1. Purpose
TestMu is committed to the highest standards of integrity, transparency and accountability in everything it does. Speaking up about suspected misconduct protects the Company's ethical culture, its people and its customers, and supports compliance with applicable laws, regulations and internal policies.
This Whistleblower Policy establishes a safe, confidential and clearly signposted mechanism through which employees and other stakeholders can report concerns about unethical conduct, legal violation or breach of Company policy. TestMu encourages everyone to raise concerns without fear of retaliation and is committed to assessing each report received and addressing it fairly, promptly and confidentially.
1.1 Legal Framework
This Policy is designed to reflect the principles of EU Directive 2019/1937 on the protection of persons who report breaches of Union law and to meet applicable whistleblower-protection laws wherever we operate, including California Labor Code section 1102.5 and, where applicable, the vigil-mechanism provisions of the Companies Act, 2013 (India).
1.2 Definitions
- "Reporter" means any person covered by this Policy who raises a concern under it, whether or not they give their name.
- "Good faith" means an honest belief, held on reasonable grounds at the time of the report, that the information reported is accurate, whether or not the concern is later substantiated.
- "Retaliation" means any adverse action, or threat of adverse action, taken against a person because they raised a concern, reported a suspected breach or assisted an investigation, including the conduct described in Section 6.
2. Scope
This Policy applies to everyone associated with TestMu, including:
- Employees, on any contract type, in every location
- Directors, officers and senior management
- Consultants, contractors, temporary workers and advisers
- Vendors, service providers, resellers and business partners
- Customers and any other stakeholder interacting with the Company
Anyone covered by this Policy may report a concern where they reasonably believe that misconduct or wrongdoing has occurred, is occurring or is likely to occur.
3. Reportable Concerns
Concerns that may be reported under this Policy include, but are not limited to:
- Violation of applicable law or regulatory requirement
- Breach of the Code of Business Conduct & Ethics or any internal Company policy
- Fraud, financial irregularity or manipulation of financial records
- Bribery, corruption, facilitation payments or abuse of authority
- Misrepresentation of Company reports, records or documentation
- Deficiency in internal controls or governance practice
- Misuse of Company assets, intellectual property or confidential information
- Harassment, discrimination, victimization, retaliation or other unethical workplace conduct
- Unsafe working conditions or breach of health and safety obligations
- Breach of information security, privacy or data protection obligations
- Misuse of artificial intelligence, or deployment of an AI system in breach of the Company's responsible-AI commitments
- Any conduct that could harm the Company's operations, reputation or governance standards
Complaints of harassment are handled under the Global Anti-Harassment & Respectful Workplace Policy and, in India, within the Internal Committee's statutory jurisdiction, under the Prevention of Sexual Harassment (POSH) Statement.
This Policy does not replace routine grievance procedures for individual workplace matters, which are handled under the Human Resources grievance process. It is used where there is a genuine concern about unethical or unlawful conduct.
4. Right and Responsibility to Report
Everyone covered by this Policy has both the right and the responsibility to raise a concern in good faith on becoming aware of potential misconduct. For employees and contractors, failing to report a known breach may itself be treated as a breach of the Code of Business Conduct & Ethics.
Reporters are encouraged to give their name and contact details, because this allows the Company to seek clarification and investigate more effectively. Anonymous reports are nevertheless accepted and assessed, although limited information may restrict the investigation that is possible.
5. Reporting Channels
A concern may be raised through any of the following channels. Where a concern involves someone in the Reporter's normal reporting line, the Reporter should report directly to the ethics and whistleblower channel rather than to that person. Concerns about Human Resources or Executive Leadership are escalated to the Disciplinary Committee; concerns about the Chief Executive Officer are escalated to the Board of Directors.
