The law in various jurisdictions has moved to protect people who ‘blow the whistle’ on serious wrongdoing within their organisation. Where jurisdictions in which we operate impose a higher standard, those local standards are deemed to be incorporated into and supplement this policy.

1. Purpose

This policy, aligned to Datacom’s values and Code of Conduct, provides an avenue for a variety of stakeholders to raise concerns and reassurance that their concerns will be addressed in a timely and confidential manner and they will be protected from reprisals or victimisation.

Datacom takes disclosures of misconduct and improper states of affairs or circumstances seriously and you are encouraged to speak up to help us identify and deal with this behaviour.

2. Applicability

This policy applies to all current and former employees, directors, officers, contractors, and/or 3rd parties engaged by Datacom or working at Datacom – and any family member of theirs.

3. Policy

When can you make a disclosure under this policy?

You may make a report or disclosure under this policy if you have reasonable grounds to believe that a Datacom director, officer, employee, contractor, intern or graduate, supplier, consultant, adviser or other person who has business dealings with Datacom has engaged in conduct which is:

• Dishonest, fraudulent or corrupt
• Illegal (such as theft, dealing in or use of illicit drugs, violence or threatened violence and criminal damage to property)
• Unethical, including any breach of Datacom’s policies such as the Code of Conduct
• Misconduct or an improper state of affairs
• A danger, or represents a danger, to the public or the financial system
• A contravention of human rights, including modern slavery.

(“Reportable Conduct”)

You can still qualify for protection even if your disclosure turns out to be incorrect, as long as you have reasonable grounds for making it.

What is not covered by this policy?

To avoid doubt, Reportable Conduct does not include personal work-related grievances. These grievances should be reported to your manager in accordance with our usual HR practice or referred to a member of the people and culture team.

How do you make a protected disclosure?

To qualify for protection under the law, you must make a disclosure of Reportable Conduct to an eligible recipient, who are described in this section.

You may disclose any Reportable Conduct to a “Whistleblower" protection officer as listed below:

• Quentin Lowcay, head of legal & commercial
• Annette Highnam, manager, people and culture
• Siobhan Gallacher, group director people
• Joanne Dickson, risk & assurance advisor
• Cecilia Chai-Tse, chief risk officer.

If you are unable to use any of the above reporting channels, or feel uncomfortable doing so, you can disclose to any member of the Senior Leadership Team, the Group CEO or Group CFO.

If you do not feel comfortable making an internal report, then you can contact the Chair of the Audit Committee of the Board, Mr Chris Day or any other Board member.

You may also report any Reportable Conduct to our auditors, an external lawyer or to any regulator such as the Financial Markets Authority in New Zealand, or the Australian Securities and Investments Commission (ASIC) in Australia. This policy will also apply to those disclosures.

In certain circumstances, you may make a public interest or emergency disclosure to journalists and members of parliament for Reportable Conduct (but in Australia only). This process is set out in Appendix 1.

If you wish to obtain additional information before making a disclosure, please contact one of our Whistleblower protection officers or the chair of the audit committee.

Can you make a protected disclosure anonymously?

You can make an anonymous disclosure, but it may be difficult for us to properly investigate the matters disclosed if a report is submitted anonymously. Therefore, we encourage you to share your identity when making a disclosure, although you are not required to do so.

Where a disclosure has been made externally and you provide your contact details, those contact details will only be provided to a Whistleblower protection officer with your consent or otherwise where this is allowed.

How will the protected disclosure be investigated?

We will investigate all disclosures as soon as practicable, after the matter has been reported. A Whistleblower protection officer will investigate the matter and where necessary, appoint an external investigator to assist in conducting the investigation. All investigations will be conducted in a fair, independent and timely manner and all reasonable efforts will be made to preserve confidentiality during the investigation.

If the report is not anonymous, the Whistleblower protection officer or external investigator will contact you to discuss the investigation process and any other matters that are relevant to the investigation.

Where you have chosen to remain anonymous, your identity will not be disclosed to the investigator or to any other person and the investigator will conduct the investigation based on the information provided to them.

Where possible, the Whistleblower protection officer will provide you with feedback on the progress and expected timeframes of the investigation. The person against whom any allegations have been made will also be informed of the concerns and will be provided with an opportunity to respond (unless there are any restrictions or other reasonable bases for not doing so).

To the extent permitted by law and if appropriate, the Whistleblower protection officer may inform you and/or a person against whom allegations have been made of the findings of the investigation. Any report and other materials relating to the investigation will remain the property of Datacom and will not be shared with you or any person against whom the allegations have been made. They may also be protected by legal privilege.

