Kaze is committed to the highest standards of integrity and accountability in all its business activities. This policy explains how anyone associated with the company, internally or externally, can raise genuine concerns about suspected wrongdoing, illegal acts, or unethical behaviour. We encourage the reporting of any concerns so they can be properly investigated and addressed.

1. Scope

This policy applies to:

• Internal Stakeholders: All employees, officers, and directors of the company;

• External Partners: Contractors, agency workers, consultants, and temporary staff;

• Other External stakeholders: Any individual regardless of their connection with the company including members of the public, suppliers, partners, and third parties with a business relationship with the company.

2. The Law

The law provides protection for workers who raise legitimate concerns about specified matters. These are called "qualifying disclosures". A qualifying disclosure is one made in the public interest by a worker who has a reasonable belief that:

• a criminal offence

• a miscarriage of justice

• an act creating risk to health and safety

• an act causing damage to the environment

• a breach of any other legal obligation; or

• concealment of any of the above

is being, has been, or is likely to be, committed. It is not necessary for the worker to have proof that such an act is being, has been, or is likely to be, committed - a reasonable belief is sufficient. The worker has no responsibility for investigating the matter - it is the company's responsibility to ensure that an investigation takes place.

Reports must be made in good faith and in the public interest.

A worker who makes such a protected disclosure has the right not to be dismissed, subjected to any other detriment, or victimised, because they have made a disclosure.

The company encourages workers to raise their concerns under this procedure in the first instance. If a worker is not sure whether to raise a concern, they should discuss the issue with their line manager or a Director depending on the nature of the disclosure..

3. Beyond the law

Whilst the UK Public Interest Disclosure Act 1998 only offers legal protections to workers, Kaze aligns to the EU Whistleblowing directive best practice, so encourages qualifying disclosures from any individual regardless of their connection to the company. Any disclosure from a non-worker made in good faith will be treated with the same level of seriousness, confidentiality and respect.

4. Principles

Everyone should be aware of the importance of preventing and eliminating wrongdoing. Workers should be watchful for illegal or unethical conduct and report anything that they become aware of.

Any matter raised under this procedure will be investigated thoroughly, promptly, and confidentially. The outcome of the investigation will be reported back to the individual who raised the issue, unless the disclosure was made anonymously.

No one who raises a matter under this procedure will suffer any form of detriment, victimisation or retaliation.

Internal Stakeholders

For workers, this means that the continued employment and opportunities for future promotion or training of the worker will not be prejudiced because they have raised a legitimate concern. Victimisation of a worker for raising a qualified disclosure will be a disciplinary offence.

Employees who require support after whistleblowing have access to our Employee Assistance Programme. Details of this can be found in the Health & Wellness Initiatives Policy.

If misconduct is discovered as a result of any investigation under this procedure the company's disciplinary procedure will be used, in addition to any appropriate external measures. Employees will be subject to disciplinary measures should they:

• Victimise a worker for raising a qualified disclosure

• Maliciously make a false allegation

• Cover up wrongdoing or instruct someone to do so

• Pressure an employee not to pursue a concern

The Employee Handbook details the Kaze disciplinary procedure.

If an employee is told not to raise or pursue any concern, even by a person in authority such as a manager, workers should not agree to remain silent. They should report the matter to a director.

This procedure is for disclosures about matters other than a breach of an employee's own contract of employment. If an employee is concerned that their own contract has been, or is likely to be, broken, they should use the company's grievance procedure detailed in the Employee Handbook.

External Stakeholders

In addition to protection from victimisation and retaliation, external stakeholders will be protected from detriment if they raise a concern. This means we will make reasonable effort to ensure that they will not be disadvantaged in any commercial dealings with the company.

5. How to raise a concern

Concerns may be raised through any of the following routes:

Internal Stakeholders

• Directly to their line manager,

• or in the event that this would not be appropriate, a Director,

• or via the Anonymous Reporting Form on SharePoint

External Stakeholders

• By email to: hello@kaze-consulting.com,

• In writing to the Company Secretary at the company registered address, marked ‘Private and Confidential – Whistleblowing’ (this can be done so anonymously if desired).