| Channel | Who may use it | Address |
|---|---|---|
| Ethics and whistleblower channel | Anyone, inside or outside the Company, including employees, contractors, customers, suppliers and partners. Reports may be made anonymously where local law permits. Reports may be made anonymously by email. | whistleblower@testmuai.com |
| Human Resources | Employees and consultants, for workplace matters | hr@testmuai.com |
| Customer, supplier and contractor matters | Service, contractual or relationship complaints and governance enquiries. Conduct concerns received here are routed to the ethics and whistleblower channel. | support@testmuai.com |
| Privacy and security | Data protection requests and the Data Protection Officer; security vulnerabilities and incidents | privacy@testmuai.com / security@testmuai.com |
Reports to the ethics and whistleblower channel are received by Human Resources, which may engage Legal, Governance, Risk & Compliance or external advisers. Reports are acknowledged normally within five business days where contact details are provided, assessed for severity and conflict of interest, investigated independently of the business area concerned, and closed with a recorded outcome and tracked corrective action. Serious matters and matters involving senior leadership are investigated independently of management and overseen by the ISCSC. Nothing in this document prevents any person from reporting a concern to a government, regulatory or law-enforcement authority, and no confidentiality obligation owed to the Company restricts such a report.
6. Protection Against Retaliation
TestMu prohibits retaliation of any kind against any person who, in good faith, raises a concern, reports a suspected breach or assists an investigation, whether or not the concern is substantiated. Retaliation is itself a breach of the Code of Business Conduct & Ethics and is subject to disciplinary action following investigation. Knowingly making a false report is also a breach. Retaliation includes termination, demotion, suspension, harassment, discrimination, denial of promotion or professional opportunity, an unfair performance evaluation, exclusion, or any form of intimidation.
7. Acting in Good Faith
Where an allegation is made in good faith but is not substantiated, no action is taken against the Reporter. Knowingly making a false, misleading or malicious allegation may be treated as misconduct and may result in disciplinary or legal action.
8. Confidentiality
Reports are handled with a high degree of confidentiality. Information is shared only with those directly involved in assessing or investigating the concern who need it for a legitimate purpose. So far as the law permits, the Company takes reasonable steps to protect the identity of the Reporter, and will, where lawful and reasonably practicable, inform the Reporter before their identity is disclosed where disclosure becomes unavoidable.
9. Review and Investigation
Each report received is assessed promptly and handled fairly and impartially by people independent of the business area concerned. The process is:
| Step | Stage | What happens |
|---|---|---|
| 1 | Acknowledgement | Receipt is acknowledged, normally within five business days where contact details are provided. |
| 2 | Preliminary assessment | Scope, severity and any conflict of interest are assessed, and the investigating function is assigned. |
| 3 | Investigation | Evidence is gathered and those involved are interviewed. |
| 4 | Determination | Findings are documented and corrective or disciplinary action is decided. |
| 5 | Closure | The matter is closed, control improvements are tracked to completion, and the Reporter is informed that the matter has been addressed so far as confidentiality and law permit. |
Investigations are conducted as promptly as the complexity and sensitivity of the matter allow. Reporters receive feedback on the outcome where contact details are provided, normally within three months of acknowledgement, or earlier where the matter is resolved.
10. Outcome and Corrective Action
Where an investigation confirms misconduct or a policy breach, the Company may take disciplinary measures against those involved, improve internal controls or processes, enhance policy or governance, and pursue legal or regulatory action where required.
11. Record Keeping and Reporting
Records of reports, investigations and outcomes are maintained securely by Human Resources under access controls, with investigation records held independently of the business area concerned, in accordance with the Company's records-retention standards and applicable legal requirements. Human Resources reports aggregate outcomes and trends to the ISCSC quarterly. Aggregate outcomes are reported to Executive Leadership and may be made available to customers on request under confidentiality.
12. Policy Oversight and Review
This Policy is owned by Human Resources, and is overseen by the ISCSC working with Executive Leadership. The ISCSC is responsible for ensuring that reports are handled appropriately, that investigations are conducted fairly, and that corrective action is taken where required.
The Policy is reviewed at least annually and whenever there is a material change in law, structure or operations. It is reviewed by the ISCSC and approved by the Chief Executive Officer on behalf of Executive Leadership.