4. Protection of whistleblowers

We are committed to ensuring that any person who makes a disclosure is treated fairly and does not suffer detriment. Confidentiality is preserved in respect of all Reportable Conduct raised under this policy.

Protection from legal action

If your disclosure qualifies as a protected disclosure, you will not be subject to any civil, criminal or administrative legal action (including disciplinary action) for making a disclosure under this policy. These protections do not protect you from your misconduct which is uncovered during an investigation.

Protection against "Detrimental Conduct"

Datacom (or any person engaged by Datacom) will not engage in Detrimental Conduct against you if you have made a proper disclosure of Reportable Conduct under this policy.

Detrimental Conduct includes actual or threatened conduct such as the following:

• Termination of your employment
• Injury to your employment including demotion or disciplinary action
• Alternation of position or duties
• Discrimination
• Harassment, bullying or intimidation
• Victimisation
• Harm or injury including psychological harm
• Damage to your property, reputation or your business or financial position, or
• Any other damage to you or your family.

We will take all reasonable steps to protect you from Detrimental Conduct and will take necessary action where such conduct is identified.

We will ensure fair treatment of all people involved in a matter.

If you are subjected to Detrimental Conduct as a result of making a disclosure under this policy or participating in an investigation, you should inform a Whistleblower protection officer as set out above.

You may also seek remedies including compensation, civil penalties or reinstatement where you have been subject to any Detrimental Conduct.

Protection of confidentiality

All information received from you will be treated confidentially and sensitively – to the same extent as any HR complaint or issue.

If you make a disclosure under this policy, your identity (or any information which would likely to identify you) will only be shared if:

• You give your consent to share that information
• The disclosure is allowed or required by law (for example, where the concern is raised with a lawyer for the purposes of obtaining legal advice)
• The concern is reported to the ASIC, the Australian Prudential Regulation Authority (APRA), the Australian Taxation Office (ATO) or the Australian Federal Police (AFP) (for Australia only).

In Australia, it is illegal for an eligible recipient of your disclosure to disclosure your identity unless one of these exemptions apply. Where it is necessary to disclose information for the effective investigation of the matter, and this is likely to lead to your identification, all reasonable steps will be taken to reduce the risk that you will be identified.

Support available

All our employees have access to our Employee Assistance Programme (EAP) for any ongoing concerns they you have about any disclosure under this policy.

Details of our EAP providers for employees may be obtained via our people and culture team or from a Whistleblower protection officer.

5. Consequences

Any breach of this policy will be taken seriously and may result in disciplinary action up to and including termination of employment.

Policy Approval

Rachel Walsh, Group chief financial officer, Policy Owner

Greg Davidson, Chief executive officer

Last review: 23 June 2020

Appendix 1

Public interest and emergency disclosure (Australia only)

In certain situations, the conduct or wrongdoing (if it occurs in Australia) may be of such gravity and urgency that disclosure to the media or a parliamentarian is necessary.

A public interest and emergency disclosure can only be made to:

• A journalist, defined to mean a person who is working in a professional capacity as a journalist, such as for a newspaper, magazine, or radio or television broadcasting service; or
• A member of parliament (MP) for the Australian government, including federal, state and territory governments.

Public interest disclosure protection

To qualify for protection when making a public interest disclosure to a journalist or MP, all of the following need to apply:

• You have previously disclosed the information to the applicable regulator (ASIC or APRA)
• At least 90 days has passed since the previous disclosure was made
• You have reasonable grounds to believe that action is not being taken to address the matters which you have disclosed
• You have reasonable grounds to believe that making a further disclosure to a journalist or MP would be in the public interest; and
• You have given written notification, including sufficient information to identify the previous disclosure to the regulator to which the previous disclosure was made that you intend on making a public interest disclosure.

Emergency disclosure protection

To qualify for protection when making an emergency disclosure to a journalist or MP, all of the following need to apply:

• You have previously disclosed the information to the applicable regulator (ASIC or APRA)
• You have reasonable grounds to believe that the information concerns a substantial and imminent danger to the health or safety of one or more persons, or to the natural environment
• You have given written notification, including sufficient information to identify the previous disclosure to the regulator to which the previous disclosure was made that you intend on making a public interest disclosure; and
• No more information is disclosed than is reasonably necessary to inform the journalist or MP of the substantial and imminent danger.