Ethics, Compliance and Control

ALTEO launched its compliance programme in 2015 and established the Compliance Manager function. In January 2016 it issued its Code of Ethics and adopted its Compliance Policy. Both documents are reviewed annually. The Compliance Committee was also founded in 2016. As a result of the group’s dynamic growth, the Ethics, Compliance and Control organisation was established in January 2022.

When designing the Company’s regulatory framework, the goal was to ensure transparent operations. Accordingly, we defined the framework of our business activities, we document our processes, and we set down the terms of cooperation between business areas, clearly defining tasks and the responsibilities attached to them.

The Compliance Management System, fundamentally as a function that supports, prevents and controls operations, ensures the prevention of damage and abuse and the minimisation of risks across the entire scope of corporate operations.

At the ALTEO Group we always strive to do better. As a thinking, forward-looking organisation, we believe that by operating in harmony with our values and building on our credibility and the trust of our partners, we can be successful over the long term. We are committed to operating with integrity and responsibility and to fully meeting the high ethical standards we set for ourselves. With our Code of Ethics we wish to reinforce this commitment towards our employees and business partners.

In order to protect data and information, the Company has defined its information and cyber security requirements, taking into account business expectations, the applicable legislation and professional recommendations. We expect our business partners to accept and comply with our internal information security rules.

In our business relationships we strive to take every measure to protect our data and business information in line with industry expectations.

To ensure the protection of data, information, IT systems and sites, the Company continuously protects and develops its systems.

Every year, in accordance with sectoral legislation, the Company certifies the closed nature of its billing system.

The IT and information security requirements concerning the closed nature of the billing system cover the administrative, physical and logical protection requirements assigned to the security class of the electronic information system.

The Company has developed its internal data protection procedure on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR).

The Company processes personal data exclusively in accordance with data protection rules, for specific purposes and with an appropriate legal basis. It continuously raises employees’ data protection awareness through training and provides regular information on both existing and new data processing activities.

The Company’s data protection organisation provides ongoing support and advice to ensure the company’s GDPR-compliant data processing.

To protect the infrastructure of its facilities, the ALTEO Group operates a physical security system. We have established security categories, and every existing and newly added site is classified into one of these categories according to its characteristics, with the corresponding physical security system put in place.

The Company carries out compliance risk management in order to identify, assess, manage and prevent compliance-related risks.

The ALTEO Group’s goal is to make the right decisions in the course of its business activities, to be aware of the risks that may arise, to develop plans for managing and preventing them, and to ensure operations that comply with the law.

In the course of compliance risk management, the organisation systematically evaluates and develops, using a systems-based approach, the audited organisation’s:

Every manager and employee of the group must comply with the provisions of the Compliance Policy, which we monitor regularly. During monitoring, every manager must make available all data, information and documents, within the limits set by privacy and data protection legislation.

We record the risks identified during the reviews together with the measures proposed to eliminate or mitigate them, and we regularly re-measure and analyse the handling of the identified issues on an annual basis. We prepare a summary report on the latter for the Compliance Committee and the Supervisory Board. Since 2017, the annual compliance report has been published in the Sustainability Reports and subsequently in the Integrated Reports. To prevent potential abuse and raise awareness, we regularly hold targeted training sessions.

Every year, the Company’s senior employees assess the company’s compliance risks in the areas of procurement, accounting, human resources, publicity and corporate governance. To eliminate any identified risks, we develop an internal audit plan and internal communication.

We firmly reject all forms of corruption and bribery, which constitute particularly serious ethical offences in relation to government relations, our suppliers and our business partners. We apply zero tolerance to every case involving bribery or corruption.

We do not enter into business relationships with suppliers who do not meet the pre-qualification requirements set by the company. We expect our business partners to be familiar with, accept and comply with our Code of Ethics.

We operate a whistleblowing hotline for reporting corruption and fraud, and reports can also be made by e-mail or telephone. We also guarantee whistleblowers the option of anonymity.

Any suspicion of corruption or fraud is always investigated in accordance with our internal procedures. The ALTEO Group firmly maintains that those who report suspected corruption or fraud must not suffer any retaliation or disadvantage, even if their good-faith report does not subsequently reveal any unlawfulness or misconduct.

Based on Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons who report breaches of Union law, ALTEO Nyrt. provides both an internal and an external reporting system.

Reports can also be made anonymously via the online reporting system or by e-mail, which is available 365 days a year, 7 days a week, 24 hours a day. If an investigation has begun but has not been completed within two months, the reporting person and the person concerned will be notified by e-mail of the expected date of closure of the investigation.

Those who submit a report must not suffer any retaliation or disadvantage, even if their good-faith report does not subsequently reveal any unlawfulness or misconduct.