File a Report

You can use the Safecall whistleblowing platform if:

• You are performing your duties within DPD Eesti AS; or
• You are not performing your duties within DPD Eesti AS but you wish to issue an alert about a situation related to your relationship with DPD Eesti AS.

If you belong to one of the categories above, you can file an alert about:

• conducts or situations contrary to the applicable policies and procedures of DPD Eesti AS or Geopost;
• a crime or offence;
• a threat or harm to the public interest;
• a breach or attempted cover-up of a breach of an international undertaking, law, or regulation; or
• serious violations of human rights and fundamental freedoms, the health and safety of people and the environment.

Once your alert is issued, it is handled in several stages, under the responsibility of the Ethics Officer of DPD Eesti AS.

You’ll be able to access it once submitted, for further follow-up.

To do so:

A user name and a password are displayed on the screen once you have submitted your alert.

Please save them securely to create an account and be able to connect to the platform thereafter;

If you choose to identify yourself and to share your mail address, you’ll receive these information by email as well.

Step 1 – Recording the information related to the alert:

The information you share are recorded on the Safecall platform.

For your alert to be handled and investigated, it’s important to describe the facts you wish to report as accurately, clearly and in as much detail as possible, to provide factual information and supporting your alert with any evidence proving the aforementioned facts (for example: letters, mails, SMS, etc.).

Step 2 – Receiving the alert and sending an acknowledgment of receipt:

1.Your alert is first read by Safecall, to make sure the information you provided are complete.

As part of this first reading, Safecall may need to contact you to ask for additional information if needed.

2.The Ethics Officer of DPD Eesti AS or any other person authorised to handle alerts within DPD Eesti AS is informed by Safecall that an alert has been created.

3.You’ll receive from the Ethics Officer of DPD Eesti AS or any other person authorised to handle alerts within DPD Eesti AS an acknowledgment of receipt, within 7 days of receipt of the alert maximum.

Step 3 – Admissibility Analysis of the alert:

For your alert to be deemed admissible:

• You must provide sufficiently precise, clear and detailed information and include the elements necessary for its analysis (e.g. letters, e-mails, SMS, etc.);
• Your alert must be based on evidence that can be verified and considered reliable (and not on suspicion or vague rumours); and
• You belong to one of the categories of persons who can issue alerts and your alert relates to one of the topics as provided for by the Safecall whistleblowing platform.

For more information on the above, please refer to the answer to question 1. Who can issue an alert? What topics can I report about?

Step 4 – Conducting an investigation when the alert is admissible:

When the alert is qualified as admissible, an investigation is conducted to verify the facts relating to the alert and whether it is confirmed by established evidence.

The investigation is conducted by the Ethics Officer of DPD Eesti AS themselves, or by the Ethics Officer and one or more persons authorised to handle alerts within DPD Eesti AS, appointed by the Ethics Officer of DPD Eesti AS.

Step 5 – Follow-up on the handling of the alert with the whistleblower

Throughout the handling process, you’ll be informed on the progress of your alert by the Ethics Officer of DPD Eesti AS or any other person authorised to handle alerts within DPD Eesti AS. The follow-up can be done either through the secured messaging service of the Safecall platform, either according to your preferred contact method.

Step 6 – Closing the alert

Once your alert has been analysed to determine its admissibility and investigated, if applicable, you are informed of its closure in writing by the Ethics Officer of DPD Eesti AS or any other person authorised to handle alerts within DPD Eesti AS, within 90 days of the sending of the acknowledgement of receipt (see step 2).

Depending on the situation, you are informed of the actions taken resulting from your alert, the measures taken to remedy the facts reported, or the reasons why your alert is considered non admissible, where appropriate.

DPD Eesti AS established an internal reporting channel for whistleblowers. We are responsible for the whistleblowing system. DPD Eesti AS; Taevavärava tee 1, 75306, Lehmja küla, Rae vald; andmekaitse@dpd.ee

The use of the whistleblowing systems by you is voluntary. You can decide if you want to disclose your identity to us or remain anonymous.

