Menu
As a member of the OTP Group, HelloPay Zrt. operates an internal abuse reporting system (Reporting System) subject to the Act on Reporting (Act XXV of 2023).
The purpose of the Whistleblowing system is to provide Whistleblowers with the opportunity to report violations of the law or breaches of the OTP Group's Code of Ethics and the Whistleblowing Act. The Whistleblowing system allows for the reporting of information on illegal or suspected illegal acts or omissions or other abuses.
Can be notified
Please note that the channels provided for receiving complaints or ethics notifications are not the same as HelloPay Zrt.'s customer service, if you wish to make a comment or complaint about a product/service, you can do so via the contact form on the HelloPay Zrt. website or by contacting the info@hellopay.hu e-mail address, or in person at the headquarters of HelloPay Zrt. (1037 Budapest, Montevideo u.10.) on working days from 10:00 to 18:00.
The rules of conduct that protect the interests of HelloPay Zrt. can be found in the OTP Group Code of Ethics and the OTP Group Partner Code of Ethics, which are available below:
Information related to the management of notifications:
Detailed rules on notifications:
about the ethics/breach of law of HelloPay Zrt.
The processing of personal data is subject to the EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR or General Data Protection Regulation), the EU Regulation on the right to information self-determination and freedom of information of 2011. CXII of 2023 (hereinafter referred to as the "Information Act") and Act XXV of 2023 on Complaints, Notifications of Public Interest and the Rules for Reporting Abuse (hereinafter referred to as the "Notifications Act").
HelloPay Zrt. operates a whistleblowing system for reporting possible violations of the values set out in the Code of Ethics and the violations referred to in the Whistleblowing Act.
HelloPay Zrt. (headquarters: 1037 Budapest, Montevideo u. 10., hereinafter referred to as HelloPay or the Company) shall ensure the lawfulness and purpose limitation of the processing of personal data processed by it. The purpose of this notice is to provide individuals (hereinafter collectively referred to as "Data Subjects") who make a report and are affected by the report with full information on the processing of their personal data in the course of the abuse reporting procedure set out in the Ethics, Infringement Reporting System Administrative Instructions.
The Company reserves the right to amend this Prospectus and will notify you of any such amendment by publishing the amended Prospectus on its website.
Name of data controller: HelloPay Zrt. 1037 Budapest, Montevideo u. 10.
E-mail address: bejelentes@hellopay.hu
Website: www.hellopay.hu
The Company may also collect the Data Subject's personal data from the following sources, in addition to the data provided by the Data Subject, in particular the Data Subject and in particular the Data Subject's Data Subject:
Specific data in the ethics, breach notification system1 will not be treated.
PURPOSE OF PROCESSING | LEGAL BASIS FOR PROCESSING | DATA SUBJECTS AND DATA PROCESSED | DATA DURATION OF STORAGE |
The Company processes the Data Subject's personal data for the purposes of operating the Ethics, Breach Notification System and, in this context, for the purposes of receiving and investigating reports of actual or suspected ethical misconduct and breaches and taking the necessary measures. | The legal basis for processing is Article 6(1)(c) of the GDPR according to fulfil a legal obligation to which the controller is subject, and Section 18(1) of the Notifications Act. | The Company processes the following main categories of personal data of the notifier and the individuals concerned by the notification:
by the Company recorded sound. | A Bank with the abuse notification, and the upon notification the data relating to the investigation carried out and the measures taken shall be kept for five years from the date of the last investigative act or measure and shall be deleted thereafter. |
Your email address: dpo@hellopay.hu
The Company may also collect the Data Subject's personal data from the following sources, in addition to the data provided by the Data Subject, in particular the notifier:
Specific data in the ethics, breach notification system will not be treated.
The recipient is a natural or legal person, public authority, agency or any other body to whom or with which the personal data are disclosed, whether or not a third party.
The Company may, on a case-by-case basis, transfer personal data necessary for the investigation of a notification under the Whistleblower Protection Act, if a whistleblower protection lawyer is involved in the investigation of the notification.
OTP Bank Plc shall transmit the notifications concerning its first line managers, senior managers and senior executives and the personal data concerning the Data Subject provided in the notification to the company belonging to the OTP Group established in the European Union and in third countries for the purpose of investigating the notification. The legal basis for the transfer of data is the legitimate interest of the Bank or of this company belonging to the OTP Group in the protection of its ethical business operations and ethical values. A list of these domestic companies belonging to the OTP Group is available here: https://www.otpbank.hu/portal/hu/Rolunk/OTPCsoport.
