Procedure for Internal Whistleblowing and Follow-Up at the MTA Group

In order to ensure compliance with applicable laws and regulations, the MTA Group, pursuant to the Law on the Protection of Whistleblowers of 14 June 2024 (Journal of Laws of 2024, item 928), has implemented a whistleblowing procedure.

This procedure allows colleagues, contractors and others to report any irregularities that may affect the MTA Group’s business or constitute a breach of the law.

We guarantee full confidentiality and protection against retaliation against those making reports. We encourage you to read the full terms and conditions. To make an anonymous report, please complete the form.

REGULATIONS TO ACCEPT INTERNAL REPORTS OF VIOLATIONS OF THE LAW IN THE MTA GROUP

§ 1 Purpose of the procedure

1. This Procedure shall apply to the MTA Group. In this way, the MTA Group, pursuant to Article 28, paragraph 8 of the Law on the Protection of Whistleblowers dated June 14, 2024 (hereinafter: "the Law"), fulfills its obligation under the Law.

2. The purpose of the Procedure is:

1. Shape an effective and unified whistleblowing system in the MTA Group's operations by creating a comprehensive regulation covering the issue of whistleblowing and protecting whistleblowers,
2. Protection of whistleblowers in the manner prescribed by the Law and through the methods specified therein,
3. term:
   • The scope of legal violations covered by the Procedure,
   • rules for reporting violations of the law by persons entitled to make a report,
   • Accountability in the process of managing the violation of the law,
   • The process of handling and managing violations,
   • principles of confidentiality, in particular, the principle of maintaining the secrecy of whistleblower reports made and the identity of those making the reports.

3. The MTA Group ensures that through the technical solutions used, each Application will be processed in accordance with applicable national regulations with confidentiality and impartiality.

§ 2 Definitions

For the purposes of the Regulations, the following meanings are given to the various expressions:

§ 3 Responsibilities of the Group, and Associates

1. The MTA Group directly oversees the effectiveness of the implemented anti-violation system and provides the resources necessary to carry out its responsibilities under it.

2. The Whistleblower Supervisor is responsible for carrying out the tasks under the procedure.

3. The whistleblower supervisor is an authorized Office & Administration Manager under delegated authority.

4. In connection with his/her function, the Whistleblower Supervisor is required and authorized to receive and verify Internal Notifications, maintain a register of notifications, conduct investigations, and further communicate with the whistleblower, including requesting additional information and providing feedback and follow-up to the whistleblower.

5. The Whistleblower Supervisor may select additional person(s) providing work or cooperation to the MTA Group prior to the planned follow-up, if necessary, which will be selected depending on the subject scope of the Notification. The selection will depend on the subject matter of the Notification of Violation listed in § 5 [Subject Matter Scope of Notifications], as such person will be selected based on his/her expertise in the particular right that has been violated. At the same time, such person may be an external person, among others, a specialist authorized by standing order or for a specific Notification.

6. During the selection referred to in paragraph 5, the Whistleblower Supervisor shall take into account the availability of such person(s) so that the deadlines for the performance of Follow-up Actions from the Act can be met. The selection shall be made on the basis of the Authorization constituting Attachment No. 3. The appointment of the same person for several or multiple Notifications shall render the previously submitted confidentiality statement valid. It is stipulated that if such a person is a person who is bound to professional secrecy by another title (e.g., legal counsel), there is no obligation to submit a statement.

7. In a situation where the Reporting directly concerns the Whistleblower Supervisor, the Whistleblower Supervisor excludes himself from the investigation of the case and his tasks are taken over by the designated HR Specialist.

8. In a situation where a Notification is made during the absence of the Whistleblower Supervisor due to a leave of absence or other reason, the tasks of the Whistleblower Supervisor will be taken over by the designated HR Specialist.

9. The whistleblower supervisor and the person selected, if any, to undertake follow-up activities, who perform the tasks under the Regulations, shall ensure the confidentiality of the person making the Application and impartiality and objectivity in conducting the procedure.

10. The Whistleblower Supervisor and the selected person, if any, for follow-up are obligated to maintain secrecy with respect to the information and personal data they have obtained, i.e., the Whistleblower Supervisor. in the course of accepting and verifying Internal Notifications and taking follow-up actions, and the selected person, if any, for follow-up actions, even after the termination of the other legal relationship under which they performed this work or services.

