Whistleblowing

Information on the Procedure and Conditions for Submitting Reports under the Act on Protection of Persons, Reporting Information, or Publicly Disclosing Information about Breaches (Whistleblowers Protection Act)

Activities for which reports can be submitted under Whistleblowers Protection Act

Reports under Whistleblowers Protection Act may be submitted regarding violations of Bulgarian legislation or the acts of the European Union specified in the law, in the areas under Article 3 of the Law, related to the activities of “ProCredit Bank (Bulgaria) EAD.”

One of our core principles is to build mutual trust between the bank and its clients. The transparency policy we follow in our relationships helps establish high ethical standards, contributing to a stronger and more successful institution. Therefore, we encourage reporting suspicions of professional misconduct, violations of Bulgarian law or EU acts, internal rules, the Bank’s Code of Conduct, or other unethical or illegal actions.

By reporting professional violations, every whistleblower acts responsibly and honestly. The Bank treats shared information confidentially and will conduct an investigation.

Persons who may submit reports

Employees of the Bank, contractors under civil contracts, shareholders, members of the management or supervisory board, members of the audit committee, interns, job applicants who participated in a competition or other form of recruitment and obtained information about a violation in that capacity, persons working for the Bank’s suppliers, and any other whistleblower who reports a violation known to them in a work-related context, including persons under Article 5 of Whistleblowers Protection Act.

Methods for internal reporting of violations

• On paper, by personal delivery or by mail/courier to: Head Office of ProCredit Bank (Bulgaria) EAD, 26 Todor Alexandrov Blvd., Sofia 1303
• By email: ethic_signals@procreditbank.bg – email for reporting violations to ProCredit Bank (Bulgaria) EAD
• In person: at the Head Office of ProCredit Bank (Bulgaria) EAD, 26 Todor Alexandrov Blvd., Sofia 1303

The report should include your personal details and may be accompanied by any documents related to your allegations, as well as information about persons who could confirm your statements. You may use the sample form provided by the Commission for Personal Data Protection, available here: https://cpdp.bg/wp-content/uploads/2025/06/ZZLPSPOIN_Formuljar-za-registrirane-na-signal_02.06.20252.pdf or submit the report in free text. Anonymous reports are not considered.
Regardless of the chosen reporting method—via the sample form or in free text—the whistleblower must sign the report. Otherwise, it will be considered anonymous and will not be reviewed.

Methods for external reporting

External reporting to the Commission for Personal Data Protection:

• In writing: by email to whistleblowing@cpdp.bg;
• By mail/courier at the address: Sofia, 1592, blvd. "Prof. Tsvetan Lazarov" No 2.
• In person at the Commission for Personal Data Protection at the address: Sofia 1592, blvd. "Prof. Tsvetan Lazarov" No 2.

Required data for registering a report of violation

Reports must contain at least the following information:

• Full name, address, and phone number of the whistleblower, as well as an email address, if available;
• Name of the person against whom the report is filed and their workplace, if the report concerns a specific person and this is known;
• Specific details of the violation or real risk of such occurring, location and period of the violation, if committed, description of the act or circumstances, and other relevant facts known to the whistleblower;
• Date of submission;
• Signature, electronic signature, or other identification of the whistleblower.

Upon receipt of each report, confirmation is sent to the whistleblower within seven days. If irregularities are found, they are communicated to the whistleblower, and a deadline for correction is set. Additional data and documents may be requested to clarify all facts and circumstances.

No action is taken on anonymous reports or reports concerning violations committed more than two (2) years before the submission date. After completing the review process, but no later than three months from receipt, the whistleblower is informed of the actions taken.

Please note

• The process for reporting legal and ethical violations differs from submitting complaints about products, services, and customer service. If you wish to file a complaint about a product or service, you can do so via the email address listed on the website or by contacting our Contact Center: *7000 / 0700 1 70 70 / +359 700 1 70 70 (for calls from abroad). Reports concern the above-mentioned legal violations, while complaints relate to dissatisfaction with products, services, and customer service.
• Reports that do not fall within the scope of Whistleblowers Protection Act and whose content does not provide grounds to be considered credible will not be reviewed.
• If the report does not meet the legal requirements for submission, the whistleblower will be notified to correct the irregularities.
• Reports are processed in compliance with confidentiality obligations, and all measures are taken to protect the information received and the identities of whistleblowers and affected persons. Any processing of personal data is carried out in accordance with the General Data Protection Regulation and national legislation. Personal data that is clearly irrelevant to the review of the specific report is not collected.

This informational material is not exhaustive and aims to provide general clarifications on the Law on the Protection of Persons, Reporting Information, or Publicly Disclosing Information about Breaches (Whistleblowers Protection Act) is available on the official website of the Commission for Personal Data Protection at: www.cpdp.bg.