COVAL strives to achieve transparency and a high level of business ethics.

Our whistleblowing service offers the possibility to alert the organization about suspicions of misconduct in a confidential way. It is an important tool for reducing risks and maintaining trust in our operations by enabling us to detect and act on possible misconduct at an early stage. Whistleblowing can be done openly or anonymously. 

Who can report?  

All our work-based contacts are welcome to report misconducts, or concerns about misconduct to us, including, but not exclusively, volunteers, self-employed persons, trainees, employees, contractors, suppliers and customers. 

Persons who have belonged to any of these categories and acquired the information during their time in such roles may also report.
In addition, persons whose work-based relationship is yet not started may report to us in cases where information on breaches has been acquired during the recruitment process or other pre-contractual negotiations. 

What can be reported?  

The whistleblowing service can be used to report work-related misconduct for which there is a public interest. 

To be of public interest it should concern serious misconduct. (e.g. criminal offences and acts in breach of laws and regulations (including EU laws), corruption, risks for health and life, or damages to the environment), for example:

• Corruption and financial irregularities; for example, bribes, unfair competition, money laundering, fraud, conflict of interest
  • Health and safety violations; for example, workplace health and safety, product safety, serious discrimination, and harassment that are against the law
  • Environmental violations; for example, illegal treatment of hazardous waste
• Privacy violations; for example, improper use of personal data

A reporting person does not need to have firm evidence for expressing suspicion.
However, the reporting person must, at the time of submitting the report, have had reasonable grounds to believe that the information about the reported misconduct was true. 

How to report? 

There are different ways to raise a concern:

• Alternative 1: Contact a supervisor or manager within our organization.

• Alternative 2: Anonymous or confidential messaging through the whistleblower reporting channel to the whistleblowing team:

• Alternative 3: Should your concern relate to a legal entity within the European Union it is also possible to report through external channels, maintained by a competent authority in each EU country. 

All messages received will be handled confidentially.
The whistleblowing channel under alternative 2 above is administrated by WhistleB, an external service provider.
All messages are encrypted. To ensure the anonymity of the person sending a message, WhistleB deletes all metadata, including IP addresses.
The person sending the message also remains anonymous in the subsequent dialogue with the responsible receivers of the report. Anonymously through the external system managed by the independent company WhistleB:
If you prefer to submit your message through a phone call or in person, please also submit such a request through the form provided by WhistleB. 

When a report is submitted: 

The Whistleblowing Team: 

Access to messages received through our whistleblowing channel is restricted to appointed individuals with the authority to handle whistleblowing cases.
Their actions are logged and handling is confidential. When needed, individuals who can add expertise may be included in the investigation process.
These individuals can access relevant data and are also bound to confidentiality.

Receiving A Message: 

The reporting person will receive an acknowledgement of receipt of the report within 7 days.
Upon receiving a message, the whistleblowing team assess whether the report is such work-related misconduct in which there is a public interest, or not. If the result of such assessment is affirmative, appropriate measures for investigation will be taken, please see the Investigation below.
If the whistleblowing team considers the report not to fulfil the requirement of being such work-related misconduct of which there is a public interest, the reporting person will be appropriately informed.

Investigation:
All whistleblowing matters are treated seriously. 

• No one from the whistleblowing team, or anyone taking part in the investigation process, will attempt to identify the reporting person. 
  • If the external WhistleB channel is used, the whistleblowing team can, when needed, submit follow-up questions via the channel for anonymous communication.
• A message will not be investigated by anyone who may be involved with or connected to the wrongdoing.
• Whistleblowing messages are handled confidentially by the parties involved.
• Corporate or external expertise may be included in the investigation. 

Within three months from the acknowledgement of receipt of the report, the reporting person will receive feedback on the follow-up of the report. 

Protection and Privacy: 

• Whistleblower Protection: 

COVAL does not tolerate any actions seeking to hinder a person from reporting misconduct and no reporting person, with reasonable grounds to believe that the information about the reported misconduct was true, will be subject to any reprisals due to a submitted report. 

• Processing Of Personal Data: 

Personal data is only processed if necessary for the investigation of the report and in accordance with laws and regulations.
Only persons authorized to receive and investigate whistle-blower reports are given access to personal data and the access is limited to what is needed to fulfil the investigation.
Personal data will not be kept longer than necessary and no longer than two years. 

• Personal Data Processor: 

WhistleB Whistleblowing Centre AB (World Trade Centre, Klarabergsviadukten 70, SE-107 24 Stockholm) is responsible for the whistleblowing application, including the processing of encrypted data, such as whistleblowing messages.
Neither WhistleB nor any sub-suppliers can decrypt and read messages.
As such, neither WhistleB nor its sub-processors have access to readable content.