Legal Notice

FOREWORD

The WhistleB tool, further described below, is a global channel through which a whistleblower is given the opportunity to report a particular situation he/she becomes aware of, which does not comply with the rules governing the conduct of the Group’s activities or the ethical standards expected, or which may be in breach of applicable laws and regulations. Please note that the legal notices below are based on the French whistleblowing regime – in particular provided by the ‘Sapin 2’ law, updated by the Waserman law in March 2022 following the transposition of Directive (EU) 2019/1937 of December 2019. A different whistleblowing regime may apply for other countries. In several of the countries in which Societe Generale operates, there may be various channels through which whistleblowing alerts can be raised. If you are a member of staff at SG, please refer to your local whistleblowing policy to get further information about the various channels at your disposal, in addition to the WhistleB channel set up at Group level. Please also note that, when a report is sent using the Group WhistleB tool, it may be shared with your entity for investigation, after a prior assessment by the parent company’s Compliance and/or Human Resources Department authorized to manage alerts. If you express the choice not to involve your entity in the handling of the report, this choice must be made explicit in your report and the report will not be sent to your entity without your prior consent.

COULD YOU BE A WHISTLEBLOWER?

The whistleblower may be all Societe Generale Group staff[1], external and occasional employees [2], the members of the governing body[3], directors and shareholder[4],and, within the framework of the Corporate Duty of Vigilance Law[5], any service provider with whom an established commercial relationship exists (subcontractors, suppliers, etc.). Whistleblowers can be helped by third parties known as “enablers” [6], without prejudice to the eligibility of the report. In order to benefit from the protective status of whistleblower, the person making the report must:

• •
  Act in good faith and responsibly
• •
  Not expect direct financial counterpart for their report.
• •
  Report facts falling within the scope of whistleblowing

Some national regulations may provide for different and/or additional conditions.

YOU HAVE A RIGHT TO REPORT

The right to report is a basic right afforded to everyone to express themselves when they believe that they have good reason to consider that an instruction they have received, an operation under investigation or, more generally, a particular situation does not appear to comply with the rules governing our Group's business conduct and resulting from the actions of one of its internal employees, representatives or by extension any third party mandated by Société Générale. The mechanism set up by Société Générale for collating reports complies with the provisions of the law on transparency, the fight against corruption and the modernisation of economic activity (law No. 2016-1691 of 9 December 2016, known as the "Sapin 2" law) amended by the Waserman Act of 21 March 2022 to improve whistleblower protection, and the law pertaining to the duty of vigilance incumbent upon parent companies and ordering companies (law No. 2017-399 of 27 March 2017), which specifies the legal regime applicable to reports and the protection of whistleblowers. As such, you are able to report any situation of sufficient gravity, including the detection of a crime or offence, a violation or attempt to conceal a violation of an international treaty, a violation or attempt to conceal a violation of a law or regulation, or any serious threat to the public interest. This system for collating reports makes it possible, on the one hand, to protect the person who – acting in good faith and in a non-abusive manner – made the report, and, on the other hand, to detect a serious situation in order to limit the Group's exposure to the related risks. YOU CAN EXERCISE YOUR RIGHT TO REPORT UNDER THE CONDITIONS PROVIDED FOR THIS PURPOSE In order for a report to be eligible under this mechanism, specific legal conditions must be met that are both applicable to the whistleblower and the reported facts. Please note that, unless local regulations specifically prohibit the parent company from accessing data on reports issued in its subsidiaries, the parent company, represented by the Compliance and Human Resources Department authorized to manage alerts, has a right to access all reports made through the local WhistleB channels within the framework of the duty of vigilance. The whistleblower may report by identifying himself/herself or by remaining anonymous, although the lifting of anonymity may facilitate certain investigations and provide certain protective measures for the whistleblower. The regulation of certain countries may prohibit the submission of anonymous reports (in particular, within the scope of Societe Generale’s activities, Ghanaian regulations). In such cases, the whistleblower will be asked to identify himself/herself. The consent of the person submitting the report is then required. As a matter of principle, Societe Generale Group undertakes not to seek the identity of the whistleblower who chooses to remain anonymous. If the whistleblower decides not to file his/her report anonymously or to lift his/her anonymity, he/she agrees that the information relating to his/her identity may be communicated to the parent company, represented by the Compliance and Human Resources Department authorized to manage alerts. Whether the alert is anonymous or not:

• •
  Verifications will be initiated to determine the veracity and seriousness of the facts reported. For this purpose, the factual elements must be sufficiently precise and corroborated.
• •
  Specific precautions will be taken in dealing with this report, such as a preliminary examination and the possible use of experts to establish the legal qualification and investigate the facts.