11. In a situation where the Whistleblower, upon inquiry by the Whistleblower Supervisor, fails to provide further information within the specified timeframe that is necessary for effective verification of the Application, the completed Application may not be considered by the Whistleblower Supervisor for further processing, may only take partial remedial measures based on the facts presented in the Application and determined by the Whistleblower Supervisor. The whistleblower will be informed by the Whistleblower Supervisor of the failure to consider the Application or the partial remedies taken.

§ 4 Personal scope

1. Internal notification can be made:

1. An applicant for employment with the MTA Group who became aware of a violation of the law during the recruitment process or pre-contract negotiations;
2. Temporary employee;
3. A person providing work on a basis other than employment, including under a civil law contract;
4. Entrepreneur;
5. A person who performs work under the supervision and direction of a contractor, subcontractor or supplier;
6. Member of a body of a legal entity;
7. Intern;
8. Volunteer;
9. Apprentice.

2. A person who makes a Notification, or public disclosure knowing that a violation of the law has not occurred, shall be subject to a fine, restriction of liberty or imprisonment for up to 2 years.

§ 5 Subject matter scope of Applications

1. A violation of the law is an act or omission that is unlawful, or intended to circumvent the law, concerning:

1. corruption,
2. public procurement;
3. services, products and financial markets;
4. Anti-Money Laundering and Countering the Financing of Terrorism;
5. Product safety and compliance;
6. transportation security
7. environmental protection;
8. consumer protection;
9. privacy and data protection;
10. Network and ICT system security;
11. financial interests of the Polish Treasury, the local government unit and the EU;
12. EU internal market, including public law competition and state aid rules and corporate taxation.

2. The violations of law listed in paragraph 1 constitute a closed catalog. This means that only violations of the law listed therein may be the subject of a Procedure Notification.

3. In a situation where the subject of the notification made is a violation of the law other than those listed in paragraph 1, the reporting person will not be treated as a Whistleblower, of which he will be informed by the Whistleblower Supervisor, who will indicate the correct way to report the problem.

4. The Notification referred to in paragraph 3 shall be made in the normal course of performance of official duties, i.e. to the immediate supervisor or management, unless other internal regulations have been established covering the procedure for making a Notification of a given violation of law, in which case such Notification shall be forwarded according to jurisdiction. Otherwise, the Notification shall be completed in the mode of Notification of a problem that has arisen, and the person making the Notification shall have the right to report it according to the modes under the law or internal regulations of the MTA Group, if any.

§ 6 Confidential notification channels - Internal trust contact

1. Internal notifications can be made in writing in electronic form through dedicated confidential notification channels, i.e.:

• 1) via email to gdpr@mta.digital . The file should be encrypted, and the file cipher should be forwarded to the Whistleblower Supervisor at his phone number 602777608 ; or
• 2) via the anonymous form provided on the site: Form

2. Anonymous submissions are accepted.

§ 7 Method of submission

1. The person making the Notification may make an Internal Notification under the Procedure or make an External Notification.

2. Internal notification can be of the following nature:

1. unclassified - occurs when the Signatory has agreed to disclose its identity.
2. Confidential - the whistleblower's data allowing to establish his/her identity are not available to unauthorized persons. The Whistleblower Supervisor and other persons involved in the handling of Requests, are obliged to maintain the secrecy of the information and personal data they obtained in the course of receiving and verifying Requests.
3. anonymous - the person making the request does not provide his or her data.

3. Successful submission of the Application in writing in electronic form via e-mail should include, in particular:

1. Name, surname and work position of the Signaller
2. The date and place where the notification was made,
3. indicating the violation and its description with an indication of relevant facts and dates.

4. The Signatory may also provide the following information in the Application in written form via electronic mail:

1. Signaller's data, i.e. telephone number,
2. Indication of persons, units or organizational units that committed violations of the law, i.e. name, surname, position,
3. Indication of the place where the violation occurred (name of the workplace, room, department),
4. indication of when the violation occurred (past, present, future, ongoing, or specific day and time),
5. An indication of whether the person making the Notification has taken any action in connection with the case,
6. Attach documents or other evidence in support of the Application (photos, videos, files, audio, emails, screenshots, other documents), which are attached as files to the Application.

