PUBLIC

WHISTLEBLOWER’SGUIDE
1VERSION 2

PUBLIC

Introduction
At Roquette, we are committed to improving the lives of people around the world and thatcommitment begins with integrity. This is how we have become a world leader. This is what definesus.
We express our four values in all our endeavors. Our culture is based on the following values:

AUTHENTICITY - EXCELLENCE – PROACTIVENESS – WELLNESSWe have adopted a Code of Conduct to help us implement the highest standards wherever we dobusiness. Wherever we are, whatever our position, everything we do must be done honestly andresponsibly. Our Code of Conduct is a guide designed to help us deal with most situations in ourprofessional lives that could raise ethical issues.
If you have witnessed inappropriate behavior, if you think you have seen unsuitable behavior, or if you
have the slightest doubt, don't hesitate to talk about it! It is vital for maintaining confidence with ourco-workers and partners.
This guide aims to create awareness about the new professional whistleblowing alert system
implemented within Roquette. It also aims to draw employee’s attention in the widest context to thelegal protective measures whistleblowers benefit from.
In the past the French legislator had attempted setting out a legal framework for the action of thesewhistleblowers, particularly in terms of their protection, provided that their approach was legitimate.
The Sapin 2 law of December 9, 2016, relating to transparency, the fight against corruption andmodernization of the economy, went further by creating a general and protective status forwhistleblowers. These legal dispositions were supplemented by the April 19, 2017, law relating toprocedures of how alerts given by whistleblowers are received.
At European level, on April 16, 2019, the Parliament adopted the directive aiming to create aharmonious framework protecting whistleblowers making alerts to violations of European Union
legislation in a large number of sectors.
This directive aims to enable whistleblowers to be shielded from any retaliation when they use one of
the alert procedures provided for by the European text.

2

PUBLICCONTENTSWHAT IS A WHISTLEBLOWER?

4WHAT IS A FACILITATOR?

4WHAT IS AN ALERT SYSTEM?

4WHICH SITUATIONS SHOULD BE REPORTED?

5WHO CAN REPORT A SITUATION?

6HOW SHOULD A SITUATION BE REPORTED?

7WHAT MUST THE REPORT CONTAIN?

7WHAT ARE THE WHISTLEBLOWER’S COMMITMENTS?

8HOW IS CONFIDENTIALITY GUARANTEED?

8HOW IS THE WHISTLEBLOWER PROTECTED?

9WHAT HAPPENS AFTER AN ALERT?

9WHO ARE THE CORRESPONDENTS?

11

WHAT IS THE RESPONSE TIMEFRAME FOR AN ALERT?

11WHAT OTHER WAYS OF REPORTING ARE THERE?

12HOW IS DATA RELATING TO AN ALERT STORED?

12WHAT DATA DOES ROQUETTE COLLECT?

12HOW CAN I EXERCISE MY RIGHTS?

133

PUBLIC

What is a whistleblower?
A whistleblower is a person who, as part of their professional duties, exposes or reports a crime, anoffense, a threat, or harm to people, the economy, society, the government, or the environment, i.e.,to the common good, the general interest, without receiving direct financial compensation.
Whistleblowers may also reveal attempts to conceal these actions. They do not need to have personal
knowledge of the events. They may have been reported to them.
There are more and more whistleblowers and each year they disclose new facts that most often makethe company in question advance. Whistleblowers are an indispensable brick in transparency, the fightagainst corruption and the modernization of economic life.

What is a facilitator?
A Facilitator is an individual or non-profit organization that assists a whistleblower in reporting ordisclosing information, and more specifically:••

An individual who may be at risk of retaliation by their employer, customers, or the recipientof their services because of their assistance to the whistleblower (family, friends, co-workers,etc.).
Legal entities controlled by a whistleblower for whom they work or with whom they are linked
in a professional context (unions, associations, etc.).

This Facilitator is afforded similar protections to the whistleblower, they cannot:••

be excluded from a hiring process or from access to a training course or a period of professional
training, be penalized, terminated, or be the subject of a direct or indirect discriminatory
measure, especially with regard to compensation, profit-sharing measures, or the distributionof shares, training, job reassignment, qualification, classification, professional promotion,transfer or renewal of their contract.
be liable by damages caused by their reporting or public disclosure

What is an alert system?
An alert system is a system provided for staff and external or temporary staff, in additional to the usualmeans of alert, to enable them to report behavior that is potentially unethical, against internal rules
and applicable regulations.

4PUBLIC

Which situations should be reported?
Any situation and any violation, proven or presumed, of the Code of Conduct, company regulations
and applicable laws, and in particular: Fraudulent acts (bribes, corruption, discounts, anti-competitive practices, misappropriation ofmoney, theft, abusive appropriation, money laundering, conflicts of interest, facilitationpayments);
 Security breaches (for example, problems that relate to data protection and computersecurity); Harassment, discrimination;
 Malicious acts against persons or company property; More generally, any crime or offense.
 Any breach of an international commitment, a unilateral act of an international organization,a European Union law, a law or a regulation.
 As well as any information concerning the above-mentioned actions.