A transfer to another country may take place if the Company is required to do so by law or if the Company has a legitimate interest in doing so as a result of the balancing of interests test. If the recipient of the transfer is a third country, one of the safeguards in Chapter V of the GDPR must be applied. The transfer of data processed under the internal whistleblowing system under the Whistleblowing Act to a third country or an international organisation may only take place if the recipient of the transfer has given a legal undertaking to comply with the rules on whistleblowing set out in this Act and subject to the provisions on the protection of personal data.
Our company's computer systems and other data storage locations are located at the headquarters and on servers leased by the data processor. Our Company selects and operates the IT tools used to process personal data in the course of providing the service in such a way that the data processed:
We take particular care to ensure data security and to put in place the technical and organisational measures and procedural rules necessary to enforce the guarantees under the General Data Protection Regulation. In particular, we take appropriate measures to protect the data against unauthorised access, alteration, disclosure, disclosure, erasure or destruction, accidental destruction or accidental damage, and against inaccessibility resulting from changes in the technology used.
Our company and our partners' IT systems and networks are protected against computer fraud, computer viruses, computer intrusions and denial of service attacks. The operator ensures security through both server-level and application-level protection procedures. Daily data backup is provided. In order to avoid data breaches, our company takes all possible measures to ensure that a data breach is not
in the event of an incident, we will take immediate action to minimise the risks and repair the damage, in accordance with our incident management policy.
The person concerned - the Based on the Privacy Notice - may request the controller to access, rectify, restrict or delete personal data concerning him or her, withdraw consent or object to the processing of his or her data.
The data subject may lodge a complaint with the controller at dpo@hellopay.hu in the event of a breach of the rights set out in the Privacy Notice.
The Company will comply with the data subject's request to exercise his or her rights in accordance with the Privacy Notice without undue delay, but no later than one month from the date of receipt of the request. Where necessary, taking into account the complexity of the request and the number of requests received, this time limit may be extended by a further two months. The Company shall inform the person concerned of the extension of the time limit, stating the reasons for the delay, within one month of receipt of the request.
If the data subject has made the request by electronic means, the reply shall also be provided by electronic means, where possible, unless the data subject requests it in another form expressly indicated in the request.
The data subject shall have the right to obtain from the Company, through the contact details provided in this notice, information as to whether or not his or her personal data are being processed and, if such processing is taking place, the right to be informed that the Company:
The Company shall provide a copy of the personal data subject to processing free of charge upon the data subject's request for the first time, and thereafter, in accordance with its Privacy Notice, if the data subject's request is manifestly unfounded or excessive, in particular because of its repetitive nature, it may charge a reasonable fee based on administrative costs or refuse to act on the request.
In order to meet data security requirements and to protect the rights of the data subject, the Company is obliged to verify the identity of the data subject and the person who wishes to exercise his or her right of access, and to this end, the provision of information, access to data and the issue of copies of data are subject to the identification of the data subject.
The data subject may request in writing, via the contact details provided in this notice, that the Company amend or correct any of his or her personal data, provided that he or she can credibly demonstrate the accuracy of the corrected data. If the request is sent to the Company by electronic means, the Company will also send a reply by electronic means. If you request a reply by any other means, please indicate this in the request.
The data subject may request, through the contact details provided in this notice, that the Company restricts the processing of his or her personal data (by clearly indicating the restriction of processing and ensuring that it is kept separate from other data), if:
You have the right to receive personal data concerning you and provided by you to the Company in a structured, commonly used, machine-readable format and the right to transmit such data to another controller without hindrance to the Controller, if:
The data subject may request the erasure of his or her personal data in writing to the Company using the contact details provided in this notice.
The Company is obliged to delete personal data concerning you without undue delay if, among others, one of the following grounds applies:
If the data subject considers that the Company has violated the applicable data protection rules in the processing of his or her personal data, he or she may lodge a complaint with the National Authority for Data Protection and Freedom of Information (address: 1055 Budapest, Falk Miksa utca 9-11; postal address: 1363 Budapest, PO Box 9; telephone: +36-1-391-1400; e-mail: ugyfelszolgalat@naih.hu). The data subject also has the right to lodge a complaint with another supervisory authority, in particular the supervisory authority established in the EU Member State of his or her habitual residence.
