Whistleblower policy

If an employee or a collaborative partner discovers irregularities or some other form of problematic conduct, many may be reluctant to share their suspicions or criticisms. Therefore, the Bikuben Foundation Group has decided to establish a whistleblower scheme through which all employees or others affiliated with the Bikuben Foundation Group may anonymously report suspicions about violations or omissions with respect to the law or other serious and sensitive matters.  
 
The purpose of the whistleblower scheme is to create assurance and to provide employees and other stakeholders in the Bikuben Foundation Group greater opportunity:  

• To express themselves about illegalities or other problematic matters  
• To protect persons who report information through the whistleblower scheme 
• To discover mistakes and negligence  

The whistleblower policy applies to the entire Bikuben Foundation Group: It applies to the Bikuben Foundation and the Bikuben Foundation’s affiliated companies, including Enkotec A/S, Høbbet A/S, BIFI A/S, Food TV29 ApS, and Black Box TV29 ApS.  

Employees, management, board of directors, customers, grant recipients, and collaborative partners of the Bikuben Foundation Group may submit reports through the whistleblower scheme. This includes both present and former employees and stakeholders.  

The whistleblower scheme is a supplement to direct, daily communication within the Bikuben Foundation Group about mistakes or unsatisfactory circumstances, etc. In the first instance, therefore, you may address problems by contacting, for example, your immediate supervisor, collaborative partner, union representative, or the executive board directly.

You may only report persons or systems with a connection to the Bikuben Foundation Group. 

The report may touch on the following: 

• Employees of the Bikuben Foundation Group, i.e., where there is an employment relationship between the Bikuben Foundation Group as employer and the employee as a wage earner. It is irrelevant what form of employment the wage earner has (permanent or part-time employment, hourly employment, temporary employment, substitute) 
• Members of the board of directors  
• Collaborative partners and suppliers  
• Fundamental system flaws that cannot be linked to a particular person or specific persons. 

The report may touch on serious violations of law, misdemeanours, or other serious matters or suspicions thereof. There may only be reports made about: 

• Serious and/or criminal offences such as, for example, theft, embezzlement, fraud, deception, bribery, corruption, accounting fraud/manipulation, irregular use of assets, misuse of financial means, etc.
• Serious instances of discrimination, violence, assault, or harassment 
• Gross violation of internal guidelines (’gross violation’ means a systematic, repeated, and significant violation of internal guidelines and/or internal procedures) 
• Violations of EU law. For example, ignoring EU rules on public procurement, financial services, money laundering, and/or rules on data protection. 

You must have knowledge or reasonable suspicion that the reported events have occurred. 

Issues relating to employment matters – for example, absenteeism, office conflicts, smoking, alcohol use, dress code, wages and salaries, etc. – as well as matters that are not serious are not to be reported through the whistleblower scheme but should be handled, for example, by an immediate supervisor, the human resources department, union representative, etc. 

Issues relating to ordinary conduct problems – for example, inadequate waste management, or disregard of a dormitory's general rules of conduct regarding use of laundry rooms, bicycle parking, or noise and general disturbances, etc. – are not to be reported pursuant to the whistleblower scheme.  

If you are a resident, special requirements apply to submitting reports: 

Persons who are not mentioned in the Danish Whistleblower Act as entitled to use a compulsory whistleblower scheme – for example, residents at the Bikuben Foundation’s dormitories – may only report matters that may be handled pursuant to the general rules on data protection. 

This means that, as a starting point, the Bikuben Foundation Group may not process reports that contain sensitive information about persons other than the person doing the reporting. This applies, for example, to sexual assaults where the person assaulted is someone other than the person reporting it and the person assaulted may be identified.  

However, as a rule, residents may submit reports that a (possibly named) person has engaged in offensive/harassing behaviour against another person as long as the person who has been subjected to the offensive behaviour is not identified by name.  

However,  under exceptional circumstances, reports with sensitive information about others may be processed if the Bikuben Foundation Group specifically assesses that it is necessary to do so in order to comply with work, health, social security or social protection law obligations, to maintain, defend, or pursue a legal claim, or to promote important public interests, cf. Article 6 and article 9 of the General Data Protection Regulation.   

Therefore, the Bikuben Foundation Group shall undertake a thorough assessment of such reports, including a thorough assessment of whether the information – depending on the nature of the specific report – may nevertheless be processed pursuant to the general rules of data protection.    

