Hootsuite Romania Whistleblowing Policy

Last updated: December 22nd, 2023

Commitment and Aims

Hootsuite strives to achieve transparency and a high level of business ethics, therefore we expect high standards of conduct from all of our people – employees and collaborators. 

The purpose of the Hootsuite Romania Whistleblowing Policy (the "Policy") is to set forth the commitment of Hootsuite S.R.L. (“Hootsuite” or "Hootsuite Romania") to the Romanian Whistleblowing Law (Law No. 361/2022 on the protection of whistleblowers in the public interest) and protect whistleblowers from any retaliatory actions for raising concerns.  The Policy explains how whistleblowers can make a report about a concern and details the steps Hootsuite shall take to investigate it.

The Policy is designed to ensure that you can speak up with concerns about wrongdoing or malpractice without fear of victimisation, subsequent discrimination, disadvantage, dismissal, or other detrimental actions. 

The aims of this Policy are to:

• provide an effective way for you to raise serious concerns;

• ensure that you receive feedback on any action undertaken by us as a result of you raising serious concerns;

• ensure that you will be protected from reprisals or victimisation for having raised your concern in good faith;

• signpost you to further options available to you if you are dissatisfied with our response, or if internal investigation is not appropriate;

• allow Hootsuite to take action against any employee who makes allegations in bad faith and/or publicly discloses information when it is unreasonable for them to do so.
  

Who this Policy applies to

This Policy applies locally to employees and collaborators of Hootsuite Romania as described below and is not to be regarded as a Hootsuite group wide whistleblowing policy.  

The Policy applies to the following categories of people who wish to report a workplace-related concern (the "whistleblowers"): 

• Current or former employees of Hootsuite Romania, 

• Third-party contractors, sub-contractors, suppliers, consultants, or agency workers, both current or former, who performed work or provided services for or to Hootsuite Romania,

• Shareholders and persons belonging to the administrative, management or supervisory body of Hootsuite Romania, including the non-executive members of the board of directors,

• Volunteers, as well as paid or unpaid trainees,

• Any persons working under the supervision and direction of contractors, subcontractors and suppliers who performed work or provided services for or to Hootsuite Romania,

• Job candidates in relation to a recruitment process at Hootsuite Romania, who obtained information in relation to their concern during the recruitment process or other pre-contractual negotiations,

• Potential service providers to Hootsuite Romania, such as manufacturers, suppliers, contractors, or consultants, who obtained information in relation to their concern during the pre-contractual negotiations,

• Persons who anonymously report or publicly disclose information regarding violations of the law.

What concerns this Policy applies to

At Hootsuite, we are dedicated to fostering an environment free of misconduct and retaliation, and we value honesty, integrity, and high standards of conduct. Our workplace culture promotes openness and accountability, empowering all individuals to report any improper or unlawful conduct without fear of retaliation.  

If you’re concerned that any of the things below are happening, have happened or are likely to happen, we encourage you to raise this as soon as possible:

• Breaches falling within the scope of the Romanian laws and European Union acts set out in the Annex 2 to the Romanian Whistleblowing Law that concern the following areas: 
  
  a) public procurement, 
  
  b) financial services, products and markets, and prevention of money laundering and terrorist financing, 
  
  c) product safety and compliance, 
  
  d) transport safety, 
  
  e) protection of the environment, 
  
  f) radiation protection and nuclear safety, 
  
  g) food and feed safety, animal health and welfare, 
  
  h) public health, 
  
  i) consumer protection, 
  
  j) protection of privacy and personal data, and security of network and information systems.
  

• Breaches related to the internal market, as referred to in Article 26(2) of the Treaty on the Functioning of the European Union (TFEU), including breaches of the European Union rules on competition and State aid ;

• Breaches related to the internal market in terms of acts that violate the rules on corporate taxation or mechanisms whose purpose is to obtain a fiscal advantage that contravenes the object or purpose of the law applicable to corporate taxation, which represent disciplinary misconducts, contraventions, or crimes, or which are contrary to the object or purpose of the law.

We encourage you to use our internal reporting measures whenever possible. However, you also have the option to report a breach externally. 

Relevant authorities

If you have reasonable grounds to believe that there is a risk of retaliation against you or a low chance of the matter being effectively remedied by Hootsuite, then you do have the option of reporting the matter to a relevant public authority or institution with expertise in the subject matter of the concerns you have raised.