The controller can also be sued in court for breach of the rules on the processing of personal data. The data subject may bring the action before the Metropolitan Court or the court of his or her place of residence. The contact details of the courts in Hungary can be found at the following link: http://birosag.hu/torvenyszekek. If the person concerned has his or her habitual residence in another Member State of the European Union, the action may be brought before the competent court in the Member State of habitual residence.
Factsheet HelloPay Zrt. ethics/misconduct reporting system
HelloPay Zrt. (hereinafter referred to as HelloPay or the Company) operates a Reporting System pursuant to Act XXV of 2023 on Complaints, Public Interest Reports and Rules for Reporting Abuse (hereinafter referred to as the Reporting Act).
Anyone can report information about an unlawful or suspected unlawful act or omission or other misconduct, or a possible violation of the values set out in the OTP Group Code of Ethics, to the Reporting System, even anonymously.
HelloPay Zrt. will record the notification made through the above channels in a permanent and retrievable form after being informed, in accordance with the regulations on the protection of personal data. If the notifier makes the notification in person, HelloPay Zrt. will record it in writing and - with the possibility of verification, correction and acceptance by signature - will provide the notifier with a duplicate copy.
Within the framework of the Notification System:
may have,
personal data that are essential for the investigation of the Report may be processed solely for the purposes of investigating the Report and remedying or stopping the conduct that is the subject of the Report.
Any personal data processed within the framework of the Notification System that goes beyond the above shall be deleted without delay.
The personal data of the notifier may only be disclosed to the body competent to conduct the procedure initiated on the basis of the notification, if this body is entitled to process the data by law or if the notifier has consented to the disclosure of the data. The personal data of the notifier shall not be disclosed without his/her consent.
If it has become apparent that the Whistleblower has, in bad faith, provided false data or information and
For information on the rights and remedies relating to data processing, please consult the In the Privacy Notice for detailed information.
From the date of receipt of a written Notification in the Notification System, the Bank shall. send you confirmation of the notification within seven days to the notifier, as well as general information on the procedural and data management rules under the Notification Act. The Company shall, within the shortest period of time permitted by the circumstances, but not later than the date of receipt of the Notification, provide the information contained in the Notification to the investigate within thirty days. The thirty-day time limit may be extended in particularly justified cases, subject to simultaneous notification to the notifier. In this case, the notifier shall be informed of the expected date of the investigation and the reasons for the extension. The time limit for the examination of the notification shall not exceed three months in the case of an extension.
During the investigation of the Notification, the Company will keep in contact with the Notifier, in the framework of which it may invite the Notifier to supplement or clarify the Notification, to clarify the facts and to provide additional information.
The Company shall inform the notifying party in writing of the investigation or non-investigation of the notification and the reasons for the non-investigation or the result of the investigation of the notification. Written information may be waived if the Bank has informed the notifier orally, who has taken note of the information.
If the person concerned (the notifier or the person concerned by the notification) does not agree with the outcome of the investigation (first instance procedure) of the notification, the tWithin 15 days of receipt of the information, you can contact the Ethics Committee in writing through the Reporting channels.
For issues not covered in this policy, please refer to the HelloPay Zrt Ethical Abuse Reporting System Policy.
For information on the rules on the protection of whistleblowers, see Information on the protection of whistleblowers
has.
HelloPay Zrt.
Code of Conduct for the operation of the ethics/misconduct reporting system
Document title: The HelloPay Zrt. ethics/breach of law reporting system
Scope: These Rules shall enter into force on 15.04.2024.
Review: Mandatory review before 15.04.2025
Responsible for review: change management/compliance officer
CREATED BY: | |||||
Name | Position | Date | Signature (if printing) | ||
Bea Csabai | Change Management Officer | 2024.04.19 | |||
CONTROLLED: | |||||
Name | Position | Date | Signature (if printing) | ||
Dr. Orsolya Füredi | OTP Mobil Kft. Compliance officer | ||||
TRACKING CHANGE
Version | Date | Exhibitor | Change / Comment | ||||||||
FINE: | |||||||||||
Name | Position | Date | Signature (if printing) | ||||||||
Norbert Varga | CEO | 2024.04.19. | |||||||||
The document is only valid if signed and printed!
The contents of this document may be copied in whole or in part for any purpose only with the prior written permission of HelloPay Zrt.
All rights reserved.
