Complaint handling

Complaint handling

HUNGAROBLECH KFT. Policy on the operation of the internal whistleblowing system

Purpose of the Policy

The purpose of this Policy applied by hungaroBLECH Kft. (hereinafter: the Company) is to define the process and rules for identifying, investigating and handling internal wrongdoing.

Persons covered by the Policy

The Policy applies to all workers and employees of the Company and to every person who reports information concerning wrongdoing, including current and former employees of the Company;
persons wishing to establish an employment-related legal relationship with the Company (e.g. job applicants), provided that the procedure for establishing that relationship has begun (e.g. they have attended a job interview);
sole traders, sole proprietor companies, subcontractors and suppliers that have, have had, or have begun the procedure for establishing a contractual relationship with the Company, and persons under the supervision and direction of a contractor (the latter typically being employees);
persons who hold or have held an ownership interest in the Company, persons who are or have been members of the Company's administrative, management or supervisory body, including non-executive members, and persons for whom the procedure for establishing a legal relationship or contract to acquire an ownership interest or participate in the administrative, management or supervisory body has begun; as well as trainees or volunteers carrying out activities at the Company
(hereinafter collectively: the “Reporting Person”).

Period of validity of the Policy

This Policy takes effect on 1 December 2023 and remains in force for an indefinite period.

Publication and maintenance of the Policy

The person appointed by the managing director is responsible for developing, publishing and maintaining this Policy, establishing the conditions for its applicability and monitoring the application of its provisions.
The Company publishes clear and detailed information in Hungarian on its official website concerning the operation of the reporting system and the procedure relating to reports, addressed to employees, contractual partners and other third parties.

Related legislation and guidance

Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (Info tv.) Act I of 2012 on the Labour Code (Mt.) Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (GDPR) Act XXV of 2023 on Complaints, Public Interest Disclosures and Rules Relating to the Reporting of Wrongdoing (Panasz tv.)

Abbreviations and definitions

Anonymous reports: The Reporting Person is also entitled to make a report anonymously (without providing personal data). The Company guarantees that in such cases it will not seek to establish the Reporting Person's identity; however, under Panasz tv., it is not obliged to investigate an anonymous report in such cases.
Reporting Person: The persons specified in point 2 of this Policy qualify as Reporting Persons.
Report: Information concerning an unlawful or allegedly unlawful act or omission, or other wrongdoing, and breaches of rules of conduct established by the Company to protect the public interest or an overriding private interest may be reported through the internal whistleblowing system.
Protection of the Reporting Person: The Company protects the Reporting Person, provided that the report was not made anonymously, and ensures that the Reporting Person suffers no retaliation, disadvantage or other negative consequence in connection with making the report (excluding cases where, in the course of reporting, the Reporting Person acts in bad faith and intentionally provides false information or presents a true fact in a false light). The protection afforded to the Reporting Person also applies where, during an investigation initiated by a report made in good faith, the Investigator(s) find the report to be unfounded.
Person concerned by the report: A person whose conduct or omission gave rise to the report, or who may have substantive information about the matters contained in the report.
False report: The threshold for protection of the Reporting Person is a “reasonable belief in a breach”. A false report does not receive protection, except where the report was made with a well-founded belief that the information was true. Protection also extends to persons who communicate inaccurate information or make a report by mistake, but does not extend to cases where, in the course of reporting, the Reporting Person acts in bad faith and intentionally provides false information or presents a true fact in a false light.
Investigator(s): Independent person(s) with appropriate authority and experience who handle and investigate reports on behalf of the Company.
Whistleblowing report: A whistleblowing report means an oral or written report, as defined in this Policy, concerning wrongful acts, including in particular, but not limited to, corruption offences, breaches of legal obligations, unlawful procedures, specific threats to public health, public safety or the environment, unauthorised use of public funds or public assets, serious waste or misappropriation, conflicts of interest, and any acts intended to conceal or cover up these activities.

Protection of the Reporting Person

The Company protects the Reporting Person and ensures that the Reporting Person suffers no retaliation, disadvantage or other negative consequence in connection with making the report (excluding cases where, in the course of reporting, the Reporting Person acts in bad faith and intentionally provides false information or presents a true fact in a false light). The protection afforded to the Reporting Person also applies where, during an investigation initiated by a report made in good faith, the Investigator(s) find the report to be unfounded.

