Whistleblowing and Modern Slavery Reporting Policy

1. Purpose

Our voluntary Modern Slavery Statement commits BONDAP to assessing and remediating any incident brought to its attention. That commitment only means something if people — staff, contractors, suppliers' workers, or anyone else — feel safe raising a concern and know exactly how to do it. This policy sets out who can report, what to report, how to report it, what happens next, and the protections that apply. It works alongside our general Complaints Policy and Procedure (for service and commercial complaints) but is the specific route for modern slavery and related wrongdoing, and it gives effect to the whistleblowing commitments referenced in our Workforce Matters Policy.

Concerns raised under this policy about a specific suspected incident of modern slavery are then handled under the Modern Slavery Incident Response and Remediation Procedure.

2. Who can report

Anyone with a genuine concern can use this policy, including:

• BONDAP LTD employees, directors, and workers, and BONDAP Sp. z o.o. staff where this policy has been adopted;
• Contractors, freelancers, consultants, and agency workers engaged by BONDAP, whether on-site, remote, or engaged through a third party;
• Workers employed by our suppliers or subcontractors, including where they are supplied via a labour agency;
• Members of the public, clients, or anyone else who becomes aware of a concern connected to our business or supply chains.

You do not need to be a direct employee, and you do not need to be certain — a genuine, honestly-held suspicion is enough.

3. What to report

The primary focus of this policy is suspected modern slavery — forced or compulsory labour, servitude, human trafficking, debt bondage, deceptive recruitment, or child labour — occurring in BONDAP's own operations or anywhere in our supply chains (see the red flags in section 6 of the Anti-Slavery and Human Trafficking Policy).

This policy also covers wider wrongdoing in brief, consistent with the protections in the Public Interest Disclosure Act 1998: criminal offences, breach of legal obligation, danger to health and safety, environmental damage, miscarriages of justice, or the deliberate concealment of any of these. Where a report concerns wrongdoing unrelated to modern slavery, the CRO will still receive and triage it, redirecting it to the appropriate internal owner (e.g. under the Workforce Matters Policy) where more suitable, but the modern-slavery-specific process in this document takes priority for anything touching forced labour or trafficking.

4. How to report

The external routes listed above are UK services. If you are outside the UK — including BONDAP Sp. z o.o. staff and non-UK suppliers' workers — use the equivalent local emergency number and the local police or labour authority, and the internal routes above remain open to you.

You are never required to exhaust internal routes before going external, particularly where you believe internal reporting would not be safe or effective, or where someone is in danger.

5. What happens next

• Acknowledgement — we will acknowledge receipt of your report within 3 business days, using whatever contact method you provided (or, for genuinely anonymous reports with no way to reply, this step is not possible — see the Feedback bullet below and section 6).
• Assessment — the CRO (or, if the CRO is implicated or conflicted, another director) will assess the report and, where it concerns suspected modern slavery, open it as a case under the Modern Slavery Incident Response and Remediation Procedure. Reports about other wrongdoing are triaged to the appropriate policy or owner.
• Feedback — where possible and where confidentiality allows, we will let you know the outcome or general direction of the response. We cannot always share full details, particularly where doing so would compromise an affected worker's safety, a supplier's due process, or a police investigation, but we will not simply go silent on a named reporter without any update.

6. Confidentiality and anonymity

We will keep the identity of anyone who reports a concern confidential, sharing it only with those who need to know in order to investigate and respond, and only with the reporter's consent where practicable. You may also report anonymously via the route in section 4. Anonymous reports can be harder to investigate and we cannot give feedback directly to an anonymous reporter, but they will still be assessed and acted on.

7. No retaliation

BONDAP gives a strict guarantee: no one who raises a concern in good faith under this policy will be dismissed, disciplined, demoted, denied opportunities, excluded, or otherwise disadvantaged because they raised it. This applies equally to workers whose employer is a supplier, not BONDAP — we will not accept or facilitate retaliation against a supplier's worker for raising a concern about that supplier, and any supplier found to have done so is in breach of the Supplier Code of Conduct and the Model Contract Clauses — Modern Slavery.

Employees and workers with UK employment status who make a "protected disclosure" are protected in law under the Employment Rights Act 1996, as amended by the Public Interest Disclosure Act 1998: dismissal for making a protected disclosure is automatically unfair, and subjecting a worker to detriment for making one is unlawful. For BONDAP Sp. z o.o., equivalent protection is provided under Poland's implementation of the EU Whistleblowing Directive (2019/1937).

Anyone found to have retaliated against a reporter — whether a BONDAP employee, manager, or director — will face disciplinary action up to and including dismissal, regardless of seniority.

8. Good faith, not certainty

You do not need proof, and you will not be criticised or penalised for raising a concern that turns out, after investigation, to be mistaken or unfounded — provided it was raised honestly and in good faith. The only conduct that is not protected is a report known by the person making it to be false, or made maliciously.

9. Safety first

If anyone is in immediate danger, call 999 (or your local emergency number) first — do not wait to follow this policy's internal steps. Report through this policy afterwards, or ask someone else to do so on your behalf. Never confront a suspected perpetrator directly; this can endanger victims and compromise any later investigation or prosecution.

10. Record-keeping

The CRO maintains a confidential log of all reports received under this policy — including anonymous reports — recording the date, channel, nature of the concern, and outcome, redacted or aggregated as needed to protect identities. This log feeds the quarterly risk report to the Board and the Risk and Control Register, and anonymised incident metrics are disclosed in our next annual Modern Slavery Statement. Records are retained for 6 years from the date the report is closed, then deleted, and are kept securely and accessible only to the CRO and any director handling the report.

11. Governance

This policy is owned by the CRO, sits within the Risk Management Framework owned by the CEO, and was approved by the Board of Directors, taking effect on the effective date above. It will be reviewed at least annually, or sooner following any incident that reveals a gap in the reporting process, or a relevant change in law.

© BONDAP LTD. This document is the property of Bondap and is published for information only. It may not be copied, reproduced, adapted, distributed or used for any purpose without our prior written consent.