Whistleblowing Policy

1. Introduction

If something at eclean is wrong, unsafe, or against the law, we want to know. This policy explains how to tell us and how we protect you when you do.

This Whistleblowing Policy explains how to report wrongdoing at eclean, what happens after you report, and how we protect the people who report and the people they report about.

It applies to eclean Labs AB and ECLEAN LIMITED. Where this policy says "we," "us," or "eclean," we mean both companies, individually or together as the context requires.

We follow ISO 37002 (Whistleblowing management systems) and the EU Whistleblowing Directive (Directive (EU) 2019/1937). Where whistleblowing law applies to us, including the Swedish Whistleblowing Act (Lag (2021:890) om skydd för personer som rapporterar om missförhållanden) and the UK Public Interest Disclosure Act 1998, we comply with it. Where it doesn't, we follow this policy anyway. If the law where you live protects you more than this policy does, the law wins.

2. Who can report

Anyone. You don't have to work for us, and you don't have to live anywhere in particular.

You can report if you are, or have been, any of the following:

• People who work with us: Employees, interns, trainees, volunteers, and job applicants
• People who work for us: Contractors, freelancers, consultants, and their staff
• People we do business with: Suppliers, partners, investors, and shareholders
• Customers and users of eclean's software and services
• Anyone else who has learned about wrongdoing at eclean

You are protected whether the information came to you during a working relationship, before one started, or after it ended.

3. What you can report

Wrongdoing, risks, and breaches of law or policy. Product support and bug reports have faster routes.

You can report anything at eclean that you have reasonable grounds to believe is wrong, unsafe, or against the law. The reporting site at report.eclean.gg has five topics:

• Fraud or financial wrongdoing: Bribery, theft, false records or invoices, expense or payroll abuse, conflicts of interest, money laundering, or sanctions breaches
• Misuse of personal data: Personal data used for a purpose people weren't told about, shared with people who shouldn't have it, kept longer than it should be, or a data breach that wasn't reported
• Security problems inside eclean: A security incident being kept quiet, a known weakness being ignored, security controls being bypassed, or passwords, keys, and secrets handled unsafely
• Harassment, discrimination, or workplace safety: Bullying, sexual harassment, discrimination, retaliation for speaking up, or risks to health and safety at work
• Something else: Anything else that breaks the law or eclean's own policies, or harms customers, users, competitors, or the environment

You can report something that has happened, something that is happening, or something you believe is likely to happen, as well as attempts to hide any of it.

Some things have better routes:

• Product support, billing, and account questions: Our contact page
• Vulnerabilities in eclean's software or websites: security@eclean.gg, encrypted with our PGP key if you like, so they can be fixed quickly
• Disagreements about your own employment terms that don't involve wrongdoing: The founders, directly

If you're not sure whether something qualifies, report it anyway. We would rather read a report that turns out to be out of scope than miss one that matters.

4. How to report

Online at report.eclean.gg, anytime, with or without your name. Keep the 16-digit receipt you get at the end.

Online. Go to report.eclean.gg, choose the topic your report is about, and answer the questions. You can attach documents, screenshots, or recordings. You don't need proof; reasonable grounds to believe what you report are enough.

Anonymously, if you prefer. You don't have to tell us who you are, and you can still read our replies and answer our questions through the site. For the most privacy:

• Open the site in Tor Browser, which hides your IP address and location
• Leave out details that point to you, unless you choose to share them
• Remove hidden details from files before you attach them, such as the author in a document's properties or the location in a photo

You can choose to tell us who you are at any point, then or later.

Your receipt. When you submit, you get a 16-digit receipt. It's the only way back to your report: to read our replies, answer our questions, and add details. Keep it somewhere safe. We can't recover it, because we never know whose it is.

In a meeting. If you would rather speak to someone, ask for a meeting or a call through your report, and we will arrange one within a reasonable time. With your consent, we keep a written record of the conversation, and you can check and correct it.

5. What happens after you report

We confirm within 7 days and tell you what we're doing within 3 months. You follow along with your receipt.

During the investigation we may ask you questions through the site. Answering is up to you. Outside experts, such as lawyers, accountants, or security specialists, are bound by confidentiality before they see anything.

Feedback is as complete as we can make it, but some details may stay confidential, for example disciplinary action against a named person or information that could identify someone.

Every closed report records one of four outcomes: substantiated, not substantiated, out of scope, or not a genuine report.

If a report reveals a crime or an immediate risk to someone's health or safety, we may have to involve the authorities. Where we can, we will tell you first.

6. Who handles reports

A small, named group, and never anyone your report is about.

Reports are received and handled by the people eclean designates for this role, currently eclean's co-founders. They handle reports independently of their other duties, follow this policy, and are bound by strict confidentiality.

Conflicts of interest. When you report, you choose who receives it. If your report concerns one of the people who handle reports, leave them out and they will never see it. Anyone with a conflict of interest in a report steps back from handling it. If a report concerns everyone who handles reports, we appoint an independent outside investigator, and you can also report to an authority (see section 11).

7. Confidentiality and anonymity

Your identity stays with the people handling your report, unless you agree otherwise or a court orders it.

Reports are encrypted, and only the people handling a report can read it. Every staff account on the reporting site requires two-factor authentication, and every access to a report is logged.

If you tell us who you are, we will not share your identity, or anything that could reveal it, with anyone beyond the people handling your report without your explicit consent. The only exception is a disclosure the law requires, for example in court proceedings. In that case we will tell you first, unless doing so would put the investigation or the proceedings at risk.

