Speak-Up Policy | Gradio Safety LTD

// table of contents

1.  Purpose and scope2.  What to report3.  What is not covered4.  Reporting channels5.  Anonymity and confidentiality6.  Investigation process7.  Non-retaliation and protection8.  External reporting9.  Legal framework10. Roles and responsibilities11. Training and awareness12. Policy review and version history13. Contact us

1. Purpose and scope

This Speak-Up Policy enables anyone connected to Gradio Safety LTD to raise concerns about wrongdoing in a safe and structured way. It is a cornerstone of our governance framework and supports our commitment to ethical business practices.

This policy applies to:

Employees: All full-time, part-time, and temporary staff
Contractors and consultants: Anyone engaged on a contract basis
Suppliers and sub-processors: As referenced in our Supplier Code of Conduct Section 14
Clients and partners: Anyone who interacts with Gradio Safety LTD and has a concern
Former employees: Retrospective reports are accepted
Job applicants: Reports of misconduct during the recruitment process

// key principle
→ If you see something, say something
→ You do not need proof — a reasonable suspicion is enough to report
→ You will not be penalised for raising a concern in good faith
→ Your identity will be protected to the fullest extent possible
→ Retaliation against a whistleblower is itself a disciplinary offence

2. What to report

You should report any conduct that you reasonably believe constitutes wrongdoing. This includes, but is not limited to:

Category	Examples
Modern slavery and human trafficking	Forced labour, child labour, human trafficking in our operations or supply chain
Bribery and corruption	Bribery, kickbacks, facilitation payments, conflicts of interest, fraud, embezzlement
Financial misconduct	Falsifying accounts, tax evasion, misreporting revenue, unauthorised transactions
Data protection breaches	Unauthorised access to personal data, sharing data outside agreed purposes, failing to report a breach
Security vulnerabilities	Knowingly deploying vulnerable code, ignoring security findings, bypassing access controls
Health and safety violations	Unsafe working conditions, failing to provide PPE, ignoring safety procedures
Discrimination and harassment	Discrimination based on protected characteristics, sexual harassment, bullying, victimisation
Environmental damage	Illegal pollution, improper disposal of hazardous waste, ignoring environmental regulations
Sanctions violations	Doing business with sanctioned individuals, entities, or countries
AML / KYC failures	Failing to conduct proper due diligence, ignoring suspicious activity, tipping off
Consumer protection violations	Misleading pricing, false advertising, failing to honour refund rights
Misuse of company assets	Using company resources for personal gain, unauthorised use of client data or code
Retaliation against a whistleblower	Punishing, threatening, or disadvantaging someone for raising a concern under this policy

3. What is not covered

This policy is not intended for personal grievances or employment disputes. These should be raised through the following channels:

Issue type	Where to raise it	Policy reference
Personal grievance (pay, conditions, workload)	Line manager → Founder	Employment contract / HR policy
Interpersonal conflict (not harassment)	Line manager → Founder	HR dispute resolution process
Client service complaint	info@gradiosafetyltd.com	Client engagement agreement
Website bug or technical issue	info@gradiosafetyltd.com	Standard support channel

If you are unsure whether your concern falls under this policy, report it anyway. We will route it to the appropriate channel.

4. Reporting channels

We provide multiple channels for raising concerns. Choose the one you are most comfortable with:

Channel	How to use	Anonymity	Confidentiality
Email — general	info@gradiosafetyltd.com with "Confidential — Speak-Up" in the subject line	Optional — you may use an anonymous email address	Handled by the Founder only; not shared with other staff
Email — Security & Compliance Lead	Direct email to the Security & Compliance Lead (available on request)	Optional	Handled exclusively by the Security & Compliance Lead
In person	Request a private meeting with the Founder or Security & Compliance Lead	No — identity is known to the recipient	Meeting is private; notes are confidential
Anonymous report	Send a physical letter to the company registered address, marked "Private & Confidential — Speak-Up"	Yes — do not include your name or return address	Opened by the Founder only
External regulator	Report directly to a relevant regulator (see Section 8)	Per the regulator's policy	Per the regulator's policy

