Whistleblowing Policy
1. Purpose and scope
This policy describes how Accomplice AB receives, assesses, handles, investigates and provides feedback on reports of serious wrongdoing in a work-related context. Its purpose is to ensure a safe, confidential and legally sound process for reporting, follow-up and feedback.
The whistleblowing function is to be designed around the ISO 37002 principles of trust, impartiality and protection.
2. Who can report
The channel is intended for employees, job applicants, trainees, consultants, agency workers, former employees and other people who have or have had a work-related connection to the business.
3. What can be reported
Reports may concern wrongdoing where there is a public interest in the information coming to light, such as financial irregularities, corruption, serious risks to health and safety at work, harassment, security shortcomings or other serious breaches of the law or internal rules.
4. What is normally not handled as whistleblowing
Matters concerning only individual employment conditions, pay, management, personal conflicts, customer support or general dissatisfaction are normally not handled as whistleblowing cases, unless they also involve serious wrongdoing where there is a public interest in the information coming to light. Such matters should normally be handled through the usual HR, management, health and safety, customer service or complaints procedures.
5. Reporting channels
Reports can be submitted in writing through Accomplice AB's digital whistleblowing channel provided by Clearwhistle.
Open Accomplice AB's whistleblowing channel
Accomplice AB must also be able to receive oral reports and offer an in-person meeting within a reasonable time if the reporting person requests one. Use the whistleblowing channel above to request oral reporting or an in-person meeting.
6. Recipients, authorisation and conflicts of interest
Reports are received by designated authorised recipients. Only people who need the information to receive, assess, investigate or follow up the case may access it. If a report concerns someone who would normally handle the case, or if there is otherwise a risk of a conflict of interest, the case must be handled by an alternative authorised person or an external recipient.
7. Anonymous reporting and continued dialogue
Reports can be made anonymously if the chosen reporting channel supports this. However, an anonymous report may be harder to investigate if there is no way to ask follow-up questions. When reporting anonymously, the reporting person should save the case code and follow-up key so that dialogue can continue without revealing their identity. Any contact details provided are treated confidentially.
8. How a report is handled
When a report is received, an initial assessment is made to determine whether the case falls within this policy. A decision is then made on follow-up, an internal investigation, an external investigation or another appropriate action. The case is documented throughout the process.
The reporting person receives acknowledgement of receipt within seven days when contact is possible, unless they have declined acknowledgement or an acknowledgement would risk revealing their identity.
Feedback is provided within three months of acknowledgement. If no acknowledgement has been provided, the period runs from the end of the seven-day period following receipt. Feedback is provided to a reasonable extent and as far as possible without harming the investigation, revealing identities or disclosing confidential information.
9. External reporting channels
The reporting person may also have the right to report externally to a competent authority. Internal reporting is encouraged when possible and appropriate, but this policy does not restrict the right to use external reporting channels, report under applicable law or contact competent authorities.
10. Confidentiality and protection against retaliation
The identity of the reporting person and other information that could reveal their identity must be protected. Anyone who reports in accordance with the law must not be subjected to retaliation. Retaliation may include dismissal, reassignment, denial of promotion, threats, harassment, worsened employment conditions or other adverse treatment as a result of reporting.
11. Deliberately false or misleading information
Protection applies to anyone who had reasonable grounds to believe the information was true at the time of reporting. Anyone who deliberately provides false or misleading information may be dealt with under applicable rules, agreements and internal procedures. This provision must not be used to discourage people from reporting suspected wrongdoing in good faith.
12. Personal data, access and retention
Accomplice AB is the controller of personal data processed as part of the whistleblowing function, unless otherwise stated in separate information. Personal data is processed to receive, assess, investigate, document and follow up reports. The legal basis is normally a legal obligation and/or a legitimate interest, depending on the organisation's obligations and the nature of the case. Access must be restricted to authorised people who need the information to handle the case.
Information that is clearly irrelevant must be deleted promptly. Personal data must not be processed for longer than necessary and normally no longer than two years after the follow-up case has been closed, unless there is another legal basis for retaining it for longer.
Data subjects may have rights to information, rectification, erasure, restriction, objection and complaints to the supervisory authority under data protection rules.
13. Security and documentation
Reports and follow-up cases must be handled using appropriate technical and organisational security measures. Documentation must be factual, relevant and subject to restricted access. Decisions, actions, feedback and closure should be documented so that Accomplice AB can demonstrate how the case was handled without disclosing sensitive information to unauthorised people.
14. Review
The policy should be reviewed at least annually or following significant organisational, legal or procedural changes.