Introduction 

These terms & conditions are based on the requirements of the German Supply Chain Due Diligence Act in relation to the Grievance Procedure (§8 LkSG) and the BAFA suggestions accessible here. Adhering to these terms & conditions can help companies establish a Grievance Mechanism in compliance with the German Supply Chain Due Diligence Act. 

In order to use WhiteBox, companies must adhere to the following terms & conditions: 

1. Grievance Procedural Rules

Establish easily understandable procedural rules in a written format that are publicly accessible and linked to in your profile page on WhiteBox.  

The grievance procedure policy should include: 

• Listing and description of complaint channels.
• Complaint procedure, time- line and frame. 
• If offered by your organisation; description of the amicable dispute resolution.
• Relevant contact persons and departments.
• How protection against discrimination is achieved, the rights of the reporting party in relation to protection against discrimination or punishment due to the grievance procedure or the use of other formal complaint procedures.

2. Accessibility & Promotion 

Promote the procedure with employees, employees of suppliers, and other relevant stakeholders identified in your risk analysis, with measures such as:  

• visible links from company websites,  
• targeted ad campaigns on appropriate platforms, 
• collaboration with local stakeholder representatives, 
• informational resources at own worksites and those of suppliers, and 
• relevant clauses in the Supplier Code of Conduct. 

3. Swift handling of reports

Upon receipt of a report, the company will do its best to commence with the procedure on the platform within 7 days, and aim to complete the procedure without delay.

4. Communication of reporting parties

The individuals appointed by the company to conduct the procedure must communicate with the reporting party to discuss the facts, ideally through the relevant section on the platform.  

5. Process for amicable resolution

Your organisation may propose a process for an amicable resolution. If this is the case it should be described in your grievnace procedure policy, or in a seperate policy that is linked to in the grievance procedure policy. 

6. Conditions for staff

6.1 Impartial action 

Companies must create the structural conditions for impartial action: Those entrusted by the company with the conduct of the procedure must act impartially. This means they must demonstrate independence and be free from binding instructions. 

6.2. Confidentiality

Staff handling reports or with access to WhiteBox are obligated to maintain confidentiality throughout the process. For example, by means of a contractually anchored protection against dismissal as well as the anchoring of the independence from instructions in the employment or service contract. 

6.3. Appropriate training & sufficient time  

The people involved should be appropriately trained and have sufficient time resources to understand and assess the situation and the procedure from the perspective of the whistleblowers and to be able to process it further in the procedure. 

7. Confidentiality (in general)

In the procedure, precautions must be taken to ensure the confidentiality of the identity of persons providing information and the protection of their personal data.  

8. Protection from reprisals

Companies must define and communicate what measures they will take to protect reporting parties from being discriminated against or penalized for using a grievance procedure. For example, companies can commit to not tolerating retaliation for complaints or tips and outline specific consequences that employees or suppliers can expect if reporting parties are subjected to retaliation. It is recommended to stay in contact with the whistleblower even after the process has been completed to ensure that he or she is not subsequently put at risk by retaliation. 

9. Review of effectiveness

The company must review the effectiveness of the complaint procedure at least once a year and additionally on an event-driven basis. This is required if the company anticipates a significant change or expansion in risk within its own operational area or with its immediate supplier, such as through the introduction of new products, projects, or a new business field. Immediate repetition of these measures is required if deemed necessary. 

10. Account information & security

Your organisation is responsible for:  

1. Keeping up to date information for your account settings. This includes company information, information on suppliers and business customers using WhiteBox, staff access, and policies. 

2. Keeping access to accounts secure, in particular passwords secret.