If you notice any misconduct in our operations, please let us know.

We aim to act responsibly and lawfully in all situations. We want to find out about any misconduct in our operations.

Vastuu Group has established a confidential whistleblowing channel. Through this channel, our personnel and stakeholders can safely report any detected misconduct. You can submit a notification if you suspect that Vastuu Group’s Ethical Business Conduct Guidelines  or Code of  Conduct for Suppliers and Business Partners have been breached or an offence or misconduct referred to in the Whistleblower Act (2022/1171) has occurred in our company. The notifications sent through the whistleblowing channel may particularly concern breaches of legislation related to the following areas:

• Breach of data protection legislation, personal data protection or network and data system security
• Breach of competition legislation or engagement in unfair competition
• Bribery, corruption and money laundering
• Grey economy, including tax evasion
• Breach of environmental and occupational safety legislation
• Breach of product safety legislation or compliance breach
• Breach of consumer protection legislation

The whistleblowing channel is only for reporting breached of ethical guidelines, misconduct and suspected offences. Normal feedback should be given through the normal feedback channels. 

How do I send a notification?

We recommend that you primarily discuss any grievances with the supervisor or the person responsible for the matter in question. If you do not want to disclose the issue to these persons, you may use the whistleblowing channel. The whistleblowing channel can be accessed via http://vastuugroup.ilmoituskanava.fi/. You may send your notification completely anonymously and discuss it anonymously with the person processing the notification.

You are not required to send us any evidence; just reporting your suspicion is enough. However, the notification may not include any information that the notifier knows to be false or groundless. Intentional groundless or false notifications may lead to legal consequences.

How are notifications processed?

All notifications are processed appropriately and confidentially. We always keep confidential the identity of the whistleblower, the subject of the notification and any other parties mentioned in the notification.

The information in the notification can only be accessed by authorised persons, and we will not disclose your identity information to third parties without your consent. General Counsel, Chief People Officer and Chief Information Security Officer are the persons in Vastuu Group who can see the notification. Other experts may be used during an investigation to ensure appropriate processing.

When will I get a reply?

The persons authorised to process notifications may request additional information concerning the notification from you through the whistleblowing channel. They will also reply to you through the channel within three months, explaining what measures will possibly be taken on the basis of your notification. Therefore, please write down the code you receive after sending the notification, so that you can log in and access it again to communicate with the persons processing the notification. 

Additional information about concealing the whistleblower’s identity

The whistleblowing channel is implemented with a neutral third party, the Finnish Central Chamber of Commerce, to conceal the identity of an anonymous whistleblower. The Central Chamber of Commerce is in charge of the technical implementation of the service and does not receive notifications.

Processors authorised by the company receive the notifications sent through the whistleblowing channel and process them confidentially. Only authorised processors have access to the notifications.

A notification can always be made anonymously. The processors receiving the notification do not have access to any metadata or IP address that could help to identify the sender. When a notification is created, it is encrypted with a symmetric and asymmetric strong encryption algorithm that cannot be decrypted or changed afterwards. The processors will only know the date, time and content of the notification. 

The whistleblower may decide to include their name and contact details in the notification. The information in the notification can only be accessed by authorised processors, and we will not disclose your identity information to third parties without your express consent, unless the appropriate processing of the notification requires providing the authorities with the information or other similar measures.

Do not include any sensitive personal data in the notification, unless this is necessary for the description and processing of the notification. 

More information about the processing of personal data in the service can be found in the privacy notice on the whistleblowing channel pages.

External whistleblowing channel

If your notification concerns a topic that is listed in the national legislation concerning whistleblower protection or in the directive, it is also possible to send the notification through the Chancellor of Justice’s centralised external whistleblowing channel, provided that the requirements of the Whistleblower Act are met. If your notification concerns Vastuu Group companies in other countries, you can send your notification to the locally specified authorities or EU agencies.