Procedure relating to reports

Making reports

Information concerning an unlawful or allegedly unlawful act or omission, or other wrongdoing, and breaches of rules of conduct established by the Company to protect the public interest or an overriding private interest may be reported through the internal whistleblowing system.
The Company provides the following methods of making a report:
By post, by sending a letter addressed to the Office Manager at the Company's address (5000. Szolnok, Mester u. 41.). Anonymous reports may also be made in this way, but the Company is obliged to investigate only reports that are signed and made under the Reporting Person's name.
The envelope must bear the marking “VISSZAÉLÉS BEJELENTÉS, BIZALMAS” (“WHISTLEBLOWING REPORT, CONFIDENTIAL”) or “VISSZAÉLÉS BEJELENTÉS, SK FELBONTÁS” (“WHISTLEBLOWING REPORT, TO BE OPENED BY THE ADDRESSEE ONLY”).
Letters bearing such markings must be forwarded separately to the Office Manager for opening and preliminary examination.
By e-mail, in the form of an electronic letter sent to: [visszaelesbejelentes@hungaroblech.com](mailto:visszaelesbejelentes@hungaroblech.com)
In person at the workplace, using the boxes placed in the lobby.
Orally by telephone, from Monday to Friday between 10,00-15,00, by calling +36 56 210-001 and asking for the Office Manager.
If the report concerns the Office Manager, letters sent by post must be addressed to the Managing Director, and the caller must likewise ask for the Managing Director when making a report by telephone.
When making a report, the Reporting Person may provide their name and home address or, in the case of a legal entity making a report, its registered office and the name of its legal representative submitting the report. They may also declare that the report is made in good faith concerning circumstances of which they are aware or which they have reasonable grounds to believe are true. In the case of non-anonymous reports, the Company may check whether such a declaration has been made or, if necessary, ask the Reporting Person to make such a declaration.
If the Reporting Person makes an oral report, the Company, after providing the information required by the rules on the protection of personal data, records it in a durable and retrievable form or puts it in writing and gives a duplicate copy to the Reporting Person, while providing the opportunity to check it, correct it and accept it by signing.
The person acting on behalf of the Company and recording the report is the Office Manager, who prepares a complete and accurate record when putting an oral report in writing and draws the Reporting Person's attention to the consequences of reporting in bad faith, the procedural rules governing the investigation of the report, and the fact that their identity, if they provide the data necessary to establish it, will be treated confidentially at every stage of the investigation.
The Company informs the non-anonymous Reporting Person of the outcome of the investigation and the measures taken, provided that they have supplied their contact details.

Not conducting an investigation

The Investigator(s) may consider whether to investigate the report and, as a result, may decide not to investigate in the following cases:
an anonymous report,
a repeated report with the same content as an earlier report made by the same Reporting Person,
a report made by a person who is not entitled to report or by an unidentifiable reporting person,
where the harm to the public interest or an overriding private interest is disproportionate to the restriction of the rights of the person concerned by the report.
A decision not to investigate a report is possible only with appropriate justification. If there is any possibility of a breach of the rules or wrongdoing, an investigation may not be omitted, except in the case described in point (iv).

