Whistleblower Procedure

1. Purpose

This procedure establishes a professional whistleblowing system for Triops Technologies and its subsidiaries (collectively, "Triops"). It is designed to enable individuals to report, in a secure and confidential manner, unlawful acts or conduct that constitutes a threat or serious harm to the public interest.

The procedure is adopted in compliance with French and European Union legislation governing the protection of whistleblowers and the collection and processing of reports.

2. Scope

This procedure is open to any natural person who qualifies as a whistleblower under applicable law. This includes, but is not limited to:

• Current and former employees of Triops;
• Job applicants;
• Directors, shareholders, partners, and holders of voting rights;
• Members of administrative, management, or supervisory bodies;
• Contractors, subcontractors, and members of their governing bodies or staff;
• External and occasional collaborators.

3. Key Definitions

4. Reportable Matters

4.1 Matters Within Scope

Reports may concern information relating to any of the following:

• A crime or offense;
• Conduct that threatens or causes serious harm to the public interest;
• A violation, or attempted concealment of a violation, of an international commitment duly ratified or approved by France;
• A violation, or attempted concealment of a violation, of a unilateral act of an international organization;
• A violation, or attempted concealment of a violation, of a statute or regulation;
• A violation, or attempted concealment of a violation, of European Union law;
• A breach of the Triops Anti-Corruption Code of Conduct.

By way of illustration, this may include corruption, influence peddling, conflicts of interest, embezzlement, tax fraud, anti-competitive practices, or serious risks of violations of human rights and fundamental freedoms.

This system does not cover individual or collective labor disputes. The whistleblowing mechanism is intended to address matters of general scope directed at the common good.

4.2 Matters Outside Scope

The following categories of information are excluded from this procedure:

• Information covered by national defense secrecy;
• Information protected by medical confidentiality;
• Information subject to the secrecy of judicial deliberations, investigations, or inquiries;
• Information covered by attorney-client privilege.

4.3 Conditions for Whistleblower Status

A person qualifies as a whistleblower under this procedure if they:

• Have personal knowledge of the reported facts, where the information was not obtained in the course of their professional activities;
• Act in good faith;
• Do not receive direct financial compensation for making the report;
• Do not act with the intent to cause harm.

4.4 Optional Nature of the System

This whistleblowing system is a complementary mechanism. It does not replace existing internal communication channels such as reporting through management or employee representative bodies. Use of this system is voluntary and should remain exceptional, given the scope described above. No adverse consequences will result from choosing not to use it.

5. Responsibilities and Contact Information

All persons involved in the handling of a report must comply with the provisions of this procedure. Primary responsibility for the administration of this system lies with the Referent and the management of Triops Technologies.

The Referent for Triops Technologies is the Ethics Committee.

If any member of the Ethics Committee is personally implicated by a report, that member will be excluded from every stage of the process, including the assessment of admissibility and all subsequent verification and handling.

Reports may be submitted through the following channels:

6. How to Submit a Report

6.1 Internal Reporting (to the Referent)

A person wishing to make a report should send a formal request to the Referent by email or by post. The formal request requires the following information, to the extent available:

• The identity of the whistleblower;
• Whether the whistleblower consents to their identity being disclosed during the procedure;
• The date, location, and persons involved, together with a detailed description of the reported facts;
• Contact information for further communication with the Referent (email preferred, or postal address).

The whistleblower should attach any information or documents in their possession that may substantiate the report, in any form or medium.

6.2 Anonymous Reports

As an exception, an anonymous report may be processed provided that the gravity of the facts described is established and the factual elements are sufficiently detailed. The Referent will exercise particular caution and carry out a preliminary assessment before circulating any anonymous report within the system. Because verification of the whistleblower's status is a condition of admissibility under French law, anonymous reporting should remain exceptional.

6.3 Oral Reports

Reports may also be made orally by telephone, voice message, or audio message. When a report is submitted orally, the Referent must acknowledge receipt within seven days. Within the following twenty days, the whistleblower will be invited to attend an interview, either in person or by videoconference, at the whistleblower's choice. The interview will be recorded, transcribed, or summarized in a detailed written record, which the whistleblower must review, correct if necessary, and approve.

6.4 Timelines

The Ethics Committee will meet to review any new report within 15 days of receipt (this period may be shortened in exceptional circumstances). An opinion must be issued within a maximum of three months. The Committee may consult any internal or external expert relevant to the subject matter of the report.

6.5 Reporting to Competent Authorities

In the event of serious and imminent danger, or where the Referent has failed to verify the admissibility of the report within three months, the whistleblower may refer the matter to the judicial authority, the relevant administrative authority, or the applicable professional body.

Under French law, the whistleblower is free to choose between the internal channel described in this procedure and external reporting to a competent authority. For guidance on the appropriate body, the whistleblower may also contact the Defender of Rights (Défenseur des droits) or any competent institution, body, or agency of the European Union.

6.6 Public Disclosure

A whistleblower may make a public disclosure in the following circumstances:

• Where there is a serious and imminent danger, or, for information obtained in a professional context, an imminent or manifest danger to the public interest;
• Where no appropriate measures have been taken following an external report;
• Where external reporting would expose the whistleblower to a risk of retaliation or would not effectively remedy the situation.

Public disclosure is strictly prohibited where it would compromise national defense or security interests. A whistleblower who makes such a disclosure in violation of this restriction forfeits all protections.

