Hamburger Hafen und Logistik : Rules of Procedure Whistleblower System

Rules of procedure

for the whistleblower system of

Hamburger Hafen und Logistik Aktiengesellschaft (HHLA)

Rules of procedure

TABLE OF CONTENTS

1 PROVIDING INFORMATION

HHLA's business activities are based on integrity, fairness, respect, sustainability and transparency. The whistleblower system of HHLA is an important component of HHLA's compliance management system and serves to detect and eliminate potential breaches of the law and violations of internal guidelines at HHLA and along the associated supply chains. Employees and concerned third parties as well as other stakeholders can report violations as part of HHLA's whistleblower system.

The whistleblower system is available in particular to receive information regarding potential violations within the HHLA Group or along the associated supply chains:

• Information on potential breaches by employees of the HHLA Group of applicable laws (in particular breaches of EU law in accordance with EU Directive 2019/1937 ("EU Whistleblower Directive"))
• Information on potential breaches by employees of the HHLA Group of internal company guidelines (e.g. violations of HHLA's Code of Conduct or HHLA's Supplier Code of Conduct)
• Information on potential violations of obligations related to human rights or the environment in accordance with the German Supply Chain Due Diligence Act (Lieferkettensorgfaltspflichtengesetz, LkSG) within HHLA's own business activities or those of HHLA's direct or indirect suppliers

Rules of procedure

Update: 04/2024

Version: 1.1

• Information on potential risks related to human rights or the environment in accordance with LkSG within HHLA's own business activities or those of HHLA's direct or indirect suppliers

2 REPORTING CHANNELS FOR WHISTLEBLOWERS

HHLA has established different channels to report tips and information. HHLA's foreign subsidiaries have also published additional compliance contact addresses for the event that whistleblowers only want to contact the respective local compliance officer.

In particular, HHLA has set up the digital HHLA whistleblower portal (BKMS® System) to identify and combat potential breaches of the law and violations of internal guidelines. It is available to all internal and external stakeholders who wish to report potential compliance risks and violations digitally and anonymously (optional). Reports can be submitted at any time via a secure application provided by a specialised provider:

• HHLA whistleblower portal:https://www.bkms-system.com/hhla

The HHLA whistleblower portal (BKMS® System) offers whistleblowers the opportunity to submit their report digitally and optionally anonymously and to communicate with the local HHLA compliance contact person of the respective subsidiary (if available) or the central HHLA Compliance Department without disclosing their identity. The content is processed exclusively by the central HHLA Compliance Department and/or the local compliance officers. Whistleblowers can decide whether and which contact details they wish to provide or whether they wish to remain anonymous. It is ensured that the identity of whistleblowers is reliably protected and not disclosed to HHLA or third parties if this is requested by the whistleblower.

Information can be provided via the following reporting channels:

• Email:compliance@hhla.de
• Compliance Hotline: +49 40 3088 3777
• Postal address: Hamburger Hafen und Logistik Aktiengesellschaft, Group Compliance Officer, Bei St. Annen 1, 20457 Hamburg
• Personal meeting: Appointments to be arranged via the channels mentioned above

Rules of procedure

Update: 04/2024

Version: 1.1

3 PRINCIPLES OF THE PROCEDURE

3.1 CONFIDENTIALITY AND DATA PROTECTION

The reporting channels are designed so that the identities of the whistleblowers - as long as they choose to remain anonymous - and third parties mentioned in the report are always confidential and that unauthorised employees have no access to that information. The employees of the HHLA Compliance Department are bound to confidentiality and work impartially. They review the issue and, if needed, carry out the further clarification of the specific case.

When reviewing possible violations in accordance with LkSG, the human rights officer who is also based in the central Compliance Department will play a central role in the process.

As part of the whistleblower system, HHLA only processes personal data based on the applicable data protection statutory requirements found mainly in the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). Further information on data protection within the context of HHLA's whistleblower system can be found here: Data protection information HHLA whistleblower system.

3.2 PROTECTION FROM REPRISALS AND FAIRNESS

Whistleblowers who report information in good faith are protected from negative consequences and reprisals. Therefore, unfair intentions resulting from reports will not be tolerated and will be prosecuted consistently. When clarifying information on violations, all people involved will be treated fairly.

3.3 TRANSPARENCY AND FEEDBACK

HHLA ensures the adequate briefing of whistleblowers - provided that this is legally possible (especially in terms of data protection legislation) - regarding the further steps and measures after receiving information on possible violations. As long as whistleblowers provide their contact information, the receipt of the information will be confirmed within seven days upon receipt. Over the further course of the process, it will be possible for whistleblowers to provide further information regarding the matter at hand and to come into contact with the office in charge of reviewing the case as part of a joint discussion. The HHLA whistleblower portal (BKMS® System) offers the possibility of an anonymised exchange with the whistleblower via a protected mailbox. Furthermore, in the event of

Rules of procedure

Update: 04/2024

Version: 1.1

concrete suspicion of violations, it will be ensured that the appropriate remedial measures are adopted in order to immediately eliminate the risks or violation and that measures to prevent or avoid it from happening again are introduced. Whistleblowers will be appropriately informed of these planned or adopted follow-up measures - provided that this is legally possible (especially in terms of data protection legislation) - within an adequate period - at most within three months or six months if required by the special circumstances of the case. If the review of a case does not lead to any concrete initial suspicion, the investigation will be stopped and the whistleblower informed in an appropriate manner.