Investigation process

The Company designates the Office Manager, appointed by the Managing Director, to investigate reports. Taking account of the rule of impartiality and the seriousness and subject matter of the issue, the Office Manager may involve additional investigators in the investigation process (hereinafter: Investigator(s)). If the Office Manager's involvement in the report is clear or may be presumed from the subject matter of the report, it is the Owner's duty to appoint an impartial investigator. In relation to third parties, the procedures and measures of the Investigator(s) constitute the procedures and measures of the Company.
The Office Manager receives, records and forwards reports within the organisation to the Investigator(s).
The Office Manager opens, reads, listens to and studies the report, carries out the related preliminary examination that does not address the merits, and then forwards it to the Investigator(s).
During the preliminary examination, the Office Manager establishes whether the report is anonymous or the Reporting Person can be identified, and whether the Reporting Person is entitled to make the report. The Office Manager then forwards it to the Investigator(s), with a recommendation as to whether to conduct an examination on the merits or to omit it. If the report concerns the operation of Human Resources, the decision is made by the Managing Director/Owner.
Following further preliminary examination, the Investigator(s) acknowledge the written report to the Reporting Person as soon as possible after receipt, but within a maximum of 7 days, and at the same time provide general information about the procedure and the data protection rules.
The person concerned by the report must be informed of the report and given an opportunity to set out their position in detail and substantiate it, including through a legal representative.
During the procedure, the Investigator(s) may interview witnesses and request evidence (e.g. correspondence, contracts, other documents, etc.) from workers and other employees or the Company's other contractual partners.
Until the investigation is concluded or formal action to establish responsibility is initiated as a result of the investigation, the Investigator(s) must keep information about the content of the report and the persons concerned by it confidential and, except for informing the person concerned by the report, may not share it with anyone, in particular with any other organisational unit or member of staff of the Company, except in cases specified by law. Under Panasz tv., data may be transferred to an external organisation participating in the investigation, while ensuring compliance with the necessary data protection requirements.
The investigation must be carried out as soon as possible, but no later than thirty (30) days after the report, unless the report is anonymous. In particularly justified cases, and with the Reporting Person being informed at the same time, the investigation may exceed thirty (30) days, but may not exceed three (3) months. The reasons for extending the deadline must be properly documented. The Investigator(s) must complete the investigation within a maximum of three (3) months.
The requirement of a fair procedure must be upheld in proceedings initiated following a report. In the course of those proceedings, persons concerned by the report must receive equal treatment irrespective of their position.
Following the investigation, the Investigator(s) prepare a report summarising their findings and, if they consider the matters reported to be well-founded, establish an action plan to prevent similar breaches of the rules or wrongdoing in the future. Where necessary, taking account of the relevant provisions of Mt., they also make recommendations on sanctions against persons who breached the rules, employees who committed wrongdoing, or persons representing the Company (such as intermediaries or agents). In the case of employees, the recommendation may be a warning or another adverse legal consequence specified in the collective agreement, or, depending on the seriousness of the breach, termination of employment by notice or with immediate effect. For persons engaged outside an employment relationship, they recommend the adverse legal consequence, other measure or termination of the legal relationship to be applied, taking account of the specific features of that relationship. The Investigator(s) submit their report to the Office Manager. If the Office Manager is implicated, the report must be submitted directly to the Managing Director/Owner. If the Managing Director is implicated, the report must be submitted to the Office Manager, Csomor Csilla.
With the Managing Director's approval (or, if both the Office Manager and the Managing Director are implicated, with the Owner's approval), the Office Manager informs the Reporting Person, provided that the report is not anonymous, whether the report has been investigated or an investigation has been omitted and the reason for such omission, the outcome of the investigation, and the measures taken or planned. Notification is sent by e-mail and by post, provided that the Reporting Person supplied their postal address in the report.
If, during the investigation, the Investigator(s) identify grounds for initiating criminal proceedings, a criminal complaint may be filed with the competent investigating authority following the Office Manager's decision to that effect, with the Managing Director's approval – the Owner where both the Office Manager and the Managing Director are implicated.
If the matters contained in the report warrant proceedings before an authority, the competent authority may be notified following the Office Manager's decision to that effect, with the Managing Director's approval – the Owner where both the Office Manager and the Managing Director are implicated.
The Office Manager keeps a register of reports, which is kept confidentially in a locked office and, within that locked office, in a locked cabinet. Electronic records, notes and draft documents relating to reports are stored in a separate folder with restricted access rights, accessible to the Office Manager and the Investigator(s).

Information about data processing

The Company provides the following information about data processing.

Identity of the controller

The controller is hungaroBlech Kft. (registered office: 5000. Szolnok, Mester u. 41.).
The Reporting Person's personal data may not be transferred, except in the case specified by law, namely the Reporting Person's prior written approval. They may be processed only by employees or persons engaged under another legal relationship who have been entrusted with investigating reports.
If the Reporting Person reveals their identity, the Company treats their personal data confidentially at every stage of the investigation, having regard to the provisions of GDPR and Info tv. and in accordance with the requirements of Panasz tv.

Contact details

HungaroBlech Kft.
Address: 5000. Szolnok, Mester u. 41.
Telephone number: +36 56 210-001
E-mail address: [visszaelesbejelentes@hungaroblech.com](mailto:visszaelesbejelentes@hungaroblech.com)

Details of data processing

The fundamental purpose of processing personal data is to investigate information contained in reports made through the internal whistleblowing system concerning an unlawful or allegedly unlawful act or omission, other wrongdoing, or a breach of rules of conduct established by the Company to protect the public interest or an overriding private interest, and, in the event of an irregularity, to remedy it and/or impose appropriate sanctions.
The processing of special categories of personal data in the reporting system is prohibited. The persons investigating the report immediately erase data concerning third parties not involved in the report, data not necessary to investigate the report, and data that may not be processed under Panasz tv.
The Company processes the Reporting Person's personal data to fulfil its legal obligation under Panasz tv. The Reporting Person's personal data may not be disclosed to the public without their unambiguous consent.
The Company does not carry out automated data processing, does not make decisions based on automated processing without human intervention, and does not carry out profiling. The Company is not obliged to appoint a data protection officer. The Company does not transfer personal data to third countries (countries that are not EU Member States).
The source of the data is the data subject directly in the case of a reporting person, and the Reporting Person in the case of a person concerned by the report.
The following important information applies to the processing:

