Whistleblowing policy

Last updated: September 14, 2026

Operating entity: Travaela - Online Bookings & Web Systems Ltd. ("Travaela", "Goferry", "we", "us", or "our")

Applicable legal framework: EU Directive 2019/1937 on the Protection of Persons Who Report Breaches of Union Law & Cypriot Transposition Law (Law 6(I)/2022).

1. Purpose & core principles

At goferry, operated by Travaela Ltd. (registered in Cyprus), we promote a culture of openness, integrity, and accountability. We encourage all individuals connected to our operations to speak up about potential wrongdoing, unlawful behavior, or ethical breaches.

This policy provides a secure, confidential framework for reporting concerns without fear of retaliation, dismissal, or discrimination.

2. Who is protected?

This policy protects anyone who acquires information about breaches in a work-related context, including:

• Current and former employees, directors, and officers.

• Shareholders, board members, and members of administrative bodies.

• Self-employed contractors, freelancers, consultants, and agency workers.

• Employees of suppliers, sub-contractors, and business partners.

• Job applicants, trainees, and volunteers.

• Third parties connected to the whistleblower (e.g., colleagues or relatives up to the fourth degree) who could face work-related retaliation.

3. Scope of reportable misconduct

You may report any activity that constitutes a breach of EU or national law, or a serious risk to the public interest, including:

• Financial integrity: Tax evasion, money laundering, accounting fraud, bribery, or corruption.

• Data security & privacy: Serious breaches of GDPR, unauthorized access to user data, or cyber incidents.

• Consumer & transport safety: Non-compliance with maritime transport safety standards or consumer protection laws.

• Market & environmental integrity: Anti-competitive behavior, environmental damage, or public procurement violations.

• Workplace safety: Workplace health and safety breaches, severe harassment, or unlawful discrimination.

Note: Personal employment grievances (e.g., individual salary disputes or routine interpersonal conflict) fall outside this policy and should be submitted directly to Human Resources.

4. How to submit a report

Goferry provides multiple reporting channels:

• Digital submissions: Email whistleblowing@go-ferry.com

• Postal submissions: Send a sealed confidential letter marked "Strictly Confidential - Attention: Whistleblowing Compliance Officer" to: Travaela Ltd., Regulatory Compliance Division, 4-6, Louki Akrita Avenue, Pedieos Block C, App. 32, 1100 Nicosia, Cyprus

• In-person meetings: You may request a physical or virtual meeting with the designated Whistleblowing Compliance Officer by emailing whistleblowing@go-ferry.com

• Anonymous reporting: Reports may be filed anonymously. If you choose to reveal your identity, it will remain confidential and accessible only to designated compliance personnel.

5. Evidentiary standards & fair use

• Reasonable suspicion: You do not need absolute proof to make a report. Expressing an honest suspicion based on factual grounds at the time of reporting is sufficient for protection.

• Prohibition of malicious reports: Deliberately submitting false, speculative, or malicious reports is strictly prohibited. Misuse of the whistleblowing system may lead to internal disciplinary action or external legal sanctions under national law.

6. Investigation timelines & procedure

All reports are managed by an impartial Whistleblowing Officer under clear statutory deadlines:

1. Acknowledgment (7 days): You will receive confirmation of receipt within 7 days.

2. Impartial assessment: The Whistleblowing Officer assesses whether the report falls under this policy and conducts an investigation.

3. Formal feedback (3 months): You will receive a summary of the investigation results and any remedial steps taken within 3 months of the acknowledgment.

7. Strict non-retaliation guarantee

Goferry maintains a zero-tolerance policy regarding retaliation. Whistleblowers who act in good faith are fully protected against:

• Termination, suspension, lay-offs, or demotion.

• Reduction in pay, changes in working hours, or denial of promotion.

• Harassment, intimidation, formal warnings, or negative performance evaluations.

• Cancellation of vendor or supplier contracts.

Any adverse action taken against a whistleblower is presumed to be retaliatory unless the company proves otherwise. Anyone engaging in retaliatory behavior will face severe disciplinary action and potential criminal prosecution under EU or national law.

8. External reporting authorities

While internal resolution is recommended, you have the statutory right under Cypriot Law 6(I)/2022 and EU Directive 2019/1937 to report breaches directly to external national oversight bodies (such as the Ministry of Justice and Public Order or the Cyprus Public Audit Oversight Board - CyPAOB) or competent EU institutions such as the European Anti-Fraud Office (OLAF).