Whistleblowing Channel Policy

This policy establishes the internal whistleblowing channel of ONRISING TI Portugal, Lda. ("Velv") and the procedure for receiving, following up on, and deciding on reports of infringements of which the persons addressed by this policy have become aware in a professional context, in compliance with Law No. 93/2021, of 20 December, which approves the general regime for the protection of whistleblowers (the "Whistleblowing Law").

This policy is based on Law No. 93/2021, of 20 December, Directive (EU) 2019/1937 of the European Parliament and of the Council, of 23 October 2019, and other applicable legislation, including Regulation (EU) 2016/679 (GDPR) and Law No. 58/2019, of 8 August, regarding the processing of personal data of those involved in the reporting process.

The following persons may submit a report under this policy:

• Velv employees, including during the probationary period;
• Former employees, provided the information on the infringement was obtained in the context of the now-terminated employment relationship;
• Job candidates, provided the information on the infringement was obtained during the recruitment process;
• Service providers, independent consultants, suppliers and subcontractors, as well as their respective employees;
• Shareholders and members of management or supervisory bodies;
• Volunteers and interns, whether paid or unpaid.

Reports may concern infringements of which the whistleblower became aware in a professional context, namely:

• Serious or very serious criminal and administrative offences (crimes and contraordenações);
• Infringements that violate or undermine the application of European Union acts in the areas listed in the Annex to Law No. 93/2021, including, among others: public procurement; financial services, products and markets and the prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; protection of privacy and personal data; and network and information systems security;
• Infringements of competition and State aid rules, and infringements harming the financial interests of the European Union.

Complaints of a strictly personal or interpersonal nature that do not amount to an infringement as described above (e.g., interpersonal conflicts between employees) fall outside the scope of this policy and should be directed to the applicable internal channels (HR or the relevant procedure, namely the Code of Good Conduct for the Prevention and Combating of Workplace Harassment).

5.1 Internal channel

Velv provides an internal reporting channel, hosted on the Factorial platform, accessible to employees. Reports may be submitted in writing or verbally, by requesting an in-person meeting or a video call to be held within a reasonable timeframe, in which case the report is reduced to writing with the whistleblower's consent.

5.2 External channel

Without prejudice to the internal channel, the whistleblower may choose to submit the report directly through the external channel of the National Anti-Corruption Mechanism (MENAC), pursuant to Law No. 93/2021, namely where there is no adequate internal channel, where the whistleblower has reason to believe that the internal report will not be adequately followed up, or where there is a risk of retaliation.

5.3 Disclosure

The existence of the reporting channel and how to access it are disclosed clearly and accessibly to all potential whistleblowers, namely through posting on Factorial and information made available on the company's website (www.velv.pt).

The identity of the whistleblower, as well as any information that directly or indirectly allows their identification, is strictly confidential and accessible only to the persons responsible for receiving or following up on reports.

Reports may be submitted anonymously; in that case, Velv likewise ensures the report is recorded and followed up, to the extent the information provided allows.

Management of the reporting channel is ensured jointly by the Human Resources Department and the Legal Department (through the Data Protection Compliance Officer, where the report involves data protection matters), acting independently and impartially in relation to the subject matter of the report.

Where the report concerns a person within the Human Resources Department or the Legal Department, or where the impartiality of either may otherwise be compromised, the report must be directed straight to Management (Managing Partners), who ensure follow-up with the exclusion of the person concerned from the entire process.

Where the report concerns acts of corruption or related offences covered by the General Regime for the Prevention of Corruption (Decree-Law No. 109-E/2021, of 9 December), the Compliance Officer ("RCN") of Velv — responsible for overseeing implementation of the Corruption Risk Prevention Plan — is informed, without prejudice to the escalation route set out in the preceding paragraph.

Given that the RCN is, as of the date of this policy, one of Velv's Managing Partners, where a report concerns the RCN personally, follow-up is ensured exclusively by the other Managing Partner, with the exclusion of the person concerned; where the report concerns both Managing Partners, the whistleblower should use the MENAC external channel referred to in point 5.2 above.

• Acknowledge receipt of the report within 7 days of receiving it;
• Carry out investigative steps to verify the facts reported and, where applicable, adopt appropriate measures to bring the reported infringement to an end;
• Inform the whistleblower, within a maximum of 3 months from the acknowledgment of receipt (or, absent such acknowledgment, from the end of the 7-day period), of the measures envisaged or taken to follow up on the report and the reasons for them.

• Any form of retaliation, direct or indirect, against a whistleblower for a report made in good faith is prohibited, including dismissal, non-renewal of contract, change of duties, unjustifiably negative performance evaluation, or any other discriminatory measure;
• Acts carried out in breach of this prohibition are void;
• A whistleblower who, at the time of reporting, had reasonable grounds to believe the information was true does not incur liability, even if the report later proves unfounded;
• A knowingly false report constitutes an infringement and may give rise to disciplinary, civil or criminal liability on the part of the whistleblower.

The processing of personal data within the reporting channel complies with the principles and safeguards of the GDPR and Law No. 58/2019, of 8 August, namely purpose limitation, data minimisation and storage limitation.

Personal data processed in connection with a report is kept for 5 years after the case is closed, or for longer while any related judicial or administrative proceedings remain pending, after which it is deleted or anonymized. This processing activity is recorded in Velv's Record of Processing Activities (ROPA).

This policy is reviewed annually or whenever relevant changes occur in the applicable legal framework or in Velv's organizational structure.

Version 1 — 20/07/2026. Author: Vera Zavattieri, Head of Legal / DPO. Approved by the Managing Partners. Lisbon, 20 July 2026.