III.1.Scope of the regulation 5
III.3.Interpretative provisions 7
IV.2.A Information to the notifier 12
IV.3.Not to examine the notification 13
IV.4.Referral of a non-ethical complaint for action 14
IV.5.Initiation of the procedure 15
IV.6.Ensuring the confidentiality of the procedure 15
IV.7.Exclusion from ethics investigation: 16
IV.8.Conduct of the proceedings at first instance 16
IV.8.1.Initiation of the investigation 16
IV.8.2. Informing the notifier of the outcome of the preliminary examination of the notification 17
IV.8.3. Making up for shortfalls 17
IV.8.4. Information to the person concerned by the Notification 17
IV.8.7. Extension of the study 19
IV.8.9. Closure of the first instance investigation: 20
IV.9. Second instance procedure 21
IV.10. Register of Notifications 22
IV.11. Investigation of Reports concerning Compliance Officers 22
IV.12. Investigation of Reports concerning the Company 22
IV.14. Procedure in the event of an Ethics Complaint 23
INTRODUCTORY provisions
Pursuant to Act XXV of 2023 on Complaints, Whistleblowing and the Rules for Reporting Abuse (hereinafter: the Reporting Act), the employer specified therein must operate an internal abuse reporting system. Recommendation No. 12/2022 (VIII.11.) of the Magyar Nemzeti Bank on the establishment and operation of internal lines of defence and on the management and control functions of financial organisations also requires financial organisations to operate procedures to ensure that concerns and problems raised by employees are brought to the attention of the management and supervisory bodies.
Anyone can report a possible violation of the values set out in the Code of Ethics of HelloPay Zrt. (hereinafter "HelloPay" or the "Company"), even anonymously.
The purpose of this Instruction of the Chief Executive Officer (hereinafter referred to as the "Rules" or "Rules" or "Instruction") is to set out the rules for the operation of a whistleblowing system that is both compliant with the requirements of the law and capable of reporting possible violations of the values set out in the Code of Ethics (hereinafter collectively referred to as "Reports"), as well as the rules governing the procedure for the Report and the responsibilities and powers of the departments and persons involved in the investigation of the Report.
The Instructions are a document to be implemented at group level, and the transposition of changes is mandatory for those involved in their implementation, provided that their importance justifies it and the relevant national legislation does not contain any provision contrary to this regulation.
The personal scope of this Instruction extends to the employees, agents and representatives of HelloPay Zrt. To register, or otherwise involved in the procedure.
The scope of the Instruction covers the procedure to be followed in the case of reports of wrongdoing (including reports to the internal whistleblowing system under the Whistleblowing Act) and ethics complaints (hereinafter "Whistleblowing Procedure" or "Procedure").
Regulatory documents referred to in the Instructions:
The legislation referred to in the Instruction:
Principles for the management of Notifications:
Employee: a person employed by or having an employment relationship with the Company.
Identifiable natural person: a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the natural person.
Notification: a report of a breach of the Code of Ethics and any report of a breach (including a report of an unlawful or suspected unlawful act or omission or other abuse under the Whistleblowing Act (hereinafter "a report"))
Notification system: a system for receiving, receiving, recording, managing and monitoring notifications, with an independent and autonomous channel and procedure.
Whistleblowing lawyer: Under the Whistleblowing Act, a whistleblower protection lawyer or other external organisation can be contracted to operate and investigate the internal whistleblowing system.
Log in to: person making the notification, in particular
Person concerned by the notification: who has been the subject of a notification or who, in the course of the investigation of the notification, becomes concerned by the notified conduct.
compliance officer: HelloPay Zrt.'s regulatory compliance officer
Notification concerning a Compliance Officer: a notification involving a Compliance officer.
Ethics notice: Report of a breach of the Code of Ethics.
Ethical misconduct: a breach of the values set out in the Code of Ethics, conduct or omission contrary to the values set out in the Code of Ethics, which constitutes a breach of the rules of the Code of Ethics.
Employment relationship: any legal relationship in which the employee performs an activity for and under the direction of the employer for remuneration or self-employment.
Employment: who employs a natural person under an employment relationship.
Employed by: a natural person who performs an activity for and under the direction of an employer in the context of an employment relationship for consideration or who performs an activity for his/her own account.
Infringement: any legal obligation or requirement and any actual or potential breach of the requirements of prudential legislation.
Infringement report: the notification of a violation by an employee, officer or employee of HelloPay Zrt. or the Notifier.
