Whistleblowing system

Rules of procedure for implementing the German Whistleblower Protection Act (HinSchG) for ACS Deutschland GmbH (hereinafter ACS)

1. Introduction

ACS is committed to responsible, law-abiding and transparent corporate governance. An essential part of this corporate culture is giving all employees as well as business partners and third parties who have a professional relationship with ACS the opportunity to report grievances and violations of the law. These rules of procedure set out bindingly how such reports are handled in accordance with the Whistleblower Protection Act (HinSchG).

The reporting office serves to protect whistleblowers as well as the company itself. It ensures that violations are identified and clarified at an early stage and that suitable countermeasures can be taken. At the same time, ACS undertakes to protect whistleblowers from disadvantages and reprisals and to treat their identity confidentially.

2. Purpose and scope

With these rules of procedure, ACS aims to create clear processes for receiving, reviewing and handling reports, thereby ensuring transparency and legal certainty. The rules of procedure apply to all persons who have a professional connection with ACS. This includes in particular all employees, including trainees and interns, temporary workers, applicants, former employees and business partners.

Reports may concern any matters that indicate violations of laws, internal guidelines or other misconduct. Of particular relevance are reports of criminal offences, administrative offences, violations of European law, dangers to the environment and risks to people’s health and safety.

3. Reporting office and responsibility

To implement the Whistleblower Protection Act, ACS has commissioned MD Consult GmbH (hereinafter MD Consult) as its external reporting office. Incoming reports are handled exclusively externally by MD Consult.

The external reporting office performs the following tasks in particular:

  • receiving and reviewing incoming reports,
  • audit-proof documentation of all processes,
  • communication with whistleblowers,
  • initiating appropriate follow-up measures in consultation with ACS.

ACS only receives the information from MD Consult that is necessary for handling the report. The identity of whistleblowers is only disclosed if they expressly consent or if there is a legal obligation to do so.

4. Reporting channels and access

Reports can be sent to the external reporting office by e-mail or by phone:

MD Consult GmbH
Occupational safety · Management · Training · Consulting
Phone: (02841) 99 800-79
E-Mail: hinweis.ACS@gmx.de
Web: www.mdconsult-gmbh.de

Please send written reports by post directly to:

ACS Deutschland GmbH
An der Hofweide 7
67346 Speyer
Germany

  • Documents and further evidence can be attached to the report.
  • Every report can be made anonymously or with voluntary contact details. Providing a way to contact you is helpful for queries and feedback.

5. Procedure after receipt of a report

  • Receipt & confirmation: Every report is documented in an audit-proof manner. Receipt is confirmed within 7 days, provided contact details are available.
  • Review: The external reporting office reviews the plausibility and seriousness of the information provided.
  • Follow-up measures: Relevant reports are analysed and, where appropriate, forwarded to the responsible bodies internally or externally.
  • Feedback: Whistleblowers receive feedback on planned or implemented measures no later than 3 months after the report.
  • Documentation: All steps are recorded in an audit-proof manner. Only persons specially bound to secrecy have access to the documentation.

6. Protection of whistleblowers

A central element of the Whistleblower Protection Act and these rules of procedure is the protection of whistleblowers. Nobody who makes a report in good faith may suffer any disadvantage as a result. This includes in particular dismissals, warnings, salary reductions, transfers or other forms of discrimination.

Abusive reports containing deliberately false accusations are not covered by this protection and may have legal consequences.

7. Confidentiality and data protection

The reporting procedure is designed to ensure the confidentiality of whistleblowers and of the persons named in the reports at all times.

  • Only a small number of specially bound persons have access to reports and documentation.
  • All data processing is carried out in accordance with the GDPR and the German Federal Data Protection Act (BDSG).
  • Data is retained in an audit-proof manner for at least 3 years and deleted thereafter.
  • Whistleblowers have the right to information, rectification and erasure.

8. External reporting offices

Irrespective of the ACS reporting procedure, whistleblowers are free at any time to contact state external reporting offices, e.g. the Federal Office of Justice (BfJ) or BaFin.

9. Entry into force and review

These rules of procedure enter into force on October 29, 2026. They are reviewed regularly and updated if changes in the law require it or if practical experience makes adjustments necessary.

10. Note on gender neutrality

All gender-specific terms used in this document apply equally to all genders. Solely for better readability, the masculine or feminine form has been used in places; this always includes the other gender form and every other gender identity.