However, the alert may not concern matters covered by national defense secrets, medical secrecy, thesecrecy of judicial proceedings, an investigation, a judicial inquiry, or attorney-client privilege.

5

PUBLICWho can report a situation?
Any person working for the company
Persons working for the company include, on one hand, members of the company, and on the other,external or temporary staff.
•Members of the company include: Employees (on fixed-term or permanent contracts),
 Interns,
 Temporary workers,
 And any other staff member seconded within the company.

•External and temporary staff.

They correspond to all those who provide their services to the company within a professionalframework and have access to the company information system
They include in particular:
 Suppliers,
 Subcontractors,
 Services providers, Freelance workers

6PUBLICHow should a situation be reported?
The Roquette confidential alert channel is the last resort for reporting an abnormal situation, if you do
not feel comfortable sharing your concerns with your line manager, the Human Resources department,
or if you have already shared your concerns and feel that an adequate answer has not been provided.
Roquette has set up the secure solution SpeakUp ®, which enables a report to be made in writing orvia voicemail.
This solution is available via an app available in the Roquette ONE intranet. A mobile app’ is alsoavailable in the Roquette Software Center.

It is a secure, confidential platform subject to whistleblower laws and general data protection
regulations.

What must the report contain?
The information communicated within the framework of this alert system must be formulated in an
objective way and be sufficiently precise in order for the alleged facts to be checked.
Only the data necessary for the examination of the legitimacy of the alert must be provided and show
the presumed nature of the alert.
Whistleblowers are encouraged to identify themselves in order to carry out the investigation andfacilitate discussion.

7

PUBLIC

What are the whistleblower’s commitments?
The capacity of a whistleblower relies on five cumulative conditions: The whistleblower must be a natural person.
A legal person (union, association…) cannot therefore report an ethical alert from thedefinition of the Sapin 2 law.
 They must act in a professional capacity, i.e. the reported actions must relate to ROQUETTE
itself, regardless of whether or not they are reported to them.
 The alert must be given in good faith, The whistleblower must not receive any direct financial compensation. The whistleblower
must also not be motivated by personal grievances or an intention to cause harm.
Any whistleblower who, knowingly, or in a manifestly negligent way, makes false declarations in fullknowledge of the facts, discloses misleading information, acts in bad faith or an abusive way, will be
liable to be subjected to disciplinary procedures or proceedings in line with applicable laws andregulations.
Conversely, a whistleblower or facilitator acting in good faith will not be subject to discipline orprosecution if the allegations prove to be inaccurate or do not result in any action.

How is confidentiality guaranteed?
The originator of a professional alert who identifies themselves, benefits in return from their identityand personal data being kept confidential, in accordance with applicable legislation. The
Correspondents undertake to maintain whistleblowers confidentiality throughout the investigation
process. The identity of a whistleblower cannot be communicated without their agreement, except tolegal authorities. In some cases, due to the nature of an investigation or certain legal requirements, itis necessary to disclose the identity of an individual. In those cases, Roquette will work closely with theindividuals involved to address their questions or concerns.
An anonymous alert can only be dealt with according to certain conditions: Violation, cover-up, or attempted cover-up of the events is a violation.
Examples: Sexual harassment, false accounting, corruption.
 Factual elements are sufficiently detailed.
Example: Detailed report that does not allow the authenticity of the alert and reported facts tobe doubted.

8PUBLIC

How is the whistleblower protected?
Roquette does not tolerate any form of retaliation towards any employee or third party acting on
behalf of Roquette who reports, in good faith, a proven or presumed violation of the Code of Conductor applicable laws.
The access to data is restricted only to Roquette SpeakUp Correspondents. The elements that may
identify the alert originator can only be disclosed with the person’s agreement (except to legalauthorities).

What happens after an alert?
As soon as a professional alert is received by the Correspondents, through the different
communication channels possible, the report originator is informed:
 That their alert has been received;
 Of the reasonable timeframe necessary to examine its admissibility;
 Of the modalities following which they will be informed of the next steps to be taken after theirreport.
In a first phase classed as verification, the Correspondents carry out a preliminary evaluation toestablish that the report falls within the scope of application of this procedure.
Any report that does not clearly fall within the scope of application of the procedure that is not of aserious nature, that is in bad faith or constitutes an abusive accusation or even slander, as well as any
report relating to facts that cannot be checked, will be immediately destroyed and the author informed.
The whistleblower is informed in the event that the correspondents conclude the alert is admissible.
Any alert deemed admissible will then be presented to the Alert Committee which will decide the formand substance the following steps will take. Referral to specialists could be envisaged and aninvestigation could be carried out.
The professional report originator will only be involved in the investigation process for the purpose ofchecking the reported facts. The proceedings of the investigation, its content, outcome, and theresulting report are strictly confidential, including for the alert originator.
As soon as the company has made a final decision following the case investigation, the whistleblower
will be informed of this decision (the case is closed, disciplinary or legal measures, etc.) as well as thereasons that justified it.
If the whistleblower is informed of the action taken by Roquette management, they will not beinformed of the nature of the sanction decided or criminal offenses on which a complaint may havebeen filed.

