1. Purpose
Subcontext wants anyone who works with us to feel able to raise concerns about wrongdoing, knowing they will be taken seriously and that they are protected under the Public Interest Disclosure Act 1998.
Raising concerns early helps us put things right before they cause harm to the people our customers serve, to our customers or to Subcontext. We would always rather hear about a concern that turns out to be unfounded than miss one that was real.
2. Who This Policy Covers
This policy applies to directors, employees, contractors, agency workers, former staff and job applicants. Anyone else who works with us, such as a supplier or a customer's staff, is also welcome to use it.
3. What to Report
Concerns about wrongdoing in our business, including:
- Criminal offences, including fraud and bribery
- Failure to meet legal or regulatory obligations
- Risks to anyone's health and safety
- Misuse of customer or personal data
- Deliberately concealing any of the above
Other examples include unsafe or misleading behaviour by our AI agents that is being ignored, damage to the environment, modern slavery in our supply chain, and security weaknesses that are not being addressed.
Personal grievances about your own employment are handled separately.
For example, a concern that your own pay has been miscalculated is a grievance. A concern that the company is deliberately underpaying people below the legal minimum wage is a whistleblowing concern.
4. How to Raise a Concern
- Raise it with any director, in person or in writing
- If you would rather not raise it internally, or it concerns the directors, you can contact a prescribed body such as the Information Commissioner's Office or the Financial Conduct Authority
- The charity Protect (protect-advice.org.uk) gives free, confidential advice
It helps if you can say what happened, when, who was involved and how you came to know about it, and share any evidence you already have. You do not need proof, and you should not investigate the matter yourself or gather evidence you are not entitled to see. A reasonable belief that wrongdoing is happening is enough.
If a concern involves a director, raise it with a different director. If it involves all of the directors, or you are not confident it will be handled properly, contact a prescribed body directly.
You can be accompanied by a colleague or a trade union representative at any meeting about your concern.
5. Confidentiality
Your identity will be kept confidential wherever possible. You can raise a concern anonymously, although this can make it harder to investigate.
Your identity will only be shared with the people who need to know to investigate the concern, and only with your agreement unless the law requires otherwise. Records are kept securely and access to them is limited.
6. Protection
Nobody will be dismissed, disciplined or treated unfairly for raising a genuine concern in good faith, even if it turns out to be mistaken. Retaliating against someone who has raised a concern is a disciplinary matter.
Unfair treatment includes being threatened, excluded, passed over for work or promotion, or having a contract ended. If you believe this has happened to you, tell a director straight away. Deliberately making a false report that you know to be untrue is a disciplinary matter.
7. What Happens Next
We will acknowledge your concern, investigate it, and tell you the outcome as far as we can while respecting the confidentiality of others.
| Step | What happens |
|---|---|
| 1. Acknowledge | We confirm receipt, normally within 5 business days |
| 2. Assess | A director who is not involved in the matter decides how to investigate it, and may arrange a meeting with you |
| 3. Investigate | The director, or an independent adviser where needed, looks into the concern. Urgent risks, such as a data breach, are acted on straight away under the Incident Response Plan |
| 4. Act | Anything found to be wrong is put right, and any disciplinary, regulatory or legal steps are taken |
| 5. Feed back | We tell you the outcome as far as we can, and explain if a full answer is not possible |
Where Subcontext has a duty to tell a regulator, a customer or an affected person about something found through an investigation, it will do so.
If you are not satisfied with how your concern was handled, you can raise it with another director or with a prescribed body.
8. Records and Review
A record is kept of each concern raised, how it was investigated and the outcome, without unnecessary detail about the person who raised it. The directors review how the policy is working at least annually.
9. Related Documents
- Anti-Bribery & Corruption Policy
- Conflicts of Interest Policy
- Equality, Diversity & Inclusion Policy
- Modern Slavery Statement
- Incident Response Plan
10. Document Control
| Item | Detail |
|---|---|
| Owner | A director of Subcontext Ltd |
| Approved by | The directors |
| Review | At least annually |
| Effective | October 2026 |