Rules of Procedure Compliance Hotline (Heraeus SpeakUp) Version: 2.0 - 01.10.2023

1.

GeneralIt is important to Heraeus that employees, as well as business partners or other persons whofind themselves affected by Heraeus’ business activities, have the opportunity to report possible
violations of the law or human rights (compliance violation, defined in more detail in Clause 2)
easily and without fear of disadvantage or punishment. That is why Heraeus has offered its
employees an internal (via the Heraeus Compliance Officer, HCO) and external (via theombudsman) compliance hotline for many years. Since 01.04.2020, external third parties havealso had the opportunity to report possible compliance violations via the Compliance Hotline.
As of 01.10.2023, Heraeus will offer the worldwide option to submit tips via Heraeus SpeakUp
either IT-supported (via WEB or APP) or by telephone. The tips are recorded in the Heraeus
SpeakUp Tool and forwarded to the Heraeus whistleblowing unit.
The Compliance Hotline can be used by employees, former employees, business partners ofHeraeus, suppliers and indirect suppliers and anyone affected by Heraeus’ activities.
With these rules of procedure, Heraeus ensures that the various legal requirements, such as
those arising, in particular, from the German Whistleblower Protection Act (HinSchG), theGerman Supply Chain Sourcing Obligations Act (LKSG), the EU-Conflict Minerals Regulationand the EU-Basic Data Protection Regulation (GDPR), are implemented.
2.

Purpose of these rules of procedure and definition of compliance violation

The aim of Heraeus SpeakUp is to ensure that Heraeus becomes aware of-criminal offences, in particular, property offences, corruption, environmental offences,money laundering,-

significant violations of the law,-the violation of human rights or environmental obligations,-significant violations of internal guidelines, or the risk of such violations

to the extent that such violations or risks arise from the economic activities of Heraeus or adirect supplier. In particular, a potential violation of the Heraeus Supply Chain Due Diligence
Policy or the Heraeus Human Rights Policy is to be regarded as a legal or human rights violation
within the meaning of the previous provision (in future: “compliance breach”).
The Compliance Hotline is not responsible for information pertaining to misconduct bycolleagues or supervisors without direct reference to Heraeus’ business activities, conflicts

15426 Page 1 of 5

Rules of Procedure Compliance Hotline (Heraeus SpeakUp) Version: 2.0 - 01.10.2023
under labour law or social conflicts with supervisors or colleagues, or other non-substantial
violations of internal guidelines.
Heraeus is keen to welcome any situation when potential compliance violations are first
addressed locally with the supervisors or Compliance Officers (CO) of the respective company.
If this is not possible or expedient, e.g. because the superior fails to take action, it concerns
misconduct on the part of the superior himself or the whistleblower fears personal
disadvantages, use should be made of the possibility to report compliance violations via theIT-supported reporting channel Heraeus SpeakUp or the external ombudsman. As analternative to Heraeus SpeakUp, the whistleblower can always contact the CO of the company
or the operating company (OpCo) in person or by e-mail.
3.

Reporting channels and reporting points

3.1

Submitting a report via SpeakUp or personally to the Heraeus Compliance Officer
Reporting is possible via the web portal Heraeus SpeakUp, via the app or phone, or ina personal conversation.
Web portal: Whistleblowers can access the whistleblowing web portal here.
App: The person submitting the whistleblowing report also has the option of submittinga report via their mobile phone using the “SpeakUp” app. The prerequisite is theinstallation of the app “SpeakUp by People Intouch” from the store required for therespective operating system.
Phone: The person submitting the whistleblowing report also has the option ofsubmitting a tip by telephone. The spoken text is first recorded, transcribed in the next
step and, if necessary, machine-translated into English or German. The voice recording
is deleted after translation.
Personal conversation: Lastly, the whistleblower can also make an appointment with
the HCO for a personal conversation via MS Teams or in the office.
Whistleblowing office: The whistleblowing office is the Heraeus Compliance Officer(or his representative) (HCO). The whistleblowing office also includes the Head ofCorporate Audit (or his representative), whom the HCO will regularly involve for thepreliminary investigation and, if necessary, also for the full investigation of the facts(Clause 4) on a regular basis. The HCO and the Head of Corporate Audit act
independently and without instructions when dealing with information.

3.2

Reporting via e-mail or telephone or in a personal conversation to the local CO or theCO of the OpCo

15426 Page 2 of 5

Rules of Procedure Compliance Hotline (Heraeus SpeakUp) Version: 2.0 - 01.10.2023
Employees also have the option of reporting possible compliance violations to the local
CO or the CO of the operating company (OpCo) by e-mail or phone or in person. The
whistleblowing office is then the local CO or CO of the OpCo, the HCO, who can act inan advisory capacity, and the Head of Corporate Audit, who can be involved in the factfinding process. The local CO and the CO of the OpCo act independently and without
instructions when dealing with whistleblowing reports.
3.3

Ombudsman
The report to the ombudsman can be submitted by telephone or e-mail or in a personal
meeting.
The exclusive point of contact for the external ombudsman is the HCO. For thispurpose, the external ombudsman enters the information received from thewhistleblower into Heraeus SpeakUp. Only if the allegations are directed against theHCO or the General Counsel does the external ombudsman pass the information
directly to the CEO of Heraeus.
The ombudsman is a lawyer and is bound to professional secrecy. This means that hewill not disclose to Heraeus the facts disclosed or the name of the whistleblower without
the whistleblower’s prior written consent. The external ombudsman is independent andnot bound by instructions from Heraeus.
Unless otherwise agreed in individual cases, the HCO shall process the information inaccordance with the process described in Clause 4 as well as for information received
directly via Heraeus SpeakUp. Clause 3.1 applies accordingly.

