Rules on internal reporting of breaches
Rules on internal reporting of breaches
І. General provisions
Article 1.(1) These rules govern the terms and conditions for internal reporting of breaches and for following up on such reports at Lavena AD (the Company) in accordance with the provisions of the Act on the Protection of Persons Who Report or Publicly Disclose Breaches (Whistleblowers Protection Act) (WPA).
(2) The objective of these rules is to ensure information and assurance for protection of persons who report or publicly disclose information about breaches of the Bulgarian legislation or of European Union acts, they have become aware of in relation to their employment or official duties or in another work-related context.
Article 2.(1) Reporting of breaches shall be possible through:
- internal reporting channels;
- external reporting channels.
(2) Persons who report or publicly disclose information about breaches may choose the reporting method.
Article 3. Protection under WPA shall be provided to:
1. a whistleblower from the time of reporting or public disclosure of information about breach;
2. persons who facilitate the whistleblower in the process of reporting;
3. persons who are reported to the whistleblower and who may be subject to repressive retaliation due to the reporting;
3. legal entities the whistleblower has an equity interest in, works for, or is otherwise related with in work-related context.
Article 4. (1) An employee of the Company shall be appointed by virtue of internal order who shall be in charge of the breach report handling.
(2). The person in charge of report handling shall not be in conflict of interest for each handled case.
ІІ. Internal reporting channel
Article 5. (1) The report may be send either in writing or orally. The report is send to the employee under article 4.
(2) Written reports shall be send by means of post parcel delivered by licensed post operator to the following address: city of Shumen, 9700, kv. Industrialen, Lavena AD, or by electronic message via email to the following address: signals@lavena.bg. Written reports shall be sent by the sender by filling-in the template of the Personal Data Protection Commission. Updated version of the template can be found on the website of the Personal Data Protection Commission (https://www.cpdp.bg/). The report may be accompanies by any kind of information sources, which support the statements made therein, and/or by references to documents, including contact details of persons who might confirm the reported details or to provide additional information. When sending a report in writing, in a post parcel, the text “report under WPA” should be subscribed under the addressee’s address. The parcel shall be immediately delivered to the employee under article 4, with a list, and unopened. Upon receiving a written report in a parcel, the employee under article 4 shall draft a protocol with detailed description of the parcel content. The protocol is an integral part of the report file. Access to the content of the email shall be given to the employee under article 4 only.
(3) Oral reports shall be made by phone on +359 850 147 or, upon whistleblower’s request, through face-to-face meeting, within the established working hours of the Company, in an appropriate time period as agreed upon between the parties.
IІІ. Acceptance and registration of reports
Article 6. Any report made orally, at face-to-face meeting or by email in free format shall be documented by the employee under article 4 by filling-in a form in strict observance of the provisions of article 15, paragraph 2 of WPA. Upon filling-in the required information in the form, the whistleblower shall be given the opportunity to sign the form. The refusal or consent to sign the form shall be specified in therein. In case the required data to fill in the form cannot be identified from the sent written report or electronic message, the employee under article 4 shall invite the whistleblower to fill in the missing information. Such invitation shall be served in the same way as the report has been received.
Article 7. (1) In case a report of breach of the Bulgarian legislation in the fields under article 3 of WPA, or of the European Union acts as set out in the annex to WPA shall get into an employee other than the employee under article 4, the receiving employee shall be prohibited to disclose any kind of information that could identify the whistleblower or the person concerned. The report shall be immediately forwarded, without modifications, to the employee under article 4 who is in charge of report handling within the Company.
(2) Provided any report under paragraph 1, which shall not be within the competence of the Company, shall be directly received at Lavena AD, the employee under article 4 shall immediately forward it to the Personal Data Protection Commission (PDPC) through the external reporting channel.
Article 8. (1) An electronic register of reports shall be established and maintained at Lavena AD according to the PDPC template. The register shall contain information as set out in article 18, paragraph 2 of WPA.
(2) The register shall be kept by the employee under article 4. The register shall not be public and shall be accessible only for the employee under article 4.
(3) The terms and conditions for keeping such register shall be determined in these Rules in accordance with the requirements of the Ordinance under article 18, paragraph 4 of WPA.
(4) The employee who is in charge of report handling shall be obliged to regularly submit the necessary statistical information to the national authority for external reporting in accordance with the procedure established by such authority, including, if technically feasible, by establishing a direct connection between the entity’s register and the register kept by the national authority for external reporting.
Article 9. (1) The electronic documents under the breach reports shall be processed and kept in files by the employee under article 4 organized in especially developed workspace within the Company’s infrastructure.
(2) Hardcopies of documents under reports shall be stored by the employee under article 4 organized in individual files in a metal cabinet (strong-box) and in a way that shall ensure their confidentiality and security.
(3) Any new documents relevant to a report already sent shall be subject to registration under the same number.
(4) Documents under reports shall be handled in strict observance of the Personal Data Protection Policy of Lavena AD.
ІV. Handling, reporting and deciding on reports
Article 10. (1) Upon receiving a report, the employee under article 4 shall generate a unique identification number (UIN) from the PDPC website and shall register the report in the register under article 18 of WPA.
