WHISTLEBLOWING POLICY

MS Security Group Companies (the “Company”) Whistleblowing Policy (the “Policy”) is a set of established standards of behavior and actions that create a proper and secure whistleblowing framework for the reporting of any serious concerns in relation to matters as described in this Policy.

A key aspect of ensuring and maintaining Company’s commitment to conducting business with integrity and in an open and fair manner is by providing a robust whistleblowing policy and internal reporting channels.

The Company therefore encourages its employees, contractors / security personnel, service providers and others to report any serious concerns and/or disclose information that come to their attention in workplace or during Company’s operations, and they reasonably believe may evidence wrongdoing, misconduct, illegal activities, and/or malpractice affecting themselves, the Company, others, or third parties.

Aims of the Policy

The Policy is designed to ensure that you can raise your concerns without fear of victimisation, retaliation, subsequent discrimination, disadvantage, or dismissal.

It is also intended to encourage and enable you to raise serious concerns within the Company rather than ignoring a problem or 'blowing the whistle' outside.

This Policy aims to:

• encourage you to feel confident in raising serious concerns at the earliest opportunity;
• provide avenues for you to raise those concerns and receive feedback on any action taken;
• ensure that you receive a response to your concerns and that you are aware of how to pursue them if you are not satisfied;
• reassure you that you will be protected from possible reprisals or victimisation.

Scope of the Policy

The Company will safeguard an individual who reports a breach of the European Union and/or National law, in accordance with the Protections of Persons Reporting Violations of the Union and National Law 2022 (the ‘Law’) and as outlined below.

The Law guarantees confidentiality, prohibition of disclosure of any information regarding the whistle-blower, GDPR compliance, anonymity, protection against retaliation and prohibition of reprisals against a person who ‘blows the whistle’.

It is important to clarify that reporting of personal complaints and/or grievances unrelated to illegal activities, misconduct, wrongdoings or unethical behavior during the provision of services or in the workplace do not count as whistleblowing and therefore this Policy does not cover such type of internal reports.

What should be reported?

Reportable breaches and misconducts are those falling into the scope of:

1. the acts and regulations of the European Union which concern safety requirements in the maritime sector as listed in the EU Directive 2019/1937;
2. acts or omissions related to criminal offences and especially corruption offences as provided in the criminal laws;

• acts or omissions relating to a person's failure to comply with any legal obligation imposed on him;

1. violations that endanger or are likely to endanger the safety or health of any person;
2. violations that cause or are likely to cause damage to the environment.

These might relate to:

• conduct which is an offence or a breach of laws and / or regulations;
• criminal offence, including bribery or abuse of power or trust;
• possible fraud and corruption;
• conduct that makes you feel uncomfortable in terms of known standards;
• conduct that falls below established standards and codes / procedures of the Company;
• any other unethical conduct.

If you are uncertain whether something falls within the scope of the above examples, it is preferable to raise any concern you believe to be reportable rather than keeping it to yourself.

Record keeping

The Company is keeping records of every report it receives, with confidentiality, in accordance with the Company’s Whistleblower Procedure. Personal data collected in the context of receiving reports is deleted within three (3) months from the date of completion of the investigation and findings.

In case of initiation of judicial or disciplinary proceedings the personal data shall be retained for the duration of said proceedings, including the case of an appeal or objection. The personal data is deleted one (1) year after the completion of the proceedings.

Required information to report a concern

When reporting a concern that may consist of a breach of the European Union and/or National Law under this Procedure, the whistle blower should provide the following information where possible:

• the nature of the concern and its key elements;
• the date the incident happened; and
• the parties involved.

In addition to details of the concern, the whistle blower should try to provide the following information:

• the background and reason behind the concern;
• whether they have already raised a concern with anyone and their response;
• any other relevant details.

It is important that this Procedure is followed, and matters are not investigated by the whistle blowers themselves.