4.1 What to include in your report

Nature of concern: What happened, when, and where
People involved: Names or descriptions of the individuals involved (if known)
Evidence: Any supporting evidence — emails, documents, screenshots, dates (if available and safe to obtain)
Impact: Who or what is affected — people, systems, data, clients
Prior reports: Whether you have raised this before and what happened
Your contact details: Optional — only if you want us to follow up with you

// important
→ You do NOT need to have all the evidence — a reasonable suspicion is enough
→ Do NOT investigate the matter yourself or confront the individuals involved
→ Do NOT attempt to gather evidence by accessing systems you are not authorised to use
→ Do NOT discuss your concern with colleagues who are not involved in the investigation

5. Anonymity and confidentiality

We respect your right to remain anonymous. Here is how we handle anonymity and confidentiality:

Anonymous reports accepted: You can submit a report without revealing your identity. We will investigate to the extent possible based on the information provided
Confidentiality by default: If you do identify yourself, your identity is shared only with the people who need to know — typically just the Founder and/or the Security & Compliance Lead
Need-to-know basis: Information about the report is shared on a strict need-to-know basis. We will not tell your manager, colleagues, or anyone else unless required by law
Record retention: Records of reports are stored securely and separately from general HR files. Access is restricted to the Founder and Security & Compliance Lead
Identity protection: In any formal proceedings, we will seek to protect your identity unless disclosure is required by law or you consent to it
Limitations: In some cases, the nature of the report or the investigation may make it possible to infer who made the report. We will discuss this with you before proceeding if there is a risk

6. Investigation process

Every report is taken seriously and investigated thoroughly. Our investigation process:

Stage	Timeline	What happens
1. Acknowledgement	Within 2 business days	We acknowledge receipt of your report (if you provided contact details) and assign a reference number
2. Initial assessment	Within 5 business days	We assess whether the report falls under this policy, determine the severity, and decide on the investigation approach
3. Investigation	Within 14 business days	We conduct a thorough investigation — interviewing relevant people, reviewing documents, and gathering evidence
4. Findings	Within 21 business days	We document the findings, determine whether wrongdoing occurred, and recommend actions
5. Action	As soon as practicable	We implement corrective actions — disciplinary measures, process changes, policy updates, or external reporting
6. Feedback	After investigation closes	We provide feedback to the reporter (if contactable) on the outcome, subject to confidentiality constraints
7. Closure	After action and feedback	The report is formally closed. The record is retained for 6 years

// investigation principles
→ Investigations are conducted impartially and without bias
→ The person investigating has no conflict of interest with the subject of the report
→ The subject of the report is informed of the investigation at an appropriate stage (not immediately)
→ All parties are treated fairly and given an opportunity to respond
→ Investigation records are confidential and stored securely

7. Non-retaliation and protection

Gradio Safety LTD has zero tolerance for retaliation against anyone who raises a concern in good faith under this policy. Retaliation is itself a serious disciplinary offence.

Protected activity	Protection
Raising a concern in good faith	Full protection from retaliation, even if the concern turns out to be unfounded
Participating in an investigation	Full protection as a witness or witness-participant
Refusing to participate in wrongdoing	Full protection for refusing an instruction that would constitute wrongdoing
Reporting to an external regulator	Full protection under PIDA 1998 and this policy

The following are examples of retaliation and are strictly prohibited:

Dismissal, suspension, or demotion
Reduction in pay or benefits
Reassignment to less favourable duties or projects
Exclusion from meetings, communications, or opportunities
Negative performance reviews not based on actual performance
Bullying, harassment, or ostracism
Threats, intimidation, or coercion
Blacklisting or damaging references
Changing work conditions to make the role untenable (constructive dismissal)

// if you experience retaliation
→ Report it immediately through any channel in Section 4
→ Retaliation reports are treated as a separate, serious investigation
→ Retaliation is a disciplinary offence that can result in dismissal
→ You are also protected by law under the Public Interest Disclosure Act 1998

8. External reporting

If you do not feel comfortable reporting internally, or if you have reported internally and are not satisfied with the response, you have the right to report to an external regulator. The following regulators are relevant to Gradio Safety LTD:

Regulator	Jurisdiction	What they handle	Contact
Information Commissioner's Office (ICO)	UK	Data protection breaches, UK GDPR violations	ico.org.uk / 0303 123 1113
Financial Conduct Authority (FCA)	UK	Financial misconduct, AML failures, payment services	fca.org.uk / 0800 111 6768
HM Revenue & Customs (HMRC)	UK	Tax evasion, money laundering	hmrc.gov.uk / 0800 788 887
National Crime Agency (NCA)	UK	Serious and organised crime, modern slavery, human trafficking	nationalcrimeagency.gov.uk
Modern Slavery Helpline	UK	Modern slavery, forced labour, human trafficking	modernslaveryhelpline.org / 08000 121 700
Action Fraud (UK Police)	UK	Fraud, cybercrime, financial crime	actionfraud.police.uk / 0300 123 2040
Health and Safety Executive (HSE)	UK	Health and safety violations	hse.gov.uk / 0345 300 9923
Employment Tribunal	UK	Unfair dismissal, retaliation for whistleblowing	gov.uk/employment-tribunals

You are also protected if you report to your MP, the police, or the media in certain circumstances. For full details of protected disclosures, see the Public Interest Disclosure Act 1998.

9. Legal framework

This policy is aligned with the following legal frameworks:

Legislation	Relevance
Public Interest Disclosure Act 1998 (PIDA)	Protects workers who make "protected disclosures" from detrimental treatment and unfair dismissal
Enterprise and Regulatory Reform Act 2013	Extended whistleblowing protections — detriment by co-workers attributed to the employer
Modern Slavery Act 2015	Section 54 — transparency in supply chains; protection for reporting modern slavery
Bribery Act 2010	Protection for reporting bribery and corruption
UK GDPR / Data Protection Act 2018	Protection for reporting data protection breaches; whistleblower identity is personal data
Computer Misuse Act 1990	Protection for reporting unauthorised access and cybercrime
EU Whistleblower Directive (2019/1937)	EU-wide whistleblowing protection — relevant for any EU-based operations or partners

10. Roles and responsibilities

Role	Responsibility under this policy
Founder / Director	Ultimate accountability for this policy. Receives and investigates reports. Ensures no retaliation. Reports to the board on whistleblowing activity annually.
Security & Compliance Lead	Day-to-day administration. Receives reports, conducts investigations, maintains records, trains staff on this policy, reviews and updates the policy.
All managers	Must be aware of this policy, must not retaliate, must direct concerns to the appropriate channel, must support anyone who raises a concern.
All staff	Must report wrongdoing they become aware of. Must not retaliate against anyone who reports. Must cooperate with investigations.

11. Training and awareness

All staff receive training on this Speak-Up Policy as part of their induction and annual refresher training. The training covers:

What wrongdoing looks like and how to recognise it
How to report a concern and which channels are available
The protection available to whistleblowers
What retaliation is and why it is prohibited
The investigation process and what to expect
Case studies and examples

Training completion is recorded and retained for 5 years. The Security & Compliance Lead reviews and updates the training content annually.

12. Policy review and version history

This policy is reviewed annually by the Security & Compliance Lead and approved by the Founder. It may be updated at any time to reflect changes in legislation, organisational structure, or best practice.

// version history

v2.0  2026-08-28  Full rewrite — 13 sections: what to report (13 categories), reporting channels table, anonymity/confidentiality, 7-stage investigation process, non-retaliation protections, external regulators table (8 regulators), legal framework (7 acts), roles, trainingv1.0  2026-08-27  Initial placeholder

13. Contact us

To raise a concern, ask a question about this policy, or report retaliation:

Email: info@gradiosafetyltd.com
Subject line: "Confidential — Speak-Up"
Anonymous report: Physical letter to our registered address, marked "Private & Confidential — Speak-Up"
Company: Gradio Safety LTD, Company No. 17456330, 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
Related policies: Compliance Overview · Supplier Code of Conduct · Modern Slavery Act Statement · Security & Ephemeral Access Policy