3.4

Heraeus welcomes any situation where the whistleblower is also willing to disclose hisor her identity, but anonymous tips are also possible, and anonymous tips will befollowed up. The credibility of the whistleblower’s information depends, in many cases,on whether the whistleblower is willing to disclose his or her identity to the HCO orombudsman or local or OpCo CO, which ensures the whistleblower’s protection, cf.
Clause 5.

4.

The whistleblowing procedure and handling of tips

4.1

The whistleblowing office will acknowledge receipt of the tip within 7 days.

4.2

If the tip is deemed plausible, the responsibility for investigating the reported facts lies
with the respective OpCo. For matters concerning the companies that are not allocatedto an OpCo (company), responsibility shall lie with the respective company. For thispurpose, the HCO forwards the facts to the CO of the OpCo or to the CO of therespective company. If a preliminary investigation has not already been carried out, the15426 Page 3 of 5

Rules of Procedure Compliance Hotline (Heraeus SpeakUp) Version: 2.0 - 01.10.2023
CO of the OpCo or company may carry out a preliminary investigation, and will initiate
an investigation if necessary.
4.3

In the event that(a) an allegation is directed against a Lead Team member or against the Managing
Director of the service platform, or it is conceivable that the conduct subject to complaint
was supported or at least approved by the Lead Team member or the ManagingDirector,(b) the reference does not concern only one OpCo or company,(c) the behaviour in question may have serious effects on the Heraeus Group as awhole if it is assumed to be correct,(d) the protection of the identity of the whistleblower could be jeopardised if theresponsibility for disclosure is handed over to the OpCo or service platform and thewhistleblower has not consented to disclosure of their identity,
the responsibility for investigation shall lie with the HCO with the involvement of theHead of Corporate Audit.

4.4

The whistleblowing office will only involve those persons within the Heraeus Group who
need to be involved, in order to clarify the facts or decide on further action. In doing so,
the whistleblowing office shall ensure the protection of the identity of the whistleblower.

4.5

The responsibility for stopping the violation, if necessary, and sanctioning employees,
if applicable, lies with OpCo management or the Managing Director of the service
platform. The remedy’s purpose is to prevent or remedy the breach or violation.

4.6

No later than three months after receipt of the tip, the whistleblowing office shall informthe whistleblower of follow-up measures already taken and planned, as well as theunderlying reasons.

4.7

The content of the tip, as well as the result of the investigation (if such an investigation
has taken place) shall be retained for a period of 3 years from the date of document
creation, unless a longer retention is necessary and proportionate on the basis of otherlegal provisions or to fulfil the requirements under the HinSchG.

5.

Protection of the whistleblower

5.1

The HCO and COs shall ensure the protection of the whistleblower. This includes notpressuring the whistleblower to disclose his or her identity, and not disclosing theidentity of the whistleblower, if known, without the whistleblower’s consent. The

15426 Page 4 of 5

Rules of Procedure Compliance Hotline (Heraeus SpeakUp) Version: 2.0 - 01.10.2023
whistleblowing office will also not disclose documents from which the person of thewhistleblower can be identified without the whistleblower’s consent.
5.2

Disclosure of the whistleblower’s identity is permissible by way of exception if thewhistleblower has consented thereto (or if this is unavoidable for the investigation orfollow-up) or necessary in the context of a state investigation.

5.3

Retaliatory measures – in particular, measures under labour law – against awhistleblower who has reported a possible compliance violation are prohibited, andmust themselves be regarded as a compliance violation and punished accordingly.

5.4

A whistleblower who knowingly (or by way of gross negligence) provides false
information to harm others or otherwise abuses the Compliance Hotline, shall not beprotected. Rather, Heraeus reserves the right to assert a claim for damages from any
whistleblower who knowingly provides false information, in order to harm others orotherwise misuses the Compliance Hotline.

5.5

Intermediaries and supporters of the whistleblower are also protected to the sameextent.

5.6

There shall be no cost to the whistleblower for using Heraeus SpeakUp or engaging theombudsman or local COs or OpCo COs. Heraeus shall bear the associated costs. In afew cases, telephone charges are incurred by the whistleblower if the report issubmitted by telephone.

6.

Data protection

6.1

The whistleblower and the data subjects shall be informed about the processing andsecurity of their personal data in the data protection notices.

15426 Page 5 of 5