Speak-Up & Whistleblowing Policy

01. Introduction & Corporate Identity

This Speak-Up & Whistleblowing Policy ("Policy") establishes the framework for reporting concerns about wrongdoing within or connected to KHODSHIMA SUMN ASSIST LTD ("Company", "we", "us", or "our"), a private limited company incorporated in England and Wales under company registration number 17435961, with its registered office at 128 City Road, London, United Kingdom, EC1V 2NX.

The Company is committed to conducting its business with honesty, integrity, and transparency. This Policy is issued in accordance with the Public Interest Disclosure Act 1998 (PIDA), which amends the Employment Rights Act 1996 to protect workers who make "protected disclosures" from detriment and dismissal. It also aligns with the EU Whistleblowing Directive (2019/1937) principles for EU-connected operations and the UK Bribery Act 2010 adequate procedures guidance.

02. Who This Policy Applies To

This Policy applies to the following individuals ("Reporters"):

• Employees: All current and former employees of the Company;
• Contractors & Consultants: Independent contractors, freelancers, and consultants engaged by the Company;
• Suppliers & Partners: Suppliers, vendors, and business partners who become aware of wrongdoing in connection with the Company;
• Clients: Clients who observe or suspect wrongdoing in the Company's service delivery;
• Security Researchers: Individuals who identify wrongdoing through security testing or vulnerability disclosure (see our Responsible Disclosure Policy);
• Job Applicants: Individuals who believe they have experienced wrongdoing during the recruitment process.

Under PIDA, the term "worker" is broadly defined and includes employees, contractors, agency workers, and certain other categories. This Policy extends protection beyond the statutory minimum to include clients, suppliers, and researchers.

03. What to Report — Qualifying Disclosures

A "qualifying disclosure" under PIDA is a disclosure of information which, in the reasonable belief of the Reporter, is made in the public interest and tends to show one or more of the following:

• Criminal Offences: Including fraud, theft, bribery, corruption, money laundering, cybercrime, or any other criminal activity;
• Failure to Comply with Legal Obligations: Breach of UK GDPR, Computer Misuse Act, Companies Act, HMRC regulations, or any other statutory duty;
• Miscarriages of Justice: Wrongful conviction, perjury, or interference with judicial processes;
• Health & Safety Dangers: Risks to the health and safety of any individual;
• Environmental Damage: Unauthorised environmental harm or breach of environmental regulations;
• Modern Slavery & Human Rights: Forced labour, human trafficking, child labour, or other human rights violations (see our Modern Slavery Act Statement);
• Prohibited Activities: Provision of services to financial, cryptocurrency, gambling, or adult content sectors in breach of the Company's Terms & Conditions;
• Sanctions Evasion: Providing services to sanctioned individuals, entities, or jurisdictions in breach of UK/UN/EU/US sanctions;
• Security Vulnerabilities: Unreported security flaws in Company or client infrastructure that could lead to data breaches;
• Cover-Ups: Deliberate concealment of any of the above.

Personal grievances (e.g., disputes about pay, working conditions, or interpersonal conflicts) are not qualifying disclosures under this Policy and should be raised through the Company's internal HR procedures.

04. How to Report — Reporting Channels

The Company provides multiple reporting channels to ensure accessibility and confidentiality:

Reporters are encouraged to use internal channels first, where it is safe and practicable to do so. However, external disclosures to prescribed persons (ICO, Action Fraud, NCA) or wider disclosures (e.g., to media or parliament) may be protected under PIDA if specific conditions are met.

05. Whistleblower Protection & Non-Retaliation

The Company maintains a zero-tolerance policy against retaliation toward any individual who makes a report in good faith under this Policy. Protected actions include:

• Protection from Dismissal: No employee will be dismissed for making a protected disclosure under PIDA;
• Protection from Detriment: No employee will be subjected to any detriment (demotion, exclusion, harassment, reduction in responsibilities, or other adverse treatment) for making a protected disclosure;
• Contractor Protection: No contractor or supplier will have their engagement terminated or modified as retaliation for a good-faith report;
• Confidentiality: The identity of the Reporter is kept strictly confidential and shared only with personnel directly involved in investigating the report, unless the Reporter consents to disclosure or disclosure is required by law;
• Anonymity: Reports may be submitted anonymously. While anonymous reports are investigated, providing contact information enables the Company to seek clarification and provide feedback on outcomes;
• Legal Recourse: If a Reporter experiences retaliation, they may bring a claim to the Employment Tribunal under PIDA. The Company will not attempt to prevent or discourage such claims.

