PROCEDURE – Internal reporting of violations of the law

Axis Classic Auto Srl Company

ANNOUNCEMENT

In accordance with Law No. 361/2022 on the protection of whistleblowers in the public interest,
we hereby announce the following:

1. Axis Classic Auto Srl has approved the Procedure – Internal Reporting of Violations of the Law (
   ), published on the website https://axisrent.ro.
2. The reporting methods used by Axis Classic Auto Srl are as follows:

• mailing address: the company's headquarters in Rudeni, No. 103, Ilfov County, Chitila
  envelope marked "For the third party designated under Law 361/2022"
• e-mail: integritate@romstalgroup.com

1. The third party appointed under Law No. 362/2022 for Axis Classic Auto Srl
   is Ana Maria-Camelia, who can be contacted via the reporting channels at
   pct.

Axis Classic Auto Srl Company
Through administrator Matei Talambuta

Axis Classic Auto S.R.L.

1. SCOPE OF APPLICATION

This procedure regulates the protection of persons who report violations of the law that have occurred or are likely to occur within the company.

This procedure establishes the procedure for receiving, examining, and resolving reports, the rights and obligations of persons who report or publicly disclose information regarding violations of the law, measures for their protection, the rights of the persons concerned, as well as the duties of the designated person/third party.

This procedure applies to persons who report and who have obtained information regarding violations of the law in the context of their professional relationship with the company. This category of persons includes, at least, the following:

a) workers

b) shareholders and persons who are members of the administrative, management, or supervisory body of the company, including non-executive members of the board of directors, as well as volunteers and paid or unpaid interns;

c) any person working under the supervision and management of the company with which the contract was concluded, its subcontractors, and suppliers.

d) persons whose employment relationship has not yet commenced and who report through internal or external reporting channels or publicly disclose information about violations of the law obtained during the recruitment process or other pre-contractual negotiations e) persons whose employment relationship or service relationship has ended.

f) persons who report or disclose information about violations of the law anonymously.

• REFERENCE DOCUMENTS
• Law No. 361/2022 on the protection of whistleblowers in the public interest
• DIRECTIVE (EU) 2019/1937 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 23 October 2019 on the protection of persons who report breaches of Union law
• Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data
• Law 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector.

This procedure shall not affect the provisions concerning:

a) protection of classified information;

b) lawyer-client privilege;

c) confidentiality of medical information;

d) the secrecy of judicial deliberations;

e) rules of criminal procedure.

• TERMS AND DEFINITIONS

Violations of the law	acts consisting of an action or inaction that constitute violations of legal provisions or that contravene the object or purpose of the law.
Information regarding violations of the law	information, including reasonable suspicions, regarding actual or potential violations of the law that have occurred or are likely to occur within the company where the whistleblower works or has worked in the public interest, or with which he or she is or has been in contact through his or her work, as well as information regarding attempts to conceal such violations
Public interest whistleblower	a natural person who reports or publicly discloses information relating to violations of the law obtained in a professional context;
Internal reporting	oral or written communication of information regarding violations of the law within the company through the means provided by the company for reporting violations of the law, these constituting the internal reporting channels
External reporting	oral or written communication of information regarding violations of the law through external reporting channels represented by the competent authorities in the field (e.g., the National Integrity Agency)
Public disclosure	making available, in any way, in the public domain, information relating to violations of the law;
Facilitator	the natural person who assists the whistleblower in the public interest in the reporting process in a professional context and whose assistance must be confidential;
Professional context	current or previous professional activities of any kind, whether remunerated or not, carried out within the company, on the basis of which persons may obtain information relating to breaches of the law and may suffer reprisals if they report them
Worker	a natural person who is in an employment or service relationship, based on the provisions of common or special law in this matter, and performs work in exchange for remuneration
Person concerned by the report	the natural or legal person mentioned in the report or in the public disclosure as the person to whom the violation of the law is attributed or with whom that person is associated;
Reprisals	any direct or indirect action or omission in a professional context that is determined by internal or external reporting or public disclosure and that causes or may cause harm to the whistleblower in the public interest.
Subsequent actions	any action taken by the recipient of an internal report or by the competent authority to address the report and, where appropriate, remedy the reported breach;
Information	providing the whistleblower with information about subsequent actions and the reasons for such actions;
Designated person/designated third party	the person responsible for the duties set out in point 4.6, appointed at company level. Depending on the number of employees, the duties may be performed by one person, one department, or may be outsourced to a third party, hereinafter referred to as the designated third party.

