EthicsPoint - Sabanci Holding A.S.

Reporting Security & Confidentiality

About EthicsPoint

What is EthicsPoint?

EthicsPoint is a web intake portal for reporting ethical misconduct. It is a comprehensive and confidential reporting tool for employees, vendors, customers and other stakeholders to report instances of actual or potential ethical misconduct as per the Sabancı Group Code of Business Ethics, related policies or applicable laws and regulations.

Why do we need a system like EthicsPoint?

EthicsPoint augments our efforts to maintain and foster a culture of integrity and ethical decision-making. By creating open channels of communication, we promote a positive work environment enabling us to create greater value for all of our stakeholders.

Reporting – General

May I report using either the Internet or the telephone?

Yes. EthicsPoint enables you to file a confidential, anonymous report via either the telephone or the Internet.

What types of situations should I report?

You should report instances of ethical misconduct as per the Sabancı Group Code of Business Ethics, related policies or applicable laws and regulations. Examples include but are not limited to:

Fraud
Conflicts of Interest
Misuse of Company Assets and Resources
Bribery
Discrimination
Harassment
Accounting Irregularities
Violations of Sabancı Group Regulations

You may refer to the Sabancı Group Code of Business Ethics to get a better understanding of our business ethics values and guidelines.

Why should I report what I know? What’s in it for me?

We all have the right to work in a positive environment and with that right comes the responsibility of acting in an ethical manner and letting the appropriate people know if someone is not acting appropriately. By working together, we can maintain a healthy and productive environment.

Does management really want me to report?

We certainly do. In fact, we need you to report. You may have initial knowledge of an activity that may be cause for concern from a business ethics perspective. Your reporting can minimize the potential negative impact of ethical misconduct on the Sabancı Group and our stakeholders and help strengthen the internal control environment. Also, offering positive input may help identify issues that can improve corporate culture and performance.

How can I access the Sabancı Group Code of Business Ethics and related policies?

You can access the Sabancı Group Code of Business Ethics using the link below:

https://www.sabanci.com/en/management-approach/sabanci-group-code-of-business-ethics

Where do these reports go? Who can access them?

Reports are entered directly on the EthicsPoint secure server. These reports are accessible only to specific authorized individuals within the Sabancı Group who are charged with evaluating the report, based on its content, nature, the entity as well as the management level your report relates to. Each of these report recipients has had formal training in keeping these reports in the utmost confidence. You may refer to the Sabancı Group Code of Business Ethics to obtain more detailed information on the working principles of the Ethics Board including how it processes reports.

Isn’t this system just an example of someone watching over me?

No. EthicsPoint is a positive aspect of our overall philosophy that allows us to ensure a safe, secure and ethical workplace. You are encouraged to seek guidance on ethical dilemmas, provide positive suggestions or communicate a concern. Effective communication is critical in today’s workplace and this is a great tool to enhance that communication. We have implemented this reporting tool to digitalize our business ethics notification processes with an end-to-end perspective and continually improve our business ethics reporting processes.

Reporting Security & Confidentiality

It is my understanding that any report I send from a company computer generates a server log that shows every website that my PC connects with. Won’t this log identify me as the report originator?

NAVEX does not generate or maintain any internal connection logs with IP addresses, so no information linking your PC to EthicsPoint is available.

If you feel uncomfortable making a report on your work PC, you have the option of using a PC outside our work environment (such as one located at an Internet café or at a friend’s house) through the EthicsPoint secure website.

Can I file a report from home and still remain anonymous?

A report from home, a neighbor’s computer, or any Internet portal will remain secure and anonymous. An Internet portal never identifies a visitor by screen name and the EthicsPoint system strips away Internet addresses so that anonymity is totally maintained.

I am concerned that the information I provide EthicsPoint will ultimately reveal my identity. How can you assure me that will not happen?

The EthicsPoint system protects your anonymity. However, if you wish to remain anonymous, you - as a reporting party - need to ensure that the body of the report does not reveal your identity by accident.

Is the telephone toll-free hot line confidential and anonymous too?

Yes. You will be asked to provide the same information that you would provide in an Internet-based report and an interviewer will type your responses into the EthicsPoint Web site. These reports have the same security and confidentiality measures applied to them during delivery.

What if I want to be identified with my report?

There is a section in the report to identify yourself, if you wish.

Are my telephone conversations with the interviewer recorded when I use the Ethics Hotline?

No, telephone conversations are not recorded.

What is your policy of maintaining the confidentiality of phone numbers if I call the Ethics Hotline?

We do not reveal caller phone numbers. You may prefer not to share your phone number. Hotline staff is trained on confidentiality policies and procedures. They understand the importance of protecting caller anonymity and confidential information.

What is your policy towards individuals who report ethical concerns?

The Ethics Board keeps the reports and the identity of the reporters confidential. Reporters are under the protection of Ethics Board, any kind of influence to them such as mobbing, discrimination, pressure is not allowed.

Who has access to the reports?

To the extent permitted by law, details of a concern raised by a Whistleblower is only shared with those who have the authority to (i) investigate; (ii) assess the matter and (iii) take action, on a need-to know basis and whose names are not alleged in the related incident.

How do you process reports?

Please refer to the working principles of the Ethics Board to obtain more information on the processing of reports.

Tips & Best Practices

I am aware of some individuals acting unethically, but it doesn't affect me. Why should I bother reporting it?

As per the Sabancı Group Code of Business Ethics, it is a primary duty to report ethical misconduct by self or others. This helps Sabancı Group maintain an ethical and positive work environment. If you know of any incidents of misconduct or ethical violations, consider it your duty to yourself and your coworkers to report it.

I am not sure if what I have observed or heard is a violation of company policy, or involves unethical conduct, but it just does not look right to me. What should I do?

File a report. NAVEX can help you prepare and file your report so it can be properly understood. We'd rather you report a situation that turns out to be harmless than let possible unethical behavior go unchecked.

What if my boss or other managers are involved in a violation? Won’t they get the report and start a cover-up?

The EthicsPoint system and report distribution ensure that implicated parties are not notified or granted access to reports in which they have been named.

What if I remember something important about the incident after I file the report? Or what if the company has further questions for me concerning my report?

When you file a report at the EthicsPoint Web site or through the EthicsPoint Call Center, you receive a unique, randomized number called a “Report Key” and are asked to choose a password. You can return to the EthicsPoint system again either by Internet or telephone and access the original report to add more detail or answer questions posed by a company representative. We strongly suggest that you return to the site in the time specified to answer company questions. You and the company now have entered into an “anonymous dialogue,” where situations are not only identified, but can also be resolved, no matter how complex.

Are these follow-ups on reports as secure as the first one?

All EthicsPoint correspondences are held in the same strict confidence as the initial report, continuing under the umbrella of anonymity.

What if I lose my Report Key or forget the Password I created?

To ensure that security and confidentiality is maintained, if you lose your report key or password, you will need to file a new report. Mention in the new report that it is related to a report or question you previously submitted.

Can I still file a report if I don’t have access to the Internet?

You can file an EthicsPoint report from any computer that can access the Internet. You can file from home. Many public locations, including the public library, have Internet computers. If you don’t have access to or are uncomfortable using a computer, you can call the EthicsPoint toll-free hotline, which is available 24 hours a day, 365 days a year.