9PUBLICThe complete process for handling alerts is described in DIFMGR1001EN

10

PUBLICWho are the correspondents?
Two SpeakUp Correspondents in Roquette Group are responsible for professional alerts and attachedto the Audit and Internal Control and Risk Management division. These Correspondents have been
awarded professional certification and adhere to the profession’s standards.
Their role consists of: Receiving professional alerts and monitoring their full treatment, from opening to closing the file,with confidentiality and ethics being respected, according to the dedicated process; Communicating with whistleblowers and centralizing the contacts;
 Coordinating investigations which may be carried out.

Contacts:• Véronique SCELLESVERONIQUE.SCELLES@roquette.com• Arnault MARIN

ARNAULT.MARIN@roquette.com

Any question regarding Data Protection in the framework of the alert
system and requests relating to exercising your personal data rights
mustbeaddressed
todpo@roquette.com
orjennifer.godin@roquette.com .
Cf. Protection of personal data charter in the framework of the professional alert system – Article
2 Whistleblower contact point

What is the response timeframe for an alert?
An acknowledgement of receipt is sent to the whistleblower within 72 hours of the report being filed.
The alert is then processed within a reasonable timeframe, which varies according to the nature of
the alert (sexual harassment will take longer to investigate); the average timeframe is generally twomonths.
If a reason is not given for the report (absence of supporting documents) or unfounded, it is “closed”
within 1 to 2 months following the investigations carried out.

11

PUBLIC

What other ways of reporting are there?
Instead of or subsequent to an internal report, the whistleblower may choose to submit an externalreport to a human rights advocate, to the courts, to the relevant authorities depending on the country.

How is data relating to an alert stored?
Data relating to an alert that the Correspondents consider as soon as it is received as not coming under
the system’s scope of application, will be either destroyed or archived (after being anonymized)
without delay.
When the alert is not followed by a disciplinary or legal procedure, the data relating to this alert isdestroyed or archived, after being anonymized, within a two-month timeframe from when checking
operations are closed.
When a disciplinary procedure or legal proceedings are started against the person implicated or theauthor of an abusive alert, the data relating to this alert is kept until the end of the procedure. Data
subject to archiving measures is kept, in the framework of a distinct information system with restricted
access for a duration that does not exceed litigation procedure timeframes.

What data does ROQUETTE collect?
In accordance with the General Data Protection Regulation, ROQUETTE complies with the principles ofrelevance and data minimization. ROQUETTE divides the alert into two phases:
1- The issuing phase
During this phase, the whistleblower is asked to communicate strictly factual information directly
related to the subject of the alert. It is up to the whistleblower to understand what information isnecessary to process the alert.

2-The investigation phase
This phase enables ROQUETTE to investigate the reported events. ROQUETTE determines theevidence that may be collected or kept in the system.
As part of the investigation, ROQUETTE may process the following data:•••ID, job title, and contact information of the whistleblower.
ID, job title, and contact information of the persons who are the focus of the alert.
ID, job title, and contact information of the persons involved in collecting or processing thealert.

12PUBLIC••••

Reported events.
Items collected as a result of verifying the reported events.
Verification reports.
Follow-up of the alert.

ROQUETTE regularly updates its reporting log.

How can I exercise my rights?
ROQUETTE processes your data in order to comply with the various regulations on whistleblower
protection and, in particular, Law no. 2016-1691 dated December 9, 2016 on transparency, the fightagainst corruption and the modernization of the economy.
The purpose for processing the data is to assess the appropriateness of the alerts, to investigate them,and to take any appropriate measures necessary.

Your data may be sent to other ROQUETTE Group companies, judicial and administrative authorities
in order to process the various alerts.
As a data subject of ROQUETTE's data processing, you have the following rights:• The right to request access to your personal data.
• The right to have your personal data corrected or deleted.
• The right to limit the processing of your personal data.
• The right to object to the processing of your data.
• The right to the portability of your data.
You can exercise your rights under the General Data Protection Regulation by contacting the DPO atthe following address:
Jennifer Godin, Group Data Protection Officer
Roquette Frères, Legal & Compliance
Rue de la Haute Loge, 62136 Lestrem France
Or the following email: DPO@roquette.com
ROQUETTE has one month to respond to your requests.

13

PUBLIC

Sources and references
Useful links
https://www.defenseurdesdroits.fr/fr/lanceurs-dalerte

For more details
https://www.cnil.fr/sites/default/files/atoms/files/referentiel-alertes-professionnelles_dec_2019.pdf
https://www.cnil.fr/fr/le-referentiel-relatif-au-dispositif-dalertes-professionnelles-en-questions

Reference texts> Article 6 of the General Data Protection Regulation (GDPR)> Article 8 of the GDPR
> Article 8 of the “SAPIN 2” law> Article 17 of the “SAPIN 2” law> Article L. 225-102-4 of the French Code of Commerce> Deliberation no. 2019-139 of July 18, 2019 adopting a reference standard relating toprocessing personal data intended for implementing a professional alert system

Tool
https://peopleintouch.com/14PUBLIC15