Whistleblowing law

INFORMATION UNDER ARTICLE 12, PARAGRAPH 4 OF THE APPRIPDIB

ON THE CONDITIONS AND PROCEDURE FOR INTERNAL WHISTLEBLOWING IN “BULTEX 99″LTD

This information is provided by BULTEX 99 Ltd in compliance with the requirements of Article 12, paragraph 4 of the Act on the Protection of Persons Reporting Information or Publicly Disclosing Information about Breaches (Whistleblowers Protection Act), promulgated  in State Gazette № 11 of 2 February 2023, entry into force from 4 May 2023, hereinafter referred to as “APPRIPDIB” or “WPA”.

The purpose of the WPA is to provide protection for persons who report or publicly disclose information about breaches of Bulgarian legislation or European Union (“EU”) acts that threaten or harm the public interest, that has become known to them in the course of or in connection with the performance of their work or official duties or in another work-related context.

Pursuant to Article 13 of the WPA, BULTEX 99 Ltd. has established an internal reporting channel under the WPA. Received reports are accepted, registered and examined by one or more employees responsible for the examination of whistleblowers, designated by order of the Manager. Whistleblowers shall have no conflict of interest for each case reviewed.

І. REPORTING THROUGH INTERNAL CHANNEL

1. Persons to whom protection under the WPA is granted

A person reporting breaches through Internal Reporting Channel may be a reporting person (whistleblower) within the meaning of Article 5(2) of the WPA, namely: a natural person who submits an information report about breaches that has become known to him/her in his/her capacity as:

  1. a worker, employee or other person who performs wage labour at BULTEX 99 , regardless of the nature of the work, the method of payment or the source of financing;
  2. a person who performs work without an employment relationship in BULTEX 99 , exercises a freelance profession or craft activity;
  3. a volunteer or an intern (trainee) at BULTEX 99 Ltd;
  4. а partner, shareholder, sole owner of the capital, member of the management or supervisory body or member of the audit committee of BULTEX 99 Ltd;
  5. a person who works for a natural or legal entity, contractors, subcontractors or suppliers of BULTEX 99 Ltd;
  6. a person whose employment or service with BULTEX 99 Ltd is yet to begin in cases where information on breaches has been acquired during the recruitment process or other pre-contractual negotiations;
  7. а worker or an employee of BULTEX 99 , when the information was obtained within the framework of an employment or service relationship that has been terminated at the time of the submission of the report;
  8. any other whistleblower within the meaning of Article 5(2) of the WPA.

IMPORTANT! Anonymous signals are NOT considered.

2. Subject area of the reports on breaches under the WPA

Reports on breaches submitted under the WPA must refer to one or more of the following areas related to the activities of BULTEX 99 Ltd., namely:

  1. breaches of Bulgarian legislation or of European Union (EU) acts specified in the Annex to 1 and 3 of the WPA, Part I and Part II, in the field of:a) public procurement;
    b) financial services, products and markets and the prevention of money laundering and terrorist financing;
    c) product safety and compliance;
    d) transport safety;
    e) environmental protection;
    f) radiation protection and nuclear safety;
    g) food and feed safety, animal health and animal welfare; з) public health;
    h) consumer protection;
    i) the protection of privacy and personal data;
    j) security of networks and information systems.
  2. breaches affecting the financial interests of the European Union within the meaning of Article 325 of the Treaty on the Functioning of the European Union (TFEU) and further specified in the relevant Union measures;
  3. violations of the internal market rules within the meaning of Article 26 (2) of the Treaty on the Functioning of the European Union (TFEU), including the rules of the European Union and Bulgarian legislation on competition and state aid;
  4. violations related to cross-border tax schemes, the purpose of which is to obtain a tax advantage that defeats the object or purpose of the applicable corporate tax law;
  5. a committed crime of a general nature of which the person has learned in connection with the performance of his or her work or in the performance of his or her official duties;
  6. breaches of Bulgarian legislation in the area of:
    • the rules for payment of due public state and municipal receivables;
    • labour legislation;
    • the legislation relating to the performance of civil

IMPORTANT! Reports on breaches that do not fall within the scope of the WPA and the content of which does not warrant being considered credible shall not be considered.

