the Company(including their employees); and (3) consultants and contractors to the Company (including
their employees).

3.2

This Policy applies, but is not limited to, concerns about possible improprieties in financial
reporting, internal controls or other matters within the Company including, but not limited to,the following:••••••••

violation of Lenovo’s Code of Conduct or other rules of conduct, policies or procedures
applicable within the Company;
breach of applicable laws and/or legal or regulatory requirements;
criminal offenses, breach of civil law and miscarriage of justice;malpractice, impropriety or fraud relating to accounting, auditing, financial matters andinternal controls;
misuse of or leakage of Lenovo or third-party confidential or proprietary information;
endangerment of the health and safety of an individual;
damage caused to the environment;
conduct involving bribery or corruption, money laundering and terrorist financing;
CP-00024/1

•
•
••

harassment or discrimination;breach of privacy and security of network and information systems;
improper conduct or unethical behavior likely to prejudice the standing of the Company; anddeliberate concealment of any of the above, which may implicate any employee at all levels
and divisions of the Company, or any external parties related to the Company.

4. Reporting Mechanisms
4.1

Reporting Mechanisms: Lenovo’s Code of Conduct provides various means by which aWhistleblower may raise concerns. These include:
••
••••
•

the manager of an employee raising an issue (or another trusted manager);the Lenovo Ethics and Compliance Office (ECO) (ethics@lenovo.com);the Lenovo Human Resources Department;
the Lenovo Legal Department;
the Lenovo Internal Audit Department;
the LenovoLine (https://www.integrity-helpline.com/lenovo.jsp); andin China Lenovo’s Independent Commission Against Corruption (ICAC@lenovo.com).

4.2

Any Whistleblower who has a legitimate concern about improprieties in financial reporting,internal controls or other matters within the Company (such as those described in paragraph
3.2 above) can raise it in confidence.

4.3

A report made by the Whistleblower should, to the extent possible, be in writing and include
specific, accurate and relevant information in relation to the activity(ies) and person(s) involved
so that, if appropriate, an investigation can be undertaken into the concern raised, including
the identity of the Whistleblower. Whistleblowers are however able to submit reports orally
and/or in person via the methods, persons, or departments listed in paragraph 4.1.

4.4

The Company does not encourage anonymous reporting since it will be difficult for theCompany to follow up and obtain further information to make a proper assessment. However,
the Company will accept anonymous reporting, where legally permissible, and in thecircumstances where a Whistleblower has made an anonymous report, a means of contact(such as an anonymous email address) should be provided to facilitate the initial assessment(and subsequent investigation) of the report. There may be limitations on the extent of any
investigation if anonymity is maintained throughout any investigation.

4.5

Any concern should be initially reported via one of the methods described in paragraph 4.1
above. The concern will be logged into the investigations system of record and processed via
the established Lenovo Investigation Oversight Committee (IOC) procedure for processing
and investigating such concerns. The IOC will, after gathering sufficient details, assign thecomplaint to the appropriate group within the IOC for further action based on IOC processes,guidelines and policies. The Internal Audit team will report on cases at each meeting of theAudit Committee of the Board of Directors (the “Audit Committee”).

4.6

If the concern involves the ECO of the Company, or the Whistleblower believes that it would
not be otherwise appropriate to use one of the methods described in paragraph 4.1 above, theWhistleblower may raise the concern directly to the Audit Committee by submitting it to theLenovo Company Secretary. The Audit Committee will consider the report made to it by theWhistleblower (directly or indirectly through the IOC of the Company) and decide on theappropriate investigation arrangement.

4.7

The Company will acknowledge the receipt of the report from the Whistleblower within thetimeframe anticipated by the respective applicable local laws and regulations (usually withinseveral business days) in order to ensure the Whistleblower that his/her report has been
received and is being processed.

CP-00024/2

5. Investigation Procedures
5.1

The IOC establishes and maintains the internal investigations processes, guidelines and policies
and is responsible for reasonably assuring internal investigations comply with thesestandards. Generally, investigations will be based on IOC processes, guidelines and policies.
Depending upon the particular circumstances of a complaint, a separate investigation process
may be followed as authorized by the Audit Committee or the IOC to investigate the matter in atimely and fair manner.

5.2

The format and the length of an investigation will vary depending upon the nature, complexityand particular circumstances of each complaint made. Resources are not required to beallocated to investigate allegations that were previously reviewed if there is no new material
information, new material information is not provided in good faith, or new information isdetermined to be inconsequential.

5.3

Internal investigations may be conducted by assigned Lenovo personnel, or independentattorneys, accountants, investigators, or other third parties that are retained to conduct or assist
in an investigation.

5.4

A Whistleblower who reports a concern may be asked to provide more information during thecourse of the investigation.

5.5

If IOC processes, guidelines or policies require the filing of a final report, it should be includedin the investigations system of record. Depending on the particular circumstances of thecomplaint, a final report, with recommendations for change or improvement (if any), may beproduced to the Audit Committee. The Audit Committee will then review the final report and if
appropriate, make recommendations to the Board.

5.6

Subject to the terms of this Policy and limitations under applicable laws, the Whistleblower who
reports the concern will be advised of the outcome of the investigation. Except as otherwise
required by applicable laws, the IOC retains full discretion regarding the extent of information
provided to the Whistleblower regarding the investigation.