5. In order to make an Application in writing via the form provided on the website, to take the following steps:

1. in the first place, go to the link: here, after which the form will open,
2. The next step will be to complete the form,
3. After completing the form, click "Submit Application".

6. Internal application in writing via the anonymous form provided should include, in particular:

1. The date and place where the notification was made,
2. indicating the violation and its description with an indication of relevant facts and dates.

7. The whistleblower may also provide the following information in the Application in writing via the anonymous form provided:

1. Indication of persons, units or organizational units that committed violations of the law, i.e. name, surname, position,
2. Indication of the place where the violation occurred (name of the workplace, room, department),
3. indication of when the violation occurred (past, present, future, ongoing, or specific day and time),
4. An indication of whether the person making the Notification has taken any action in connection with the case,
5. identification of possible witnesses,
6. Attach documents or other evidence in support of the Application (photos, videos, files, audio, emails, screenshots, other documents), which are attached as files to the Application.

8. The personal data provided by the Whistleblower in the Notification in writing will be processed for the purpose of accepting the Notification, processing the case and performing other necessary activities within the framework of the operation of the whistleblowing system at the MTA Group, and will be kept for a period of 3 years after the end of the calendar year in which the follow-up of the accepted Notification was completed or the proceedings initiated by these activities were terminated. The personal data collected and processed shall be made available only to authorized persons and only to the extent that it is necessary for them to perform their duties set forth in the Procedure.

§ 8 Receipt and initial verification of the Application

1. The Whistleblower Supervisor is required to confirm to the Whistleblower the acceptance of the internal Application within 7 days of receipt.

2. The maximum time limit for providing feedback to the whistleblower is a period not exceeding 3 months from the date of confirmation of acceptance of the internal application, or in the case of failure to provide the confirmation referred to in paragraph 1 - 3 months from the expiration of 7 days from the date of the application.

3. Confirmation of acceptance of the internal written Application and transmission of the feedback referred to in paragraphs 1 and 2 to the e-mail address of the Signer from which the Application was made (excluding anonymous notification).

4. The Whistleblower Supervisor performs initial verification of the Application and then decides on further follow-up with due diligence.

5. Initial verification of the Notification is made as to whether the reported violation falls within the catalog indicated in § 5 of the Procedure and whether it was made by an authorized person from § 4 of the Procedure. In addition, verification is made as to whether the information contained in the notification is sufficient to initiate and conduct an investigation. Initial verification may take place in consultation with the head of the organizational unit where the violation occurred, and if the Notification concerns the head of this unit - with his/her immediate superior.

6. If it is determined that an Application meets the criteria set forth in paragraph 5, the Whistleblower Supervisor shall grant the Reporting Person the status of a Whistleblower.

7. If the Notification contains sufficient information to initiate an investigation, the Whistleblower Supervisor shall conduct Follow-up without undue delay. Follow-up shall include, in particular, an assessment of the veracity of the allegations contained in the notification.

8. In order to determine the veracity of the violations, the Whistleblower Supervisor may ask the Whistleblower via email address or by phone for clarification, or to provide additional information or evidence regarding the submitted Violation Report (excluding anonymous reporting).

9. Refusal to provide explanations or additional information referred to in paragraph 8 or inactivity on the part of the Signatory does not halt the course of further proceedings, including internal investigation and inquiry.

10. As part of the Follow-up, the Whistleblower Supervisor is authorized - with confidentiality and impartiality - to:

1. document and data analysis, including for securing electronic storage media,
2. consultation with internal and external advisors,
3. conduct exploratory interviews with Associates.

11. If the following circumstances are found in the Follow-up:

1. it was concluded that for the recognition of the Application this Procedure is not applicable,
2. found that the Notification was manifestly unfounded,
3. was found that due to insufficient information or cooperation with the Whistleblower, it was not possible to recognize it,
4. The existence of a violation of the law was ruled out,
5. it was found that there were other reasons that prevented recognition of the Application,

it is the Whistleblower Supervisor who closes the follow-up procedure on the case.