• RULES OF PROCEDURE

The reporting methods are as follows:

a) internal reporting;

b) external reporting.

Reporting of violations of the law is mainly carried out through existing internal reporting channels. However, whistleblowers reporting violations of the law may choose between internal and external reporting channels.

A whistleblower acting in the public interest may report either by name or anonymously. From a procedural point of view, the main differences between the two reporting methods are:

– In the context of a nominal report, there is the possibility of communication to clarify certain aspects presented in the report between the whistleblower in the public interest and the designated person;

– A person who reports violations of the law anonymously cannot benefit from exemption and protection in accordance with the provisions of Law No. 361/2022, except in cases where they are subsequently identified and suffer reprisals;

– A person who reports violations of the law anonymously and does not provide contact details cannot be notified of the registration of the report, the progress made, and the manner of resolution.

• External reporting

External reporting is the process of communicating orally or in writing through external information channels, including reasonable suspicions, regarding actual or potential violations of the law that have occurred or are likely to occur within the company where the whistleblower works or has worked in the public interest, or with which he or she is or has been in contact through his or her work, as well as information regarding attempts to conceal such violations.

External reporting channels are represented by the following authorities:

a) public authorities and institutions which, according to special legal provisions, receive and resolve reports concerning violations of the law within their area of competence;

b) The National Integrity Agency, hereinafter referred to as the Agency;

c) other public authorities and institutions to which the Agency forwards reports for competent resolution;

To report a violation using the external channel to ANI, find details here –https://avertizori.integritate.eu/

• Internal reporting

Internal reporting is the process of communicating orally or in writing through internal company channels information, including reasonable suspicions, regarding actual or potential violations of the law that have occurred or are likely to occur within the company where the whistleblower works or has worked in the public interest, or with which he or she is or has been in contact through his or her work, as well as information regarding attempts to conceal such violations.

Internal reporting is carried out by whistleblowers in the public interest to the designated person, in accordance with the working method presented below.

• Internal reporting procedures internal

Reporting is done in writing, on paper or in electronic format (e-mail), or through a face-to-face meeting, at the request of the whistleblower in the public interest.

The report shall include, at a minimum, the following:

• first and last name,
• the contact details of the whistleblower in the public interest,
• the professional context in which the information was obtained,
• the data subject, if known,
• description of the act likely to constitute a violation of the law and, where applicable, evidence supporting the report,
• report date and signature.

By way of exception, reports that do not include the name, surname, contact details, or signature of the whistleblower in the public interest shall be examined and resolved to the extent that they contain reasonable evidence of violations of the law.

The employer must ensure that at least one means of reporting is accessible at all times.

Reporting methods at company level Axis Classic Auto Srl are as follows:

mailing address: thecompany's headquarters addressin Rudeni, No. 103, Ilfov County, Chitila, with the envelope marked "For the third party designated under Law 361/2022."

e-mail: integritate@romstalgroup.com

The reporting methods must be brought to the attention of each employee by posting them on the company's website (company link:https://axisrent.ro) and displaying them at the headquarters in a visible and accessible place.

• Internal reporting records

The company, through its designated representative or third party, is required to keep a record of reports in a register and maintain statistics on reports concerning violations of the law.

Reports are entered into anelectronic registerthat includes:

• date of receipt of the report,
• the name and surname, contact details of the whistleblower in the public interest,
• subject of the report
• method of resolution.

The company keeps records of all reports received in accordance with confidentiality requirements. Reports are kept for 5 years. After the 5-year retention period expires, they are destroyed, regardless of the medium on which they are stored.

If the whistleblower requests that the report be made in the presence of the designated person/third party, the latter is required to draw up a record of the conversation in a durable and accessible form, subject to the whistleblower's consent. The designated person/third party shall give the whistleblower the opportunity to verify, rectify, and express their agreement with the minutes of the conversation by signing them.

• Obligation to maintain confidentiality

1. The person designated/third party designated to handle the report is obliged not to disclose the identity of the whistleblower in the public interest, nor any information that would allow their direct or indirect identification, unless they have their express consent.
2. By way of exception, the identity of the whistleblower in the public interest and any other information may be disclosed only where this is required by law, subject to the conditions and limits laid down therein.
3. In the case referred to in point 2, the whistleblower shall be informed in advance, in writing, of the disclosure of their identity and the reasons for the disclosure of the confidential information in question. This obligation shall not apply if the disclosure would jeopardize investigations or judicial proceedings.
4. Information contained in reports that constitutes trade secrets may not be used or disclosed for purposes other than those necessary to resolve the report.
5. The obligation to maintain confidentiality does not apply if the whistleblower in the public interest has intentionally disclosed their identity in the context of a public disclosure.
6. The obligation to maintain confidentiality shall also apply if the report is mistakenly sent to another person within the authority, public institution, any other legal entity governed by public law, or within legal entities governed by private law other than the designated person/third party. In this case, the report shall be forwarded immediately to the designated person/third party.