IMPORTANT! Proceedings shall not be initiated on registered anonymous signals or reports on breaches committed more than two years ago.

3. Procedure for reporting through internal channel in BULTEX 99 Ltd.

Reports of information on breaches through the internal channel at BULTEX 99 Ltd. shall be submitted to the employee(s) responsible for handling reports in writing, including by e-mail or orally, as follows:

3.1. in writing:

  • by email: signali@bultex99.com
  • by post/courier to the address: Plovdiv 4000, 8 Karlovsko shose Str.
  • in person at “BULTEX 99” at the address: Plovdiv, 4000, 8 Karlovsko shose Str., through a personal meeting with an employee responsible for signals, arranged in advance.
  • orally – on the spot at BULTEKS 99 Ltd. at the address: Plovdiv, 4000, 8 Karlovsko shose Str., through a personal meeting with the employee responsible for handling signals at “BULTEKS 99” Ltd., agreed in advance.
  • A written report shall be submitted by filling in the Report Registration Form for submitting information on breaches under the Whistleblowers Protection Act (WPA) (PDF) (DOCX) in a sample approved by the CPDP (hereinafter referred to as the “Report Registration Form” or “Form”) which shall contain at least the following data:
    1. the whistleblower’s full name, address and telephone number, as well as e-mail address, if available;
    2. the names of the person against whom the report is directed and his place of work, if the report is filed against specific person and the person is known;
    3. specific details of the breach or of a real danger that it will be committed, the place and period of the breach, if it was already committed, a description of the act or the situation and other circumstances as far as these are known to the whistleblower;
    4. date of submission the report;
    5. signature, electronic signature or other identification of the sender.

IMPORTANT! The form is NOT mandatory for the reporting person (whistleblower). In case he/she decides to use it, the whistleblower should only fill in Part I – V inclusive and sign it:

  • when sending the form by post/courier – with a handwritten signature;
  • when sending the form by e-mail – with a qualified electronic signature (QES).

When the whistleblower does not use the sample Form approved by the CPDP, he/she may submit a written report in any other way, providing at least the information referred to in Article 15(2) of the WPA.

The written report shall be submitted in person to the employee responsible for handling signals at BULTEX 99 Ltd. or shall be sent to him/her by email: signali@bultex99.com or by post/courier to the address: Plovdiv 4000, 8 Karlovsko shose Str., with explicit writing of the text: “SIGNAL under the ZZLPSPOIN” or “REPORT under the WPA”

3.2. An oral report shall be submitted through a personal meeting with the employee at BULTEX 99 Ltd. responsible for handling reports, which the reporting person has arranged in advance. The oral report shall be documented by  the employee responsible for handling reports at BULTEX 99 Ltd. by filling in a Report Registration Form (mandatory according to the sample form of the CPDP), who shall offer the reporting person to check it for accuracy and sign it if he/she wishes.

To the report may be attached any written evidence available to the reporting person supporting the statements made in it and/or to provide indicating data on persons who could confirm the reported data or provide additional information.

If the report does not meet the requirements of the law, the whistleblower shall be sent a message to eliminate the irregularities within 7 days of receiving the report. If the irregularities are not corrected within this period, the report together with its attachments shall be returned to the whistleblower.

4. Receiving, registering and handling reports on breaches. Follow-up actions. 

Within 7 days of receipt, the employee responsible for handling reports shall confirm receipt and register it with a unique identification number (UIN) provided by the CPDP. Any subsequent information or communication relating to the report shall apply to this UIN.

The report is subject to an internal investigation at BULTEX 99 Ltd and where necessary additional information is requested from the whistleblower or third parties.

Within three months of confirming receipt of the report, the employee responsible for handling reports at BULTEX 99 Ltd. shall provide the reporting person feedback about the results of the  inspection and the actions taken.

If necessary to take action with the assistance of a state authority, the report may be forwarded to the CPDP after prior notification of the reporting person.

IMPORTANT! Each report shall be checked for its credibility. Reports that do not fall within the scope of the WPA and the content of which does not give reasons to be considered credible shall not be considered. Reports that contain patently false or misleading statements of fact shall be returned with instructions to the sender to correct the statements and his liability for libel or slander.