Public disclosure

Public disclosures are disclosures under Romanian Whistleblowing Law to the media, professional organizations, trade union, non-governmental organizations, parliamentary committees.

Although not prohibited, Hootsuite’s view is that it will very rarely, if ever, be appropriate to raise a whistleblowing concern directly to the media. 

If you choose to publicly disclose information regarding a violation of the law, you may only benefit from protection afforded under Romanian Whistleblowing Law if one of the following conditions is met:

a) you first reported internally and externally or directly externally, but you consider that appropriate measures were not applied within the term provided by law; or

b) you have good reasons to consider that:

1. the violation may constitute an imminent or obvious danger to the public interest or the risk of irreparable damage; or

2. in the case of external reporting there is a risk of retaliation or a low probability that the violation will be effectively remedied given the specific circumstances of the reporting.
   

Personal grievances

If your concern doesn’t relate to any of the areas listed in this Policy, but it relates to your own treatment as a Hootsuite employee, then you should raise it with your manager or in accordance with the procedures under Hootsuite’s Respectful Workplace Guidelines. For example, complaints about your pay or working hours, the amount of work that you are expected to do, working conditions, or being bullied by fellow workers, are all outside the scope of this Policy.

If you are a Hootsuite employee and have concerns about bullying or harassment,  you can also call our internal Employee Assistance Programme.

Manager responsibilities

If you’re a people manager, you have a duty to promptly address concerns brought to your attention. Report concerns immediately after you learn about them. If you ignore any concerns or prevent or discourage someone from reporting them, you could face disciplinary action.

How to internally report a breach or concern covered by this Policy

There are several ways to make a report. Use one of the following methods that you’re most comfortable with:

Your line manager

• Contact your manager, someone else in your reporting chain, or any other manager outside of your reporting chain.
  

The Hootsuite whistleblowing page 

• You can report your concern on the Hootsuite whistleblowing page
  

What a whistleblowing report ("Report") should contain

According to the Romanian Whistleblowing Law, a Report should include, at least, the following: 

• your name and contact details,

• the workplace-related context in which the information was obtained, 

• the person concerned, if known, 

• the description of the fact likely to constitute a violation of the law within Hootsuite and, as appropriate, the evidence in support of the Report, 

• the date and signature if the case. 

If your Report does not contain the above-mentioned elements,, other than your identification data, you may be asked to complete the report within fifteen (15) days. If you fail to provide the requested information within the foregoing timeframe, the Report will be closed without further notice to you.

Anonymous reporting

Concerns expressed anonymously are much less powerful and difficult to investigate. You are encouraged to put your name and contact details to your Report, and it will be kept from others if you so wish. It also means that you can be kept abreast of what Hootsuite is doing about your concern. If you choose to withhold contact information when submitting a Report, Hootsuite may be compromised in its ability to fully investigate your concerns. Nonetheless, and notwithstanding the reporting requirements referred to above, any anonymous reports will still be looked into to the extent they contain indications of the alleged breach of the law. 

If your anonymous Report does not contain enough information about violations of the law to allow analysis and resolution of the Report, you may be asked to complete the required information within fifteen (15) days, provided that you have supplied an email at which you may be contacted. If you fail to provide the requested information within the foregoing timeframe, the anonymous Report will be closed without further actions taken in relation to your Report. 

What to expect when reporting a concern under this Policy

Hootsuite is committed to ensuring that all disclosures raised will be dealt with, consistently, fairly, and professionally. All investigations will be conducted sensitively, as quickly as possible, and under this procedure. 

Hootsuite's designated whistleblowing team 

Access to Reports received through our reporting channels is restricted to appointed individuals at Hootsuite Romania with the authority to handle whistleblowing cases; their actions are logged, and handling is confidential. In this respect, the whistleblowing team is the Hootsuite legal team, based in London and Canada, which is the designated department dealing with Reports. When needed, individuals who can add expertise may be included in the investigation process. These individuals can access relevant data and are also bound to confidentiality. 

If you request a meeting to discuss your Report, we’ll also set up a video call within a reasonable time frame.

If you’re a manager and receive a Report, it’s important for you to notify the whistleblowing team directly using the webform available at hootsuite.com/legal/romania-whistleblowing. Report a concern as soon as possible after learning of it. Failure to send a Report quickly or at all may result in disciplinary action.

