November 2017

1. Terms and definitions

Ciklum or Ciklum Group
Ciklum or Ciklum Group is a group of companies that directly or indirectly are under common control of Ciklum Group Holdings Limited Holding Company, BVI and operating under Ciklum Trademark.

Corruption

Ciklum defines “corrupt conduct” or “corruption” as the abuse of entrusted power for private gain.

Ciklumer

The collective reference for employees, permanent or temporary, full or part time, of any Ciklum legal entity, or any of its affiliates or subsidiaries, as well as for other individuals (such as, but not limited to, contractors and private entrepreneurs) performing work for, or on behalf of, Ciklum.

Whistleblower

A whistleblower is anyone who has and reports insider knowledge of illegal activities occurring in an organization. Whistleblowers can be employees, suppliers, contractors, clients or any individual who somehow becomes aware of illegal activities taking place in a business either through witnessing the behaviour or being told about it.

2. Purpose

Ciklumers who are aware of possible wrongdoing within Ciklum have a responsibility to disclose that information to appropriate parties inside Ciklum. The purpose of the Ciklum Whistleblower Policy (hereinafter – “the Policy” or “the
Whistleblower Policy”) is to set out the framework for collection and processing of the information from both internal and external whistleblowers.
By implementing this Policy, Ciklum is asking and encouraging Ciklumers as well as representatives of third parties to inform responsible stakeholders of potential misconduct and unethical behaviour.
Topics for whistleblower reports have to be directly related to the content of sections
2-5 of the Ciklum Code of Conduct:

This policy is not applicable for feedback on the quality of services provided by Ciklum, the maintenance of applications and equipment, as well as all for all other issues not mentioned in the table above (as the latter topics are in scope of Delivery Department, IT Help Desk and other services and facilities at Ciklum).
Policy demonstrates Ciklum’s commitment to operate ethically.

The two main aims of the Policy implementation are following:

• to reduce Ciklumers misconduct and reduce Ciklum’s compliance risk1 by
  identifying and resolving allegations of business ethics and compliance
  violations – as quickly and as efficiently as possible.
• to help all potential whistleblowers who may feel concerned or unnerved
  by a situation but don’t know how to act, by describing the right way how
  to report the issue or concern effectively and safely (under the veil of
  anonymity and having the non-retaliation shield and being protected by the
  non-retaliation2 approach).

Requirements of the Policy are mandatory and to apply by all Ciklumers in every
jurisdiction where Ciklum operates.

3. Ownership, approval and periodic review

This Policy, which is owned by the Compliance Director, will be reviewed at least annually, and any material changes will be approved by the Group CFO.

4. Core provisions

The Policy covers all three stages of whistleblowing process – collection, investigation and reporting.
The key element of whistleblowing process in Ciklum is the Speak Up facility that is supported by an external provider. The external provider performs independent registration and storage of all Speak Up claims and requests.
Speak Up facility provides:

• A variety of mechanisms for Ciklumers to raise issues. These include reporting
  to a manager or higher up in Ciklum, as well as to human resources, legal, and
  compliance office via a 24/7/365 phone or web intake process, e-mail
• Tracking and case management processes to make sure reported incidents
  are collected in a centralised location, resolved in a timely manner, and accurately reported – no matter where they originate.
• Access to a centralised data source to identify trends and gaps in Compliance
  programme, determine where training is needed, locate “hot spots” within Ciklum, and
  update any unclear or outdated policies.

5. Non-retaliation

Ciklum guarantees that Ciklumers who in good faith disclose perceived wrongdoing to the designated parties inside the organization or via Speak Up facility will be protected from adverse employment consequences According to Ciklum Code of Conduct (Section 5), Ciklum will not tolerate any discrimination against anyone who has reported a concern in good faith.
Incidents of retaliation against any Ciklumer reporting a violation or participating in the investigation of a reasonably suspected violation will result in appropriate disciplinary action against anyone responsible, including possible termination of employment. Those working for or with Ciklum who engage in retaliation against reporting Ciklumers may also be subject to civil, criminal and administrative penalties.