The same confidentiality protects everyone named in a report.

8. What we never do

No hunting for anonymous reporters, no IP logs, and no penalties for honest mistakes.

We want to be clear about things we will never do:

• We never try to identify an anonymous reporter. Not through the report's content, not through files, and not by asking around.
• We never record your IP address on our servers. Our gateway removes it before a request reaches the reporting site, and doesn't log requests to the site at all.
• We never ask for your receipt. No one at eclean will ever ask you for it. Anyone who does isn't us.
• We never put report details in email. Notifications to the people handling reports say only that there is something to read.
• We never punish an honest mistake. A report made on reasonable grounds stays protected even if it turns out to be wrong.

9. Protection from retaliation

No one at eclean may treat you worse for reporting in good faith. If someone does, report that too.

eclean does not tolerate retaliation against anyone who reports in good faith, or against anyone who helps them, such as a colleague, a relative, or a witness.

Retaliation includes, but is not limited to:

• Dismissal, suspension, demotion, or a withheld promotion
• Changed duties, location, hours, or pay
• Negative reviews or references, or withheld training
• Disciplinary action, intimidation, harassment, or exclusion
• Damage to your reputation, including on social media
• Ending or not renewing a contract early, or blacklisting

Threats and attempts to retaliate count as retaliation.

Anyone at eclean who retaliates, or tries to stop someone from reporting, faces disciplinary action up to and including dismissal or the end of their contract with us.

If you believe you have been treated worse because of a report, report that through the same site. You keep these protections even if your report turns out to be mistaken, as long as you had reasonable grounds to believe it when you made it.

10. Fairness to people named in a report

Being named in a report isn't a finding of wrongdoing. Everyone gets heard.

Anyone named in a report is presumed innocent until the investigation concludes. Where it won't put the investigation or the reporter at risk, they will be told about the allegations and given the chance to respond before any decision about them is made. Their identity is protected in the same way as the reporter's.

Knowingly making a false or malicious report isn't protected by this policy, and may lead to disciplinary action or legal consequences.

11. Reporting to an authority

We'd like to hear it first, but you don't have to come to us. You can go straight to the authorities.

We encourage you to report to us first, because it's usually the fastest way to fix the problem. You don't have to. You can report directly to the authority responsible for the matter in your country, such as a data protection authority, a financial supervisor, a work environment authority, or the police, and to the institutions, bodies, and agencies of the European Union.

• In Sweden: The Swedish Work Environment Authority (Arbetsmiljöverket) publishes the list of authorities that receive whistleblowing reports, at av.se
• In the United Kingdom: The government publishes the list of prescribed persons and bodies, at gov.uk
• Elsewhere: Your national whistleblowing or data protection authority can tell you where to go

In some circumstances the law also protects public disclosure, such as going to the media, for example if reports to us and to the authorities haven't led to appropriate action, or if there is an imminent danger to the public.

12. How we process personal data in reports

Reports hold personal data about you and the people involved. Here's what happens to it, and for how long.

eclean Labs AB is the data controller for personal data processed through the reporting site, as described in our Privacy Policy. That policy applies to reports except where this section says otherwise.

What we process

• The report: What you write, the answers you give, and the files you attach
• People named in it: The identities and roles of the people a report concerns or mentions
• Your identity: Only if you choose to share it
• Case records: Our messages with you, the report's status and outcome, and who opened it and when

We process only what the report needs, and we delete anything clearly irrelevant to it.

Legal basis

Where it lives and who can see it

• Storage: Encrypted, on servers eclean runs in the EU
• Access: Only the people handling the report, and outside experts or authorities where section 5 or the law requires it
• Network: Connections pass through Cloudflare, our network provider, which handles your IP address to deliver the site. Our servers don't store it, and Tor Browser hides it from Cloudflare too.
• Email: Notifications are sent through Resend (EU region) and contain nothing from the report

Retention

Your rights

You have the rights described in our Privacy Policy, including access, correction, and deletion. Where exercising a right would reveal a reporter's identity or put an investigation at risk, the law allows us to limit or postpone it, and we will tell you when that applies to you.

You can also complain to the Swedish Authority for Privacy Protection (IMY), the UK Information Commissioner's Office (ICO), or your local supervisory authority, as listed in our Privacy Policy.

13. Records and review

We keep the channel accountable and this policy current.

We keep a confidential record of every report and how it was handled, for no longer than section 12 allows. We review this policy and how the channel works at least once a year, and after any significant change in the law, in our organization, or in what we learn from reports.

14. Changes to this policy

We may update this Whistleblowing Policy to reflect changes in our practices or legal requirements. We will update the "Last updated" date, and earlier versions are available on request. Changes never reduce the protection of a report already made.

15. Contact us

Questions about this policy go to legal@eclean.gg. Reports go to report.eclean.gg.

For questions about this policy, as opposed to reports:

• Email: legal@eclean.gg
• Reports: report.eclean.gg

Don't send a report, or anything about one, by email. Email isn't confidential the way the reporting site is.

eclean Labs AB
Registration Number: 559546-5831
STORGATAN 41C
931 31 SKELLEFTEÅ, Sweden

ECLEAN LIMITED
Company Number: 14953607
Suite 3194 Unit 3a, 34-35 Hatton Garden
London, EC1N 8DX, United Kingdom