• Designated person/Designated third party

A person/third party shall be designated with responsibilities for receiving, recording, examining, taking follow-up action, and resolving reports, who shall act impartially and independently in the exercise of these responsibilities.

The designated person/third party is brought to the attention of each employee by posting on the company's website (company linkhttps://axisrent.ro) and by posting at the headquarters, in a visible and accessible place.

The designated person/third party has the following duties, obligations, and responsibilities:

• the obligation to receive, record, and keep track of reports in the register;
• the obligation to send the whistleblower confirmation of receipt of the report within a maximum of 7 calendar days of receiving it;
• diligently performing subsequent actions;
• the obligation to inform the whistleblower in the public interest about the status of subsequent actions, within a maximum of 3 months from the date of confirmation of receipt or, if no confirmation of receipt of the report has been provided, from the expiry of the 7-day period, and subsequently whenever there are developments in the follow-up actions, unless such information could jeopardize their progress;
• the obligation to inform company managers about how the report will be handled;
• the obligation to provide clear and easily accessible information on external reporting procedures to the competent authorities and, where appropriate, to the institutions, bodies, offices, or agencies of the European Union;
• the obligation to inform the whistleblower in the public interest about how the report will be handled.
• the obligation to maintain statistics on reports concerning violations of the law.

If the designated person/third party needs clarification from the company's staff in the specialized departments in order to resolve a report, they may disclose an excerpt from the report to them for clarification, while protecting the personal data of the whistleblower and the person concerned by the report.

• Internal reporting ranking

Reporting is classified when:

1. does not contain the elements provided for in point 4.3 other than the identification details of the whistleblower in the public interest, and the designated person/third party requested that it be completed within 15 days, without this obligation being fulfilled;
2. The report is submitted anonymously and does not contain sufficient information regarding violations of the law to allow for analysis and resolution of the report, and the designated person requested that it be completed within 15 days, without this obligation being fulfilled.
3. In the situation referred to in point (a), the decision to dismiss the case shall be communicated to the whistleblower in the public interest, stating the legal basis.
4. If a person makes several reports on the same subject, they are linked, and the whistleblower in the public interest receives a single notification. If, after this notification is sent, a new report on the same subject is received without additional information justifying a different subsequent action, it is closed.
5. The person designated/third party designated in accordance with point 4.6 may decide to close the procedure if, after examining the report, it is found that the breach is clearly minor and does not require any further action other than closing the procedure. This provision does not affect the obligation to maintain confidentiality, to inform the whistleblower in the public interest, and does not affect other obligations or other applicable procedures for remedying the reported violation.
6. The classification decision shall be communicated to the whistleblower in the public interest, indicating the legal basis.

• Public disclosure

A whistleblower who publicly discloses information about a violation of the law is protected if one of the following conditions is met:

a) first reported internally and externally or directly externally, but considers that no appropriate measures have been taken;

b) has reasonable grounds to believe that:

1. the infringement may constitute an imminent or obvious danger to the public interest or the risk of irreparable harm; or

2. in the case of external reporting, there is a risk of retaliation or a low probability that the violation will be effectively remedied given the specific circumstances of the report.

Reports of violations of the law through public disclosure may be addressed to the press, professional organizations, trade unions or employers' organizations, non-governmental organizations, parliamentary committees, or by making information about violations of the law available in any way in the public domain.

• Protective measures, support measures, and remedial measures

5.1. Conditions

In order to benefit fromprotection measures, whistleblowers acting in the public interest must cumulatively meet the following conditions:

a) be one of the persons reporting in accordance with the provisions of point 4.3 who has obtained information about violations of the law in a professional context;

b) had reasonable grounds to believe that the information regarding the reported violations was true at the time of reporting;

c) have made an internal report, an external report, or a public disclosure.

In order to benefit fromremedial measures, whistleblowers must cumulatively meet the conditions set out above, as well as the condition that the reprisals are a consequence of the report made.

