Whistleblower & Speak-Up Policy

1. Why this Policy exists

SriLankaExport.com (operated by Harker International (Pvt) Ltd, Reg. No. PV 00338032, Kandy, Sri Lanka) depends on the willingness of vendors, buyers, employees, and third parties to report concerns about wrongdoing that affects the Platform, its users, or its supply chain. This Policy guarantees that you can raise such concerns in good faith without fear of retaliation, and tells you how we handle them.

It is aligned with the substance of Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law, and reflects similar protections recognized under Sri Lankan, UK, and US whistleblower frameworks (UK Public Interest Disclosure Act 1998, US Sarbanes-Oxley Act 2002 § 806, US Dodd-Frank Act 2010, Sri Lanka Witness Protection Act No. 4 of 2015).

2. Who can use these channels

• Employees, directors, officers of Harker International, current and former.
• Vendors and Vendor staff listing on the Platform, current and former.
• Buyers and Buyer procurement staff transacting on the Platform.
• Job applicants, interns, volunteers.
• Contractors, freight forwarders, customs clearance partners, and any third party engaging with us.
• Anyone with credible information about wrongdoing affecting the Platform, even if not in one of the above categories.

3. What concerns are in scope

Examples include but are not limited to:

• Bribery, corruption, kickbacks, facilitation payments (see Anti-Bribery & Anti-Corruption Policy).
• Fraud, embezzlement, accounting irregularity, false invoicing.
• Money laundering, terrorism financing, sanctions evasion (see AML & KYC Statement 그리고 Export Compliance).
• Modern slavery, forced labour, child labour, trafficking (see 현대판 노예제 성명).
• Health, safety, or environmental violations in Vendor production facilities.
• Mislabeling, food-safety violations, or counterfeit goods.
• Personal-data breaches affecting Platform users.
• Discrimination, harassment, or retaliation by Harker International personnel or a Vendor.
• Any other breach of law applicable to the Platform or its users in any jurisdiction it operates.

Personal grievances between two private parties (e.g. a one-off pricing dispute on an order) are out of scope and are handled via the Dispute Resolution Policy instead.

4. How to report

The internal Speak-Up channels are monitored directly by the Managing Director. Where the concern relates to the Managing Director, mail or email the Executive Director instead, marked “Speak-Up to Executive Director.”

5. What we will do

1. Acknowledge. We acknowledge receipt within 7 calendar days unless you have requested complete anonymity with no return channel.
2. Triage. We assess the concern within 14 days to determine whether investigation is warranted and what scope is appropriate. Where the concern overlaps with criminal conduct, we may involve law-enforcement authorities at this stage.
3. Investigate. Investigations are conducted by a person or panel independent of the subject matter of the concern. Where necessary, we engage external counsel or forensic accountants.
4. Update. We provide a status update to the reporter at least every 30 days, and a substantive update on outcome within 90 days, where the reporter has provided a return channel.
5. Act. Where the concern is substantiated, we take proportionate action under the Vendor Agreement, employment contracts, or referral to authorities.
6. Record. We maintain a confidential record of all reports and actions for at least 5 years for regulatory and audit purposes.

6. Confidentiality

The identity of a reporter is kept confidential by default. The reporter’s identity is disclosed only:

• To a person who is conducting the investigation, on a need-to-know basis.
• Where required by law (e.g. court order, supervisory authority request under DSA, AML/CFT obligations).
• With the reporter’s explicit prior written consent.

7. Non-retaliation guarantee

Retaliation against a person who has reported a concern in good faith, whether by Harker International, a Vendor, a Buyer, or anyone else, is strictly prohibited. Retaliation includes dismissal, demotion, account suspension on the Platform, withholding of payouts, blacklisting, threats, or harassment.

If you experience retaliation, report it via the same channels described in section 4. We will treat retaliation as a serious breach of this Policy in its own right. Confirmed retaliation by a Vendor results in immediate account suspension; by an employee, dismissal; by a third party, termination of engagement and where applicable, referral to authorities.

This guarantee is independent of whether the underlying concern is ultimately substantiated, provided the report was made in good faith.

8. Good-faith and bad-faith reports

A “good-faith” report is one made by a person who reasonably believes, at the time of reporting, that the information is substantially true and relates to wrongdoing within scope of this Policy. Reporters do not need to be certain or to have proof.

A knowingly false report, one made by a person who knew or should have known the information to be untrue, is itself a breach of this Policy and can result in account suspension, dismissal, or other appropriate action. Reports that turn out to be unsupported after investigation, but were made in good faith, do not result in any adverse action against the reporter.

9. Data protection

Personal data submitted in a Speak-Up report is processed for the purposes set out in this Policy and our 개인정보 처리방침. The legal basis is our legitimate interest in detecting and preventing wrongdoing, and where applicable, our compliance with legal obligations under Sri Lankan PDPA 2022 and EU/UK GDPR. Reporters and persons named in a report have the data-subject rights set out in the Privacy Policy, subject to the confidentiality protections in section 6.

10. Review and accountability

This Policy and the channels operating under it are reviewed annually by the Managing Director and Executive Director. The next scheduled review is May 2027. Summary statistics, number of reports received, number investigated, number substantiated, average resolution time, are published in our annual DSA transparency report.