Whistleblowing Policy

Purpose

NetFM UK Limited is committed to conducting its business honestly and with integrity. This policy encourages anyone working for us to report suspected wrongdoing as soon as possible, in the knowledge that their concern will be taken seriously and investigated, and that they will be protected from detriment for raising it.

We are a small company. There is no large compliance department to absorb a problem — which makes it more important, not less, that people feel able to speak up early.

Who is covered

This policy applies to employees, directors, apprentices, work-experience placements, contractors, agency workers and suppliers' staff working on NetFM business.

What to report

A whistleblowing concern — a "qualifying disclosure" under the Public Interest Disclosure Act 1998 — is information you reasonably believe shows, in the public interest, one or more of the following:

• A criminal offence, including fraud, theft or bribery.
• A failure to comply with a legal obligation — for example data protection, health and safety, or employment law.
• A miscarriage of justice.
• Danger to the health and safety of any individual.
• Damage to the environment.
• Deliberate concealment of any of the above.

For our business, that will most often mean things like: mishandling of customer personal data or a concealed data breach; misrepresenting the security of our systems to a customer; falsified records, invoices or timesheets; unsafe installation work; or bribery in a sales process.

A concern about how you personally have been treated at work — pay, workload, a disagreement with a colleague — is normally a grievance rather than a whistleblowing matter. Raise it with the Director of Operations; it will still be taken seriously. If you are unsure which route applies, raise it anyway and we will sort out the right process.

How to raise a concern

In the first instance, raise it with the Director of Operations or any director — verbally or in writing, whichever you find easier. Say as much as you can about what you have seen, when, and who was involved. You are not expected to prove anything; a reasonable belief is enough, and investigating is our job, not yours.

If the concern involves a director, or you do not feel able to raise it internally, you may write in confidence to hello@netfm.org marking the message for the attention of the Board, or go directly to an external prescribed person (below). You may raise a concern anonymously, but it is harder for us to investigate anonymous reports and harder to protect you — so we would encourage you to identify yourself where you can.

What happens next

We will acknowledge your concern within five working days and tell you who is handling it. We will then assess it and decide whether it needs an internal investigation, referral to an external body, or handling under another procedure.

We will keep you informed of progress and of the outcome, so far as legal duties of confidentiality to others allow. We may not be able to tell you the detail of any action taken about another individual. If you are not satisfied with how your concern has been handled, you may escalate it to the Board or to a prescribed person.

Protection

Anyone who raises a genuine concern under this policy will not be at risk of dismissal, disciplinary action or any other detriment as a result — even if the concern turns out to be mistaken. Victimising someone for raising a concern, or deterring them from doing so, is itself a disciplinary offence and may amount to gross misconduct. Protection is not conditional on being right; it is conditional on acting in good faith. Knowingly making a false or malicious allegation is a disciplinary matter.

We will treat your identity as confidential and disclose it only where we are required to by law, or where it is unavoidable for the investigation and we have discussed it with you first.

External disclosure

We would rather you raised a concern with us first, but the law does not require it, and you may go straight to a prescribed person or body where that is appropriate. Relevant ones for our business include the Information Commissioner's Office (data protection), the Health and Safety Executive (workplace safety), HM Revenue & Customs (tax and fraud), and the Financial Conduct Authority. The independent charity Protect offers free, confidential advice to whistleblowers, and you are free to take independent legal advice at any point.

Responsibility and review

The Directors are responsible for this policy and for ensuring concerns raised under it are handled properly. It is reviewed at least annually.