Whistleblowing Alert Procedure

A "Whistleblower" is an individual who reports or discloses, without direct financial compensation, and in good faith, information concerning a Breach (as defined in article 3 below).

A Whistleblower may make his or her Alert within or outside the scope of his/ her professional activity. If the information has not been obtained in the course of professional activities, the Whistleblower must have personal knowledge of the facts. In any case, he/she must belong to one of the following categories of persons:

• 3DS employees: managers, employees and trainees of 3DS, whatever their function, hierarchical position or place of work, whether they are in the process of being recruited or have already been recruited (on condition that the information has been collected as part of the application process), whether they work full time or part time, on permanent or fixed-term contracts;
• Former 3DS employees, provided that the information was collected in the context of this relationship;
• External and occasional contractors/employees of 3DS, in particular service providers to whom a @3ds.com address has been assigned, whatever their mission and whether or not they are in the process of negotiating their contract;
• 3DS contractors and their subcontractors who are natural persons, or in the case of legal entities, members of their administrative, management or supervisory bodies, as well as members of their staff;
• Shareholders and holders of voting rights at the 3DS General Meeting;
• Members of the administrative, management or supervisory bodies of 3DS.

3DS undertakes to process any alerts, even those made by persons others than those above.

Use of this Whistleblowing Alert Procedure is neither mandatory nor exclusive.

Alerts may be made by any means. Whether received within or outside the framework of this Procedure, 3DS will treat all alerts it receives by applying the confidentiality and non-retaliation principles provided in this Procedure. (See article 5).

In certain countries, a whistleblower can simultaneously or alternatively send a Whistleblowing Alert to external authorities, as may be designated by law of the applicable country.

Please refer to Appendix B of this Whistleblowing Alert Procedure for details of country-specific whistleblowing provisions.

If he or she considers it justified, any Whistleblower with knowledge of:

• Conduct or situations likely to constitute a breach of the Code of Business Conduct, in particular acts of corruption or influence peddling, as described in the 3DS Code of Business Conduct and Anti-Corruption Policy;
• A criminal offence, a violation (or attempted concealment of a violation) of the law or regulations or of an international commitment ratified or approved by France or of European Union law,
• A threat or harm to the public interest ;
• Risks of serious violations of human rights and fundamental freedoms, human health and safety rules, or harm to the environment;

(hereinafter "Breaches", or individually a "Breach")

may report, in good faith and without direct financial compensation, such Breach in accordance with the Whistleblowing Alert Procedure set forth herein (hereinafter an “Alert").

Certain facts cannot be reported if they are covered by:

• Secrets of National defense and security ,
• Protected or classified information,
• Information in judicial deliberations,
• The confidentiality of an investigation or judicial inquiry,
• Attorney-client privilege
• Medical confidential information.

4.1 Who should I contact to make a Whistleblowing Alert?

Any Whistleblower wishing to alert 3DS of a Breach may send his/her Report, together with any information and/or documents supporting the Alert, to the 3DS Business Ethics & People Ethics managers[3] (together the "Reporting Officers"):

• Preferably in writing
- by e-mail to: people.ethicscommittee@3ds.com
- or by completing an online webform for the Dassault Systèmes Ethics Committee available on the following link

• Or orally
- by leaving a telephone voice message on a dedicated voicemail
- or through an in person meeting[4].

Please, refer to Appendix C to find the number of the voice mail pertaining to your country.

Only Reporting Officers have access to the mailbox and voicemail. They act in the name and on behalf of the 3DS Ethics Committee.

In the event that the reported Breach involves one or more Reporting Officers, the Whistleblower may contact by email the Chairman and CEO of 3DS, who will refer the matter directly to the 3DS Ethics Committee, whose mission is to ensure compliance with the values of 3DS, as described in the Dassault Systèmes Code of Business Conduct.

In certain countries, Whistleblowers may alternatively have the right to use local channels to make an Alert. Please, refer to Appendix B of the Whistleblowing Alert Procedure to find details of your country specific whistleblowing provisions.  

4.2 What are good reporting practices? How to report effectively?

To facilitate efficient processing of Alerts, a Whistleblower is strongly advised to:

• Identify herself/himself,
• Indicate whether he/she is acting in a professional capacity, specifying whether he/she falls in the category of the persons listed above (see paragraph 1 "Who can be a Whistleblower?") and, if not, whether he/she has personal knowledge of the alleged facts,
• Describe the situation accurately, providing objective facts, dates and names of people involved,
• Present factual evidence (e.g. reports, documents, correspondence) helping to verify the alleged facts, so that a thorough investigation can be carried out and any slanderous actions discouraged.