Receiving a Report

Upon receiving a Report, the whistleblowing team decides whether to accept or decline the Report. If the Report is accepted, appropriate measures for investigation will be taken.

If you have provided a contact email address, you will receive an acknowledgment of receipt of the Report within seven (7) days. 

The whistleblowing team may not investigate the reported misconduct if: 

• the alleged conduct is not reportable conduct under this Policy; 

• the Report has not been made in good faith or is malicious;

• there is insufficient information to allow for further investigation; and/or

• the subject of the Report has already been solved.

If a Report includes issues not covered by the scope of this Policy, the whistleblowing team should, where possible, provide you with appropriate instructions. 

The whistleblowing team will, where possible, send appropriate feedback within three (3) months of the date of receiving the Report.

Do not include sensitive personal information about anyone mentioned in your Report unless necessary for describing your concern.

Investigation

All Reports are treated seriously and in accordance with this Policy.

• Where and to the extent possible, no one from the whistleblowing team, or anyone taking part in the investigation process, will attempt to identify you where you have reported anonymously.

• A Report will not be investigated by anyone who may be involved with or connected to the wrongdoing. 

• The whistleblowing team decides if and how a Report should be escalated.

• Reports are handled confidentially by the parties involved. 

While Hootsuite cannot guarantee that the outcome will be as you may wish, the matter will be handled fairly and in accordance with this Policy. Once the investigation has concluded, and if you have provided a means of contacting you, you will receive an explanation about how the concern has been addressed. If there are legal constraints, e.g., in a criminal investigation, you will receive sufficient information about the outcome of any investigation to enable you to be informed that the concern has been dealt with. If no further action is proposed, you will be given reasons for this in writing.

Hootsuite may decide that no further action will be taken under this Policy in the following (not exhaustive) set of circumstances:

• If, after investigation, there is no evidence that wrongdoing has occurred, is occurring or is likely to occur;

• If the matter concerned is already the subject of legal proceedings, or has already been referred to the police or other public authority;

• If the matter is already, has already been, or should be, the subject of proceedings under one of the other Hootsuite policies and procedures.

Sharing of Reports and whistleblower’s identity

The Report and your identity may be disclosed, on a strict need-to-know basis, with:

a) external advisors, if necessary, engaged to provide specialized legal or different required advice; and / or

b) local authorities, if required by applicable laws,

in compliance with the below processing principles, to the extent it is legally feasible. 

In the cases where the disclosure of your identity is necessary for the defense of the concerned person, the disclosure of your identity is subject to your prior consent and receiving prior notice about the reasons for your identity disclosure. 

Hootsuite Romania shall, to the extent it is legally feasible:

• comply with the EU General Data Protection Regulation (GDPR), Romanian data protection laws, as far as applicable, and with the Hootsuite data protection policies; and 

• observe and enforce rigorous standards of prudence, proportionality, and confidentiality of information, as well as your personal identity protection, in compliance with applicable laws. In this regard, Hootsuite Romania may decide to obscure personal data which is not strictly necessary, to use password-protected files, to share a redacted or summarized version of the Report, depending on the contents and the kind of facts and information reported, on a case-by-case basis. 
  

Record keeping

We keep a record of every Report we receive. If you wish to raise a concern in person, we’ll create a transcript or take minutes of your concern and give you an opportunity to check, rectify, and agree to the documentation with your signature.

We shall store Reports for a period of five (5) years, as provided under the Romanian Whistleblowing Law.

On expiry of this period, the relevant Report will be destroyed. 

How the Policy works – what protection it gives

You can voice your concern without fear of victimisation, discrimination or disadvantage. You are encouraged to raise concerns about Hootsuite rather than ignoring them or waiting for others to speak up.

If you make such a protected disclosure, you have the right not to be dismissed, victimised or subjected to any other detriment such as:  

• suspension, lay-off, dismissal or equivalent measures

• demotion or withholding of promotion

• transfer of duties, change of location of place of work, reduction in wages or change in working hours

• withholding of training 

• a negative performance assessment or employment reference

• imposition or administering of any disciplinary measure, reprimand or other penalty, including a financial penalty

• coercion, intimidation, harassment or ostracism

• discrimination, disadvantageous or unfair treatment

• failure to convert a temporary employment contract into a permanent one, where the worker had legitimate expectations that they would be offered permanent employment

• failure to renew, or early termination of, a temporary employment contract

• harm, including to the person's reputation, particularly in social media, or financial loss, including loss of business and loss of income 

• blacklisting on the basis of a sector or industry-wide informal or formal agreement, which may entail that the person will not, in the future, find employment in the sector or industry

• early termination or cancellation of a contract for goods or services

• cancellation of a license or permit 

• psychiatric or medical referrals

This is the case even if it were to materialise that you were genuinely mistaken. We will not tolerate any individual being subjected to a detriment as a result of their making a disclosure in good faith. Hootsuite will not tolerate harassment, discrimination or victimisation. There can be no adverse consequences from raising such concerns. 