IMPORTANT! Persons named in the whistleblower report as violators shall be entitled to compensation for all material and non-material damages when it is established that the reporting person has knowingly reported or publicly disclosed false information. In these cases, the whistleblower shall be liable to a fine of BGN 3,000 to BGN 7,000

 5. Conditions for protection of reporting persons under the WRA

A person reporting on breaches through internal channel at BULTEX 99 Ltd. or through external channel within the meaning of the WPA shall have the right to protection when the following conditions are met simultaneously:

  1. The person has had reasonable grounds to believe that the information provided in the report was correct at the time of submission and that such information fell within the scope of Article 3 of the WPA; and,
  2. The person has reported on breaches under the terms and conditions of the WPA.

6. Protection of reporting persons under the WPA

Protection under the WPA shall be granted to the reporting person (whistleblower) from the moment of submitting the report, subject to the conditions under Article 6 of the WPA. Protection under WPA shall also granted to:

  • persons who assist a reporting person in the whistleblowing process;
  • persons who are connected with the reporting person (colleagues or relatives) and who could be subject to retaliation as a result of the reporting; and
  • legal entities in which the reporting person holds a shareholding, which works for or with whom is otherwise connected in a work-related context.

The identity of the reporting person, persons connected to the reporting person (colleagues, relatives) and any other person  named in the report will be duly protected against unjustified disclosure and the necessary measures will be taken to restrict unauthorized access to the report.

The WPA prohibits any form of retaliation against protected persons, having the character of repression and putting them at a     disadvantage: suspension, dismissal; demotion or delay in promotion; changes in job location or nature of work,  working hours, or reduction of remuneration; negative performance assessment; imposition of financial and/or disciplinary liability; physical or verbal coercion; threat; hostility; violation of their dignity; discrimination; unfair treatment, etc.

ІI. REPORTING THROUGH EXTERNAL CHANNEL

Where the reporting person is at risk of retaliatory, discriminatory action or it is apparent that effective action to verify the signal to eliminating the breach will not be taken, the whistleblowing should be submitted through an external reporting channel.

THE COMMISSION FOR PERSONAL DATA PROTECTION (CPDP) is the central authority for external reporting and for the protection of individuals who are afforded protection under the WPA. A report may be summited directly  to the CPDP through the external reporting channel established at the CPDP as follows:

1. in writing:
    – by e-mail whistleblowing@cpdp.bg
    – by mail to the address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.

2. orally – on site at the CPDP at the address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
– By Secure Electronic Delivery System (if possible)

For submitting a written report, the whistleblower shall use the sample Report Registration Form for submitting information on breaches under the Whistleblowers Protection Act (WPA) (PDF) (DOCX), published on the website of the CPDP. The form is not mandatory. However, in case he/she decides to use it, the whistleblower should only fill in Parts I to V inclusive and sign it: when sending the form by post – with a handwritten signature; when sending by e-mail – with a qualified electronic signature.

When the Secure Electronic Delivery System is used to submit the report, the CPDP employee responsible for reviewing the report will contact the whistleblower for the purpose of filling in a Report Registration Form for registering an information report about breaches according to the APPRIPDIB.

More information on the procedure for submitting a report to the CPDP and the conditions under which protection under the WPA is granted can be found on its website: https://cpdp.bg/en/.

III. PUBLIC DISCLOSURE OF INFORMATION ON BREACHES

Instead of reporting on breaches through an internal or external channel, a whistleblower may publicly disclose information about breaches, under the terms of Article 7 of the WPA, in cases where:

  • the person has reported on breaches under the conditions and according to the procedure of WPA, but the appropriate actions has not been taken on the report within the provided time limits;
  • the person has grounds to believe that the breach may constitute an imminent or manifest danger to the public interest, or there is an emergency or risk of irreversible damage; or where, in case of an external reporting, there is a risk of retaliation or there is a likelihood that the breach will not be effectively investigated due to the risk of concealment or destruction of evidence, suspicion of collusion between the competent authority and the perpetrator of the breach,  or of complicity by the authority in the breach, as well as other specific circumstances of the case.