The wording used to describe the alleged facts must honestly reflect the alleged facts as well as any elements of uncertainty.

Subsequently, exchanges between the Whistleblower and the Reporting Officers will take place by email and/or telephone contact, 3DS internal instant messaging and/or other means available on the 3DEXPERIENCE platform. The Reporting Officers may also propose meetings, including remote meetings by videoconferencing.

4.3 Can Whistleblowing Alerts be anonymous?

Alerts may be anonymous. However, anonymous Alerts are not encouraged insofar as they make it difficult to carry out a thorough investigation in order to establish the facts and organize the protection of the Whistleblower.

5.1 3DS guarantees confidentiality

3DS guarantees the confidentiality and integrity of the information collected within the framework of a Whistleblower alert, in particular the identity of the Whistleblower.

3DS undertakes to keep the identity of a Whistleblower confidential.

Except with the express consent of the Whistleblower, his/her identity (or elements enabling his/her identification) will only be communicated to persons specifically responsible for the processing of Alerts within 3DS (in particular investigations and their follow-up) and under the condition that this communication is necessary for the processing of the Alert. These persons are bound by a strict confidentiality obligations under the terms of the Charter of the Dassault Systèmes Ethics Committee.

3DS also undertakes to keep confidential and to guarantee the integrity of the information collected in the context of an Alert, as well as:

• The identity of the persons targeted by the Whistleblowing Alert,
• The identity of any third party mentioned in the Alert.

The identity of the Whistleblower (or elements that would enable him/her to be identified) and the identity of the person targeted (or elements that would enable him/her to be identified), may always be communicated by 3DS to a judicial authority. The Whistleblower is then informed, unless this information could compromise the legal proceedings.

5.2 3DS formally prohibits all retaliatory measures

Retaliation is strictly prohibited. A Whistleblowing Alert cannot give rise to retaliatory measures.

3DS prohibits any form of retaliation, including attempted retaliation, against any Whistleblower who files a Whistleblowing Alert in good faith.

A retaliatory measure may include, for example: (i) being excluded from a recruitment process or from access to an internship or a period of professional training, (ii) being punished or dismissed, or (iii) being subjected to coercion, intimidation, harassment, ostracism or reputation attacks on social media, or (iv) being subjected to a discriminatory measure, direct or indirect, in particular with regard to remuneration, profit-sharing measures or the distribution of shares, training, reclassification, assignment, qualification, classification, professional promotion, transfer or renewal of contract. Depending on the facts and circumstances, acts of moral harassment may also constitute retaliation.

As this Whistleblowing Alert Procedure is not mandatory, 3DS also prohibits sanctions or retaliatory measures against persons who file an Alert outside of this Whistleblowing Alert Procedure.

Improper or bad faith use of the Whistleblowing Alert Procedure or of a whistleblowing alert (for the sole purpose of harming the interests of an Employee or of 3DS in particular) may expose its initiator to disciplinary sanctions as well as legal proceedings.

In some countries, individuals who help a Whistleblower to file a Whistleblowing Alert ("facilitators") are protected under the conditions laid down by applicable law, in particular against retaliation. Country-specific provisions are listed in Appendix B of this Procedure.
 

Alerts are analyzed impartially, with the utmost care, and are subject to verification, investigation if appropriate, and any action deemed necessary, in compliance with applicable law and regulations.

Reporting Officers may request additional information from the Whistleblower to assess the accuracy of the allegations made.

Alerts are handled by the Reporting Officers under the authority of the Dassault Systèmes Ethics Committee.

The Dassault Systèmes Ethics Committee meets once a month. Its members are, as of the date of this Procedure, the Company Secretary, the Human Resources Director, the Legal Director, the Internal Audit Director, the Director in charge of People Ethics, the Director of Business Ethics and Compliance, and the Group Compliance Officer.

The Committee ensures compliance with the rules set out in the Code of Business Conduct, and is tasked with systematically investigating events of non-compliance with the Code of Business Conduct brought to its attention, in particular through the Whistleblowing Alert Procedure.

Ethics Committee:

• Is informed of any breaches of 3DS's specific ethics and compliance policies, recommendations and processes,
• Examines the action plans implemented,
• In the case of complex management issues or local conflicts of interest, conducts and defines and monitors these plans before issuing its conclusions and recommendations to the 3DS 's operational organizations.

The Ethics Committee is informed when an investigation is closed if the allegations are inaccurate or unfounded, or if the Alert has become irrelevant.

7.1 The Whistleblower is informed of the receipt of his/her Alert, in writing, at the latest within seven (7) working days of such receipt.

