Internal notification system of the company Dopravní podnik města Hradec Králové, a.s.

Company Hradec Králové City Transport Company, a.s., with registered office at Pouchovská 153/52, Věkoše, 500 03 Hradec Králové, ID No.: 25267213, registered in the Commercial Register maintained by the Regional Court in Hradec Králové, Section B, Insert 1625 (hereinafter „Company“):

a) with regard to Act No. 171/2023 Coll., on the protection of whistleblowers, as amended (hereinafter referred to as „ZOO“ or „Whistleblower Protection Act“Whistleblowing, which sets out in particular the conditions for making and assessing a report of possible wrongdoing, and the conditions for providing protection to individuals who have made a report, and

b) with regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as „GDPR“), which sets out in particular the rules relating to the protection of natural persons in connection with the processing of personal data, has established the Company's Internal Notification System.

The Company's internal whistleblowing system implements the rights and obligations under the Whistleblower Protection Act.

I. NOTIFIER AND NOTIFICATION

1. Notifier

1.1 A whistleblower is an individual who has made a notification under the Whistleblower Protection Act.

2. Announcement

2.1 Notification means a notification under the Whistleblower Protection Act.

II. INTERNAL NOTIFICATION SYSTEM

1.   Competent person and contact details for submitting the Notification

1.1 In accordance with the Whistleblower Protection Act, the Company has established the Company's internal whistleblowing system for the receipt and handling of Notices.

1.2 The Company has appointed the following Competent Person to act as a Competent Person under the Whistleblower Protection Act: Ing. Josef Januš (hereinafter „Competent person“).

1.3 The Competent Person is the person who receives and processes Notices under the Company's internal notification system.

1.4 The Company allows the submission of Notices in writing, orally and in person as follows:

- Phone Competent persons: +420 495 089 270,

- e-mail Competent persons: oznameni@dpmhk.cz,

- via the Competent Persons contact form on the website www.dpmhk.cz

- by post to the delivery address Pouchovská 153/52, Věkoše, 500 03 Hradec Králové, with the information „At the hands of the Competent person“,

- in person at the office of the Competent Person: Pouchovská 153/52, Věkoše, 500 03 Hradec Králové, building, ground floor, room 19; office hours Competent persons for personal meetings Mon - Fri, 8:30 am - 10:30 am, or by prior arrangement.

2.    Content of the notification - identity of the Notifier

2.1 Pursuant to Section 2(2) of the ZOO, the Notification also contains information about the name, surname and date of birth, or other information from which the identity of the Notifier can be inferred. The Notification need not contain the information referred to in the first sentence if it has been submitted by a person whose identity is known to the Competent Person.

3.    Non-exclusion of whistleblowers

3.1 The Company does not exclude the acceptance of a Notice from a person who does not perform work or other similar activity for the Company pursuant to Section 2(3)(a), (b), (h) or (i) of the ZOO.

4.   Notification to the Ministry

4.1 The methods of notification to the Ministry of Justice are set out at: https://oznamovatel.justice.cz/chci-podat-oznameni/

5.    Whistleblower protection

5.1 The conditions for entitlement to Whistleblower protection and the scope and content of Whistleblower protection are set out in the Whistleblower Protection Act.

5.2 Protection from retaliation not applicable to a person who has made a Notification without having reasonable grounds to believe that it is based on truthful information.

6.    Procedure Competent persons after the notification

6.1 The Notifier may submit a Notification through the internal notification system in writing i orally (including by telephone notification) or at his request in person.

6.2 If the Notifier so requests, the Competent Person shall receive the notification in person within a reasonable time, but not later than 14 days from the date on which the Notifier so requests.

6.3 The Competent Person shall notify the Notifier in writing of the receipt of the Notification within 7 days of its receipt, unless:

(a) the Notifier has expressly requested the Relevant Person not to notify it of receipt of the Notification; or

(b) it is clear that notification of receipt of the Notification would disclose the identity of the Notifier to another person.

7.   Handling of information and personal data

7.1 Only the Competent Person may inspect the submitted Notifications. The Competent Person shall not provide information that could defeat or undermine the purpose of the Notification.