The conditions, which partly determine the status and protection of the whistleblower, may differ depending on the country and the applicable law. It is therefore recommended that whistleblowers consult the normative documentation provided for this purpose, available on the Group's intranet site, as well as on the Group’s corporate website. This documentation may be supplemented, where necessary, by entities' own normative documentation to take into account local regulatory specificities. The strict confidentiality of information is guaranteed throughout the process, in accordance with applicable regulations. The right to ‘blow the whistle’ will have to be carried out in compliance with Group and local provisions, for example those relating to professional secrecy, the protection of personal data or location of data. Thus, in some countries, it will be appropriate to anonymize the names of clients and persons concerned or to use the only local whistleblowing device.

WHAT FACTS CAN BE REPORTED?

The reports covered by the whistleblower scheme cover, including particularly the following facts:

• •
  Crimes or misdemeanors (including corruption),
• •
  Violation or attempt to conceal a violation of an international treaty,
• •
  Violation or attempt to conceal a violation of a law or regulation (including international sanctions violations, bribery and corruption, money laundering or other financial crime-related matters…),
• •
  Any serious threat to the public interest,
• •
  Violation or attempt to conceal a violation of human rights and fundamental freedoms, the health and safety of persons and the environment,
• •
  Conduct or situation contrary to the Group's code of conduct
• •
  Retaliation against the whistleblower or any other natural or legal person protected by whistleblowing.

Some national regulations may not provide for the status of whistleblower for all serious situations that are reported. If the report contains information that falls into the categories listed below, the whistleblower should verify that the legislation of his/her country allows the communication of this information in the framework of whistleblowing:

• •

  national defense secrecy,

• •

  medical confidentiality,

• •

  lawyer-client privilege,

• •

  state security,

• •

  state secrets,

• •

  and any information the disclosure of which would be contrary to any applicable laws or regulations.

  For Switzerland, you must not enter any client information in the WhistleB tool otherwise there might be a violation of Art. 47 Swiss Banking Act and resulting in criminal liability.

  Reports shall directly concern the entities within the Société Générale group.

WHO RECEIVES THE REPORTS?

Alerts are sent to experts for investigation based on the strict need to know principle. These experts shall be recognized for their expertise in the relevant field, having the authority and means to deal with the whistleblowing reports effectively. They may be internal or external to Société Générale, which must process and investigate the alert strictly confidentially whether the whistleblowing report is anonymous or not.

YOU BENEFIT FROM SPECIFIC LEGAL PROTECTION

All reports will be treated securely, and the confidentiality of your identity will be ensured, both at an information system level and at organizational level. The reporting channel is provided by an external partner, the Whistleblowing Centre, to keep your identity confidential. The reporting process is encrypted and personal and confidential password is assigned to each expert in charge of treatment and investigation. If you are eligible for the status of whistleblower provided for by applicable law, you will be protected from any retaliation, discriminatory measures, sanctions or dismissal with regards to you personally. The status of whistleblower may extend to these third-party facilitators, natural persons in relation to the whistleblower[7] and legal entities controlled[8] by the whistleblower for which the whistleblower works or with whom the whistleblower is associated in a professional context.

WHAT RISKS MIGHT YOU BE EXPOSED TO?

If the above legal requirements are not met, you will not, by law, be eligible for whistleblower status or for the appropriate protection regime. However, reporting in good faith will not result in retaliation, even if you do not meet the applicable legal requirements for whistleblower status. Furthermore, any report must be made in a responsible, non-defamatory and non-abusive manner. Failure to do so may result in (i) penalties, potentially of a criminal nature, for slander or defamation, in particular, and (ii) possible disciplinary proceedings.

FOLLOW-UP ON THE PROCESSING OF YOUR REPORT

To enable you to follow the processing of your report, please keep your login and password, which you received when you sent your report, in a safe place. These will enable you to access the status of your report at any time, to communicate with the people in charge of it, and to answer any questions you may be asked during the investigation of your report.

