UMARUTTI S.R.O. POLICY ON HANDLING REPORTS

Purpose: To establish rules and procedures for the submission, receipt, assessment, and resolution of reports of possible unlawful conduct within Umarutti s.r.o. (hereinafter referred to as the "Company") and to ensure the protection of whistleblowers in accordance with Act No. 171/2023 Coll. (hereinafter referred to as the "Act").

Personal Scope: This Policy sets out the rights and obligations for the Company, the Competent Person, and Whistleblowers. Whistleblowers may include, in particular (but not exclusively), employees (current and former), job applicants, members of corporate bodies, clients and users of the AreteApp platform, suppliers, service providers, trainees, and other persons who perform or have performed work or similar activities for the Company, or who have been or are in contact with the Company in connection with such activities, in accordance with Section 2 of the Act.

Material Scope: Governs the entire process from the submission to the resolution of reports.

Temporal Scope: Applies to reports concerning conduct regardless of when it occurred.

Key terms will be defined here, such as: Whistleblower, Report, Unlawful Conduct (with reference to Section 2 of the Act), Retaliatory Measure (with reference to Section 4 of the Act), Competent Person, Company, Related Person, Tool (FaceUp platform), Act. (Based on the template and the Act).

Whistleblower: A natural person who makes a Report in accordance with the Act because they became aware of Suspicious Facts in connection with work or other similar activity performed for the Company (or with whom they were in contact in connection with such activity), including clients of the Company and users of the AreteApp platform.

The Company designates Mr. Vladimír Kondratěnko, the company's executive director, as the Competent Person. The contact details of the Competent Person are whistleblowing{'@'}areteapp.eu and telephone number +420,606 751,525.

The Competent Person meets all legal requirements set out in Section 10 of the Whistleblower Protection Act, i.e., is of good character, of legal age, and has full legal capacity. Within their duties, the Competent Person receives and assesses reports of possible unlawful conduct, proposes corrective measures to the company management to remedy identified deficiencies, acts impartially and objectively when handling reports, and maintains confidentiality regarding all facts learned in connection with the performance of their duties, in accordance with Section 11 of the Act.

The Company guarantees that the Competent Person will not be penalized in any way for the proper performance of their duties arising from this function, as stipulated in Section 11 of the Whistleblower Protection Act. This protection includes, in particular, a prohibition on any sanctions, discrimination, or other negative consequences related to the proper fulfillment of the Competent Person's duties.

Who can report: A report can be submitted by any natural person who became aware of possible unlawful conduct in connection with work or other similar activity for the Company (or in contact with it), as defined in Section 2 of the Act. This explicitly includes employees (current and former), job applicants, members of the Company's bodies, clients and users of the AreteApp platform, suppliers, service providers, trainees, and other collaborating persons.

What can be reported: See Material Scope and Section 2 of the Act. Mention that it does not apply to knowingly false reports (Section 7(3) of the Act). Exclude information according to Section 3 of the Act.

Reporting Methods (Section 9 of the Act):

• Preferred: FaceUp Tool: https://www.app.faceup.com/cs/c/xgidfb2s/ – in writing or orally (voice message), anonymously or non-anonymously.
• E-mail: whistleblowing{'@'}areteapp.eu
• Telephone: +420,606 751,525
• In person: By appointment with the Competent Person (within 14 days).
• Externally: Option to report to the Ministry of Justice.

Content of the report: Details of the name, surname, and date of birth, or other data from which the identity of the whistleblower can be inferred (if not anonymous and provided), and information about possible Unlawful Conduct (Section 2(2) of the Act).

Confirmation of receipt: Within 7 days, with exceptions (Section 12(2) of the Act).

Record-keeping: Maintaining records in the FaceUp Tool to the extent specified in Section 21 of the Act.

Retention: For a period of 5 years (Section 21(2) of the Act).

Access: Only the Competent Person (Section 21(3) of the Act).

Recording of oral reports: Recording (with consent) or transcript, opportunity for the whistleblower to comment (Section 19 of the Act).

Deadline: Within 30 days, possibility of extension twice by 30 days (Section 12(3) of the Act).

Procedure: The Competent Person assesses impartially, gathers information, may request cooperation.

Unfounded report: Notification to the whistleblower, information about the right to report to a public authority (Section 12(6) of the Act).

Founded report: Proposal of corrective measures to the Company (Section 12(5) of the Act).

Notification to the whistleblower: Information about the outcome of the assessment (Section 12(3) of the Act).

Adoption: The Company shall adopt appropriate measures to remedy or prevent an unlawful situation (Section 9(2)(g) of the Act).

Examples: Change of processes, training, disciplinary proceedings, termination of relationship, compensation for damages, filing a criminal complaint.

Informing the whistleblower: About the measures taken (Section 12(5) of the Act).

Prohibition of retaliatory measures: Strict prohibition of any form of retaliation against the whistleblower and other protected persons (Section 4 of the Act).

Identity protection: Obligation of the Competent Person to maintain confidentiality of identity, exceptions according to Section 20 of the Act.

Confidentiality: Obligation to maintain confidentiality about the content of the report (Sections 11, 20 of the Act).

Processing of personal data in accordance with GDPR and the Company's Personal Data Protection Policy. Informing whistleblowers about the processing.

The Company shall ensure that this Policy and information about whistleblowing are available to all relevant persons (e.g., on the intranet, website).

The Company shall provide training for employees and the Competent Person.

This policy is effective from 25.05.2025