7.2 Information on the identity of the Notifier and the person referred to in § 4 (2) (a) to (h) of the ZOO may be provided only with their written consent, unless the Competent Person is obliged to provide such information to the relevant public authorities pursuant to generally binding legal regulations; this applies mutatis mutandis to information on the identity of the person referred to in the Notification in the case of a procedure under Title III. ZOO.

7.3 If the Competent Person provides information about the identity of the Notifier to a public authority pursuant to section 20(2) of the ZOO, it is obliged to notify the Notifier in advance, together with the reasons for which it is obliged to provide the information about the identity, and to allow the Notifier to comment on the provision of the information.

8.   Assessment of the Notification

8.1 The Competent Person must assess the validity of the Notification and notify the Notifier in writing of the results of the assessment within 30 days of receipt of the Notification. In cases of factual or legal complexity, this period may be extended by up to 30 days, but not more than twice. The Competent Person shall notify the Notifier in writing of the extension of the time limit and the reasons for it before the expiry of the time limit, unless:

(a) the notifier has expressly requested the Competent Person not to notify it of the results of the assessment; or

(b) it is clear that the notification of the results of the assessment would disclose the identity of the Notifier to another person.

8.2 If the Competent Person determines, in assessing the reasonableness of the Notice, that it is not a Notification under the Whistleblower Protection Act, it shall notify the Whistleblower in writing without undue delay.

8.3 If the Notification is found to be justified, the Company's Competent Person shall propose measures to prevent or remedy the violation. If the notification is made to the Competent Person of an obliged entity for which the Notifier does not carry out work or other similar activity, the Competent Person shall propose corrective measures to the person for whom the Notifier carries out work or other similar activity, unless the nature of the matter so excludes. If the Company does not accept the measure proposed by the Competent Person, it shall take another appropriate measure to prevent or remedy the unlawful condition; this shall not apply if the measure is proposed to a person other than the obliged entity that designated the Competent Person.

The Company shall promptly notify the Competent Person of the action taken, who shall notify the Whistleblower in writing without undue delay, unless:

(a) the notifier has expressly requested the Competent Person not to notify him of the action taken; or

(b) it is clear that notification of the measures taken would reveal the identity of the Whistleblower to another person.

8.4 If the Notification is not found to be justified, the Competent Person shall without undue delay inform the Notifier in writing that, on the basis of the facts stated in the Notification and the circumstances known to it, it does not suspect that an infringement has been committed or that the Notification is based on false information, and shall inform the Notifier of the right to file a notification with a public authority.

9.    Recording of Oral Notifications

9.1 The Competent Person shall make an audio recording or recording of the Oral Notice which faithfully captures the substance of the Oral Notice. An audio recording of an oral Notification may only be made with the consent of the Notifier. The Competent Person shall give the Notifier an opportunity to comment on the recording or transcript of the audio recording, if made; the Notifier's comments shall be attached to the recording or transcript.

10. Recording and Retention of Notifications

10.1 The Competent Person is obliged to keep an electronic record of data on received Notifications, in the following scope:

(a) the date of receipt of the Notice,

(b) the name, surname, date of birth and contact address of the Notifier, or other information from which the identity of the Notifier can be inferred, if known,

(c) a summary of the contents of the Notice and identification of the person against whom the Notice was directed, if known,

(d) the date of completion of the Competent Person's assessment of the reasonableness of the Notification and the outcome thereof.

10.2 The Competent Person shall keep the Notification submitted through the Internal Notification System and the documents related to the Notification for a period of 5 years from the date of its receipt.

10.3  In the case of Notifications submitted through the internal notification system, only the Competent Person shall have access to the records, the documents relating to the Notification and the Notifications stored.

11. Knowingly False Notification - an offence

11.1 Pursuant to Section 23(1) of the ZOO, an individual commits an offence by knowingly making a false Notification.

11.2 A fine of up to CZK 50,000 may be imposed for an offence under section 23(1) of the ZOO.

12. External notification system

12.1 The competent authority for the operation of the external reporting system is the Ministry of Justice.

III. PERSONAL PROTECTION DATA

1.    General principles and personal data processed

1.1 Any processing of personal data under the Whistleblower Protection Act shall be carried out in accordance with the GDPR.

1.2 The Company, as the data controller, processes the following personal data:

(a) the name, surname, date of birth and contact address of the Whistleblower, or other information from which the identity of the Whistleblower can be inferred, if known; and

(b) the identification details of the person against whom the Notice is directed, if known.