Delegated to: for the purposes of compliance with the Code of Ethics, a principal means a representative, intermediary, consultant, agent, subcontractor and supplier, or any other company or natural person having a civil law relationship with the Company.
Employment relationship: employment relationship, membership of a cooperative with an employment obligation, contract of agency and commission, relationship as a member of a management or supervisory board of a company and self-employment
Personal data: any information relating to an identified or identifiable natural person (data subject).
Customer complaint: A complaint is a request for redress for a violation of an individual right or interest, which is not subject to any other procedure, in particular judicial or administrative.
Executive officer: decisions relating to the management of the legal person which do not fall within the competence of the members or the founders may be taken by one or more managers or by a body of managers. In HelloPay Zrt, the CEO and his deputies are considered to be.
Person in a managerial position: the Chief Executive Officer and his/her deputies, and the directors, managers of the Company with powers of directors.
Examiner: the Company's Compliance Officer or an impartial staff member designated by them to record and/or investigate the Reports. Where appropriate, an employee from another area of the Company may be designated as an Investigator.
In accordance with the following provisions of the Instructions, HelloPay Zrt.
Notifications may be oral or written.
An oral announcement can be made:
The oral Notification must be recorded in a durable and retrievable form or in writing, after having been informed in accordance with the provisions on the protection of personal data, and must be provided to the Notifier in duplicate, with the possibility to verify, correct or accept it by signature.
A full and accurate record must be kept when the oral report is put in writing.
A written notification may be sent to:
If the Notifier does not wish to make a Notification through one of the designated official channels, he/she must be informed of the possible ways to make a Notification.
A customer report not received through the designated formal reporting channels, if it is deemed to be a full or partial notification under the Instructions, will be forwarded by the person authorised to make a decision on the complaint handling (the customer report handler) to the Compliance Officer for bejelentes@hellopay.hu to the following e-mail address.
Whether or not all or part of a notification not received through the designated official notification channels constitutes a Notification under the Instructions is at the discretion of the Investigator.
The Notification or the part of the Client Notification that is a Notification under these Instructions shall be recorded by the Examiner and the provisions applicable to the Notification under these Instructions shall apply to the Client Notification (or the part thereof).
At the same time, the department from which the request was received will be informed of the decision.
The Customer Service Department will respond to the complaint handling part of the customer's complaint within the 30-day deadline for notifications.
In the case of a partial reclassification of the Notification, the Customer Service or the department from which the request was received will inform the Notifier that the part of the customer notification that qualifies as a Notification will be investigated by HelloPay Zrt. in the framework of an ethical, infringement notification procedure.
If the customer report has been reclassified in its entirety, the Customer Service or the department from which the request was received will only inform the Reporting Party that the report will be investigated by HelloPay Zrt. in the framework of an ethical, infringement notification procedure.
At the time of an Oral Notification, the attention of the notifier should be drawn to.
In the case of an oral Notification, if the notifier provides written contact details, the information notice for a written Notification will be sent to the notifier.
If the Report is a Report involving a Compliance Officer, the Investigator will immediately notify the Director of Operations of this fact and will forward the Report to the Director of Operations without recording the Report. In this case, the Director of Operations or his delegate shall ensure that the Report is recorded.
The (anonymous) notifier shall be informed, where possible, that if the information provided by him/her is not sufficient/sufficient to investigate his/her notification or if the information indispensable for the initiation or effective conduct of the investigation cannot otherwise be obtained for any reason, the investigation may be closed without result. When recording the report, the Investigator of the report will ask the reporter to provide contact details, on condition of anonymity, in order to request further information and to inform the investigation closure.
In the case of a written Notification, the Notifier will receive the information referred to in paragraph 45 in writing within 7 days of receipt of the Notification, if an address (postal or e-mail) is available. The sending of the information shall constitute confirmation that the notification has been made.
The report must include a description of the alleged ethical misconduct or violation, the evidence relating to the matter of which you are aware or have reasonable grounds to believe.
The examination of a notification may be waived if
The Compliance Officer decides not to make a report and immediately informs the Reporting Party of the decision, stating the reasons. An investigation may be conducted despite a withdrawal if it is justified by the interests of the Company or by overriding private interests.
Provided that it does not jeopardise the statutory protection of the notifier and the fair and impartial investigation of the notification, and the notification
The person/department conducting the investigation must inform the Compliance Officer of the outcome of its action within 15 days. This time limit may be extended once for a further 15 days at the request of the investigating entity. The Compliance Officer may decide on this basis to open a further ethics investigation, to take a decision on the merits or to close the case.