(2) Within 7 days of the receipt of the report, the employee under article 4 shall verify the regularity of the report, shall confirm its receipt and shall provide the whistleblower with details about the report UIN and registration date.
(3) In case the report shall not meet the requirements of article 15, paragraph 2 of WPA, the whistleblower shall be sent a notice to remedy any irregularities within 7 days of the receipt of the report.
(4) Upon failure to remedy the irregularities within the time period as set out in the preceding paragraph, the employee under article 4 shall submit a report to the executive director of Lavena AD, which does not contain identification information of reporting natural persons and/or persons anyhow concerned by the report, and then returns the report to the whistleblower, together with the attachments thereto.
Article 11. (1) Each report shall be verified by the employee under article 4 in terms of its admissibility and authenticity. If the verification shall find that the report does not fall within the scope of WPA and its content does not give grounds to be accepted as plausible, a report to the manager of the Company shall be prepared.
(2) Any reports that contain apparently untrue or misleading fact statements shall be return with instructions to the sender to correct the statements and with information about the liability they have for false accusation.
Article 12. (1) In case the report shall be subject to handling, a report to the executive director of Lavena AD shall be drafted stating: the subject matter of the verification; the verification period; the time to make the verification with deadline, and deadline for submission of report.
(2) In case the facts stated in the report shall be confirmed, the employee under article 4:
а) shall organize the follow up in relation to the report, and to this end, they shall be entitled to ask other persons or units within the structure of the Company for assistance;
b) shall draft and submit a report under the case to the executive director of the Company providing details about the report, without disclosing personal data, unless the employee shall be required to disclose such data by law, the undertaken follow up and suggestion for undertaking specific measures to terminate or prevent the breach;
c) enclose to the report any evidence collected in the course of the verification in the form of written attachments.
(3) Within three months after the confirmation of the receipt of the report, the employee under article 4 shall draft a short report on behalf of the Company, which shall summarize the report details, the undertaken actions, the final results of the verification, which, together with the arguments, shall be notified in writing to the sender and to the person concerned in strict observance of the obligation for their confidentiality and security.
Article 13. All actions of the employee under article 4 in the course of the report handling shall be documented on hardcopy and/or electronic medium.
Article 14. Upon receipt of many reports for more severe breaches, such reports shall be prioritized. Reports in relation to breaches that in time have or could have significant and permanent adverse effect on the public interest shall be handled as a priority.
Article 15. Access to the information related to the reports of breaches and to the protection of whistleblowers’ identity shall be granted to employees only on “must know” basis in order to enable them to fulfil their official duties, or to employees who are nominated as persons in charge in accordance with these Rules. The transfer of data and referencing to circumstances shall not directly or indirectly disclose the identity of the whistleblower or shall give rise to any suggestion about their identity.
Article 16. The drafted documents, which, in the course of the report handling, shall be accessed by any persons with view of their competence, shall not contain data or information about the whistleblower or any other information from which their identity can directly or indirectly become known.
Article 17. Personal data that are irrelevant for the handling of the respective report shall not be collected, and in case of accident collection, they shall be erased.
V. Conditions and measures to ensure protection
Article 18. Any person reporting a breach through internal or external channel shall be entitled to protection, provided there has been a good reason to believe that the reported information for breach has been true at the time of its submission and provided such information falls within the scope of article 3 of WPA.
Article 19. (1) Any form of retaliation against the persons under article 3 of these rules, being characterized as repression and placing them in unfavorable position, as well as any threats or attempts for such actions, including in the form of:
1. suspension, lay-off, dismissal or application of other grounds for termination of the employment under which the person has been employed;
2. demotion or withholding of promotion;
3. change of location of the place or nature of work, change in working hours or reduction in wages;
4. withholding training for maintaining and improving the worker’s or employee’s professional qualification;
5. a negative performance assessment;
6. administering of any financial and/or disciplinary liability, including imposition of disciplinary punishments;
7. coercion, ostracism, intimidation for retaliation or actions manifested physically, orally or otherwise, which are intended to harm the dignity of the person and to create a hostile professional environment;
8. direct or indirect discrimination, unfair or unfavorable treatment;
9. failure to convert a temporary employment contract into a permanent one, where the worker or employee had legitimate right that he or she would be offered permanent employment;
10. early termination of temporary employment contract or withholding of renewal, where this is admissible by the law;
11. early termination or cancellation of a contract for goods or services, where the person is a supplier, shall be prohibited.
Final provisions
§ 1. These Rules are issued on the grounds of article 13 of WPA.
§ 2. These Rules are approved by order of the executive director of Lavena AD and shall become effective as from 17.12.2023.
§ 3. Any personal data processing, including exchange or transfer of personal data by the competent authorities shall be carried out in accordance with Regulation (EU) 2016/679 and Directive (EU) 2016/680, and where European Union institutions, authorities, offices or agencies are involved in the transfer – in accordance with Regulation (ЕU) 2018/1725, and the Personal Data Protection Act.
§ 4. The employee under article 4 shall review and analyze the practice for implementation of these rules at least once every three years, and whenever needed, shall undertake follow-up actions for their update.
§ 5. Any issues that are not stipulated in these rules shall be governed by the provisions of WPA.