Internal Rules for the Protection of Whistleblowers

INTERNAL RULES OF "BROKER INS" OOD for the protection of persons reporting or publicly disclosing information on violations Chapter I GENERAL PROVISIONS Art. 1. (1) These Internal Rules regulate the procedure and conditions for submitting and reviewing reports, as well as the conditions, procedure, and introduction of measures for the protection of employees of "Broker Ins" OOD and persons connected with them who report or publicly disclose information on violations of Bulgarian law or of acts of the European Union that endanger or damage the public interest and the law of the European Union, in accordance with Directive (EU) 2019/1937 and the Act on the Protection of Persons who Report or Publicly Disclose Information on Violations (hereinafter referred to as "the Act"), which has come to their knowledge in or in connection with the performance of their employment or official duties, or in another work-related context. (2) These Internal Rules have been drawn up on the basis of Art. 12(1)(2) of the Act. Art. 2. (1) These Rules apply to reports of violations, or public disclosure of information, concerning: 1. Violations of Bulgarian law or of the European Union acts specified in the Act, in the areas of: a) public procurement; b) financial services, products, and markets, and the prevention of money laundering and terrorist financing; c) product safety and compliance; d) transport safety; e) environmental protection; f) radiation protection and nuclear safety; g) food and feed safety, animal health, and animal welfare; h) public health; i) consumer protection; j) the protection of privacy and personal data; k) the security of network and information systems; l) rules on the payment of public state and municipal receivables; m) labour legislation; n) legislation relating to the performance of civil service. 2. Violations affecting the financial interests of the European Union within the meaning of Art. 325 of the Treaty on the Functioning of the European Union; 3. Violations of the internal-market rules within the meaning of Art. 26(2) of the Treaty on the Functioning of the European Union, including European Union and Bulgarian rules on competition and state aid; 4. Violations relating to cross-border tax arrangements whose purpose is to obtain a tax advantage that defeats the object or purpose of the applicable corporate tax law; 5. General crimes of which the person referred to in Art. 1 has become aware in connection with the performance of their work or official duties. Art. 2. (1) Persons who report or publicly disclose information on a violation are referred to as reporting persons. Only natural persons may submit reports or disclose information on a violation that has come to their knowledge in their capacity as: 1. employees in an employment relationship, persons performing paid work regardless of the nature of the work or the manner of remuneration; 2. paid or unpaid interns; 3. a person whose employment or official relationship is about to commence, or a person who is about to conclude a contract for the provision of any type of service, where information about violations was obtained during the selection process or other pre-contractual relations; 4. a worker or employee, and any other person under items 1–5, who obtained the information within an employment, official, or other work-related relationship that has been terminated by the time the report is submitted or the information publicly disclosed; 5. persons who assist the reporting person in the process of submitting the report; 6. persons connected through work, or relatives of the reporting person, who may be subject to retaliation because of the report; 7. any reporting person submitting a report on a violation that has come to their knowledge in a work-related context. Chapter II PROCEDURE AND CONDITIONS FOR INTERNAL SUBMISSION, REGISTRATION, AND REVIEW OF REPORTS Section I Receipt of Reports Art. 3. (1) The Managers of the Company shall, by order, designate a Commission for the Review of Reports under the Whistleblower Protection Act (hereinafter "the Commission"), which shall be responsible for registering and reviewing received reports. (2) The Commission shall consist of three employees. Members of the Commission must not be in a conflict of interest with regard to any case under review; they must observe the general rules on the absence of conflicts of interest and must recuse themselves where such a conflict exists. (3) The members of the Commission referred to in para. 1 shall sign a Confidentiality Declaration, in accordance with Annex No. 1 to these Rules. (4) The Managers of the Company may also entrust the functions of receiving and registering reports of violations to another natural or legal person outside its own structure, subject to compliance with the requirements of the Whistleblower Protection Act. Art. 4. (1) A report of a violation shall be submitted in writing, by completing a Report Registration Form in the template approved by the Commission for Personal Data Protection (CPDP) – Annex No. 2 to these Rules. (2) Reports shall be submitted in writing to the Commission referred to in para. 1, by one of the following means: 1. in person or through a proxy with an express written power of attorney (notarization is not required); 2. electronically, signed with a qualified electronic signature created in accordance with the requirements of the Electronic Document and Electronic Trust Services Act, sent to the e-mail address notice-of-violations@brokerins.bg, published on the official website of "Broker Ins" OOD. (3) An oral report may be submitted: 1. by telephone, as published on the "Broker Ins" OOD website; 2. through other voice-message systems; 3. at the request of the reporting person – through a personal meeting at a time agreed between the parties. Art. 5. (1) The report registration form shall contain at