The Compliance Officer will inform the notifying party of the other preliminary examination of the notification, other than the ethics procedure, and monitor the further progress of the procedure. In the event that the complaint is not investigated under the ethics procedure, he/she shall request the other department to conduct the investigation. If the investigation is to be conducted entirely by another department, the whistleblower shall be informed of this fact without delay. The Compliance Officer shall be informed of the outcome of the investigation by the department requested to conduct the investigation. The Compliance Officer shall inform the notifier of the decision taken.
Twice a year, the Compliance Officer informs the CEO of all Notifications, including those that have been forwarded to another department for action or for which no action has been taken.
The Compliance Officer decides on the basis of a preliminary examination of the notification:
The Compliance Officer or the person designated to conduct the investigation will conduct an evidentiary hearing to obtain the facts and evidence on which the decision on the complaint is based.
Any evidence that can help clarify the facts may be used in the proceedings, except evidence obtained by breaking the law. The designated Investigator shall be free to choose the means of proof and to assess the available evidence according to his or her own judgement.
The following persons are entitled to see the notification and the decision closing the investigation:
The identity of the non-anonymous Reporting Party is not known to anyone other than the investigators of the Report.
The Whistleblower and the person subject to the Whistleblowing may have indirect access to the documents (including the Whistleblowing) and information used in the discovery process of the investigation, subject to the Company's legitimate business and banking confidentiality safeguards, as provided by the Compliance Officer.
The obligation of confidentiality of the report does not affect the right of the person concerned to consult his/her manager exercising the authority of his/her employer, his/her legal representative to the extent necessary for their cooperation, or to inform the witness designated by him/her of the fact of the investigation. Any person interviewed as a witness or involved as a respondent in the investigation of a complaint shall keep confidential what is said during the interview and all facts coming to their knowledge and shall not share them with any other department or staff member of the employer. Failure to do so shall constitute a violation of the Company's Code of Ethics.
You cannot investigate or take part in decision-making:
The Compliance Officer decides whether to open an investigation, to refer it to the competent department or not to report it.
The Compliance Officer shall appoint the Investigators responsible for the investigation of the Notification, if necessary, and shall arrange for the appointment of a replacement Investigator if the Investigators are unable to attend.
The decision to open an investigation, not to pursue a Notification or to refer the investigation to another specialised area is taken by the Compliance Officer, upon receipt of the Notification, by the Notifier. within seven days in writing to the contact details provided by the notifier. In exceptional cases, if the notifier has not provided written contact details, the information may be provided by telephone or orally.
If the Examiner deems it necessary, he will return the Notification to the initiator of the procedure, indicating the deficiencies, with a short deadline of 8 days at the most, for the purpose of rectifying them. If the notifying party does not reply to the request to rectify the deficiencies, the investigator will close the procedure without conducting an investigation.
The Investigator shall, at the start of the investigation, inform the person subject to the notification in detail of.
In exceptional and justified cases, the person concerned by the notification may be informed later than the start of the investigation,
which conditions are examined and decided by the Compliance Officer.
If, after the investigation has been initiated, the Investigator becomes aware of data/information which suggests that a third person may be involved in the Report, the investigation may be conducted against that person as provided for in paragraphs (80) to (82).
The person concerned by the Notification may be waived if the Compliance Officer decides not to investigate the Notification.
Thirty (30) days from the date of receipt of the Notification are available for the investigation of the facts contained in the Notification, which deadline may be waived only in particularly justified cases, with simultaneous notification to the Notifier.
The Compliance Officer shall inform the notifier in writing of the extension of the investigation, the reasons for the extension and the expected date of completion of the investigation, at the same time as the decision on the extension.
The duration of the investigation should not exceed three months.
In particular, the following investigative tools may be used:
In all cases, the hearing will be conducted by at least two Examiners.
A record or note of the hearing is made, which the interviewee can view, comment on, ask for corrections to and approve in writing.
For interviews conducted by telephone or videoconference, the rules for personal interviews shall apply mutatis mutandis.
At the hearing, the person concerned by the report or other interested interviewees (witnesses, experts) will be informed by the Investigator about the processing of their personal data (name, position, conclusions drawn from what they have said about the case) and their rights regarding the protection of their personal data, as well as the procedure.
The legal representative of the person concerned may be present at the hearing of the person concerned by the request.