1.3 The notification can also be made anonymously, in which case the processing of the Notifier's personal data does not take place.

2.    Information according to Article 13 GDPR

In accordance with Article 13 of the GDPR, the Company hereby provides the following information to all personal data subjects:

(a) Identity and contact details of the data controller

The data controller is the Company.

(b) Data Protection Officer

The Company has appointed a data protection officer, namely GDPR Hradec s.r.o., with registered office: Orlické nábřeží 376/17, 500 03 Hradec Králové, ID: 06708218, contact person: Mgr. Martin Jeřábek, e-mail: info@gdprhradec.cz, tel: +420 495 510 765.

(c) Purposes of the processing

Processing and handling of the Notification under the Whistleblower Protection Act.

(d) Legal basis for processing

The legal basis for the processing of personal data is the legal title referred to in Article 6(1)(c) of the GDPR, where the processing of personal data is necessary for the fulfilment of a legal obligation to which the Company is subject as a controller, and the title referred to in Article 6(1)(a) of the GDPR, i.e. the consent of the Notifier (data subject) for the purpose of providing information about the identity of the Notifier, if applicable, and for the purpose of making an audio recording or transcript of the oral Notification.

(e) Categories of data subjects concerned

Whistleblowers, other persons under the Whistleblower Protection Act, and persons affected by the Notification.

f) Potential recipients of personal data

Law enforcement authorities, provided that the legal conditions for the transfer of processed personal data to that authority are met.

(g) Duration of processing of personal data

For the time necessary to complete the Notification and the facts stated therein, and for the period of performance of the obligations set forth in generally binding legal regulations, in particular the Whistleblower Protection Act.

(h) Source of personal data

Notification and personal data provided by the Notifier.

(i) Rights of data subjects:

1) The right to Access to personal data

The data subject has the right to access all personal data processed. Upon request, the Company shall provide a copy of the personal data processed in a machine-readable format.

2) The right to Correction personal data

The data subject shall have the right to have inaccurate personal data concerning him or her rectified by the controller without undue delay. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by providing an additional declaration.

3) The right to deletion personal data

The data subject has the right to have personal data processed unlawfully by the Company erased.

4) The right to limitations processing of personal data

The data subject has the right to block his or her personal data under the conditions set out in Article 18 of the GDPR (in particular, if an objection is raised, if there is a dispute about the lawfulness of the data processing).

5) The right to portability personal data

The data subject has the right to have the Company provide him or her with the automated personal data in a structured, commonly used and machine-readable format or, where technically feasible, to have the Company transfer the data to another controller.

6) Law not be subject to automated decision-making

The data subject has the right not to be subject to any decision based solely on automated processing, including profiling, which would have legal effects concerning him or her or significantly affect him or her. The Company does not carry out any such automated decision-making or profiling.

7) Right to file objection

The data subject has the right to object to the processing of personal data on the grounds of legitimate interest.

8)    Request for the processing of personal data

If personal data is provided by the Notifier, it will be processed in accordance with the GDPR. The processing of the Notifier's personal data is carried out on the basis of the Whistleblower Protection Act and Article 6(1)(c) GDPR, is not a contractual requirement and the Notifier is not obliged to provide personal data.

The provision or non-provision of personal data has no consequences for the Notifier, except that in case of non-provision of personal data the Company will not be able to identify the Notifier.

9) The right to filing a complaint

The data subject has the right to contact the Company at any time with his/her complaint or to lodge a complaint with the Office for Personal Data Protection, address: Pplk. Sochora 27, 170 00 Prague 7 or apply for judicial protection.

3.    Method of exercising personal data protection rights

3.1 To exercise your rights in relation to the Notice, please contact the Company: The relevant person.

3.2 On the website http://www.dpmhk.cz/ are located specimen forms to exercise the rights of data subjects.

3.3 In certain cases defined by legislation, the Company is not obliged to grant the request in whole or in part. This will be the case in particular if the request is manifestly unfounded or unreasonable, especially because it is repetitive. In such cases, the Company may:

- impose a reasonable fee taking into account the administrative costs; or

- refuse to grant the request.

If the Company receives a data protection request but has reasonable doubt as to the identity of the sender of the request, it may request additional information necessary to confirm the identity of the requestor.