The measures provided for in this chapter shall also apply to:

a) facilitators;

b) third parties who have links with the whistleblower in the public interest and who could suffer retaliation in a professional context, such as colleagues or relatives;

c) legal entities owned by the whistleblower in the public interest or for which the whistleblower in the public interest works or with which he or she has other types of connections in a professional context;

d) whistleblowers in the public interest who anonymously report or disclose information about violations but are subsequently identified and suffer retaliation;

e) whistleblowers acting in the public interest who report to the competent institutions, bodies, offices, or agencies of the European Union.

5.2. Disclaimer

Whistleblowers acting in the public interest, as well as persons referred to in point 5.1 who report or disclose information concerning violations of the law, shall not be in breach of legal provisions or contractual clauses concerning the disclosure of information and shall not be liable for reporting or disclosing such information, provided that they have made a report or public disclosure under the conditions of this procedure and had reasonable grounds to believe that the report or disclosure was necessary to reveal a violation of the law.

5.3 Prohibition of retaliation

Any form of retaliation against whistleblowers in the public interest, threats of retaliation, or attempts at retaliation are prohibited, in particular those relating to:

a) any suspension of the individual employment contract or employment relationship;

b) dismissal or removal from public office;

c) modification of the employment contract or service relationship;

d) reduction of salary and change of working hours;

e) demotion or prevention of promotion at work or in public office and professional development, including through negative assessments of individual professional performance or negative recommendations for professional activity;

f) the application of any other disciplinary sanctions;

g) coercion, intimidation, harassment;

h) discrimination, creation of another disadvantage, or subjection to unfair treatment;

i) refusal to convert a fixed-term employment contract into an indefinite employment contract, where the worker had legitimate expectations that he would be offered a permanent position;

j) refusal to renew a fixed-term employment contract or early termination of such a contract;

k) causing harm, including to the reputation of the person concerned, in particular on social media platforms, or financial loss, including in the form of lost business opportunities and loss of income;

l) being included on a blacklist or in a negative database, based on a formal or informal sectoral or industry-wide agreement, which may mean that the person concerned will not be able to find employment in that sector or industry in the future;

m) unilateral extrajudicial termination of a contract for goods or services, without the conditions for this being met;

n) revocation of a license or permit;

o) request for a psychiatric or medical evaluation.

At the request of the whistleblower under disciplinary investigation, within a maximum of one year from the date of reporting, the bar association in the district where the whistleblower works shall provide free legal assistance during the disciplinary proceedings.

5.4. Challenging retaliatory measures

(1) The whistleblower in the public interest, as well as the persons referred to in point 5.1, may challenge the measures referred to in point 5.3 by means of an application to the competent court, depending on the nature of the dispute, in whose territorial jurisdiction they are domiciled.

(2) In disputes referred to in paragraph (1), the burden of proving that the contested measure is justified by reasons other than those related to reporting or public disclosure to the employer shall lie with the employer.

(3) At the request of the whistleblower in the public interest who wishes to challenge the measures provided for in point 5.3, the bar association in the district where the whistleblower in the public interest carries out their activity shall provide free legal assistance.

(4) If the court finds that the measure was ordered as retaliation for reporting or public disclosure, it may order, as appropriate, the annulment of the measure, the restoration of the parties to their previous situation, compensation for damages, the cessation of the measure and its prohibition in the future, as well as any other measures to end forms of retaliation.

5.5. Counseling, information, and assistance

(1) The Integrity Agency shall provide counseling and information regarding protective measures, rights, procedures, and applicable remedial measures.

(2) The Integrity Agency shall provide whistleblowers in the public interest with assistance in relation to their protection against retaliation before any authority.

• Protection of the identity of the data subject and third parties

(1) The provisions on identity protection applicable to whistleblowers in the public interest set out in 4.5(1) and Annex 3 shall also apply to the person concerned and to third parties referred to in the report.

(2) The identity of the person concerned shall be protected while the actions subsequent to the report or public disclosure are ongoing, unless, as a result of the resolution of the report or disclosure, it is found that the person concerned is not guilty of the violations of the law that were the subject of the report or disclosure.

(3) Data subjects have the right to defense, including the right to be heard and the right to access their own file.

•    Penalties             

7.1.If the whistleblower knew that the reported information was not true:

● does not benefit from the protection provided by Law 361/2022 (neither the whistleblower nor the other persons referred to in Article 20(3) of the law), nor from those in Chapter 5;

● may be punished with a fine ranging from 2,500 lei to 30,000 lei by ANI.

● the employer may apply disciplinary sanctions and request compensation for the damage caused by the employee, under the terms of the Labor Code

● any other legal remedies remain available, including possible criminal liability.