If you disclose your identity to us this Data Protection Notice provides you with information on how we process your personal data and your rights.

What is the purpose of the whistleblowing system?

At DPD Eesti AS , all our employees and external stakeholders can report any behavior that they suspect to be in breach of the values and principles defined in DPD Eesti AS Code of Conduct and Geopost Sustainable Procurement Charter, or of the applicable laws and regulations.

What is the purpose of whistleblowing system?

• Collecting and recording whistleblowing alerts;
• Investigating and follow-ups on alerts;
• Collecting statistical data on alerts

Who is responsible for the whistleblowing system and the processing of personal data?

DPD Eesti AS; Taevavärava tee 1, 75306, Lehmja küla, Rae vald

What categories of personal data do we collect?

When you rase an alert via our whistleblowing systems, we collect information that you communicate to us, such as:

• Contact details about you (whistleblower)
• Content of the alert (containing personal data of others you disclose to us)

What is the legal basis for processing your personal data?

Legal obligation: Statutory law requires us to implement and operate a whistleblowing system to permit whistleblowers to contact us and raise alarms.

Legitimate interest: Where whistleblowers contact us and raise alarms to indicate a violation of our or Geopost’s internal Code of Conducts and/or Policies and Procedures.

Who are the recipients of your data?

The content of your alerts are transmitted to the Ethics Officer of DPD Eesti AS or a similar person authorized to respond to alerts within DPD Eesti AS. Where your alert leads to disciplinary measures or legal proceedings, the content of your alert may be shared with the person or persons concerned by the alert in relation to the right to defend.

Do we transfer your data to third parties and in which countries are they domiciled?

Our whistleblowing system is operated by an external service provider:  Safecall Limited 100 Bishopsgate London, EC2N 4AG United Kingdom

We have concluded a Data Processing Agreement with Safecall which acts as Data Processor for us. Safecall is domiciled in the United Kingdom (UK). The UK benefits of an adequacy decision by the EU Commission. Thus, no additional safeguards are necessary for the transfer of your data to Safecall.

How long do we keep your data?

After acknowledging your alert (within 7 days) and following-up on your alert (within 30 days) we keep your data for the following durations.

• 30 days from inception of the alert: Alerts considered void
• 2 months after closing the alert: Alerts considered valid but not leading to disciplinary measures or legal proceedings
• 2 months pursuant to the end of an investigation of an alert leading to disciplinary measures or legal proceedings (unless further retention is required by the proceedings)

What are your data protection rights?

Note: You can exercise those rights directly by contacting us or our Data Protection Officer (DPO):

DPD Eesti AS; Taevavärava tee 1, 75306, Lehmja küla, Rae vald

Our Data Protection Officer (DPO): annika.oruaas@dpd.ee

Generally your rights are:

• Right to access your data
• Right to rectify your data
• Right to object to the processing of your data
• Right to restrict the processing of your data
• Right to have your data erased
• Right to data portability (portable format)
• Right to lodge a complaint with our data protection authority

Note: We do not use automatic decision-making or profiling.

Note: In situations where your alert is related to a violation of our or Geopost’s internal Code of Conducts and/or Policies and Procedures the exercise of the following rights might be restricted:

• Right to object to the processing of your data;
• Right to have your data erased;

where our legitimate interest may prevail or where processing the content of the alert is necessary for us for the establishment, exercise or defense of legal claims.

Our Data Protection Authority:

Andmekaitse Inspektsioon

info@aki.ee

www.aki.ee

You also have the possibility to file an alert by calling the Safecall hotline.

To do so:

1.Please call the following number 8000 044 514 if you’re located in Estonia

If you’re located in another country, please refer to the list of Safecall hotline numbers available here: https://www.safecall.co.uk/en/file-a-report/telephone-numbers/

This number is free of charge and available 24/7.

2.Please choose the language in which you wish to file your alert.

If you wish to issue your alert in English you’ll be put in contact almost immediately with a English-speaker.

3.You’ll be able to confidentially discuss with the English-speaker contact person on the details of your alert, by answering their questions.