Whistleblowing

Why this channel exists

Serious problems are usually visible to someone before they become visible to everyone. This channel exists so that person can speak without weighing up what it will cost them.

We would rather hear an uncomfortable report early than read about the consequences later. Raising a concern in good faith is treated as doing your job well, not as disloyalty.

Who can use it

Anyone connected to our work: employees and former employees, candidates, directors, contractors, trainees, volunteers, suppliers and their staff, customers, and anyone who obtained the information in a work-related context. You do not need to be affected yourself.

What to report

Report anything you reasonably believe is happening, has happened, or is about to happen that is unlawful or seriously improper. For example:

a risk to aviation safety, airworthiness or the integrity of a maintenance record;
falsified certification, records or sign-offs, or pressure to sign for work not done;
suspected unapproved, counterfeit or untraceable parts;
bribery, corruption, fraud, theft or money laundering;
breach of competition law, sanctions, export controls or customs rules;
a data protection breach, or misuse of customer or personal data;
a serious information security incident, or its concealment;
danger to health and safety, or environmental harm;
discrimination, harassment, bullying or abuse;
forced or child labour anywhere in our supply chain;
deliberate concealment of any of the above.

You do not need proof, and it is not your job to investigate. A reasonable belief is enough. Say what you saw, when, who was involved and where any evidence sits — that is what lets us start.

What this channel is not for

Personal grievances about your own employment — pay, a rota, a manager you disagree with — are handled better and faster through the grievance route, and a commercial dispute through the contract. If you send one here we will not ignore it: we will route it to the right process and tell you where it went.

If someone is in immediate danger, or a crime is in progress, contact the emergency services first.

How to report

Email: speakup@atolys.com — read only by the small group responsible for handling reports, and not by line management.
In person or by call: Ask through the same address for a meeting, in person or by video, within a reasonable time and at a place of your choosing. At your request we will keep a written record or, with your consent, a recording.
Through your usual contact: If you would rather tell a manager or your Atolys contact, you can. Ask them to treat it under this policy and it will be passed on with the same protection.

Include, if you can: what happened, when and where, who was involved, whether it is still going on, and any documents or records that support it. Do not gather evidence in a way that breaks the law, your contract or someone else’s privacy.

Reporting anonymously

You may report anonymously and we will assess it seriously. Be aware that anonymity limits us: we cannot come back for the detail that often makes the difference, and we cannot tell you the outcome.

If you give your name, only the people handling the case will know it. Giving it is what allows us to protect you properly if anyone reacts badly.

What happens after you report

Acknowledgement within 7 days of receipt, where we have a way to reach you.
Assessment by people independent of the matter, and free of any conflict of interest. If a report concerns a senior person, it is escalated past them.
Investigation proportionate to what was raised. We may ask you follow-up questions, and we may need to involve external legal, technical or audit help under confidentiality.
Action — correcting the problem, disciplinary measures, contract termination, changes to how we work, and notification to an authority where the law requires it.
Feedback within three months of the acknowledgement, telling you what we did with the report and why, as far as confidentiality and the rights of others allow.

Anyone accused of wrongdoing is told what is alleged and given a fair chance to respond, at a point that does not prejudice the investigation, and is presumed innocent until it concludes.

Confidentiality

Your identity, and anything that could reveal it, is disclosed only to the people who need it to handle the report — and only with your consent, unless disclosure is a legal obligation in the context of an investigation or court proceedings. If that obligation ever arises, we tell you in writing beforehand and explain why, unless telling you would prejudice the investigation.

Protection from retaliation

Retaliation against anyone who reports in good faith, or who helps with an investigation, is a serious disciplinary matter — and, for a supplier, a breach of contract.

Retaliation includes dismissal, demotion, withheld promotion or training, a transfer of duties, a pay change, negative appraisal, exclusion, intimidation, blacklisting, cancelled contracts, and threats of any of these. The protection extends to colleagues who help you, to people connected to you, and to any organisation you own or work for.

If you believe you are being treated badly for speaking up, tell us at speakup@atolys.com and we will treat it as a new report, with priority.

Reports made in bad faith

You are protected if you had reasonable grounds to believe what you reported was true — even if it turns out you were mistaken. That is the whole point of the standard.

Knowingly making a false report to harm someone is different, and is a disciplinary matter in itself.

Reporting outside Atolys

You can always go to an external authority instead of, or as well as, us. Under EU whistleblower protection rules each member state runs a designated external reporting channel, and aviation matters can also go to the national civil aviation authority or the European Union Aviation Safety Agency. Occurrence reporting under the aviation rules is a separate, mandatory route and this policy never replaces it.

Nothing in this policy prevents you from reporting to an authority, taking legal advice, or exercising any right you have by law, and no confidentiality clause we hold with you can be used to stop you.

Personal data and records

We keep a secure register of reports with restricted access. Personal data in a report is processed to investigate and to comply with our legal obligations, is limited to what is relevant, and irrelevant material is deleted without delay.

Records are kept for as long as the case and any resulting proceedings require, and normally no longer than five years after closure. The wider handling of personal data is described in our Privacy Policy.

How to contact us

Reports and questions about this policy: speakup@atolys.com.

If your concern is about how personal data is handled rather than misconduct, write to privacy@atolys.com.