The report shall be investigated by the Investigator or, at the request of the Investigator, by another manager/body exercising direct managerial authority in the field of competence in the given case, or the Investigator may request the opinion or position of any other competent manager/body exercising employer authority in the course of the investigation.
The body or person requested in the procedure to provide documents or information must send the requested documents and information to the investigator within 5 days of the request. The requested body or person may, where justified, request a single extension of the time limit by a further 5 days.
If, after the investigation has been initiated, the Investigator becomes aware of data/information that suggests that a third person may be involved in the conduct complained of, the investigation may be conducted against the additional person complained of.
In the investigation report, the investigator describes the investigative tools used, the facts established, the detailed reasoning, the proposal to close the investigation and the recommendations for action proposed.
The investigation file contains the documents used, relevant correspondence on the case and any other evidence obtained.
If the investigation fails to collect sufficient and/or adequate information to allow a meaningful investigation of the facts contained in the Notification and to conduct the investigation, the Investigator shall propose in the investigation report to terminate the investigation.
On the basis of the investigation report, the Compliance Officer will decide whether to close the first instance procedure:
On the basis of the investigation report, the Compliance Officer may recommend action to the employer, business area manager or supporting departments to take appropriate employer action to remedy the violation/ethical breach, to take appropriate employer action, or to take action to avoid, prevent and mitigate the risks of violations or breaches of the Code of Conduct.
In the case of a proposal involving labour law consequences, the Compliance Officer may consult in advance with the labour law area, the manager exercising the employer's authority and the area's line manager.
Where required by law, the Compliance Officer will initiate proceedings with the competent authority if the conditions set out therein are met. If a criminal complaint appears justified, it should be made in consultation with the Chief Executive Officer and the Chief Operating Officer, as the body responsible for liaising with the authorities in criminal matters.
III.8.10. Informing the notifier and the person concerned of the closure of the procedure
The Compliance Officer shall inform the Reporting Party and the person concerned in writing of the investigation of the Report and the outcome of the investigation, the reasons for the investigation, the measures taken or planned.
If the person concerned (the Notifier or the person concerned by the Notification) disagrees with the outcome of the investigation (first instance procedure) of the Notification, he or she may, within 15 days of receiving the information, contact the CEO in writing through the Notification channels. The Executive Director will appoint the investigator of the second instance investigation, endeavouring to ensure the independence and objectivity of the investigation. If there is no suitable person or organisation within the organisation, he/she will employ a whistleblower protection lawyer.
The person/organisation designated to conduct the second instance investigation will review the evidence from the first instance investigation and the investigation report. During the review, the investigator of the second-instance investigation shall
The investigator of the second instance investigation based on the results of the review:
The rules and time limits of the first instance proceedings apply in the second instance proceedings.
The Compliance Officer will keep a record of the Notifications with the following content:
If a Compliance Officer Report is received by the Company (concerning the activities of the Board of Directors or any of its members/employees), the Compliance Officer's duties as set out in this Procedure will be performed by the Chief Operating Officer and/or his/her designees.
The person designated by the Director of Operations to conduct the investigation shall send his/her investigation report to the Executive Director immediately after the investigation has been conducted.
If the Report concerns the Company or any of its market conduct, the Compliance Directorate of OTP Bank will conduct the investigation and make a decision.
The Head of the Compliance Directorate appoints the Investigator to investigate any report received through the reporting channel of OTP Bank Plc concerning the activities of a foreign or domestic subsidiary bank or subsidiary of the OTP Group or the conduct of an employee of an OTP Group company.
The Compliance Officer notifies the Chief Executive Officer and the Chief Operating Officer on an ex-officio basis
on the notification received in connection with.
If the Ethics Hotline receives a question on the interpretation of the Code of Ethics or other compliance rules, the Compliance Officer will record it and respond within 15 days. The Compliance Officer will examine the question, consult with experts if necessary, or, where appropriate, involve the Chief Operating Officer in answering the question.
This regulatory document enters into force on the day of publication
Present regulator document no later than one month after the date of entry into force éshould be reviewed within.
The person responsible is authorised to amend the Appendix to the Instructions.
Act XXV of 2023 - on complaints, notifications of public interest and rules on reporting abuse (the Whistleblowing Act) prohibits retaliation against the whistleblower for making a whistleblowing report.