If the Alert is deemed inadmissible or cannot be processed for lack of details, the Whistleblower is informed by e-mail of the reasons why 3DS cannot follow up.

When it is possible to follow up on the Alert, the Whistleblower is informed, in writing, of the action taken upon receipt of the Alert in order to assess the accuracy of the allegations and, where appropriate, to remedy the subject of the Alert, at the latest within a period not exceeding three (3) months from acknowledgement of receipt of the Alert.

These time limits do not apply to anonymous Alerts.

In the case of anonymous Alert, the Whistleblower receives this information only if he/she has provided a contact email or address to write to.

7.2 The person who is the subject of the Alert is informed of the existence of an Alert concerning him or her and of the processing of his or her personal data in this context within a reasonable period of time, in principle one (1) month from the processing of the Alert. However, this information may be deferred when it is likely to seriously compromise the achievement of the objectives of the processing of the Alert, as in the case of a risk of destruction of evidence. In this case, the information will be provided as soon as the risk has been eliminated, in particular during the first interview with the person concerned or, failing that, at the latest at the end of the processing of the Alert. Except with the express consent of the Whistleblower, the information will not contain any information relating to his or her identity.

7.3 Persons involved in the collection or processing of the Alert (in particular witnesses) will be informed of the processing of their personal data as soon as possible and at the latest at the time of the first contact.

7.4 Once the Alert has been processed, the Whistleblower will be informed by e-mail that the procedure has been closed.

If a disciplinary sanction or legal proceedings are instituted against the person concerned as a result of the Alert, the latter may obtain access to this information in accordance with the rules of common law.

Personal data collected in the context of this Whistleblowing Alert Procedure are processed by 3DS as the data controller.

This personal data will only be communicated (i) to the Reporting Officers, (ii) to persons specifically responsible for the management of Alerts within 3DS (in particular investigations and their follow-up) and on condition that this communication is necessary for the processing of the Alert, and (iii) to the competent authorities having the right to request the communication of this data.

A detailed explanation of how 3DS protects your personal data can be found in Appendix A of the Procedure.

How is Personal Data protected in the context of this Whistleblowing Alert Procedure?

The personal data collected in the context of this Whistleblowing Alert Procedure are processed by 3DS as the data controller.

This personal data will only be communicated (i) to the Reporting Officers, (ii) to persons specifically responsible for the management of Alerts within 3DS (in particular investigations and their follow-up) and on condition that this communication is necessary for the processing of the Alert, and (iii) to the competent authorities having the right to request the communication of this data.

1. Who is concerned by the protection of personal data?
   
   As part of this Whistleblowing Alert Procedure, 3DS will collect and store the personal data of the following persons (the "Data Subjects"):
   
   • The authors of the Whistleblower Alert ;
   • The people targeted by the Alert;
   • Persons involved in the collection or processing of Alerts, in particular witnesses, facilitators and third parties in contact with Whistleblowers.
    
2. What personal data is collected? 
   
   Personal data collected as part of the Whistleblowing Alert Procedure may include:
   
   • The identity, function and contact details of the Data Subjects,
   • Reported facts and information gathered in the course of verifying reported facts,
   • Reports on verification operations and action taken on Alerts.
   
   In view of the nature of the processing and depending on the nature of the Alert, 3DS may also collect sensitive personal data within the meaning of the applicable Personal Data Protection Regulations.
   
   For this reason, 3DS has carried out a Data Protection Impact Assessment (DPIA) to ensure that the said processing presents all the appropriate guarantees to safeguard the rights and freedoms of the Data Subjects. This impact analysis has been assessed and validated by the 3DS Data Protection Officer.
   
   In accordance with the principle of minimization, 3DS ensures that only the data necessary for the purposes of processing is actually collected and processed, reminding the authors of Alerts that the information communicated within the framework of the Whistleblowing Alert Procedure must remain factual and present a direct link with the subject matter of the Alert.
    
3. How long does 3DS keep personal data?
   
   Personal data is retained by 3DS for the duration of the processing of the Alert, without prejudice to legal retention obligations and statute of limitation periods.
   
   As a general rule, Alerts may only be kept for as long as is strictly necessary and proportionate for their processing and for the protection of the Whistleblower, the persons they concern and the third parties they mention, taking into account the time required for any further investigations. More specifically, the personal data of Data Subjects are kept:
   
   • in active base for a reasonable period after receiving the Alert until the final decision is made on the follow-up of the Alert;
   • in the form of intermediate archives (i.e. archives accessible by authorized persons only, on a need-to-know basis related to their functions) after the final decision has been taken, for a reasonable period, strictly proportionate to their processing and to the protection of the Whistleblower, the persons they concern and the third parties they mention, taking into account the deadlines for any additional investigations.
   