You may only submit a report electronically by filling out and submitting an online questionnaire. You may not submit it in another way since a report typically contains confidential information that must be sent encrypted. You may submit a report in Danish or English.  

To the extent possible, the report is to be documented by attaching the relevant documents in digital form. 

You may submit a report via the whistleblower portal 

All information is treated confidentially and with discretion. 
 
If you submit a report anonymously, it is crucial that you do not provide contact information (name, e-mail address, telephone number, etc.), and that you are diligent in removing metadata from files attached for documentation – i.e., names that are not to be revealed – and that the report does not provide information that can be traced directly back to the person in question. 
 
If an investigation is undertaken by an external authority (for example, the police), the Bikuben Foundation Group may be forced to disclose information about the identity of the person filing the report to the extent the Bikuben Foundation Group is aware of it.  
 
If you file a report from a network affiliated with the Bikuben Foundation Group or another monitored network, there may be a risk that a visit to the whistleblower portal may be logged internally as a part of an ordinary logging of user activities. You may avoid this risk by entering the web address itself into a browser on a private or public computer that is not affiliated with a monitored network.  
 
The whistleblower portal is also designed to remove or limit the storage of information and supports the use of a TOR browser, which ensures anonymity to the highest degree possible.  

BDO Statsautoriseret revisionsaktieselskab was chosen by the Bikuben Foundation Group as data processor and delivers and administers the technical solution of the whistleblower portal.  
 
A few trusted employees at BDO Statsautoriseret revisionsaktieselskab receive and register the reports and send them on to management at the Bikuben Foundation Group. If reports concern the management at the Bikuben Foundation Group, the report is sent on to the chairperson of the Bikuben Foundation’s board of directors or to the chairperson for Enkotec’s board of directors if the report concerns Enkotec’s management. 
 
BDO undertakes a preliminary review of the report to assess whether it falls within the framework of the whistleblower scheme, whether there is a need to handle the matter through a case, or whether the report may be  dismissed as evidently unfounded if, for example, the report has to do with matters or is submitted by a person not covered by the whistleblower scheme. 
 
If there is a basis for processing the report, a more in-depth investigation of the matter is launched. Depending on need, assistance is sought, for example, from legal or other external advisors.  

The processing of personal information, including collection, storage, and any transmission, is subject to applicable rules of data protection law. 
 
The processing of information is covered by the Bikuben Foundation Group’s legitimate and reasonable interest in handling personal information that has been submitted in a report. This processing is assessed to be more important than the person’s interest which the report concerns. Thus, the processing is undertaken on the basis of a weighing of interests pursuant to article 6(1)(f) of the Data Protection Regulation. 

You may submit reports anonymously and, at the same time,  follow the progress of the case via a 16-digit key code, which will be provided after submission of the report via the whistleblower portal. 
 
You may subsequently communicate anonymously with BDO Statsautoriseret revisionsaktieselskab with the use of the 16-digit key code. You will receive a receipt for the report through this communication channel which, at the same time, provides an option for obtaining additional information necessary for processing the case without knowing the identity of the person in question.  
 
It is also via this communication channel that the person submitting the report may be sent any conclusion to the case. For all reports, the following deadlines apply to the whistleblower portal: 

• Within seven days, you will receive a receipt for the report. 
• The processing of the case shall occur as quickly as possible – preferably, within three months.  
• You shall have access to the case via the whistleblower portal and the 16-digit key code until the case is deleted. However, you shall have access to the case at a maximum for one year from the time of reporting.  

Unless there are particularly significant and warranted investigative considerations, the person about whom the reported information concerns shall be notified of the processing of the case when an investigation begins.  

Reports that are submitted in good faith shall not have adverse consequences for the person submitting the report.  
 
Reports that are submitted in bad faith or submitted in order to harass or harm the person about whom the reported information concerns may have consequences for the person submitting the report (for example, it may lead to a police report or have work-related consequences).  
 
Persons who submit information to the whistleblower scheme shall be informed of the processing of the case and its result.  

If the report does not fall with the framework of the whistleblower scheme or is groundless, personal information shall be deleted immediately.  
 
Personal information will also be deleted when it is no longer necessary but no later than when the investigation is closed.  
 
As a starting point, reports are deleted from the whistleblower portal after 90 days unless the deadline is manually extended by the recipient.  
 
The general rules regarding deletion also apply. If, on the basis of the information collected, a disciplinary sanction is implemented against an employee or there are other grounds it is reasonable and necessary to continue to retain information about an employee, the information shall be stored in the HR records of the person in question.