least the following information: 1. the full name, address, and phone number of the submitter, as well as an e-mail address, if available; 2. the name of the person against whom the report is made, and their place of work, where the report is directed against specific, known persons; 3. specific details of the violation or of a real risk of its being committed, the place and date/period of commission of the violation, if it has been committed, a description of the act or the circumstances, and other circumstances, to the extent known to the reporting person; 4. the date of submission of the report; 5. the signature, electronic signature, or other identification of the submitter. (2) Reports submitted under Art. 4 shall be entered in the Company's special register under Art. 6, whereby: 1. a written report is submitted by the reporting person in accordance with Art. 4(1); 2. an oral report is documented by the employee responsible for reviewing reports completing the form under para. 1, who shall offer the reporting person the opportunity to check, correct, and approve it by signing it. With the express consent of the reporting person, an oral report made via a telephone line or another voice-message system, or through a personal meeting, may also be documented by means of a durable recording that allows it to be retrieved. (3) The report may be accompanied by any type of source of information supporting the statements made in it and/or references to documents, including data on persons who could confirm the reported information or provide additional information. (4) Any new information relating to the report, or information not provided when the form under para. 1 was submitted, may be subsequently provided by the reporting person, indicating, when submitting it, the Unique Identification Number of the report assigned under Art. 6(3)(11). (5) Where the report does not meet the requirements of Art. 4(2) and (3) and Art. 5, the reporting person shall be sent a notice requiring the deficiencies to be remedied within 7 days of receipt of the report. If the deficiencies are not remedied within that period, or the signature is not affixed within the period under para. 2(2), the report and its attachments shall be returned to the reporting person. (6) Where a report is received by a method (channel) other than that provided for in Art. 4(2) and (3), or by an employee who is not a member of the Commission under Art. 3, the employees who receive it are prohibited from disclosing any information that could identify the reporting person or the affected person, and shall immediately forward the report to the Commission under Art. 3 of these Rules. (7) Every report shall be checked for credibility. Reports that do not fall within the scope of the Whistleblower Protection Act, and whose content gives no grounds for being considered plausible, shall not be reviewed. Reports containing manifestly false or misleading factual statements shall be returned, with instructions to the submitter to correct the statements and a note on their liability for false accusation. Section II Acceptance, Registration, and Review of Reports Art. 6. (1) "Broker Ins" OOD shall establish and maintain a Register of Reports of Violations, in a template approved by the CPDP in its capacity as the national authority for the external submission of reports, in accordance with Annex 3. Only the employees responsible for reviewing reports (the members of the Commission under Art. 3) shall have access to the register and the data contained in it. (2) The register is not public and has restricted, password-protected access; it is stored on a computer without network access. The information entered in the register is kept in a manner that guarantees its confidentiality and security. (3) The register shall contain information on: 1. the person who received the report; 2. the date the report was submitted; 3. the affected person, where such information is contained in the report; 4. summarized data on the alleged violation, such as the place and period in which it was committed, a description of the act, and other circumstances under which it was committed; 5. the connection of the submitted report with other reports, once established during the processing of the report; 6. information provided as feedback to the person who submitted the report, and the date it was provided; 7. subsequent actions taken; 8. the results of the review of the report; 9. the retention period of the report; 10. the manner in which the report was submitted – in writing or orally; 11. the UIN assigned by the Commission for Personal Data Protection. (4) The entry of circumstances under para. 3 that are not known at the date of submission of the report, as well as other additional circumstances and/or notes at the Commission's discretion, shall be made progressively as information is received during the review of the report. (5) Where data is added to the register progressively, a note shall be made of the current status of the report. (5) [sic] The register shall be kept and maintained on a durable medium within the meaning of § 1(18) of the additional provisions of the Act by the Commission for the Review of Reports. The information entered in the register is kept in a manner that guarantees its confidentiality and security. The information in the register is stored in a manner allowing it to be reproduced without loss of data. (6) The procedure for keeping the register under para. 1 shall be determined by order of the Managers of the Company, in implementation of an ordinance issued by the CPDP. (7) When a report is reviewed, a file on the report shall be created, in paper and digital form, containing: 1. the data from the register under para. 3; 2. the employees responsible for reviewing the report; 3. the evidence gathered during the review; 4. the review report under Art. 11. (8) The Commission for the Review of Reports