Whistleblower Channel

You can report in English or Spanish, in writing or verbally, in either of these ways:

(1) By email to the independent member of our Risk Committee at speakup@tinycode.io. Only the independent member can access this mailbox. If you want to remain anonymous, send your report from an email account that doesn't identify you.

(2) Directly to our Compliance Officer at melissa@tinycode.io.

You can ask either of the people above for a meeting in person. It will be held within 7 calendar days of your request.

If you report verbally, then with your consent, we will record your report or write it down. You can review and correct the record.

To help us look into your report, please include as much of the following as you can:

(1) Who was involved?

(2) What happened?

(3) Where did it happen?

(4) When did it happen?

(5) What evidence or witnesses could help confirm it?

You can choose to remain anonymous, and we will not try to identify you. If you do identify yourself, only the people strictly needed to handle your report will know who you are. Your identity will never be shared with the people named in your report. We will disclose it only with your express consent, or where the law or a court or authority requires it. If disclosure is legally required, we will tell you before disclosing your identity unless doing so would jeopardize the investigation or proceeding.

The identities of people named in a report, and of witnesses, are also kept confidential. People named in a report are presumed innocent and are given the chance to respond.

Tinycode strictly prohibits retaliation against anyone who reports in good faith, or who helps with or takes part in an investigation. This protection also covers your colleagues and relatives, and any business you own or work for. You are protected even if your report turns out to be mistaken, as long as you had reasonable grounds to believe it was true.

Retaliation includes dismissal, suspension, demotion, changes to your duties or pay, negative reviews or references, intimidation or harassment, blacklisting, ending a vendor or customer relationship, and threats of any of these. If you believe you have suffered retaliation, report it through this channel. We investigate these reports as a priority. Anyone found to have retaliated faces disciplinary action up to and including termination.

Knowingly false or malicious reports are not protected and may lead to disciplinary action.

(1) You will receive an acknowledgment of receipt within 7 calendar days. You won't receive one if you've asked not to be contacted, or if sending it could compromise the confidentiality of your report.

(2) Within 10 business days, we assess whether your report falls within the scope of the channel and has enough information to investigate. If it does, we open an investigation. Matters outside the channel's scope, such as ordinary workplace grievances, are passed to the appropriate team, and we tell you when we do this.

(3) Each investigation is assigned to an investigator with no conflict of interest. For serious or sensitive matters, the investigator may be external counsel. We may contact you through the channel for more information.

(4) You will be told the outcome of the investigation, and any action taken, within 3 months of your acknowledgment of receipt. In particularly complex cases, this period may be extended once by up to 3 more months, and you will be told if this happens.

Reports involving the CEO, the Compliance Officer, a Risk Committee member, or anyone with authority over the Compliance Officer are handled by the independent member of the Risk Committee. The Compliance Officer is excluded from those cases.

If the reported facts may constitute a crime, Tinycode will refer the matter to law enforcement or prosecutors where the law requires it or where the Risk Committee decides it is appropriate. If a report concerns the services we provide to a customer or the customer's data, we will notify that customer as our contracts require. We will never tell a customer who you are without your consent.

You don't have to use this channel first, and you don't need Tinycode's permission to report possible violations of law directly to a government or regulator, or to receive an award for doing so. You can report to any U.S. federal, state, or local authority. If you are covered by EU or Spanish law, you can report to the competent national authorities, including Spain's Independent Authority for Whistleblower Protection (Autoridad Independiente de Protección del Informante, A.A.I.). You can also use the internal reporting channel of any Tinycode customer.

Defend Trade Secrets Act notice. Under 18 U.S.C. § 1833(b), you cannot be held criminally or civilly liable under any federal or state trade secret law for disclosing a trade secret in either of two situations. The first is when you disclose it in confidence to a government official or an attorney solely to report or investigate a suspected violation of law. The second is when you disclose it in a complaint or other court filing made under seal.

Personal data submitted through this channel is used only to handle your report. It can be accessed only by the Compliance Officer, assigned investigators, and legal advisors where necessary. For people in the EU, we comply with the GDPR and Spanish Law 2/2023. Please visit our Privacy Policy for more information.