12. The whistleblower supervisor informs the person making the Report that the procedure has been closed and, if necessary, will indicate the correct way to report the resulting problem.

§ 9 Covered entities

1. The whistleblower shall be protected from Retaliation from the time of the Reporting or public disclosure, provided that the whistleblower had reasonable grounds to believe that the information that is the subject of the Reporting or public disclosure is true at the time of the Reporting or public disclosure and that it constitutes infringing information.

2. Protection against retaliation under the terms and conditions as above is extended to Persons assisting in the filing of the Application and/or Persons affiliated with the Whistleblower.

3. The persons referred to above are protected only to the extent of the notifications made.

4. A whistleblower against whom retaliatory actions have been committed is entitled to compensation in an amount not lower than the average monthly salary in the national economy in the previous year announced for pension purposes in the Official Journal of the Republic of Poland "Monitor Polski" by the President of the Central Statistical Office, or the right to compensation.

5. Making a Submission/Public Disclosure may not be the basis for liability, including disciplinary liability or liability for damages for violation of the rights of others or obligations set forth in the law, in particular on the subject of defamation, violation of personal rights, copyright, protection of personal data and the obligation to maintain secrecy, including business secrets, provided that the Signatory had reasonable grounds to believe that the Submission or Public Disclosure was necessary to disclose the violation of the law.

6. A person who makes a Notification, or public disclosure knowing that a violation of the law has not occurred, shall be subject to a fine, restriction of liberty or imprisonment for up to 2 years.

7. The whistleblower may not waive the rights set forth in the Law, and may not accept liability for damages arising from the filing of a Notification or public disclosure. This does not apply to the acceptance of liability for damage arising due to a knowing Notification or public disclosure of false information.

§ 10 Prohibited Retaliatory Actions

1. It is prohibited to take any Retaliatory Actions, including threats to take and attempts to take such actions against the Signaller and Persons assisting or associated with the Signaller.

2. If Covered Entities have provided, are providing, or are about to provide work on a basis other than employment, including under a civil law contract (Business to Business - a collaboration between two businesses), within the MTA Group, no Retaliatory Action may be taken due to the filing of a Notification. In particular, retaliatory actions are considered to be:

1. refusal to establish further cooperation;
2. contract termination;
3. withdrawal or termination of the contract without notice;
4. reduction in the amount of remuneration;
5. omitting from the award of benefits related to work on a basis other than salary, including on the basis of a civil law contract (B2B) or reducing the amount of such benefits;
6. Transfer to another Collaborator of the existing duties of the Signaller;
7. imposing an obligation or refusing to grant, limit or withdraw an entitlement, in particular a concession, permit or relief;
8. the imposition or application of a disciplinary measure, including a financial penalty, or a measure of a similar nature;
9. Coercion, intimidation or exclusion;
10. bullying;
11. discrimination;
12. adverse or unfair treatment;
13. Withholding participation or omission from typing for professional qualification training;
14. An action to make it more difficult to find a future job in a particular sector/industry based on an informal or formal sector/industry agreement;
15. causing financial loss, including economic loss, or loss of income;
16. infliction of other intangible damage, including violation of personal property, in particular, the Sygnalist's good name.

3. Retaliation for making a Notification or public disclosure is also considered to be an attempt, or threat, to apply the measure specified in paragraph 2.

4. In providing the protection referred to in paragraph 1, the MTA Group, in particular:

1. takes measures to ensure respect for the principle of confidentiality of data, protection of identity at every stage of the investigation, as well as after its completion, with the proviso that the person making the Report should be informed in each case of circumstances in which disclosure of his identity becomes necessary, such as in the event of criminal proceedings;
2. shall lead to the punishment, in accordance with the Work Procedure, of Associates who are proven to have taken any Repressive and Retaliatory Actions against the Reporting Person and the Person assisting in the Reporting;

5. The activities referred to in paragraph 4(1) primarily include:

1. Restrict access to information only to authorized persons as part of the investigation, as well as the process of ensuring the protection of the Person making the Request and the Person assisting in making the Request,
2. Collection from persons authorized to access the information, written declarations of commitment to maintain the confidentiality of information obtained in the investigation or in the process of protecting the Person making the Request and the Person assisting in making the Request,
3. To draw consequences for those who are proven to have failed to meet the commitment mentioned above.