is obliged to regularly submit the necessary statistical information to the national authority for the external submission of reports, in accordance with the procedure established by it, including, where technically possible, by establishing a direct link between the register of the obligated entity and the register kept by the national authority for the external submission of reports – the CPDP. Art. 7. (1) The Commission shall confirm receipt of reports within 7 (seven) days of receipt, in an appropriate manner. Within the same period, the reporting person shall be provided with information on the UIN and the date of registration of the report, and any subsequent information or communication relating to the report shall be linked to that UIN and to the Company's own incoming reference number from its document-management system. (2) The Commission shall check the admissibility of the report. Every report shall also be checked for credibility. Reports that do not fall within the scope of the Whistleblower Protection Act, and whose content gives no grounds for being considered plausible, shall not be reviewed. (3) Reports containing manifestly false or misleading factual statements shall be returned, with instructions to the reporting person to correct the statements within 7 days, and with a note on the liability the person bears for false accusation under Art. 286 of the Criminal Code. (4) When reviewing a report, the members of the Commission are obliged to: 1. ensure the application of measures to protect the identity and provide protection of the reporting person and of any other person named in the report, and to take the necessary measures to restrict access to the report by unauthorized persons; 2. maintain contact with the reporting person, requesting additional information from them and from third parties, where necessary; 3. provide feedback to the submitter of the report on the actions taken, within a period not exceeding 3 (three) months after confirming receipt of the report; 4. provide persons wishing to submit a report with clear and easily accessible information on the procedures for external submission of reports to the CPDP, and, where appropriate, to the institutions, bodies, offices, and agencies of the European Union; 5. document oral reports; 6. maintain the register of submitted reports under Art. 6 of these Rules; 7. hear the person against whom the report has been submitted, or accept their written explanations, and gather and assess the evidence they present; 8. provide the affected person with all evidence gathered and give them the opportunity to raise objections to it within 7 days, while observing the protection of the reporting person; 9. give the affected person the opportunity to present and identify new evidence to be gathered during the review; 10. regularly submit the necessary statistical information to the CPDP, in accordance with the procedure established by it, including, where technically possible, by establishing a direct link between the registers kept by the internal whistleblowing system and the CPDP. (5) Where the facts set out in the report are confirmed, the Commission shall: 1. organize the taking of follow-up action in connection with the report, and may for this purpose request the assistance of other persons or units within "Broker Ins" OOD; 2. propose to the Managers that specific measures be taken with a view to stopping or preventing the violation, in cases where it has been established or where there is a real risk of it being committed; 3. direct the reporting person to the competent authorities, in cases where their rights are affected; 4. forward the report to the CPDP where action on its part is required, notifying the reporting person in advance of the forwarding. Where the report is submitted against the reporting person's employer, the person shall be directed to simultaneously report to the CPDP. 5. prepare an individual report briefly describing the information contained in the report, the actions taken, and the final results of the review, which, together with the reasons, shall be communicated to the reporting employee and to the affected person, in compliance with the obligation to protect them. (6) On the basis of a received report and the proposal under para. 5(2), the Managers of the Company shall: 1. take action within their competence to stop the violation or to prevent it, if it has not yet begun; 2. prioritize, in accordance with predetermined criteria and rules, the review of multiple reports of more serious violations; 3. terminate the review; (7) The review shall be terminated where: 1. the violation for which the report was submitted is of minor importance and does not require further follow-up action, and its closure does not affect other obligations or procedures relating to the violation reported, nor the protection of the person(s) under the Whistleblower Protection Act; 2. it concerns a repeated report that does not contain new information material to a violation in respect of which a review has already been completed, unless new legal or factual circumstances arise providing grounds for follow-up action; 3. evidence of a criminal offence is established, in which case the report and the materials relating to it shall be sent immediately to the prosecution authorities. (8) In cases where the review has been terminated on the grounds of para. 7(1) or (2), the reporting person may submit a report to the CPDP. Art. 8. (1) All instructions to the submitter of the report shall be communicated to the correspondence address, phone number, e-mail, or other appropriate means indicated by them, in accordance with the Company's technical capabilities. (2) Where notification is given orally – by telephone or through other voice-message systems – the submitter of the report shall be informed that they may review the content of the instructions at the Commission. The notification