Whistleblower Policy

Overview

Speaking up about suspected wrongdoing takes courage, and it should never cost anyone their safety, their standing or their livelihood. This Policy explains how anyone connected with Epcotec can raise a concern, how we investigate it, and the protections we apply to the people who come forward.

Epcotec (the group comprising Epcotec Pty Ltd in Australia and Epcotec Ltd in Canada) holds itself to high standards of fair dealing, honesty and proper conduct in its business activities. Those standards hold only if people can safely challenge behaviour that falls short of them, which is why we treat a trusted reporting process as a matter of Integrity, not paperwork.

Purpose

This Policy supports Epcotec's culture of honest and ethical behaviour, good governance, and corporate and financial compliance. It:

• encourages the reporting of reasonably held concerns about suspected or actual unethical, illegal, corrupt, fraudulent or otherwise improper conduct involving Epcotec; and
• provides protections and support to people who make such a disclosure, so that no one need fear victimisation or reprisal for doing the right thing.

This Policy is published on epcotec.com and is made available to all officers and employees through our internal systems.

Scope

This Policy applies to any person who is, or has been, any of the following in relation to Epcotec:

• an employee;
• an officer or director;
• a contractor, subcontractor or employee of a contractor;
• a supplier or employee of a supplier;
• a consultant;
• an auditor;
• an associate; and
• a relative, dependent or spouse of any of the above.

What can be reported

You may make a disclosure under this Policy if you have reasonable grounds to believe that a director, officer, employee, contractor, supplier, consultant or other person with business dealings with Epcotec has engaged in, or may engage in, any of the following ("Reportable Conduct"):

• dishonest, misleading, fraudulent or corrupt behaviour;
• illegal activity, including theft, drug offences, violence or threatened violence, and criminal damage to property;
• a breach, or a threatened or potential breach, of any legislation or regulations;
• unethical conduct, including any breach of Epcotec's policies;
• gross negligence, or conduct indifferent to its adverse consequences;
• conduct potentially damaging to Epcotec, its people or a third party, including its brand and business reputation;
• misconduct or an improper state of affairs;
• a danger to the public, or conduct that risks compromising corporate financial systems or taxation obligations; or
• harassment, discrimination, victimisation or bullying.

Personal work-related grievances

Personal work-related grievances are not Reportable Conduct and should be raised with your manager under our Grievance Policy. A personal work-related grievance is one that has implications for you personally and no broader implications for Epcotec. Examples include:

• an interpersonal conflict between you and another employee;
• a decision about your engagement, transfer or promotion;
• a decision about the terms and conditions of your engagement; and
• a decision to suspend, terminate or otherwise discipline your engagement.

If you are unsure which process applies, raise the concern anyway. We will direct it to the right place, and raising it will not attract any detriment.

Making a disclosure

If you become aware of Reportable Conduct occurring, or about to occur, you are encouraged to disclose it under this Policy in good faith and not for personal gain. You must have reasonable grounds to suspect that the information concerns Reportable Conduct, but you do not need proof, and you are not required to investigate the matter, gather further facts or make private inquiries before raising it.

Reports are easier to act on when they include:

• a description of the conduct;
• the names of the people involved;
• dates, times and locations;
• details of any relevant transactions;
• copies of any relevant documents;
• names of possible witnesses; and
• any steps already taken to report or address the matter.

You may contact the People & Compliance lead or the Founder at any time, before or after making a report, to discuss concerns about reporting, confidentiality or the protections available under this Policy or relevant legislation. If your concern involves the People & Compliance lead, contact the Founder.

Making a report under this Policy does not replace any legal duty to report a matter externally, for example to government, law enforcement or a regulator. Internal reporting does, however, allow us to provide appropriate advice and support.

Reporting channels

Internal channels

You may disclose Reportable Conduct through any of the following:

• the People & Compliance lead, for matters involving employees, contractors, suppliers or conduct generally;
• the Founder, for matters involving senior management or the People & Compliance lead, or matters of a serious or sensitive nature; or
• the secure reporting channel, a confidential service whose current details are published on epcotec.com and in our internal systems.

If none of these channels is practicable for you, you may make a disclosure to any other "Eligible Recipient" within Epcotec, identifying it as a whistleblower report under this Policy. Eligible Recipients are:

• officers and directors;
• senior managers; and
• an auditor, or a member of an audit team, conducting an audit of Epcotec.

The People & Compliance lead, the Founder and every Eligible Recipient are bound by this Policy, will safeguard your interests, and will protect the integrity of the reporting mechanism.

Written and anonymous reports

You may also report by email to a dedicated confidential mailbox, whose current address is published on epcotec.com, or anonymously by post marked "Private & Confidential" to the People & Compliance lead at our registered office, the address of which is published on epcotec.com.

Anonymity

You may disclose anonymously. An anonymous report can be harder to investigate fully, so we encourage you to share your identity where you feel able to, but the choice is yours. If you do not provide contact details, or consent for us to contact you, we cannot give you feedback on the investigation or tell you what action we have taken in response to your report.

External avenues

Regulators

You may disclose Reportable Conduct directly to the appropriate regulator. In Australia this includes the Australian Securities and Investments Commission (ASIC); in Canada, the applicable federal or provincial regulator. Disclosures to a relevant regulator attract the protections of this Policy. Where practicable and reasonable, you should also notify Epcotec of any such report.

Legal practitioners

You may discuss your concerns with a legal practitioner to obtain legal advice or representation, and the protections of this Policy apply when you do. A legal practitioner may also make a report on your behalf, including where you wish to remain anonymous. In that case we will liaise with the practitioner to conduct the investigation and provide feedback.

