Business Ethics

Code of Ethics & Business Conduct · Edition 2, Revision 2 · Effective date: 3 June 2026

At VA Consulting, how we work matters as much as the results we deliver. Our Code of Ethics and Business Conduct sets the standards of integrity we expect from everyone who acts for or on behalf of the company — our people, partners and third parties alike. This page summarises the principles we live by; they are grounded in internationally recognised frameworks and apply without exception.

Contents

1. Our commitment

Our Code is the reference point for ethical conduct across everything we do: respecting the law, acting fairly and courteously, protecting the interests of clients, suppliers, institutions and the wider community, and carrying out our work with professionalism and moral integrity.

It draws on internationally recognised standards, including the Universal Declaration of Human Rights, the UN Guiding Principles on Business and Human Rights, the OECD Guidelines for Multinational Enterprises, the UN Sustainable Development Goals (Agenda 2030), the Global Reporting Initiative, and EU Directive 2019/1937 on whistleblowing. The Code applies, without exception, to directors, partners, employees, collaborators, consultants and any third party acting for the company.

2. Respect for people and human rights

We promote and protect internationally recognised human rights and fundamental freedoms — including the right to non-discrimination, to decent work, to freedom of expression, to health, to life and security, and to privacy — and we reject all forms of child, forced or compulsory labour, in line with the core ILO conventions.

We are committed to equal opportunity and to a workplace free from discrimination of any kind. We safeguard the moral and physical integrity of our people and do not tolerate abuse of authority, psychological violence, harassment, bullying or mobbing. Health and safety are planned and managed to the highest applicable standards.

3. Integrity and anti-corruption

We act lawfully and with honesty and transparency, and we have zero tolerance for corruption, public or private: money or other benefits may never be paid, accepted or promised to influence decisions or obtain improper advantage. Gifts, entertainment or hospitality that could improperly influence business decisions are neither accepted nor solicited.

We do not engage in money laundering — payments are made and received only through traceable means — and we compete fairly, in compliance with antitrust law, on the merits of our services. We make no contributions to political parties or candidates; charitable, cultural or sector donations are permitted only when authorised and properly recorded.

4. Independence, impartiality and responsible communication

As an independent advisor, we work with objectivity. The assessments and analyses we conduct with clients on suppliers, agencies and partners are based solely on merit, and no one at VA Consulting may accept fees, benefits or favours from parties being evaluated or participating in selection processes we manage.

In tenders and competitive processes we guarantee equal treatment and confidentiality to all participants. We communicate truthfully and verifiably, and we respect the intellectual property of others.

5. Conflicts of interest and company assets

Everyone must avoid situations of conflict of interest — personal, family, financial, commercial or professional — that could affect the independence of their judgement, and must disclose them promptly.

We use company assets and tools responsibly and only for legitimate business purposes, and we keep accurate, complete and timely records supported by proper documentation. Hidden funds, false or misleading entries, and invoicing for non-existent transactions are prohibited.

6. Information, data protection and cybersecurity

We protect company and client information as a valuable asset and do not disclose confidential information to unauthorised parties. We process personal data in compliance with the EU GDPR (Regulation 2016/679) and applicable national law — on the principles of lawfulness, data minimisation and purpose limitation — and we report any data breach without delay.

Everyone is responsible for cybersecurity: using strong credentials, staying alert to phishing, storing company and client data only on authorised systems, and promptly reporting any incident. On social media, personal opinions must not be attributable to VA Consulting, and the confidentiality of client projects must be preserved.

7. Responsible use of artificial intelligence

Where we use artificial-intelligence tools, we do so under human oversight, with transparency and protection of information. Every AI-assisted output is reviewed by a professional before use; confidential client or third-party data must never be entered into unauthorised AI tools; and decisions that matter to clients, our people or suppliers are never left to automated systems alone. We are committed to complying with the applicable European rules on artificial intelligence.

8. Environment, community and sustainability

We work to improve the environmental impact of our activities and to support more sustainable practices across the partners and suppliers involved in our clients’ marketing. An internal ESG Committee reviews how our ethical principles are applied.

We track ESG performance indicators — such as the share of suppliers assessed against ethical and environmental criteria, the share of our people trained on ethics and anti-corruption, the annual reduction of our environmental footprint, and the number of whistleblowing reports handled — and we use the results to update our sustainability plan each year.

9. Speaking up: reporting concerns

We ask anyone who becomes aware of a possible breach of the Code to report it. Reports can be made — confidentially — to the dedicated mailbox whistleblowing@va-consulting.com, in line with EU Directive 2019/1937 on whistleblowing.

We guarantee the confidentiality of the reporter and of the information received, and we do not tolerate any form of retaliation against those who report in good faith. Reports are assessed by our Ethics Committee; confirmed violations are addressed promptly through appropriate and proportionate measures. We also promote regular training so that everyone understands and applies these standards.