shall be certified. Art. 9. No proceedings shall be opened on the basis of anonymous reports. Section III Follow-Up Action on a Submitted Report Art. 10. (1) Where the facts set out in the report are confirmed as a result of the review carried out and on the basis of the evidence gathered and assessed, the Commission for the Review of Reports shall: a) organize the taking of follow-up action in connection with the report, and may for this purpose request the assistance of other persons or departments of the Company; b) propose to the Company that it take specific measures with a view to stopping or preventing the violation, in cases where it has been established or where there is a real risk of it being committed; c) direct the reporting person to the competent authorities, where their rights are affected; d) forward the report to the External Reporting body, the CPDP, where action on its part is required, notifying the reporting person in advance of the forwarding; (2) Where the report is submitted against the Company in its capacity as employer, the Commission for the Review of Reports shall direct the person to simultaneously report to the External Reporting body. Art. 11. As a result of the review carried out, the Commission shall prepare an individual report briefly describing the information contained in the report, the actions taken, and the final results of the review of the report, which, together with the reasons, shall be communicated to the reporting person and the affected person, in compliance with the obligation of confidentiality. Section IV Termination of the Review Art. 12. (1) The Commission may terminate the review where: a) it establishes that the reported violation is of minor importance and does not require further follow-up action; where the time limits provided for by the relevant law for initiating administrative-penal or criminal proceedings in respect of the violation have expired, or the administrative-penal or criminal liability has lapsed due to the expiry of the limitation period provided for by the relevant law; and closure of the review does not affect other obligations or applicable procedures relating to the violation reported, nor the protection under this Act with regard to internal or external reporting; b) in the case of repeated reports, no new information is contained in relation to a review of a violation that has already been terminated, unless new circumstances and facts require follow-up action; c) evidence of a criminal offence is established. In this case, the report and the materials relating to it shall be sent immediately to the prosecution authorities. (2) The reporting person shall be notified of the decision to terminate the review and the reasons for it. (3) In cases where the review has been terminated on the grounds of para. 1(1) and (2), the reporting person may submit a report to the central External Reporting authority – the CPDP. Section VI Forwarding of a Submitted Report Art. 13. (1) The Commission for the Review of Reports under the Whistleblower Protection Act shall, within 7 days, forward to the CPDP a report which is found to: a) have been received by a private-sector employer that is not an obligated entity within the meaning of the Act and is not required to establish and maintain an internal reporting channel; b) report violations committed by persons holding senior public positions under Art. 6 of the Counter-Corruption and Unlawfully Acquired Assets Forfeiture Act, for subsequent forwarding to the Commission for Counter-Corruption and Unlawfully Acquired Assets Forfeiture; c) relate to the activity of another obligated entity under Art. 12(1) of the Act, without it being specifically named in the report; d) require action to be taken by the CPDP. (2) When forwarding under para. 1, the Commission shall send the CPDP all initial and/or subsequently gathered documentation relating to it, without redacting any data, and shall notify the reporting person of this. Section VII Retention of Reports Art. 14. The Company shall retain received reports of violations and the materials attached to them, including subsequent documentation relating to their review, for a period of 5 (five) years after the review of the report has been completed, unless criminal, civil, employment-related, and/or administrative proceedings have been initiated in connection with the report submitted. Art. 15. The Company shall provide the Commission for Personal Data Protection, by 31 January, with statistical information for the preceding year on the number of reports received, their UIN, subject matter, the number of reviews carried out, and their results. Section VIII External Submission of Reports Art. 16. (1) The central authority for the External Submission of Reports and for the protection of persons to whom such protection is granted within the meaning of this Act is the Commission for Personal Data Protection (CPDP). (2) With a view to the possibility of quickly preventing a violation or remedying its consequences, a report should preferably be submitted through an Internal Reporting channel (Chapter Two of these Rules). (3) Where there is a risk of retaliatory, discriminatory action against the reporting person, or where effective measures to review the report will not be taken, the report may be submitted through an External Reporting channel by the following means: a) in writing: - by e-mail to whistleblowing@cpdp.bg; - by post to: Sofia 1592, 2 "Prof. Tsvetan Lazarov" Blvd.; b) orally – in person at the CPDP, at: Sofia 1592, 2 "Prof. Tsvetan Lazarov" Blvd. (4) Persons reporting or publicly disclosing information on violations may choose the method of reporting. (5) A report may be submitted through the Internal or the External reporting channel, or through both. (6) In its activity, the staff of the CPDP's external-reporting unit shall: 1. confirm receipt of a report immediately, and in all cases within 