   When the Alert is followed up, in particular by disciplinary proceedings or legal action against the targeted person or the perpetrator of an abusive Alert, the data relating to the Alert is kept until the end of the legal proceedings, the statute of limitations or the expiration of legal remedies.
   
   Archives are kept in accordance with the general archive retention policy applied within 3DS, for a period not exceeding, in all cases, the duration of legal proceedings.
    
4. What are the purposes of personal data processing by 3DS?
   
   The personal data collected as part of the Whistleblowing Alert Procedure is used solely for the purposes of processing the Alert (receive and process the Alert, manage checks, investigations and analyses, define the follow-up of the Alert, as well as protect the Data Subjects as provided for by this procedure), and defend or exercise right before any jurisdiction in order to comply with applicable legal obligations and/or the legitimate interest of 3DS.
    
5. How does 3DS manage the transfer of personal data?
   
   For the purposes of verifying or investigating Alerts, personal data processed may be transferred to countries where 3DS is present; the list of these countries is regularly updated and accessible on the following page of the 3DS website.
   
   In order to guarantee a sufficient level of protection for transfers to countries that are not considered by the authorities of the Data Subject's country (e.g. the European Commission) as offering an adequate level of protection of personal data, the transfer will be based on guarantees recognized by the authorities of the Data Subject's country as offering adequate protection of personal data (e.g. standard contractual clauses issued by the European Commission, or any other relevant mechanism). Data Subjects may request more information about the mechanism used by 3DS to transfer their personal data by sending a request directly via the following form.
    
6. What are the rights of data Subjects?
   
   In accordance with applicable regulations on the protection of personal data, all Data Subjects have the right to access, rectify and restrict the processing of their personal data.
   
   The right of access may be limited according to the person exercising it, the stage of the investigation and the risks of identifying the Whistleblower.
   
   The right of rectification may only concern factual data, the material accuracy of which can be verified by 3DS on the basis of evidence, and without deleting or replacing the data, even if erroneous as originally collected. However, in accordance with applicable regulations on the protection of personal data, Data Subjects may not exercise their rights to the erasure, opposition and portability of their personal data insofar as their processing in application of the present Procedure is necessary to comply with legal obligations to which 3DS is subject.
   
   All these rights may be exercised by sending a request via the following contact form. Data Subjects also have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL).
    
7. Who do I contact if I have questions about my personal data?
   
   Any interested party may contact the 3DS Data Protection Officer by sending a request via the following contact form.

The provisions of this appendix B set out the specific features of Whistleblowing Alerts rules on a country-by-country basis.

FRANCE

External reporting procedures

• The whistleblower may send an external alert, either after having sent an internal alert, or directly to the competent authorities among those designated by Decree no. 2022-1284 of October 3, 2022 relating to the procedures for collecting and processing alerts issued by whistleblowers and establishing the list of external authorities instituted by Law no. 2022-401 of March 21, 2022 aimed at improving the protection of whistleblowers.
• This appendix to the Decree lists the competent authorities by subject matter. It is available here.

Facilitators

• In France, facilitators, who also benefit from protection, should be understood as any natural person or non-profit legal entity under private law (e.g. a trade union or an association) who helps a Whistleblower make his or her Alert.

You will find these phone numbers by clicking on the following link where you can leave a message on the voicemail corresponding to your country, on which you can make an alert.

[1] These include the French law n°2016-1691 of December 9, 2016 relating to the fight against corruption ("Loi Sapin 2"); Law n° 2017-399 of March 27, 2017 relating to the duty of vigilance of parent companies and ordering companies ("Duty of Vigilance") and Law n° 2022-401 of March 21, 2022 aimed at improving the protection of whistleblowers ("Waserman Law") transposing into French law Directive 2019/1937 of October 23, 2019 on the protection of persons who report violations of Union law, more commonly known as the Whistleblowers Directive, and its implementing decree no. 2022-1284 of October 3, 2022.

[2] Dassault Systèmes means Dassault Systèmes S.E. and all persons and entities under the direct or indirect control of, or under common control with, Dassault Systèmes S.E., whether such control is exercised by a management authority, by an equity interest or otherwise.

[3] Ethics and compliance officers

[4] The Whistleblower may also request a physical interview or videoconference with a Reporting Officer to address his or her Alert. In all cases, an oral report must be recorded with the Whistleblower's consent. In the absence of consent to recording, the Whistleblower will be invited to submit his/her Alert in writing.