Data subjects' rights in relation to data processing

The data subject has the right to request information about the features of the processing specified in Articles 13 and 14 of GDPR. The Company fulfils the data subject's right to information in accordance with the data processing notice contained in this Policy.
The data subject has the right to access data concerning them that are processed by the Company (the data subject may request information about whether their personal data are being processed and, if such processing is taking place, is entitled to obtain access to the personal data and the information specified in Article 15 of GDPR). The data subject may request a copy of the personal data being processed. The first copy is free of charge; for further copies, the Company may charge a reasonable fee based on administrative costs. If the data subject submitted the request electronically, the information is provided in electronic form, through a secure channel and protected by a password, unless the data subject requests otherwise.
The data subject has the right to request rectification of inaccurate data.
The data subject is entitled to have the Company erase personal data concerning them without undue delay at their request if any of the following grounds applies:
the personal data are no longer necessary for the purpose for which they were collected or otherwise processed;
the data subject objects to processing and there are no overriding legitimate grounds for processing;
the personal data have been unlawfully processed;
the personal data must be erased to comply with a legal obligation under Union or Member State law applicable to the controller.
Erasure of data may not be requested if the processing is necessary to fulfil an obligation under Union or Member State law applicable to the controller.
In certain cases, the Company does not erase the data but restricts processing to storage alone. This may occur (i) if the data subject contests the accuracy of the personal data, (ii) if the processing is unlawful but the data subject does not wish to request erasure and requests only restriction of the use of the data, (iii) if the purpose of processing no longer exists but the data subject requests processing in order to exercise a right, or (iv) if the data subject has objected to processing but the Company must examine whether its legitimate grounds override the data subject's legitimate interests.
The data subject has the right to receive their data processed by the Company and to request their transfer to another party (the right to data portability). The data subject has the right to receive the data they have provided in a structured, commonly used, machine-readable format and to transmit them to another controller, and may request that their data be transferred directly to another controller.
If processing is based on the data subject's consent, the data subject may withdraw consent at any time without giving reasons. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.
The data subject may object to the processing of their personal data
if it is based on legitimate interests; in this case, processing may not continue unless justified by compelling legitimate grounds overriding the data subject's interests, rights and freedoms or by grounds relating to the establishment, exercise or defence of legal claims; or if it is carried out for, or is connected with, direct marketing, in which case processing for that purpose may no longer continue.

Available remedies:

If you have any complaint concerning your personal data, please first contact the Company using one of the contact details specified in the data processing notice section of this Policy, so that your complaint can be resolved amicably as soon as possible.
Proceedings before the data protection authority
You may also contact the data protection authority using the following contact details and request an investigation on the grounds that an infringement has occurred, or that there is an imminent risk of an infringement, in connection with the processing of personal data:
Name: Nemzeti Adatvédelmi és Információszabadság Hatóság Postal address: 1363 Budapest, Pf.: 5.
Address: 1055 Budapest, Falk Miksa utca 9-11. Telephone: +36 (1) 391-1400
Fax: +36 (1) 391-1410
E-mail: ugyfelszolgalat@naih.hu
Right to bring court proceedings
If your rights are infringed, irrespective of whether you lodge a complaint, you may also bring proceedings against the Company before the regional court with jurisdiction over your permanent or temporary place of residence.

Other reporting channels

If the Reporting Person finds that the operator of the whistleblowing system has not taken the measures specified in the Complaints Act within the prescribed time limit, they may make a report to the bodies specified in Panasz tv. or required to establish a separate whistleblowing system. Anyone may submit a report to the separate whistleblowing system.
The Reporting Person may make the report in writing or orally (by telephone or another voice messaging system, or in person). The report is handled in accordance with the rules of the body concerned.
The Reporting Person may make a public disclosure of the report if they first used the internal whistleblowing system and then the separate whistleblowing system, or directly used only the separate whistleblowing system, and the operator of the whistleblowing system or the body authorised to act did not take the measures specified in Panasz tv. within the prescribed time limit; or if the Reporting Person had reasonable grounds to believe that the circumstances concerned by the report clearly endangered the public interest, in particular where there was a risk of irreversible harm; or if the Reporting Person had reasonable grounds to believe that, if the separate whistleblowing system were used, the specific characteristics of the circumstances concerned by the report created a clear possibility that adverse action would be taken against the Reporting Person or that the matters reported would not be dealt with substantively.
Public disclosure is possible only for reports falling within the material scope of the Directive.
A report must be considered lawfully made if the reporting person publicly discloses it + obtained the information in connection with their work-related activities + had reasonable grounds to believe that the reported information was true + one of the conditions listed above is met.

Final provisions

The provisions of this Policy do not constitute a unilateral commitment by the employer. They are intended to fulfil the obligation to operate the internal whistleblowing system established by an employer pursuant to Panasz tv. 18. §.