IV. OBLIGATION OF CONFIDENTIALITY

“BULTEX 99 Ltd. shall take appropriate technical and organizational measures to protect the information related to the reported breaches and to protect the identity of the reporting persons.

Access to the personal data contained in the whistleblower reports shall be limited to the employees of BULTEX 99 Ltd. responsible for handling the reports, to whom such data is necessary for the performance of their official duties in accordance  with the “need-to-know” principle.

The reports are processed in compliance with the confidentiality obligation arising from Art.31and Art.32 of the WPA

V. PROCESSING OF PERSONAL DATA OF WHISTLEBLOWERS

Any processing of personal data carried out pursuant to the WPA, including the exchange or transmission of personal data at the competent authorities, shall be carried out by BULTEX 99 Ltd. in accordance with Regulation (EU) 2016/679 and Directive (EU) 2016/680, and where the transmission involves institutions, bodies, offices or agencies of the European Union – in accordance with Regulation (EU) 2018/1725, as well as the Personal Data Protection Act.

Personal data that is clearly not relevant to the handling of a specific report shall not be collected and, if accidentally collected, shall be deleted without undue delay.

The provision of personal data of reporting person is a prerequisite for the whistleblower to be considered under the HIPAA. Failure to provide personal data and the submission of anonymous signals is an absolute obstacle to initiating proceedings on the report, according to Article 9 of the WPA.

POLICY FOR PERSONAL DATA PROTECTION IN THE CASE OF WHISTLEBLOWING UNDER THE WPA

  1. Data Controller

“BULTEX 99 Ltd. is the controller of the personal data of persons reporting on beaches through an internal    reporting channel, as an obliged subject under Article 12, paragraph 1 of the WPA.

Contact details of the controller: “BULTEX 99” Ltd, UIC: 115784032

Headquarters and registered address: Plovdiv 4000, 31 Vasil Aprilov  Blv d..

Business address: Plovdiv, 4000, 8  Karlovsko shose St

Website: www.bultex99.com, e-mail: signali@bultex99.com

Contact details of the whistleblower’s data protection officer:

Data Protection Officer for Whistleblowers: Maria Pingeva  , Tel. 0889797696, e-mail:signali@bultex99.com

  1. Data subjects

A data subject in connection with a report of a breach of the WPA may be:

  • the sender of the report, the so-called “whistleblower” as referred to in Article 5(2) of the WPA or persons related to the whistleblower
  • the person against whom the report is filed, referred to as “person concerned” within the meaning of 1, point 5 of the SP of the WPA
  • witnesses to the breaches and other persons whose data could become known during the inspection

3.  What personal data do we collect and process?   

When reporting breaches (signalling possible wrongdoing), the reporting person must provide at least the following personal information:

  • first, middle and surname
  • address and telephone number, as well as an e-mail address where the person has one
  • signature, electronic signature or other identification of the person submitting the report
  • any other information contained in the submitted report or in the attached evidence, through which the person submitting the report can be directly or indirectly

Where the report is directed against a natural person, including cases where the latter represents a legal entity or other legal formation, BULTEX 99 Ltd. shall also process the personal data of the so-called concerned person. “BULTEX 99 Ltd. may also process personal data of any other individual mentioned in the report (such as  assistants, related persons – colleagues, relatives, etc.).

  1. Purposes for processing personal data of whistleblowers

Personal data are processed for the purpose of ensuring the protection of persons who report breaches of Bulgarian legislation or of European Union acts that threaten or harm the public interest, which has become known to them during or in connection with the performance of their employment duties or in another work context, as well as for the fulfilment of relevant legal obligations.

5. Legal basis for the processing of personal data of whistleblowers

The personal data of reporting persons are processed on the basis of Article 6, paragraph 1, point (c) of Regulation (EU) 2016/679 (General Data Protection Regulation) in connection with the obligations of BULTEX 99 Ltd. arising from the WPA to receive,  register and process internal reports on breaches. Processing personal data is necessary for the verification of the  information provided in the whistleblower report, for the reviewing of the report, and for conducting the related investigation.