§ 11 Internal Notification Register

1. For the purposes of the procedure described in the Procedure, an Internal Notification Register is maintained. The administrator of the data collected therein is the MTA Group.

2. Entry in the Internal Application Register is made by the Whistleblower Supervisor on the basis of the internal application made, who maintains the Internal Application Register.

3. Each Application is subject to registration in the Register of Applications, regardless of the further course of the investigation.

4. The following data is collected in the Internal Notification Register:

1. Application Number;
2. the subject of the violation of the law;
3. personal data of the Whistleblower and the Person(s) associated with the violation, necessary for their identification (excluding anonymous reporting);
4. Signaller's address (excluding anonymous reporting);
5. the date on which the Application was made;
6. information on follow-up actions taken;
7. date of completion of the case.

5. Access to the Internal Notification Register is granted only to authorized persons.

6. The data in the Register of Internal Submissions are retained for a period of 3 years after the end of the calendar year in which the follow-up actions were completed or the proceedings initiated by them are completed. After this time, the Applications are subject to deletion from the Internal Application Register

§ 12 Disclosure of the Signaller

1. The personal data of the Signaller, allowing to establish his identity, shall not be disclosed to unauthorized persons, except with the express consent of the Signaller in electronic form.

2. Paragraph 1 shall not apply where disclosure is a necessary and proportionate legal obligation in connection with investigations by public authorities or pre-trial or judicial proceedings, including for the purpose of guaranteeing the right of defense of the Reported Person.

3. Before making the disclosure referred to above, the competent Public Authority or the competent court shall notify the Signatory, sending an explanation of the reasons for disclosure of his/her personal data in paper or electronic form, unless such notification will jeopardize the investigation or pre-trial or judicial proceedings.

4. Either the MTA Group or a Public Authority, upon receipt of a Request, shall process personal data to the extent necessary to accept the Request or take any follow-up action. Personal data that are not relevant to the processing of the Request shall not be collected and, if accidentally collected, shall be deleted immediately. The deletion of such personal data shall take place within 14 days from the time it is determined to be irrelevant.

5. The MTA Group will take measures to ensure that the principle of data confidentiality is respected, to protect identities from disclosure to unauthorized persons. These measures primarily include:

1. Restricting access to information only to authorized persons who have a legitimate interest in processing it and performing activities related to receiving, verifying Internal Notifications, conducting investigations and communicating with the reporting person,
2. Receive from authorized persons access to information, written declarations of commitment to maintain confidentiality of information obtained for receiving and verifying Internal Submissions, maintaining the Register of Submissions, conducting investigations, as well as for further communication with the reporting person, including requesting additional information and providing feedback to the reporting person, taking follow-up actions,
3. To draw consequences for those who are proven to have failed to meet the commitment mentioned above.

§ 13 Information for the Signaller on the mode of External Notifications

1. The External Application is accepted by the RPO or Public Authority.

2. A whistleblower may, in any case, report a violation of the law to either the RPO or a public body bypassing the internal reporting procedure. A whistleblower may make an External Notification without first making an Internal Notification.

3. External notification may be made orally or in writing.

4. The RPO and the Public Body may accept Submissions made anonymously.

5. External Notification in documentary form can be made:

1. in paper form - to the mailing address indicated by the ROP or the Public Authority accepting the Application;
2. in electronic form - to the e-mail address or electronic delivery box address, or electronic delivery address, designated by the ROP or the Public Body accepting the Application, or via a web form designed for this purpose, or an application designated by the Public Body as the appropriate application for making Applications in electronic form.

6. The RPO or the Public Body that accepted the External Application shall send the Signatory an acknowledgement of acceptance of the Application without delay, but no later than within 7 days from the date of acceptance of the Application, unless the Signatory has expressly requested otherwise in this regard or the RPO or the Public Body has reasonable grounds to believe that acknowledgement of the Application would jeopardize the protection of the confidentiality of the Signatory's identity.