Emergencies

If Reportable Conduct poses a real and imminent threat to the health or safety of any person, report it immediately to law enforcement or emergency services. Once the danger has passed, we encourage you to also report the matter through the channels above where appropriate.

Investigation

On receiving a report, the People & Compliance lead (or the Founder, where appropriate) conducts a preliminary review and promptly assigns the matter to the most appropriate person to investigate. The recipient may investigate personally or refer the matter to a senior manager, a member of the people team or, at Epcotec's discretion, an external investigator. Whoever investigates must not be implicated, directly or indirectly, in the report. For a studio of our size, an external investigator is the default where a report concerns senior people or where internal independence would be difficult to demonstrate.

Epcotec will investigate every report as soon as practicable. Investigations are conducted in a fair, independent and timely manner, and all reasonable steps are taken to preserve confidentiality, including de-identifying you where appropriate and practicable.

If your report is not anonymous, the investigator will contact you to discuss the process and any matters relevant to the investigation. If you choose to remain anonymous, your identity will not be disclosed to the investigator or to anyone else, and we will investigate on the information provided. Where possible, we will keep you informed of progress and expected timeframes.

The person against whom allegations are made will be informed of the concerns and given an opportunity to respond, unless there are restrictions or other reasonable grounds for not doing so. To the extent permitted by law, Epcotec may inform you and that person of the findings. The investigation report itself remains the property of Epcotec and will not be shared with you or with the person subject to the allegations.

Protections for people who report

Epcotec is committed to ensuring that anyone who makes a disclosure is treated fairly, suffers no detriment, and has their confidentiality preserved in respect of everything raised under this Policy.

No legal action for reporting

You will not be subject to civil, criminal or administrative legal action, including disciplinary action, for making a disclosure under this Policy or participating in an investigation. Information you provide will not be admissible in criminal or civil proceedings other than proceedings concerning the falsity of that information.

In Australia, these protections reflect the whistleblower protections of the Corporations Act 2001 (Cth); in Canada, analogous protections may arise under the Criminal Code and applicable provincial workplace laws. Whatever the jurisdiction, Epcotec extends the same no-detriment protections voluntarily to every person covered by this Policy.

This Policy is not a shield for bad faith. Deliberately false, disingenuous or time-wasting reports, and reports made to pursue personal grudges, are not protected. Making a report also does not automatically protect a person from the consequences of any improper, unethical or illegal conduct of their own that they report.

No detrimental conduct

Neither Epcotec nor any person engaged by Epcotec will engage in "Detrimental Conduct" against you because you have made a disclosure or participated in an investigation. Detrimental Conduct includes actual or threatened:

• termination of engagement;
• injury to your engagement, including demotion or disciplinary action;
• alteration of your position or duties;
• discrimination, harassment, bullying or intimidation;
• victimisation;
• harm or injury, including psychological harm;
• damage to your property, reputation, or business or financial position; or
• any other damage to you.

We take all reasonable steps to protect you from Detrimental Conduct and will act where such conduct is identified. A person's status or position within Epcotec will not be affected by raising a concern; however, a disciplinary investigation or procedure already underway will not be halted because that person becomes a whistleblower.

If you suffer Detrimental Conduct as a result of disclosing or participating in an investigation, inform the People & Compliance lead, the Founder or an Eligible Recipient. You may also seek remedies including compensation, civil penalties or reinstatement.

Confidentiality

All information received from you is treated confidentially and sensitively. Your identity, or information likely to identify you, will only be shared if:

• you give consent;
• the disclosure is allowed or required by law, for example to a lawyer for the purpose of obtaining legal advice; or
• the concern is reported to a regulator or law enforcement authority as required by law.

Where disclosure of information is necessary for an effective investigation and is likely to lead to your identification, all reasonable steps are taken to reduce that risk. Information you provide, and anything that could identify you, will not be released to anyone not involved in investigating the matter or implementing its findings and recommendations. A small number of situations, such as a threat to life or property, illegal activity or legal action, may make complete anonymity impossible; if your identity must be disclosed in such a case, reasonable steps will be taken before any disclosure.

You are asked to maintain confidentiality in turn, over the information you report and anything provided to you in connection with the report and investigation.

Governance and record keeping

Epcotec keeps a record of all reports made under this Policy and provides periodic reports to the Founder, and to the Board of Directors where one is constituted. These reports cover trends in the number, type and severity of reports, the investigations conducted and the actions taken. Where possible, the identity of the person reporting is not disclosed. The Founder (and the Board, where constituted) decides whether findings of illegal conduct should be disclosed to government, law enforcement or other third parties.

Support available

Employees who make a disclosure under this Policy, and those affected by one, may access Epcotec's Employee Assistance Program, a free and confidential counselling service with contact details in our internal systems. Where appropriate, we may also appoint an independent support person from the people team to handle any ongoing concerns.

In Australia, third-party services such as Lifeline and Beyond Blue are also available; in Canada, the equivalent provincial support services apply. Current contact details for these services are available through their public websites.

Status of this Policy

Any breach of this Policy is taken seriously and may result in disciplinary action, up to and including termination of engagement.

To the extent this Policy imposes obligations on Epcotec, those obligations are not contractual and create no contractual rights. Benefits and entitlements described in this Policy are discretionary and are not intended to be contractual. The terms and conditions intended to be contractual are set out in each person's written engagement contract.

Epcotec may introduce, vary, remove or replace this Policy at any time.

This Policy should be read together with our Code of Conduct and our Grievance Policy.

---

Approved: Eugene Pivnev, Founder & Managing Director, Epcotec

Version 1.2, 2 October 2026