The whistleblower is protected against discrimination or unfair treatment for making a whistleblowing complaint. A whistleblower cannot be held liable for lawfully making a report if the whistleblower had reasonable grounds to believe that the report was necessary to disclose the circumstances to which it relates.
Sections 41-44 of the Act contain the following safeguards to protect the whistleblower.
Any action under the Whistleblowing Act that is detrimental to the Whistleblower,
An adverse action is an act or omission that is detrimental to the Reporting Party, in particular:
in the sector in which he/she is employed, o./ the requirement of a medical fitness test,
p./ early termination or cancellation of a contract for goods or services, and
q./ withdrawal of the authorisation.
Any adverse action (listed above) taken against an entity owned by or having an employment or other contractual relationship with the Notifier, which is taken because the Notification was lawfully made, is unlawful even if it would otherwise be lawful.
The protection under this Chapter shall not apply to the notifier if.
If the Disclosure is lawfully made, the Discloser shall not be deemed to have breached any restriction on disclosure of business, economic or other confidential information under the Disclosure Act or any other legal restriction on disclosure of information, and shall not be liable in respect of such Disclosure if the Discloser had reasonable grounds to believe that the Disclosure was necessary to disclose the circumstances to which it relates.
Where a Notification has been lawfully made, the Notifier shall not be liable for obtaining or accessing the information contained in the Notification, unless the Notifier has committed a criminal offence by obtaining or accessing the information.
The notifier shall not be held liable for lawfully making a notification if the notifier had reasonable grounds to believe that the notification was necessary to disclose the circumstances to which the notification relates.
The notifier may invoke the provisions of the previous three paragraphs in all official or judicial proceedings, while proving the legality of the notification.
It is lawful to make a notification if.
A notification shall be deemed to have been lawfully made if the notifier makes its notification public and, in addition to the conditions set out in points (b) and (c) of the previous paragraph, one of the following conditions is met:
used the separate abuse reporting system set up by each public body, or
and the operator of the abuse reporting system or the body responsible for the procedure has not taken the measures provided for in this Act within the time limit,
The preceding paragraph shall not apply to a person providing information pursuant to Article 6 of Act CIV of 2010 on Freedom of the Press and Fundamental Rules on Media Content.
A Notification is considered to have been lawfully made if the Notifier makes the Notification at the European Union institutions, bodies, offices or agencies with competence and responsibility, and the Notifier obtained the notified information about the circumstances covered by the Notification in the context of his/her work-related activities, and the Notifier had reasonable grounds to believe that the notified information about the circumstances covered by the Notification was true at the time of the Notification.
The protection is only available to the notifier if.
The defence is not available to the notifier if.
The rules on the protection of the whistleblower apply to a whistleblower who makes a lawful report without revealing his or her identity, in particular without providing his or her name and personal data necessary for identification, and who, following his or her subsequent identification, is subject to adverse action or prosecution.
The protection applicable to a whistleblower is granted to a person who
The State shall provide the Notifier with the assistance provided for in Act LXXX of 2003 on Legal Aid under the conditions set out therein.
Extra-legal aid
The State shall provide the right to use legal assistance under this Act to the assisted person out of court. The legal adviser shall provide the party with legal advice or prepare a pleading or other document and, on the basis of a power of attorney, inspect the documents in the case (hereinafter together referred to as "legal service"), the fees and expenses of which, to the extent provided by law (hereinafter together referred to as "legal service fee"), shall be paid or advanced by the State to the legal adviser on behalf of the party.
If a party's income and assets entitle him or her to have the State pay for legal services instead, there is no cost to the party for using the legal services.
If a party becomes entitled, on the basis of his or her income and assets, to an advance payment of the legal service fee by the State instead of the State, the advance payment must be made within the time limit laid down in the decision authorising the aid to the
to reimburse the State. The maximum period for reimbursement is one year, within which payment in instalments may be authorised.
Support in civil and administrative proceedings
In the framework of legal aid, the State shall provide and advance or bear the costs of legal representation for the plaintiff, the defendant, the intervener (summoned), the interested party, the applicant and the defendant in civil proceedings and, with the exception of enforcement proceedings, in non-litigious proceedings as defined by law, as well as in administrative proceedings, other administrative court proceedings and non-administrative non-litigious proceedings (hereinafter together referred to as "proceedings").
Aid in criminal proceedings
The State provides the following assistance in the form of legal aid in criminal proceedings:
case wearing,
Festivals and
events
Trade
(retail)
Catering and entertainment
Services industry