7.2. Ifthe information proves to be false and the whistleblower had no reasonable grounds to believe it to be true, but it has not been proven that they knew it to be false:

● are not protected by Law 361/2022 (neither the whistleblower nor the other persons referred to in Article 20(3) of the law), nor by the provisions of Chapter 5.

● cannot be fined between 2,500 and 30,000 lei by the ANI.

● Depending on the circumstances of the incident, the employer may impose disciplinary sanctions as a result of the report.

● The employer may be entitled to compensation for damage caused by the employee, under the terms of the Labor Code, depending on the circumstances.

● any other legal remedies remain available.

• ANNEXES

Annex 1 – Internal reporting form

Annex 2 – Process flow Internal reporting

Annex 3 – Information note on data processing carried out as a result of reports received through the internal channel

 

Internal reporting of violations of the law

Alarm data
First and last name
Phone number
Home address
The professional context from which the information originates
The person concerned
Subject of the report (description of the act suspected of constituting a violation of the law and, where applicable, evidence supporting the report)
Reporting date		Signature of the whistleblower
Method of resolution

Date of resolution	Signature of designated person/designated third party

INFORMATION NOTE

regarding data processing carried out as a result of reports received through the internal channel

Given that Axis Classic Auto Srl has a legal obligation to create internal communication channels for reporting violations of the law that have occurred or are likely to occur, in accordance with the provisions of Law No. 361/2022, we present below important information about how we process this data.

Please read this information carefully to understand how Axis Classic Auto Srl processes your data, the purposes and period for which we do so, as well as your rights and how you can exercise them.

1. Types of data processed and purposes of processing

1.1. Axis Classic Auto Srl, headquartered in Rudeni, No. 103, Ilfov County, Chitila, processes personal data related to the type of report, the category to which the reporter belongs, and details related to the report itself (e.g., anonymous or assumed whistleblower, reporter's first and last name, mailing address, telephone number, status of the reporter as employee/supplier/customer/shareholder/other, name/position of the suspected person, date of the incident/act, type of act, any other details).

1.2. The above data is used for the purpose of analyzing reports and investigating reported facts, requesting additional data and information necessary to take appropriate measures, and if the results of internal investigations lead to the need to inform the competent authorities, the data you provide will also be used for this purpose.

2. Duration of data processing

2.1. Reports shall be kept for a period of 5 years, in accordance with Article 7(2) of Law 361/2022.

3. Data transfer

3.1. The only persons able to access the data covered by this policy are those who need it for their professional activities (the person designated to receive reports and the extended team, in the situations mentioned in the reporting procedure). The data is not distributed unofficially, either internally or outside the organization, except when Axis Classic Auto Srl is legally obliged to do so or when the transmission is necessary to achieve the purpose for which the data is processed (for example, when it is necessary for the report to be analyzed at the level of the group to which the company belongs).

3.2. In all the cases described above, the disclosure of your personal data is carried out on the basis of a contract concluded with the recipients of the data, by which they undertake to use the data exclusively for the purpose for which it was entrusted to them, to comply with the obligation of confidentiality and data security, and to comply with all provisions of the legislation in force regarding the protection of personal data.

3.3. We may also disclose data related to reports you have submitted to public authorities, based on and within the limits of legal provisions and as a result of specific requests made by them.

4. Rights of data subjects

4.1. As a natural person whose data is processed by Axis Classic Auto Srl, you have the following rights, which you may exercise free of charge:

       – Be informed whether or not the company processes your personal data and what that data is;

       – Request the correction of the data transmitted, if it is incorrect or incomplete;

       – Request the restriction of processing or object to the processing of your data, for legitimate and justified reasons relating to your particular situation;

        – Request the deletion of your data, unless the law prohibits deletion.

        – If you have given us your consent to process certain personal data, you can withdraw your consent at any time without affecting the legality of the processing carried out prior to the withdrawal.

        – You have the right to lodge a complaint with a supervisory authority when you consider that the legal provisions on the protection of personal data have been violated.

4.2. You can exercise the above rights by contacting us atoffice@axisrent.ro.To protect your personal data and interests, we may ask you for additional information to identify you when you wish to exercise the above rights.

To avoid processing sensitive data without a valid basis, please do not include the following categories of data in your report if they are not related to the reported violation:

• racial or ethnic origin
• political views
• religious denomination
• philosophical beliefs
• union membership
• health data
• data concerning sex life or sexual orientation