REMINDER OF OTHER EXISTING SYSTEMS:

Whistleblowing reports can be reported to external authorities (authorized to receive Whistleblowing reports). Internal reports may be sent to authorized contacts outside the whistleblowing tool, in accordance with the applicable procedures. Clients: special customer support center Please note that, with regard to claims, customers must use the customer support center, which is governed by local regulations and is intended specifically for them. In the event of persistent disagreement over the handling and outcome of the claims, this claim process may be escalated in particular to the French Banking Federation, or even to the Mediator of the French Financial Markets Authority (AMF) or another national authority if necessary. Suppliers: as a reminder, in case of litigation (out of the whistleblowing case), you may directly address your claims to Internal Ombudsmen / Mediator available at the following address (as indicated on the internet website of the Group https://www.societegenerale.com/en/working-together/suppliers/sustainable_sourcing_practices Société Générale Médiateur interne des relations Inter-Entreprises SEGL/DIR Tours Société Générale 75886 Paris Cedex 18

[1] including those whose working relationship has ended, where the information has been obtained in the context of that relationship, and to persons who have applied for employment in the entity concerned, where the information has been obtained in the context of that application [2] External and temporary staff (temporary workers, apprentices, interns, trainees, international business volunteers (VIE), people whose employment relationship has ended, people who have applied for a job with the entity concerned, service providers, employees of subcontractors, managers of service providers and subcontractors). [3] Members of the administrative or supervisory body [4] Shareholders, associates and voting members within the entity. [5] Law on the Duty of Vigilance of parent companies and ordering companies (Law no .2017-399 of March 27,2017). [6] Any natural or legal person under private, not-for-profit law who helps a whistleblower to report an incident. [7] People which may suffer retaliation measures / actions within their professional activities from their employer, their client or beneficiaries of their services... [8] Within the meaning of Article L.233-3 of the French Commercial Code Within the Whistleblowing framework, Société Générale, as a data controller, is collecting and processing personal data and information (hereafter personal data) that concern you. The personal data processing operations are performed due to legal obligations to which Société Générale is subject. The processing of your personal data is necessary for the management of alerts, for the identification or prevention of any unethical behavior, violation, or attempted concealment of violation of laws and regulations. Personal data collected in this context may be disclosed to the Group Head of Compliance, strictly authorized internal and external experts for analysis, processing the outcome given to the report, as well as for legal and/or regulatory purposes. Société Générale may also communicate your personal data to the competent requesting authorities, including judicial authorities or other authorities supervising the Group and its activities in order to comply with every legal or regulatory obligation to which Société Générale is subject. Société Générale is legally subject to strict confidentiality and security obligations and it places its experts or technical service providers under the obligation to provide comparable confidentiality and security measures to those imposed on Société Générale. In order to accomplish the purposes listed above, Société Générale may be required to transfer your personal data to its entities, and to its partners established inside or outside of the European Economic Area. These data transfers shall take place under the conditions and guarantees that shall ensure the protection of your personal data (authorization by the data protection authority, if required, contractual commitment with the service providers concerned or Binding Corporate Rules of the Société Générale Group). The personal information collected and processed are the following:

• •
  Identity, role and contact details of the whistleblower.
• •
  Identity, role and contact details of the individuals referred to in the whistleblowing.
• •
  Identity, role and contact details of the individuals involved in the collection and processing of the whistleblowing.
• •
  The whistleblowing facts disclosed.
• •
  The elements collected within the verification of the reported whistleblowing facts.
• •
  Written report of the verification operations.
• •
  The consequences of the whistleblowing disclosure.

Personal data processed within the framework of a whistleblowing incident considered by Société Générale as not falling into the whistleblowing set up is destroyed or anonymized in the six months following the exclusion decision of the system. When no follow-up is given to an alert falling within the whistleblowing set up, the personal data processed within the framework of a whistleblowing incident is destroyed or anonymized by Société Générale within a period of 12 months from the closure of the verification operations (closure of the whistleblowing process). When there is a follow-up to a whistleblowing (and in particular when a disciplinary or litigation procedure is underway against a person involved or against the instigator of abusive whistleblowing), the personal data processed within the framework of the whistleblowing can be retained by Société Générale until the end of the procedure or of the limitation period of appeals against the decision. It is specified that the expression “follow-ups” describes every decision taken by Société Générale for drawing conclusions from the whistleblowing. Personal data processed within the framework of whistleblowing, may be retained for longer periods if Société Générale has a legal and/or regulatory obligation. Therefore, in accordance with local legislation systems, retention periods may be subject to additional retention periods. The persons concerned have the right of access, rectification, erasure and limitation under the conditions laid down by the regulation. These persons can exercise their rights by creating a request directly in the tool (category “Protection of personal data”). A response will be sent via the secure communication channel of this tool. If you have any questions relating to the protection of your personal data, you may contact the Data Protection Officer at Société Générale: Sg-Protection.Donnees@socgen.com It is also possible to lodge a complaint with the supervisory authority responsible for data protection in the jurisdictions.