Reporting a concern

You can use the following reporting channels for reporting any concerns raised by you:

• Via e-mail at: reporting@mano-security.com - This e-mail has been designated for reporting purposes by all parties who can use the same to share their concern by name or anonymously;

• Via mail: to the office address of the Company at 123 Eirinis street, 3041, Limassol, Cyprus. The letter should be marked as “CONFIDENTIAL” for the attention of the CEO.

Senior members of Company’s management will be appointed to investigate the issues raised in the concern. They will properly examine and decide how to proceed with the concern, along with likely timescales, to ensure that it is fully, fairly and speedily investigated, shall inform the CEO and upon approval may appoint other Senior Managers to assist with the investigation. The investigation process will be determined also by whether the concern has been submitted anonymously or by name.

The company will endeavour to resolve the issues as quickly as possible and will communicate progress and outcomes to the whistle-blower and to others impacted by the concern.

Depending on the nature of the reported concern other parties who may be implicated in the concern will be informed accordingly. They will have an opportunity to respond either in writing or in a meeting. They will also have the option to be accompanied by a representative. Under no circumstances will the whistle blower’s identity be revealed, unless the whistle blower has consented to it.

A company’s senior management representative will then communicate the findings of the investigation to the person who raised the concern, to the individual(s) under investigation, to members of the Company’s senior management to consider what actions should be taken on the basis of the findings and to parties involved, as applicable.

The outcome will be provided as promptly as possible and shall not exceed three (3) months from the date of confirmation of receipt, unless specific circumstances require so. The whistle-blower will be advised on the timescales throughout the investigation.

Reporting Concerns Externally

The aim of this Procedure is to provide an internal mechanism for reporting, investigating and remedying any wrongdoing in the workplace or while providing services or operating on behalf of the Company. In most cases you should not find it necessary to alert anyone externally.

If you choose to raise a concern with an outside body, the Company requests that you should only do so if you remain dissatisfied after the internal reporting process has been exhausted.

In case you have filed a report through a Company’s internal reporting channel and while the proceedings are still pending you submit an external report directly to a competent authority, the internal proceedings will be suspended as per the provisions of the Law.

Confidentiality in reporting

All reports will be handled in complete confidence and the identity of the whistle blower will not be revealed to people outside the investigation except where the Company is legally obliged to do so, where the information is already in the public domain or to the police as a potential criminal offence.

The identity of the whistle blower may be disclosed only if said disclosure is a necessary and proportionate obligation imposed by the European Union or National Law, in the context of investigations by national authorities or judicial proceedings.

If there are any other circumstances in which the Company is required to reveal the whistle blower’s identity outside those identified above, the company’s management representative will discuss this with the whistle blower first.

The Company will keep formal records of the concern and outcome. Such records are confidential and are retained in accordance with the General Data Protection Regulation 2016/679 (GDPR).

Protection Against Retaliation

The Company will ensure that genuine concerns raised of a reasonable belief can be raised without fear of retaliation and will not affect the continued employment, work, contract, or career with the Company.

The Company will not tolerate harassment, victimisation or retaliation towards any person for raising concerns on the basis of a reasonable belief or objecting or refusing to participate in any act or practice that they honestly believe to be in violation of law or misconduct.

Any such harassment, victimisation or retaliation will be treated as very serious and will be a disciplinary offence in accordance with the Company’s procedures.

For any third parties associated with the concern, the Company will endeavour to provide appropriate advice and support wherever possible.

Anonymous Allegations

Concerns expressed anonymously are much less powerful, but they may be considered at the discretion of the Company.  In exercising this discretion, the factors to be considered would include:

• the seriousness of the issue raised;
• the credibility of the concern;
• the likelihood of confirming the allegation from other sources.

Untrue Allegations

If you make an allegation in good faith and reasonably believing it to be true, but it is not confirmed by the investigation, the Company will recognise your concern, and you have nothing to fear.

If, however, it was proved by the investigation process that you make an allegation frivolously, maliciously or for personal gain, appropriate action that could include disciplinary action, may be taken.