Supplier Code of Conduct

Purpose and scope

Atolys works in an industry where a shortcut in the supply chain becomes an airworthiness problem later. This Code sets out what we expect of every supplier, vendor, contractor, consultant, reseller and business partner that works with us, and of their employees, agents and subcontractors.

It applies from the first tender onward and sits alongside the contract, not instead of it. Where a contract term or a law is stricter than this Code, the stricter one applies. Meeting the Code is a condition of doing business with us.

Compliance with the law

Comply with all applicable laws and regulations wherever you operate, and with the aviation, employment, environmental, tax, customs, competition and data protection rules that apply to the work you do for us. Hold the approvals, licences and certificates that your work requires, keep them valid, and tell us promptly if one is suspended, limited or withdrawn.

Business integrity

Bribery and corruption

Zero tolerance. Do not offer, give, request or accept anything of value to obtain or keep business, or to secure an improper advantage — directly or through an intermediary. That includes facilitation payments, however common they may be locally.

Gifts and hospitality

Modest, occasional and transparent hospitality is acceptable. Anything that could reasonably look like an attempt to influence a decision is not. Never offer gifts, hospitality or employment during a tender or an audit.

Conflicts of interest

Disclose in writing any personal, family or financial relationship between your people and ours that could affect a decision, before it affects one.

Accurate books and no financial crime

Keep complete, accurate records that reflect real transactions. Do not launder money, evade tax, or facilitate either. Invoice only for what was delivered.

Fair competition

Compete on merit. Do not fix prices, rig bids, allocate markets or customers, or exchange commercially sensitive information with competitors. Obtain competitor information only through legitimate means.

Trade controls and sanctions

Comply with export controls, customs rules and economic sanctions, including those of the European Union, the United States and any other applicable regime. Screen the parties you deal with, do not divert goods, technology or software to a restricted destination or end user, and tell us before any transfer that requires a licence.

Human rights and labour

• No forced labour. No slavery, servitude, human trafficking, bonded or prison labour. No retained identity documents, no recruitment fees charged to workers, and freedom to leave employment on reasonable notice.
• No child labour. No one under the local legal minimum age or under 15, whichever is higher, and no hazardous work by anyone under 18.
• Freely chosen hours and fair pay. Working hours and rest within legal limits; wages, overtime and benefits at or above the legal minimum, paid on time and in full, with a clear payslip.
• No discrimination or harassment. Decisions on merit, and a workplace free of harassment, bullying, intimidation and abuse.
• Freedom of association. Respect the right to organise and bargain collectively, and to raise grievances without fear.

Health and safety

Provide a safe workplace: assess risks, control them, supply and require proper protective equipment, train your people in the language they work in, and prepare for emergencies. On our sites or a customer site, follow the site rules and the safety instructions given to you, and report every incident and near miss without delay.

Environment

Hold the environmental permits your operations need and work within them. Handle, store and dispose of hazardous substances and waste lawfully, prevent spills and uncontrolled emissions, and work to reduce energy use, waste and emissions over time. Be able to show what you do with regulated materials.

Aviation safety, quality and traceability

Where the work touches aircraft parts, maintenance or the data behind them:

• supply only parts that are traceable to an approved source, with complete and authentic documentation such as an EASA Form 1 or FAA Form 8130-3, and back-to-birth records where they are required;
• operate an active programme against suspected unapproved and counterfeit parts, quarantine anything suspect, and notify us and the relevant authority;
• never falsify, alter or reuse a certificate, stamp, test result or maintenance record, and never sign for work you did not perform or witness;
• control shelf life, storage conditions, ESD protection and calibration, and be able to prove that control;
• run a quality management system appropriate to the work, with corrective and preventive action that finds the root cause rather than closing the finding;
• report escapes, non-conformances and any defect that could affect airworthiness to us as soon as you know, not after the investigation is finished;
• support a just culture in which people report errors without fear of punishment for honest mistakes.

Information security and data protection

Protect our information and our customers’ information with controls proportionate to the risk: access on a need-to-know basis, multi-factor authentication for remote and privileged access, encryption in transit and at rest, patching, logging, backups, and secure disposal of media.

Where you process personal data for us, do so only on our documented instructions and under a written data processing agreement, keep it within the safeguards agreed for international transfers, and support us in answering data subject requests. Report any suspected breach affecting our data within 24 hours of becoming aware of it.

Where you supply or integrate software, follow secure development practice, manage the vulnerabilities in your components, and provide a software bill of materials on request.

Confidentiality and intellectual property

Treat everything you learn about our business, our platform and our customers as confidential, use it only for the purpose it was shared, and return or destroy it when the work ends. Respect our intellectual property and that of third parties, and honour the licence terms of any open-source component you build into what you deliver. Do not use our name, logo or the fact of our relationship in marketing without written permission.

Subcontracting and your own supply chain

Get our written agreement before subcontracting work you do for us. You remain responsible for what your subcontractors do. Pass these standards down the chain, check that they are met, and be prepared to show us how you check.

Business continuity

Maintain plans that keep you delivering through disruption — capacity loss, cyber incident, supply failure or natural event — test them, and tell us as early as possible when something will affect a delivery date we are planning around.

Monitoring, audit and records

Keep records that demonstrate compliance with this Code for as long as the contract and the applicable aviation and accounting rules require. On reasonable notice, allow us or our representatives to audit those records and, where relevant, your facilities and processes. Complete supplier assessments and self-declarations when we ask, honestly.

Raising a concern

If you see something that breaches this Code — in your organisation, in ours, or between them — report it to speakup@atolys.com. Reports can be made confidentially or anonymously, are handled as described in our Whistleblowing policy, and are protected from retaliation. That protection covers your workers as well as ours, and no supplier may penalise someone for making a report in good faith.

If the Code is breached

Tell us as soon as you become aware of a breach, along with the corrective action you are taking. We would rather fix a problem with you than discover it in an audit.

Depending on the seriousness and on how it is handled, a breach may lead to a corrective action plan, suspension of new orders, removal from our approved supplier list, termination of the contract, and — where the law requires — a report to an authority.

Acknowledgement

We ask suppliers to confirm in writing that they have read this Code, that they meet it, and that they will pass it down their own supply chain. Confirmations and questions go to suppliers@atolys.com.