6. Recipients of personal data of whistleblowers

Access to the personal data contained in the whistleblower reports shall be granted to the employees responsible for receiving, registering and handling the whistleblower reports, designated by the Manager’s order. Employees responsible for handling reports must sign a confidentiality declaration.

Disclosing the identity of reporting persons or information related to the reported breaches is only permissible under the conditions of Article 31 of the WPA, namely:

  1. with the express written consent of the reporting person. It shall be given to the employee responsible for handling repots at BULTEX 99
  2. when this is necessary and proportionate obligation imposed by Bulgarian legislation or EU law in the context of national authorities’ investigation or judicial proceedings, including ensuring the right to defence of the person against whom the report has been filed. In such cases, the reporting person shall be informed in advance of the need for disclosure by written notification from the employee responsible for handling The reporting person shall not be notified when this jeopardise the investigation or legal proceedings.

7. Transfer of personal data to a third country or international organisation

The personal data contained in the reports are not transferred to a third country or international organisation. If a legal obligation to transfer the data arises, BULTEX 99 Ltd. shall inform the reporting persons before the transfer and provides the necessary measures for the specific case to ensure the adequacy of personal data protection.

8. Storage period for personal data

Personal data shall be stored for a period determined by considering the following criteria:

  1. the time required for conducting the report verification
  2. the time required for further investigations and
  3. the period of storing the report according to Article 18, paragraph 2, item 9 of the WPA in conjunction with Article 8 of Ordinance No. 1 of 27.07.2023 on the keeping of the register of reports under Art. 18 of the WPA and for forwarding of internal reports to the CPDP, namely: for a period of 5 years after the completion of the handling of the report, which can be continued in the presence of instituted criminal, civil, labor-law, or administrative proceedings initiated in connection with the submitted report (until the expiry of the limitation period for appealing the decision).

 

Signal

The report does not fall under the scope

of the WPA

 The report did not lead to any  consequences and the inspection was terminated The report has led to disciplinary or legal proceedings
When data is destroyed or anonymised immediately within 5 years after the completion  of the handling of the report

within 5 years after termination of legal proceedings

or expiry of the limitation period for appealing the decision

9. Application of methods for automated individual decision-making, including profiling

“BULTEX 99 Ltd. does not apply methods for automated individual decision-making in data processing, including profiling.

10. The data subjects’ rights
When processing personal data, whistleblowers submitting reports under the WPA have all rights as data subjects under Articles 15-22 of Regulation (EU) 2016/679, which they may exercise in accordance with the procedure set out in the Privacy Policy of BULTEX 99 Ltd. published on the website: www.bultex99.com.

In addition to the rights under Regulation (EU) 2016/679, whistleblowers also have certain special rights under the WPA, such as:

  • to decide whether they want to sign the documented oral (verbal) report (Article 15 (3) of the WPA);
  • to receive confirmation of receipt of the report within 7 days of its submission to BULTEX 99 Ltd;
  • to receive information about the final results of the internal investigation of the report, the anticipated or taken actions, within a period not exceeding 3 months, which in cases requiring a thorough investigation may be extended to 6 months (Article 16, item 4, in conjunction with Article 17 (1), item 4 of the WPA);
  • to obtain information about the procedures for external reporting to the CPDP, and when appropriate, to the institutions, bodies, services and agencies of the European Union (Article 16, Para 5 of the WPA);
  • to be informed of the forwarding the report to the external reporting authority – the CPDP, when necessary for actions to be taken by them (Article 16, item 11, letter “d” of the WPA)

“BULTEX 99 Ltd. reserves the right to amend the present Information under Article 12, paragraph 4 of the WPA, with the  changes shall enter into force from the date of their publication on the website: www.bultex99.com.

Date of entry into force Version Affirmed: “BULTEX 99” LTD.
17.12.2023 г. 0.1 Eng. Stefan Bashev Manager

(1) Obliged subjects shall provide clear and easily accessible information regarding the conditions and procedures for reporting. The information shall be provided on the websites of the obliged subjects as well as in prominent places in the offices and work premises (Article 12, Para 4 of the WPA)

Annex No. 1: Report Registration Form for submitting information onbreaches under the WPA (pdf)
Annex No. 2: Form for registration of a signal under the MHPSSOI (docx)