7 days of its receipt, unless the reporting person has expressly requested otherwise, or the employee has grounds to believe that confirming receipt of the report would jeopardize the protection of the reporting person's identity; 2. provide feedback to the reporting person, in accordance with the Whistleblower Protection Act, within a period not exceeding three months, which, in duly justified cases requiring in-depth investigation, may be extended up to 6 months; 3. promptly, and in all cases within 7 days of receipt of the report, forward the information contained in the report, as appropriate, to the competent institutions, bodies, offices, or agencies of the European Union, for the purposes of subsequent investigation, where the matter concerns violations of Union law and this is provided for therein or in national law. (7) Persons who have publicly disclosed information on violations shall be guaranteed immediate protection by the Commission, upon their request. For this purpose, the Commission shall notify in writing the employer or other person against whom the publicly disclosed information is directed that the submitter of the report is placed under the protection of the law, indicating the consequences should retaliatory action be taken against the submitter of the report. Chapter III PROTECTION MEASURES Section I Duty of Confidentiality. Processing of Personal Data Art. 17. (1) The members of the Commission for the Review of Reports shall take appropriate measures to protect information relating to submitted reports of violations, and to protect the identity of reporting persons, ensuring that access to the information is granted only to employees who need such data to perform their official duties. (2) The transmission of data and reference to circumstances may not, directly or indirectly, disclose the identity of the reporting person, nor create a presumption as to their identity. (3) Paragraphs 1 and 2 shall also apply to the protection of the identity of affected persons. (4) Disclosure of identity or of the information referred to in para. 1 shall be permitted only with the express written consent of the reporting person. (5) Notwithstanding para. 1, the identity of the reporting person and any other information from which their identity may be directly or indirectly inferred may be disclosed only where this is a necessary and proportionate obligation imposed by Bulgarian law or by European Union law in the context of investigations by national authorities or of judicial proceedings, including with a view to guaranteeing the right of defence of the affected person. (6) In the cases under para. 5, before disclosing the identity or information referred to in para. 1, the Commission for the Review of Reports shall notify the reporting person of the need for such disclosure. The notification shall be in writing and shall state the reasons. The reporting person shall not be notified where this would jeopardize the investigation or judicial proceedings. (7) A Commission that receives information on a violation that includes trade secrets is obliged not to use or disclose trade secrets for purposes exceeding what is necessary for taking follow-up action. Art. 18. (1) Any processing of personal data carried out under these Rules, including the exchange or transfer of personal data, shall be carried out in accordance with Regulation (EU) 2016/679 (GDPR) and national legislation and the Company's internal policies. (2) Personal data not necessary for conducting a review of a given report shall not be processed and shall be promptly deleted. Section II Ensuring Protection Art. 18. (1) In accordance with these Rules and the Whistleblower Protection Act, any form of retaliatory action against the persons referred to in Art. 2, having the character of reprisal and placing them at a disadvantage, as well as threats of or attempts at such action, including in the form of: 1. temporary suspension, dismissal, or the application of any other ground for termination of the relationship under which the person performs paid work; 2. demotion or withholding of promotion; 3. a change of place or nature of work, working hours, or a reduction in remuneration; 4. refusal to provide training necessary to maintain or upgrade the worker's or employee's professional qualification; 5. a negative performance assessment, including in a work reference; 6. the imposition of financial and/or disciplinary liability, including disciplinary sanctions; 7. coercion, intimidation, harassment, or threats of retaliation, or acts expressed physically, verbally, or otherwise, aimed at harming the person's dignity or creating a hostile working environment; 8. direct or indirect discrimination, or unequal or unfavourable treatment; 9. failure to convert a fixed-term employment contract into a permanent one, where the employee of Broker Ins had a legitimate expectation of being offered permanent employment; 10. early termination of a fixed-term employment contract, or refusal to renew it, where such renewal would otherwise be permissible by law; 11. damage, including to the person's reputation, in particular on social media, or financial loss, including loss of business and loss of income; 12. blacklisting on the basis of a formal or informal sector- or industry-wide agreement, which may result in the person being unable to find employment, or to supply goods or services, in that sector or industry, where applicable; 13. early termination or cancellation of a contract for the supply of goods or services, where the person is a supplier; 14. termination of a licence or permit; 15. referral of the person for a medical examination. (2) Where retaliatory action is taken against a person under Art. 2 in connection with a report they have submitted, the competent authorities shall take corrective measures. Corrective measures shall be applied by these authorities regardless of the powers