Speak Up. Your Voice Matters.

EthicsLine - Europe Employee Program

EthicsLine is a system provided by The Coca-Cola Company (the “Company”) to allow you i) ask questions about ethics or policies in the Company or ii) to report incidents as individual person located in France or for incidents , occurring in France, in application of French law N° 2016-1691 of December 9, 2016” and Decree N°2017-564 of April 20, 2017” (related to transparency, anti-corruption and modernization of the economy and to procedures for collecting reports by whistleblowers in public or private companies, or administration together “Loi Sapin II”) Use of EthicsLine is entirely voluntary.

Before proceeding further, please read the notice below. If you disagree, please cancel your request. Full description of this procedure under Loi Sapin II can be found here (for Coca-Cola Services France, for Coca-Cola Midi).

In application of Loi Sapin II, the matters that can be reported through EthicsLine are matters 1/ that you disclose or report in a disinterested manner and in good faith, 2/ you have personal knowledge of and 3/ fall under the following categories :

Facts, information or documents, whatever their form or format, classified under defense secret, medical confidentiality or legal privilege are not covered under the regime of reports covered by Loi Sapin II.

The appointed referring person who is responsible for reports is the Director Data Analytics and Risks Trends, Employee in Ethics & Compliance Office in The Coca-Cola Company.

As with all matters of a sensitive nature, the best option for you is to speak directly with your supervisor, management group, or a human resources representative. If uncomfortable with this direct approach of discussing concerns in person or if the concern has not been resolved, the EthicsLine may be used. For employees based in Austria, Denmark, and Sweden, the EthicsLine should be used only if the concerns relate to senior management or key personnel, and where the concerns cannot be resolved by other means.

We ask you not to send to us and not to disclose, any sensitive Personal Information (e.g., information on a person’s racial or ethnic origin, political opinions, religious or philosophical convictions, union membership, health or sex life).

Please be aware that the information you supply about yourself, your colleagues, or any aspect of the Company’s operations may result in decisions that affect others. We therefore ask you to provide only information that, to the best of your knowledge, is correct. You will not be sanctioned for submitting information in good faith. However, if you knowingly provide false or misleading information, it may result in disciplinary action. The information you submit, including your identity, will be treated confidentially.

The Company, as the data processing body (also on behalf of your local employer), is obliged under Articles 13, 14 GDPR to inform you about any related data processing. This notwithstanding, you are entitled, according to Articles 15-22, 34 GDPR, to also demand that the Company and your local employer inform you which of your data is stored. Regardless of whether you have expressed any interest in such information or not, the following information must generally be made accessible to you at the moment your data is processed or obtained - in the event your employer or a third party obtains them – without undue delay, but no later than within one month of having obtained them.

What Information is collected? On the EthicsLine site, you may directly submit to the Company the following information: your name and contact details, any question you may have, the name and title of all individuals you may be reporting, and a description of any questionable conduct, including all relevant details. Please note that while you are encouraged to identify yourself, you are not obliged to. You are not obliged also to provide the names or personal data of co-workers, and reports may be made anonymously.

Follow up of reported issue : Once an issue is reported, you will be provided with a case number that will allow you to consult the progress and result of investigation. Average investigation timings are 90 days (subject to the complexity of matters reported).

How and by whom will the Information be used? All information will be stored on the NAVEX database hosted by NAVEX (“NAVEX”) in the USA. The Company and NAVEX entered into European Standard Contractual Clauses between them to ensure an adequate level of data protection. European Standard Contractual Clauses are a contractual framework, adopted by the European Commission to provide adequate data privacy safeguards for data transfers from an EU member state to a state located outside the European Union. In addition, the European entities of the Company and the Company itself agreed on European Standard Contractual Clauses to ensure an adequate level of data protection at the Company as a Co-Controller for employee data. Unless required by law or litigation, the information in the NAVEX database may only be reviewed and used by those entitled individuals who need to know the data to fulfill their job duties. These individuals may include appropriate human resources, audit, legal, security, or management functions at the Company, employees within the Company’s Ethics & Compliance Office, or technical staff at NAVEX. Those individuals may be located in the United States or in another country where the European Commission has not found that the privacy laws ensure the same level of protection of personal data as provided in the EU. In addition, all information you provide may be stored by the Company’s Ethics & Compliance Office in the course of answering your question(s) or investigating the report.

The Company will evaluate the information you provide, and may conduct appropriate investigations, and take corrective action. Where GDPR applies, Article 6 (1), lit. (f) GDPR is the legal basis for processing your personal data, which, under certain conditions, justifies the processing of data for the purposes of safeguarding the legitimate interests of the responsible body. The legitimate interests of TCCC and your local entity in this context include to ensure compliance and to investigate and correct all possible compliance incidents as early as possible.

Note that all individuals you may identify through EthicsLine will in due course be informed about the fact that a report has been lodged. The information will not reveal your name or identity. In addition, all such individuals you identify will have the right to correct information reported by you and to explain their version of the events.

Data Retention Period Any information you submit that is not needed to answer your question or for the investigation of any incident will be deleted or archived if needed and as permitted by local law. In addition, once we have answered your question or any investigation is complete, all information submitted by you will be deleted or archived if needed and as permitted by local law. The Company will take adequate technical, organizational, and legal steps to secure the information you provide. It also requires NAVEX to adequately secure your personal data and not use it for any unauthorized purposes.

Data Subjects’ Rights You are entitled to data subjects’ rights to information, rectification, erasures and restrictions on processing, as well as to the right to object according to Article 21 GDPR.

Contacting us Please feel free to ask us questions. To exercise one of the data subjects’ rights or to request a copy of any report you submit or to correct any information you have provided to the Company, you may contact us at compliance@coca-cola.com.

You may also contact the data protection officer responsible for your country or region, if applicable. The privacy office can be contacted via email: privacypolicy@coca-cola.com.

You also have the right at all times to lodge a complaint with a supervisory authority competent for your country or region.