6. Speak Up collection methods

The operation of the Speak Up facility is based on four methods of information collection:

1. Hotline (phone) Toll-free numbers for every jurisdictionEvery Ciklumer as well as any third party representative have a 24/7 access to hotline with the purpose to report an incident anonymously3 or with providing its name.
   Ciklum’s Hotline is a toll-free number available in every country where Ciklum
   operates 24/7 with English-speaking phone operator support.Phone numbers:
   USA Call Toll Free: 1-866-921-6714
   UKRAINE Call Toll Free: 0-800-50-35-59
   POLAND Call Toll Free: 800-112-47-17
   DENMARK Call Toll Free: 00-800-2002-0033
   SWITZERLAND Call Toll Free: 00-800-2002-0033
   SPAIN Call Toll Free: 00-800-2002-0033
   UK Call Toll Free: 00-800-2002-0033
   ISRAEL Call Toll Free: 00 or 014-800-2002-0033
   BELARUS 1-604-922-5953 (Collect Call to WhistleBlower Security)
   PAKISTAN 1-604-922-5953 (Collect Call to WhistleBlower Security)
2. E-mailReporting to ciklum@integritycounts.ca is a preferable option in case reporter does not feel comfortable speaking with a live operator or does not have a private location available to make a call. With ciklum@integritycounts.ca, reporters can type information and take time to think about and review what they have written before send an e-mail. E-mail reporting is secure, confidential, and accessible 24 hours a day.
3. “Open door”
   “Open door” method means arranging a meeting with Ciklumer’s line manager. The result of reporting an incident via “Open door” is the completed incident form via IntegrityCounts™ by line manager as a Reporter under the link https://www.integritycounts.ca/org/ciklum.
4. Web-based tool
   Ciklum Speak Up web-based tool is fully supported by an external provider.

It is available under the link https://www.integritycounts.ca/org/ciklum and provides an interface that is available 24/7 for anybody who wants to raise an issue or concern. In the process of registration of the message, there is an opportunity for the reporter to exclude from the list of recipients those whose notification, in the reporter’s opinion, is undesirable.

Information on registered claims is sent by the external provider to the Compliance Department.

If a reporter manually excludes Compliance Department representatives from a notification list, the corresponding message will proceed directly to the CHRO (Chief HR Officer).

7. Investigating and Reporting

Upon receipt of the initial message, Compliance Department decide whether to investigate reported incidents, or to forward the initial message to another department corresponding to the message subject.
Compliance Department investigates cases of corporate fraud, bribery, and other financial crime violations or matters of compliance risk as prescribed by the Code of Conduct and Ciklum Compliance Policy (refer to table at Section 2.Purpose of this document).
A log of all reported incidents should be provided on a quarterly basis to the Board of Directors4.
Incidents that include allegations against Leadership Team members and those that could cause serious reputational or financial losses for Ciklum are escalated to the Board of Directors. Compliance Director performs first review of the internal investigation report at the latest, within two weeks of the decision to investigate. The investigation shall be completed as soon as possible, but by 5 weeks from the date when Compliance Department received the initial information at the latest.
Based on the results of the investigation, Compliance Department issues an Internal Investigation Report, which is presented to Compliance Director for approval. Based on the results of the investigation, the Compliance Director has to assess the reasonability and appoint if needed a meeting with relevant managers following the investigation to discuss and plan necessary corrective actions.

8. Training and Awareness

The Compliance Director is responsible for ensuring that all Ciklumers have sufficient awareness of this Policy and know how to report incidents using Speak Up facility as well as fully aware of non-retaliation approach. All Ciklumers will be provided with Whistleblower Policy web-based training on an annual basis, and no longer than thirteen months after the last training session took place.
This training will be followed by a mandatory test that all Ciklumers must pass based on their understanding of the material communicated. Respective training activity must be documented and maintained as required by the Company’s record keeping Policy.

9. Availability of the Policy

This Whistleblower Policy is available on the Ciklum Corporate intranet site.

1 Refer to Ciklum Compliance Policy – Chapter 1.3 Compliance Risk
2 Refer to Section 5. Non-retaliation
3 Be aware that Spain legislation prohibits anonymous reports.
4 The responsibility of CHRO who has an access to the Speak Up system.