• Where concerns involve Kaze senior leadership, the investigation will be passed to our independent HR Business Partner. Contact details can be provided in advance of submitting a concern by a request to hello@kaze-consulting.com.

If anyone reasonably believes that the appropriate action has not been taken, they should report the matter to the proper authority. The legislation sets out several bodies to which qualifying disclosures may be made. These include:

• HM Revenue & Customs. o the Financial Conduct Authority (formerly the Financial Services Authority).

• the Competition and Markets Authority.

• the Health and Safety Executive. o the Environment Agency.

• the Independent Police Complaints Commission; and

• the Serious Fraud Office.

6. Investigation Process

Stage Acknowledgment of Receipt

Description Issue is logged and acknowledged to the reporting person where contact details were provided.

Timescale 5 working days from sending

———

Stage Initial Assessment

Description Issue is triaged to decide whether the issue qualifies as a whistleblowing concern. If it is not accepted as a valid whistleblowing concern under the scope of this policy, then the matter may still be investigated at the discretion of the Managing Director. If it is accepted as a valid whistleblowing concern, we will assign an impartial investigator and determine the scope of the investigation. At the end of this stage, the reporting person will be informed of the outcome and associated timescales of the investigation where relevant.

Timescale 5 working days from acknowledgement of receipt

———

Stage Full Investigation

Description Issue is investigated thoroughly and promptly. Straightforward cases may conclude quickly, complex cases may take longer. Timely updates will be provided to the reporting person, especially where more time is needed.

Timescale Usually 20-30 working days from initial assessment

———

Stage Notification of Outcome

Description The reporting person will be provided a summary of findings and, where appropriate, what remedial actions are being taken.

Timescale Usually 5-10 working days from conclusion of investigation

The company will ensure that investigations are conducted impartially. This means steps will be taken to ensure the allocated investigator is not involved in the issue reported or have a significant conflict of interest, and, where necessary, investigations will be conducted by an independent third party.

To ensure confidentiality throughout the process, we will operate on a need-to-know basis and store information related to the report securely.

7. Malicious or Vexatious Reports

Reports made in genuine good faith and public interest will not attract any penalty. Anyone who is proven to have knowingly made a false or malicious allegation may be subject to disciplinary or contractual consequences.

8. Review

This policy will be reviewed annually to ensure it remains effective, fair, and aligned with legal and regulatory requirements.

9. Data Protection

Personal data will be collected, stored and documented in accordance with our Data Privacy Policy which is in accordance with Data Protection Act 2018 and UK GDPR. We may process personal data relating to whistleblowing and complaints on the basis of legal obligation and/or legitimate interests.

If individuals wish to withdraw consent for us to hold personal data they may contact hello@kaze consulting.com.

10. Retention

Category Unsubstantiated or unfounded whistleblowing reports

Retention Period 3–6 years after closure

Rationale Allows defence against potential employment tribunal claims (limitation period + buffer) and supports audit trail, while not holding data longer than necessary

———

Category Substantiated or upheld cases

Retention Period 6–10 years after closure

Rationale Aligns with potential legal proceedings (e.g., employment law or civil claims, often up to 6 years), regulatory reviews, and corporate recordkeeping requirements.

———

Category Serious or high-risk cases (e.g. involving criminal conduct, regulatory breaches, or safeguarding)

Retention Period 10+ years, or in line with legal/regulatory retention requirements

Rationale Necessary to meet obligations under sectoral laws (e.g., FCA, PRA, NHS, public sector) and for evidential purposes.

———

Category Anonymous reports with no identifying data

Retention Period Retain only as long as operationally necessary, then delete

Rationale As the data doesn’t contain personal identifiers, it can be retained for trend analysis or learning as long as is operationally necessary.