granted to them under any other law. (3) Corrective measures shall be aimed at halting the retaliatory action taken under para. 1, until the review carried out by the competent authorities has been completed. (4) Retaliatory action under para. 1 taken against a person under Art. 2 in connection with a report they have submitted shall be void. (5) A person under Art. 2 against whom retaliatory action has been taken may apply to the competent authority for restoration to the position they held before the retaliatory action was taken. Section III Support Measures Art. 19. (1) In accordance with these Rules, when submitting a report, the persons referred to in Art. 2 are entitled to access the following support measures: 1. free and accessible information and advice on the procedures and protective measures available; 2. assistance before any authority necessary for their protection against retaliatory action, including through proper notification of the fact that they are entitled to protection; 3. legal aid in criminal, civil, administrative, and cross-border civil-law disputes relating to the protection of the reporting person in connection with a report they have submitted or information they have disclosed, in accordance with the Legal Aid Act; 4. out-of-court resolution of cross-border disputes through mediation, in accordance with the Mediation Act. (2) The measures under para. 1(1) and (2) shall be provided by the CPDP, the measures under item 3 by the National Legal Aid Bureau, and the measures under item 4 by a mediator entered in the Single Register of Mediators. Section IV Liability of the Reporting Person. Exemption from Liability Art. 20. (1) Reporting persons under these Rules shall not be liable for acquiring the information that is the subject of the report, or that has been publicly disclosed, or for accessing it, provided that such acquisition or access does not in itself constitute a criminal offence. (2) Reporting persons shall not be liable for breach of restrictions on the disclosure of information imposed by contract, by a statutory or subordinate legislative act, or by an administrative act, provided they have reasonable grounds to believe that submitting the report or publicly disclosing the information was necessary to uncover the violation. (3) Where a person submits a report or publicly discloses information on violations falling within the scope of this Act, and that information includes a trade secret, and where that person meets the conditions of this Act, such submission of a report or public disclosure shall be deemed lawful within the meaning of Art. 7(2) of the Trade Secrets Protection Act. Art. 21. Damage caused to a reporting person in connection with a report they have submitted or information they have publicly disclosed shall be presumed to have been caused intentionally, unless proven otherwise. Art. 22. Where criminal, civil, or administrative proceedings have been initiated against a person in connection with a report they have submitted or information they have publicly disclosed, that person shall be entitled to request the termination of such proceedings if they had reasonable grounds to believe that submitting the report or publicly disclosing the information was necessary to uncover a violation. Art. 23. (1) A reporting person shall be liable, under Bulgarian law and the law of the Union, for any act or omission not connected with the submission of the report or the public disclosure, or not necessary for uncovering the violation. (2) In judicial or administrative-law proceedings in which a person under Art. 2 alleges that they have been subject to retaliatory action under Art. 18, and that such action is a reaction to a report submitted or information publicly disclosed, the person who took the detrimental measure shall be required to prove that the retaliatory action taken was in no way connected with the report submitted or the information publicly disclosed. Retaliatory action shall not be deemed to be a reaction to a report or public disclosure made by the person where, upon assessment of all the circumstances, a reasonable conclusion can be drawn that another legal ground exists for applying the measure. Section V Protection of Affected Persons Art. 24. (1) The affected person is entitled to protection, fully enjoying their right to defence and to a fair trial, as well as the presumption of innocence, including the right to be heard, and the right of access to documents concerning them. (2) The affected person is entitled to compensation for all pecuniary and non-pecuniary damage where it is established that the reporting person knowingly submitted a report containing false information, or publicly disclosed false information, or where, in the circumstances, they should have been aware that the information was false. FINAL PROVISIONS Art. 25. These Rules are adopted on the basis of Art. 13 of the Act on the Protection of Persons who Report or Publicly Disclose Information on Violations. Art. 26. These Rules and any subsequent amendments and supplements to them shall be adopted by order of the Manager of the Company and shall enter into force on the date of their adoption. Art. 27. Once adopted, these Rules shall be published on the Company's official website, as well as in a visible place at the Company's head office – Sofia, 3 Karnigradska St. Art. 28. Matters not settled herein shall be governed by the provisions of the Act on the Protection of Persons who Report or Publicly Disclose Information on Violations, the Administrative Procedure Code, and/or other provisions of applicable legislation. Art. 29. These Rules do not replace the existing procedures for reviewing individual complaints and reports from employees, in accordance with the Company's internal rules and other policies, and are binding on all employees of "Broker Ins" OOD. Art. 30. The annexes to these Rules form an integral part thereof.