Information pursuant to Article 12, paragraph 4 of the ZZLPSPOIN Act

INFORMATION ON REPORTING VIOLATIONS AT “WATER SUPPLY AND SEWERAGE” EAD UNDER THE LAW ON THE PROTECTION OF PERSONS WHO SUBMIT REPORTS OR PUBLICLY DISCLOSE INFORMATION ABOUT

VIOLATIONS/ZZLPSPOIN/

Persons entitled to submit reports:

Reports of violations of Bulgarian legislation and European Union law, in accordance with the Law on the Protection of Persons Submitting Reports or Publicly Disclosing Information on Violations (ZZLPSPOIN), may be submitted to “Water Supply and Sewerage” EAD (ViK EAD) by individuals who possess information obtained and/or made known to them in the course of or in connection with the performance of their employment or official duties, or in another work-related context.

Areas for Reporting:

Violations of Bulgarian legislation or of the European Union acts listed in the annex to the ZZLPSPOIN in the following areas:
* Public procurement;
* Environmental protection;
* Protection of privacy and personal data;
* Security of networks and information systems;
* Violations affecting the financial interests of the European Union;
* Labor legislation.

Terms and Procedures for Submitting a Report

The Company provides the opportunity to submit a report to the employee responsible for receiving and registering reports, either in writing or orally, in the following ways:

1. In writing:
   • on paper—at the following address: Burgas, Pobeda Neighborhood, 3 General Vladimir Vazov St., in a sealed, opaque envelope marked “Report under the ZZLPSPOIN”;
2. via email: signal@vik-burgas.com
3. Verbally:
   • by calling 056/ 871 525;
   • in person—at a time mutually agreed upon by the parties through the channels listed above.

To file a report, use the Standard Report Filing Form, approved by the national authority for external reporting, available on the websites of ViK EAD and the Commission for Personal Data Protection (CPDP), which contains at least the following information:

1. the reporter’s full name, address, and phone number, as well as an email address, if available;
2. the names of the person against whom the report is filed and their place of work, if the report is filed against specific individuals and they are known;
3. specific details regarding the violation or a real risk that such a violation may be committed, the location and time period of the violation, if one has occurred, a description of the act or the situation, and other circumstances, to the extent known to the person filing the report;
4. the date the report was filed;
5. signature, electronic signature, or other identification of the submitter.

Verbal reports are submitted by calling 056/871 525, and a form is completed by the employee responsible for receiving and registering reports. The whistleblower is given the opportunity to review and, if necessary, correct the completed form and, if desired, to sign it.

When the report is submitted in person, if the person making the report has given their consent, the employee responsible for receiving and registering the report documents the meeting by filling out a form. The whistleblower is given the opportunity to review, correct, approve, and sign the completed form from the meeting.

Any type of information source supporting the allegations set forth in the report may be attached to the report, and/or references to documents, including contact information for individuals who could confirm the reported details or provide additional information.

No proceedings shall be initiated regarding:

1. anonymous reports;
2. reports concerning violations committed more than two years ago.

Reports shall not be considered if they:

1. fall outside the scope of this law;
2. the content of which does not provide grounds for considering them credible;
3. contain obviously false or misleading factual claims.

Reports are processed in compliance with the confidentiality obligation arising from Articles 31 and 32 of the ZZLPSPOIN. Personal data that is clearly irrelevant to the examination of a specific report is not collected; if such data is collected accidentally, it is deleted (Article 32, paragraph 2 of the ZZLPSPOIN). Access to the personal data contained in reports of violations is restricted solely to the employees responsible for registering and reviewing the relevant report.

If irregularities are found in a written report, the reporting person is sent a notice to correct the irregularities within 7 days of receipt of the report. If the irregularities are not corrected within this period, the report, along with its attachments, is returned to the person filing the report. Any type of information source supporting the allegations set forth in the report may be attached to it, and/or references to documents, including details of individuals who could confirm the reported information or provide additional details. Each whistleblower will receive confirmation within 7 days that the report has been received and will be provided with a Unique Identification Number (UIN). Protection under the ZZLPSPOIN is provided to the whistleblower from the moment the report is submitted, provided the conditions set forth in Article 6 of the law are met.
The central authority for external reporting under the ZZLPSPOIN is the Commission for Personal Data Protection, located at: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., website: www.cpdp.bg.