06. Investigation Process

Reports received under this Policy are investigated through the following process:

1. Acknowledgement (48 hours): The Company acknowledges receipt of the report within 48 hours (where contact information is provided);
2. Triage (5 business days): The report is assessed to determine whether it constitutes a qualifying disclosure, its severity, and the appropriate investigation approach;
3. Investigation (10-30 business days): A designated investigator (not the subject of the report) conducts a thorough investigation, including interviews, document review, and technical analysis where applicable;
4. Outcome Notification: The Reporter is informed of the investigation outcome, subject to confidentiality and legal constraints. Where the report is substantiated, corrective action is taken;
5. Corrective Action: Depending on findings, corrective action may include: process changes, personnel disciplinary action, contract termination with suppliers, reporting to external authorities, or policy updates;
6. Documentation: All reports and investigations are documented and retained for 5 years in encrypted, access-controlled storage.

07. Malicious & False Reports

This Policy protects reports made in good faith. A report made in good faith is one where the Reporter reasonably believes the information disclosed is substantially true and is made in the public interest, even if the investigation subsequently finds no wrongdoing.

However, the following are not protected:

• Knowingly False Reports: Reports made with knowledge that the information is false or misleading;
• Malicious Reports: Reports made primarily to harass, damage reputation, or gain personal advantage rather than to expose genuine wrongdoing;
• Reports Made for Personal Gain: Reports made solely for financial reward or competitive advantage without genuine public interest;
• Vexatious Reports: Repeated, unfounded reports made to disrupt Company operations.

Where a report is found to have been made maliciously or with knowledge of its falsity, the Company may take disciplinary action (for employees), terminate engagement (for contractors), or pursue legal action for defamation or malicious communication. This does not affect protection for good-faith reports that are ultimately unsubstantiated.

08. Prohibited Activities & Service Scope

Consistent with the Company's business model, this Policy specifically encourages reporting of any attempt to provide services in breach of the Company's prohibited activities, including:

• Financial services, banking, or payment processing outside the Company's own checkout integration;
• Cryptocurrency exchanges, wallets, ICO/IDO, DeFi, or mining infrastructure;
• Gambling, betting, lottery, or adult content platforms;
• Any FCA-regulated activity;
• Services to sanctioned individuals, entities, or jurisdictions;
• Modern slavery, human trafficking, or forced labour in any part of the business or supply chain;
• Bribery, corruption, or money laundering;
• Deliberate security vulnerabilities introduced into client deliverables.

See our Terms & Conditions and KYC & AML Policy for the full prohibited activities list.

09. Data Protection & Confidentiality

The Company processes personal data of Reporters in accordance with the UK Data Protection Act 2018 and UK GDPR. For full details, see our Privacy Policy.

• Lawful Basis: Reports are processed under UK GDPR Art. 6(1)(f) (legitimate interests — preventing and detecting crime, protecting the business) and Art. 6(1)(c) (legal compliance — where statutory reporting obligations apply);
• Confidentiality: Reporter identity is treated as confidential personal data, access-restricted to authorised personnel only;
• Retention: Report records and investigation documentation are retained for 5 years, then permanently deleted;
• Encryption: All report data is stored in AES-256 encrypted, access-controlled storage;
• Data Subject Rights: Reporters may exercise their rights (access, rectification, erasure, objection) by contacting info@khodshimasumnassistltd.com, subject to ongoing investigation requirements.

10. Policy Amendments & Related Documents

This Policy is reviewed at least annually and updated as necessary to reflect changes in legislation, regulatory guidance, or organisational structure. This Policy should be read in conjunction with:

• Terms & Conditions — prohibited activities and service scope;
• Privacy Policy — data protection and UK GDPR compliance;
• Responsible Disclosure Policy — security vulnerability reporting;
• Security & Zero-Access Policy — security architecture and access controls;
• Modern Slavery Act Statement — human rights and supply chain ethics;
• Supplier Code of Conduct — supplier ethics and compliance;
• KYC & AML Policy — sanctions screening and financial crime prevention;
• Compliance & Standards Overview — comprehensive compliance framework.