7. The RPO or Public Body may request from the Signaller, at the contact address provided by the Signaller, clarifications or additional information that may be in its possession. If the Signatory objects to sending the requested clarification or additional information, or sending it may jeopardize the protection of the confidentiality of his or her identity, the RPO or Public Body shall waive the request for clarification or additional information. In justified cases for the purpose of investigation, the Public Body may forward the External Notification:

1. subordinate or supervised organizational units,
2. another organizational unit entrusted with tasks by agreement.

8. RPO:

1. establishes a procedure for receiving External Notifications, which specifies, in particular, the procedure for handling information on rights violations reported anonymously,
2. Receives External Notifications of violations of the law in the areas indicated in Article 3, Paragraph 1, Items 1-16 of the Law, performs preliminary verification thereof, and forwards them to the Public Authority competent to take follow-up action,
3. accepts and processes External Notifications - where the Notification concerns a violation of the law in the area indicated in Article 3, paragraph 1, item 17 of the Law and no other Public Authority is competent to take follow-up action,
4. Provides public access to information on the rights and remedies of the Whistleblower, the person helping to make the Report and the person associated with the Whistleblower, against Retaliation and the rights of the Persons affected by the External Report, in particular by posting this information on a page in the Public Information Bulletin,
5. Provides advice to the Signatories, the Person assisting in making the Application and the Person associated with the Signatories, and the Persons affected by the External Application, with respect to Section 4;
6. shall provide the Signatories and the Person assisting in making the Report, as well as the Person associated with the Signator, with information on authorities that, within the scope of their tasks, may take action to protect the Signatories from Retaliation, and, where appropriate, support in contacting such authorities, in particular by informing the competent authorities of the perceived need to protect the Signatories.

9. If the External Notification concerns Information on a violation of the law, the ROP shall immediately, but no later than within 14 days from the date of the Notification, forward the Notification to the Public Authority competent to take follow-up action.

10. The RPO shall inform the Signatory of the transfer of the External Notification. The information shall include, at a minimum, an indication of the Public Authority to which the External Notification was transferred and the date of transfer.

11. The RPO shall waive the transmission of the External Notification if the Notification does not concern Information on a violation of the law.

12. The Ombudsman shall inform the Signatory of the withdrawal from the transfer of the External Notification, stating the findings of the preliminary verification of the Notification. When refraining from forwarding an External Notification, the Ombudsman may inform the Signatory that the information covered by the Notification is subject to consideration under the procedure provided for in separate regulations, in particular as the subject of a civil action, a notice of suspected crime, a complaint to an administrative court, a complaint, an application or a petition, or may be submitted to the competent authorities for consideration under another procedure. Informing the Signatory does not, in particular, affect the admissibility of a subsequently filed legal remedy, the running of time limits, or the content of the decision or the manner in which the proceedings are concluded. The information provided to the Signatory shall include an instruction in this regard.

13. The Ombudsman may leave an External Notification unacknowledged in the event that he or she has waived the transmission of an earlier External Notification to a public body competent to take follow-up action, or in the event that an External Notification concerning a matter already the subject of an earlier Notification by the same or another Signatory does not contain significant new information on violations of the law compared to an earlier External Notification. The Ombudsman shall inform the Signatory that the External Submission has been left unprocessed, stating the reasons, and in the case of a subsequent External Submission, the Ombudsman shall leave it unprocessed and shall not inform the Signatory.

14. The public body shall establish a procedure for receiving external reports and taking follow-up action, which shall specify, in particular, the procedure for handling information on violations of the law reported anonymously.

15. Public body:

1. accepts the External Application;
2. performs a preliminary verification of the External Notification, which consists of determining whether the Notification relates to Information on Violations of Law, and determining whether the Notification relates to violations of law in the field within the scope of the authority, and if not, determining the public authority competent to take follow-up action;
3. shall consider the External Application - in case the Application concerns violations of the law in the field falling within the scope of the authority;
4. forwards the External Notification immediately, but no later than 14 days from the date of the Notification, and in justified cases - no later than 30 days - to the authority competent for follow-up - when the Notification concerns violations of the law in an area outside the scope of this authority - and informs the Signatory thereof;
5. Takes follow-up actions with due diligence;
6. Provides feedback to the Signalist.