5.7

The internal investigation conducted by the Company should not jeopardize any future
investigation by a law enforcement agency. If, after having considered the facts available, theCompany is of the opinion that a criminal offence has been committed, it will seek legal advice
to determine if it is necessary or appropriate to, and if so, it will, refer the matter to the appropriate
law enforcement agency. Once the matter is referred to a law enforcement agency, theCompany may not be able to take further action on the matter, including notifying theWhistleblower of the referral.

5.8

Auditable records of all reports made by Whistleblowers, the corresponding investigations orfollow-up actions taken and the outcome of investigations should be kept by the ECO of theCompany in the investigations system of record or other appropriate repository.

5.9

The Company will ensure impartiality and competence of the personnel managing the reporting
channels and handling the report. The respective workforce will be provided with appropriate
information on the existence and proper usage of reporting channels.

5.10 The Company should respond to and follow up on reports within the timeframe anticipated by
the respective local laws and regulations.

6. Cooperation by Employees
6.1

All employees (full-time, part-time, supplemental, and temporary), consultants and contractors
are required to cooperate fully with investigations and audits conducted by Lenovo. This may
mean providing access to Lenovo-issued equipment (such as computers or smartphones),
documents and participating in interviews.
CP-00024/3

6.2

Failure to cooperate in the investigative process, including misleading, lying, destroying, oraltering documents or records, or failing to respond promptly to requests for information byinvestigators or auditors is grounds for disciplinary action up to and including termination ofemployment.

6.3

If an employee is contacted by a third-party related to a request for information by an outside orindependent audit, investigation or regulatory agency, the employee must notify either Ethics
and Compliance or the Legal Department as soon as possible, and in any event before
responding to any inquiries by the third-party. In situations where advance notification is notpossible, the employee must contact Ethics and Compliance or the Legal Department as soon
as possible.

7. Confidentiality and Retaliation
7.1

The Company will make every effort to treat all reporting under this Policy in a strictly confidentialmanner. The identity of the Whistleblower making the report or complaint will not be disclosed
without such Whistleblower’s consent, unless the Company is required to do so under applicablelaws or regulations, for the purpose of the Company obtaining legal advice or legal
representation, or as otherwise consistent with an effective investigation of the report orcomplaint. The Company will maintain such confidentiality also for the person named in thereport or complaint, as well as for any third parties referenced.

7.2

All reporting under this Policy should also be kept confidential by the Whistleblower.

7.3

Lenovo will not tolerate harassment, retaliation or any type of discrimination or adverse action
against a Whistleblower or an employee, consultant, or contractor who in good faith (a) makes
an internal report under this Policy; (b) provides information or assists in an investigation
regarding such a report; or (c) files, testifies, or participates in a legal or administrative
proceeding related to such matters. The Company will make every reasonable effort to ensurefair treatment of the Whistleblower and protect the Whistleblower from dismissal, demotion andother forms of retaliation. Anyone who victimizes or retaliates against a Whistleblower who hasgenuinely raised concerns in accordance with this Policy will be subject to disciplinary actions(including the possibility of dismissal).

8. Data Protection
8.1

Depending on the location of the Whistleblower or the legal entity to which the report relates,
the personal data associated with the report will be likely governed under one or many
overarching data protection regulations. The Company will make sure that, in each case,handling of personal data in the context of the report investigation will satisfy all applicable dataprotection laws.

8.2

The Company should, in each case, only be collecting relevant and proportionate information,i.e., not more information than necessary. The Company also encourages the Whistleblowers
to provide only relevant information in the context of the reported behavior, rather than nonrelated and excessive information. In any case, the Company will implement relevant quality
check mechanisms, involving an initial check of the information reported and keeping only theinformation that is relevant to the case.

8.3

The Company will also provide to applicable individuals relevant information about how itprocesses their personal data, as required by applicable data protection regulations or otherlaws, as soon as practically possible. However, it is possible that informing the accused personat an early stage might under certain circumstances jeopardize the investigation. In these cases,
the deferral of information should be decided on a case-by-case basis and the reasons for any
restriction should be documented.

8.4

The Company will apply appropriate technical and organizational security measures in order toCP-00024/4

protect information contained in the report. Mainly, it will ensure that only authorized personnel
have access to the information (need-to-know basis), will use reliable technology and vendors
providing sufficient safeguards, and ensure that the involved personnel are properly trained andbound by the confidentiality obligations.
8.5

The records containing personal data will be kept as described in paragraph 5.7 above, however
for no longer than required by applicable local laws and regulations and respective Lenovostandards and policies.

8.6

For more information about processing of personal data in the context of handling the reports,
please, read the Lenovo Data Privacy Policy available here.

9. Untrue Allegations
9.1

In raising a concern or report pursuant to this Policy, the Whistleblower should exercise due
care to ensure the accuracy of any information provided.

9.2

If the Whistleblower is mistaken about the concern raised, they will not be at risk of losing theirjob or suffering any form of retaliation as a result, provided that they are acting in good faith.

9.3

If the Whistleblower deliberately raises false or malicious allegations, disciplinary actions(including the possibility of dismissal) will be taken against them.

10. Disclosure of this Policy
10.1 The Policy will be published on the Company’s intranet site for employees and publicly on theCompany’s website (www.lenovo.com).

11. Implementation and Review of this Policy
11.1 The IOC shall have overall responsibility for the implementation, monitoring and periodic review
and update of this Policy and to ensure that effective arrangements are in place for fair andindependent investigations of relevant matters and appropriate follow-up actions.

12. Approval History
VersionNumberEffective Date

Policy Owner

Policy Administrator

Approved by1.0February 14, 2023

Shama Patari

Tanya Roychowdhury

Lenovo Executive
Committee

CP-00024/5