The safe way to report significant violations

The system is intended for reports about significant violations in the following categories:

• Corruption/bribery
• Breaches of competition or antitrust law
• Fraud/embezzlement/theft
• Money laundering
• Violations of data privacy regulations
• Other significant economic crimes
• Human rights violations
• Sexual harassment
• Violations of anti-discrimination laws

Due to data protection regulations, reports from EU countries that do not fall into one of these categories are not allowed to be processed or forwarded through this system. If you have questions or concerns about any other topics (e.g. working conditions, environmental protection), please consult your local contacts or contact the Compliance Department by telephone or e-mail.

If you are located in the USA and your report concerns circumstances in the USA, you can select the additional category "Other violations of the RTL Group Code of Conduct" to submit reports on other topics.

Casting suspicion on another person can lead to serious consequences for that person. For that reason, the whistleblowing portal is to be used responsibly. It is prohibited to abuse this system by knowingly submitting false or slanderous information.

To submit an anonymous or personalized report, start by clicking the "Submit Report" button located on the top left side of our information page.

The reporting process consists of four steps:

1. You will receive information about the technical measures with which this online reporting system guarantees the security of your data.
2. You will be asked about the category of your report.
3. On the report page, you can elaborate on your report in your own words and answer questions about the case. In the free text field, you can write 4,096 characters, which corresponds to a full DIN A4 page. You may also submit a file of up to 5 MB to support your report. Once you have submitted your report, you will receive a processing number and a receipt.
4. Finally, you will be asked to set up your own postbox. You will receive feedback from us via this postbox, including answers to questions and information about the progress of your report.

If you already have a postbox, you can access it directly via the "Login" button.

After submitting your report, please set up a secured postbox and regularly log back into the system. In many cases, reports can only be processed adequately once the whistleblower answers certain follow-up questions.

The process places the utmost importance on protecting the whistleblower. The technical guarantee of data confidentiality in the BKMS^® Incident Reporting has been certified.

When setting up your postbox, you will select a pseudonym and password. Your report is kept secured by encryption and other special security routines.

A member of the RTL Group Compliance Department will provide you with feedback via this postbox and ask questions if any individual points are unclear.

RTL GROUP takes the topic of data protection and confidentiality very seriously. We adhere to the provisions of the EU General Data Protection Regulation (EU-GDPR) as well as current national data protection regulations. Please read this data protection information carefully before submitting a report.

Responsible party

The party responsible for data protection in the whistleblowing system is

RTL Group GmbH
Picassoplatz 1
D-50679 Köln
Telephone: +49-221-456-0
Email: privacy.office@rtlgroup.com

The data protection officer of RTL Group GmbH (hereafter: RTL GROUP) can be reached at the above postal address with the addition "To the Data Protection Officer" or at the email address: privacy.office@rtlgroup.com.

Type of the collected personal data

Use of the whistleblowing system takes place on a voluntary basis. If you submit a report via the whistleblowing system, we collect the following personal data and information:

• your name, if you choose to reveal your identity,
• whether you are employed at RTL GROUP and
• the names and other personal data of persons whom you list in your report, if applicable.

Purpose and legal foundation of the data processing

The whistleblowing system (BKMS^® Incident Reporting) serves for securely and confidentially receiving, processing and managing reports concerning violations of the compliance rules of RTL GROUP. The processing of personal data within the framework of the BKMS^® Incident Reporting is based on the justified interest of our company in discovering and preventing abuses and thereby averting damage to RTL GROUP, RTL GROUP group companies, employees and customers. The legal foundation for this processing of personal data is therefore Article 6 paragraph 1 f) EU-GDPR.

Confidential handling of reports

Incoming reports are received by a small selection of expressly authorized and specially trained employees of the Compliance Organisation of RTL GROUP and always handled confidentially. The designated employees of the RTL GROUP Compliance Organisation evaluate the matter and perform any further investigation required by the specific case.

While processing a report or conducting a special investigation, it may be necessary to share reports with additional employees of RTL GROUP or employees of other RTL GROUP group companies, e. g. if the reports refer to incidents in subsidiaries. The latter may be based in countries outside the European Union or the European Economic Area with different regulations about the protection of personal data. We always ensure that the applicable data protection regulations are complied with when sharing reports and that the consent of the report submitter is obtained before sharing a report with employees of RTL GROUP group companies for processing of the issue. All persons who receive access to the data are obligated to maintain confidentiality.

Information about the accused

We are legally obliged to inform accused parties of any reports received against them as soon as the disclosure of this information no longer jeopardises the investigation. Your identity as a whistleblower will not be disclosed unless we are legally bound to do so .

Rights of the data subjects

Pursuant to European data protection legislation, you and the persons named in the report have a right of access, rectification, erasure, restriction of processing and right to object to the processing of your personal data. If the right to object to the processing of the personal data is invoked, the necessity of the stored data for the examination of a report will be evaluated immediately. Data that are no longer required will be deleted at once. If you would like to make use of your right to object, please contact the address listed under item 1.

You also have the option of contacting a data protection authority and submitting a complaint there. The competent authority for our company is the

State Representative for Data Protection and Freedom of Information of North Rhine-Westphalia
Kavalleriestr. 2-4
40213 Düsseldorf
Phone: +49 (0) 211/38424-0
Fax: +49 (0) 211/38424-10
Email: poststelle@ldi.nrw.de

However, you can also contact the data protection authority responsible for your place of residence.

Automated decision-making

No automated decision-making takes place with regard to the processing of your personal data described here.

Profiling

No profiling takes place.

Retention period of personal data

Personal data are retained for as long as necessary to clarify the situation and issue a final assessment of the report or until existing contractual and/or legal obligations are met, unless overriding statutory retention periods prevent erasure of the data. The same applies if you have revoked your consent.

Updating of the privacy policy

If this privacy statement is modified, notice of this change will be published on the website and in other suitable locations.

Date of privacy statement: June 2018