Hootsuite wants to be supportive of those who speak out about what matters to them. It recognises that the decision to report a concern can be a difficult one to make. If you believe what you are saying is true, you have nothing to fear. You will be doing the right thing by your colleagues, the community and supporting Hootsuite to uphold the highest standards. 

If you find out that a colleague has made a Report under this Policy, you must not treat them badly because of it. If we think you might have done so, we’ll need to investigate, and it may mean disciplinary action against you.

False or malicious allegations

If you make an allegation maliciously or for personal gain (for example, you knowingly made a false allegation) and the investigation confirms this, you will not be afforded with the legal protections offered by whistleblowing laws. We may also take disciplinary action against you.

Protection of concerned person 

The person concerned by the Report (the "concerned person") normally is not aware of the Report against him/her, although a Report may contain their personal data, which will need to be processed accordingly in order to manage the relevant Report. 

In this respect, Hootsuite Romania shall:

1. protect - to the extent required by applicable laws - the rights of the concerned person, such as confidentiality, reputation and right of defense, as well as the confidentiality of the documentation provided;

2. evaluate, on a case-by-case basis, whether disclosure towards the concerned person of their personal data included in the Report as well as of the related processing activities may be detrimental to the effective evaluation of the Report and to the execution of the internal investigations, if any. In such case, disclosure to the concerned person may be postponed until such condition of secrecy is no longer needed; and

3. document in writing the evaluation as performed according with paragraph b) above.

It is not possible to identify in advance all the specific circumstances in which a concerned person should be notified about the processing of their personal data.

Confidentiality

All concerns raised under this Policy will be treated in confidence and every effort will be made not to reveal your identity to anyone else if you so wish. At the appropriate time, however, you may need to come forward as a witness if effective action is to be taken to tackle something which is wrong. That will be discussed with you to make sure you are content. It means you should not be afraid of giving your name when you raise a concern. 

If you ask us to treat things confidentially, we won’t disclose your identity without your consent, unless we have to in order to look into your complaint or if it’s required by law.

The best way to raise a concern is to do so openly as this makes it easier for Hootsuite to investigate and provide feedback. However, Hootsuite recognises that many people may not express their concerns due to fear of reprisal.

Any concerns raised under this Policy will be treated in a sensitive manner. Hootsuite recognises that you may want to raise a concern in confidence, i.e. on the basis that your name is not revealed beyond the disclosure route without your consent.

Protection of personal data

Personal data-related aspects are regulated in our Privacy Policy. For employees and contractors, please refer to Hootsuite’s internal privacy policy.  

Hootsuite shall take the necessary measures to act in compliance with the GDPR as well as with the Romanian applicable laws on the protection of personal data. To this end, Hootsuite Romania shall ensure adequate security and organizational measures in handling Reports. 

Personal data may be retained by Hootsuite Romania during the time required for carrying out and completing an internal investigation, evaluating facts, and taking all the necessary measures and actions


External Reporting Channels 

As per the Romanian Whistleblowing Law, you can submit a whistleblowing report to external reporting channels.

The National Agency for Integrity is the authority with general competencies in relation to external whistleblowing reporting.

Further information on how you can report a concern externally according to the Policy can be found on the website of the National Agency for Integrity, respectively on: Informații generale – Avertizori în interes public (integritate.eu) 

Other aspects

If you are subject to a disciplinary proceeding due to making a whistleblowing report (whether through internal or external reporting channels, or public disclosure), the relevant disciplinary committee or similar body within Hootsuite Romania shall, on your prior request, invite the media, a representative of the trade union or professional association, or a representative of the employees. 

If you need further support

If you have any further questions about whistleblowing, speak to your manager. 

Hootsuite employees can use our Employee Assistance Programme (EAP) that can provide colleagues with support.