7. Processing of Reports

7.1 Acknowledgment of Receipt

Upon receiving a report, the Referent will inform the whistleblower, using the contact details provided, of:

• The proper receipt of the report;
• The estimated timeframe for the admissibility assessment;
• The fact that the whistleblower will be kept informed of the outcome;
• The whistleblower's rights of access to and rectification of personal data collected during the procedure.

7.2 Admissibility Assessment

The Referent examines the reported facts and supporting documents to determine whether the report falls within the scope of the applicable legislation. During this phase, the Referent may collect additional evidence and testimony.

If the report is found to be admissible, the Referent prepares a written summary setting out:

• The circumstances and date on which the report was submitted;
• The verification steps carried out;
• The facts revealed and the supporting evidence.

This summary is transmitted to the persons competent to bring the reported conduct to an end, including, where appropriate, Triops management. The admissibility assessment must be completed within three months.

7.3 Notification of Persons Concerned

Any person who is the subject of a report will be notified without delay of the recording of data concerning them, so that they may exercise their right to object to the processing of that data. Where precautionary measures are required to prevent the destruction of evidence, notification may be deferred until those measures have been adopted.

The notification will be sent by registered mail or email with acknowledgment of receipt and will include:

• The identity of the entity responsible for the system;
• A description of the facts alleged;
• The departments that may receive the report;
• The procedures for exercising rights of access and rectification.

8. Guarantees and Protections

The protections set out below apply not only to the whistleblower, but also to: (i) any facilitator, whether a natural or legal person, who assisted in making the report; (ii) any natural person connected to the whistleblower who may face retaliation; and (iii) any legal entity controlled by the whistleblower, within the meaning of Article L. 233-3 of the French Commercial Code, for which the whistleblower works or with which they are connected professionally.

8.1 Confidentiality

The identity of the whistleblower, the facts reported, and the identity of any persons concerned will be treated with strict confidentiality at all stages, including where information must be shared with third parties solely for the purpose of verifying or processing the report.

In particular, only the Referent is authorized to:

• Conduct the admissibility assessment;
• Access the dedicated whistleblowing email address (whistleblower@3ops.io);
• Open correspondence received under this procedure.

Information that could identify the whistleblower may not be disclosed to anyone other than the judicial authority without the whistleblower's consent. Information that could identify the person implicated may not be disclosed, other than to the judicial authority, until the report has been found to be substantiated.

8.2 Data Protection

All materials collected during the procedure are stored securely by the Referent. Electronic records are protected by a personal identifier and a password known only to the Referent. Physical records are kept in a locked location on the Referent's business premises. Personal data collected in connection with this procedure are processed in compliance with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés).

8.3 Data Retention

Data relating to a report may be retained only for the time strictly necessary and proportionate to its processing and to the protection of the whistleblower, the persons concerned, and any third parties mentioned.

Data that falls outside the scope of this system will be destroyed without delay upon collection.

If no follow-up action is taken, all elements capable of identifying the whistleblower or the persons targeted will be destroyed within two months of the closure of the admissibility assessment.

If the report leads to disciplinary or legal proceedings, the data will be destroyed at the conclusion of those proceedings.

8.4 Rights of Access and Rectification

Any person identified in the whistleblowing system has the right to access the data held about them and to request the rectification or deletion of information that is inaccurate, incomplete, ambiguous, or outdated. However, the person who is the subject of a report may not obtain, through the exercise of their right of access, any information concerning the identity of the whistleblower.

8.5 Protection from Retaliation

No person may suffer adverse consequences for having submitted a report in compliance with this procedure. In particular:

• No whistleblower may be excluded from a recruitment process, an internship, or professional training;
• No employee may be suspended, dismissed, demoted, denied promotion, transferred, subjected to a pay reduction, deprived of training, given a negative performance evaluation, subjected to disciplinary measures, discriminated against, or have their fixed-term contract non-renewed as a result of making a report.

Under French law, any natural or legal person who engages in dilatory or abusive action against a whistleblower on account of the information reported or disclosed may face a fine of up to 60,000 euros.

8.6 Civil and Criminal Protections

A whistleblower who has reported or disclosed information in accordance with this procedure is not civilly liable for any damage arising from their report or disclosure, provided they had reasonable grounds to believe that the reporting or disclosure was necessary to safeguard the interests at stake.

A whistleblower also benefits from criminal protection. In particular, the whistleblower is not criminally responsible for the manner in which they obtained documents to establish the veracity of the reported information, including through the retrieval, removal, or concealment of documents, provided they had lawful access to those documents.

8.7 Limits

Reports made with the intent to cause harm or containing deliberately inaccurate facts will be considered abusive. Such reports may expose the author to disciplinary sanctions and legal proceedings. Conversely, the good-faith use of this system, even where the facts later prove to be inaccurate or no follow-up action is taken, will carry no adverse consequences for the whistleblower and will remain confidential.

The personal data collected through this whistleblowing system is processed for the purpose of receiving and handling reports within the scope described in this procedure. In accordance with the French Data Protection Act (Loi Informatique et Libertés, as amended) and Regulation (EU) 2016/679 (GDPR), you may exercise your rights of information, access, rectification, erasure, and objection with respect to the processing of your personal data by contacting the Referent at the address above.