16. The Public Body shall provide the Signatory with feedback within a period not exceeding 3 months from the date of acceptance of the External Application. In justified cases, the Public Body shall provide the Signaller with feedback within a period not exceeding 6 months from the date of acceptance of the External Notification, having informed the Signaller before the expiration of 3 months. The Public Body shall also inform the Signatory of the final outcome of the investigations initiated as a result of the External Notification.

17. At the request of the Signatory, the public body competent to take follow-up action shall issue, no later than one month from the date of receipt of the request, a certificate confirming that the Signatory is subject to the protections set forth in Chapter 2 of the Law, i.e., prohibition of retaliation and protection measures.

18. The Public Body may not take Follow-up Actions if an External Notification concerning a matter already the subject of an earlier Notification by the same or another Signaller does not contain significant new information on violations of the law compared to the earlier External Notification. The public body shall inform the Signaller of the failure to take follow-up action, giving reasons, and in the case of a subsequent Submission, it shall leave the Submission unaddressed and not inform the Signaller.

19. The RPO and the Public Authority are separate controllers with respect to the personal data provided in the External Application accepted by these bodies.

20. Personal data processed in connection with the acceptance of an External Notification and documents related to the External Notification shall be retained by the ROP for a period of 12 months after the end of the calendar year in which the External Notification was submitted to the Public Authority competent to take follow-up action.

21. Personal data processed in connection with the acceptance of a Request or the taking of Follow-up Actions, as well as documents related to the Request, shall be retained by the Public Body for a period of 3 years after the end of the calendar year in which the External Request was submitted to the Public Body competent to take Follow-up Actions or the Follow-up Actions were completed, or after the completion of the proceedings initiated by these actions.

22. Either the ROP or the Public Body shall transmit without undue delay to the competent institutions, bodies or organizational units of the EU, the information contained in the External Notification for the purpose of follow-up in the manner used by such institutions, bodies or units, if provided for by separate regulations.

23. The Register of External Notifications maintained by the RPO includes:

1. Application Number,
2. the subject of the violation of the law,
3. personal data of the Signatory and the Person to whom the Application pertains, necessary to identify them,
4. the date on which the Notification was made,
5. indication of the Public Authority competent to take follow-up action, to which the Notification was forwarded, and the date of the forwarding,
6. the date on which the Signatory is informed that the Notification has been forwarded to the Public Authority competent to take follow-up action,
7. information on taking no further action.

24. Personal data and other information contained in the External Notification Register shall be retained for a period of 12 months after the end of the calendar year in which the External Notification was submitted to the Public Authority competent to take follow-up action.

25. The Register of External Notifications maintained by the Public Authority includes:

1. Application Number,
2. the subject of the violation of the law,
3. personal data of the Signatory and the Person to whom the Application relates, necessary to identify them,
4. the date on which the Application was made,
5. information on follow-up actions taken,
6. information about the issuance of a certificate, confirming the protection to which the Signer is entitled,
7. date of completion of the case,
8. information on taking no further follow-up action in the event that an External Notification concerning a matter already the subject of an earlier Notification by the same or another Signatory does not contain significant new information on violations of the law compared to the earlier External Notification.
9. property, if found, and the amounts recovered as a result of proceedings for violations of the law that are the subject of the notification - if the Public Authority has this data.

26. Personal data and other information contained in the Register of External Notifications shall be retained for a period of 3 years after the end of the calendar year in which the Follow-up Activities were completed, or after the completion of the proceedings initiated by these activities.

27. To the extent not regulated in this Procedure, the provisions of Chapter 4 of the Act, i.e., External Notifications, shall apply accordingly.

§ 14 Final provisions

1. This Procedure shall be reviewed at least once every two years.

2. In matters not regulated by the Procedure, the relevant provisions of the Act shall apply.

3. The procedure enters into force 7 days after it is communicated to Associates via email.

4. The MTA Group shall provide an applicant for employment on the basis of any other legal relationship constituting the basis for the provision of work or services or functions with information on the Internal Application procedure together with the commencement of recruitment or negotiations preceding the conclusion of the contract under which the aforementioned will be provided.

5. Any changes to the Procedure shall be made in writing in accordance with the procedure applicable to its establishment.