Whistleblower Protection Policy

I. Purpose

The purpose of this policy is to establish guidelines for the protection of Whistleblowers within Ondaro LLC and its affiliates (e.g., Ondaro do Brasil Consultoria Ltda., Ondaro Canada Consulting ULC, Cask Digital Services de Mexico, S. de R.L. de C.V. Mexico, among others), which hereinafter shall be collectively referred to in this policy as “Ondaro”. This policy aims to encourage employees, contractors, subcontractors, vendors, suppliers, and any other third-party to report Unethical Behavior, Risk Events, violations of company policies, and illegal activities without fear of retaliation.

II. Policy Statement

Ondaro is committed to maintaining the highest standards of integrity and ethical behavior. The company encourages the reporting of any suspected Unethical Behavior, Risk Events, violations of company policies, and illegal activities. Ondaro will protect Whistleblowers from retaliation and ensure that all reports are thoroughly investigated.

III. Scope

This policy applies to all employees (including individuals engaged directly or through any employer of record), contractors, and third-party service providers of Ondaro. It covers the reporting of any suspected Unethical Behavior, Risk Events, violations of company policies, and illegal activities.

IV. Definitions

• Whistleblower: An individual who reports a Reportable Concern.
• Retaliation: Any direct or indirect adverse action taken against a whistleblower as a consequence of their report. This may include, but is not limited to, termination, demotion, harassment, intimidation or discriminatory treatment.
• Unethical Behavior: Conduct that violates Ondaro's Code of Conduct, core values, or accepted professional standards. This includes, conflicts of interest, misuse of company resources, discrimination, fraud, corruption, or any other behavior that compromises integrity or accountability.
• Risk Events: situations or facts that may give rise to improper conduct or to violations of applicable legal, regulatory, or internal Company rules.
• Reportable Concerns: Includes Unethical Behavior, Risk Events, violations of company policies, and illegal or dishonest activities. This term is used throughout this policy to refer collectively to these issues.
• Reporting Channels: the communication mechanisms made available by the Company to address questions regarding the application of the Ethics and Compliance Program Manual and to report potential Risk Events or violations of the Ethics and Compliance Program.

V. Responsibilities

A. Senior Management

• Ensure the effective implementation and consistent enforcement of this policy across all levels of the organization.
• Provide support and resources.
• Lead by example and demonstrate a commitment to ethical behavior and compliance.

B. Ethics and Compliance Officer

• Monitor compliance with this policy.
• Review and authorize any exceptions to the policy, ensuring they are properly justified and documented.
• Conduct regular reviews and audits to ensure adherence to the policy and to identify opportunities for improvement.
• Oversee the investigation of whistleblower reports and inform senior management.
• Support the establishment of channels for reporting complaints for all employees and make sure to be the channel of reporting when those complaints involve officers or directors.
• Align with Human Resources Department to recommend disciplinary or remedial actions as necessary.

C. Department Heads

• Promote awareness of this policy among the employees and ensure they comply with this policy in daily operations.
• Support and protect Whistleblowers within their departments.
• Serve as an example of ethical conduct and integrity.
• Listen without judgement and handle concerns with professionalism and sensitivity, avoiding making assumptions, dismissive remarks or retaliatory comments.
• Serve as a liaison to promptly escalate any reported concerns or observed misconduct to Compliance.

D. Employees

• Report any suspected Reportable Concerns to the Ethics and Compliance Officer or through the Reporting Channels.
• Cooperate with investigations and maintain confidentiality.

VI. Reporting Channels

Ondaro has established a secure and confidential Reporting Channels that allows Whistleblowers to report suspected Reportable Concerns anonymously and has ensured that the Reporting Channels are easily accessible to all employees, contractors, and third-party service providers.

Whistleblowers can report suspected Reportable Concerns through the following channels:

• Web Intake Site: ondaro.ethicspoint.com
• Mobile Intake Site: ondaromobile.ethicspoint.com
• Hotline: 1-833-718-5740
• Email: ethics@ondarowave.com

While Ondaro encourages the use of internal reporting channels, Whistleblowers have the right to report concerns directly to external regulatory or enforcement authorities, as permitted by law. Ondaro strictly prohibits retaliation against any individual who chooses to report externally in good faith.

VII. Escalation Protocol

If the report involves the Ethics and Compliance Officer, the Whistleblower may escalate the concern directly to the CEO at jeff.gregory@ondarowave.com. An independent external investigator should be appointed by the CEO to ensure impartiality.

Ondaro guarantees that escalated reports will receive the same level of protection against retaliation and confidentiality as all other reports.

VIII. Protection Against Retaliation and Confidentiality

Ondaro strictly prohibits retaliation against Whistleblowers. Any form of retaliation – whether direct or indirect – constitutes a serious violation of this policy and will result in disciplinary action, up to and including termination of employment.

The identity of Whistleblowers will be kept confidential to the greatest extent possible, consistent with the need to conduct a thorough investigation and comply with legal requirements.

Ondaro’s commitment to non-retaliation applies not only to Whistleblowers but also to any individual who, in good faith, participates in an investigation or provides relevant information. Retaliation against witnesses, investigators, or collaborators will be treated as a serious violation of this policy and may result in disciplinary action, up to and including termination.

IX. Investigations on Reports

All reported Reportable Concerns will be treated, investigated and process as a Risk Event, according to the Ethics and Compliance Program Manual.

X. Training and Awareness

Ondaro will conduct regular training and awareness initiatives of this policy per the Training and Awareness Policy, to reinforce the protection of Whistleblowers.

Training and awareness initiatives may include internal communications, live or virtual training sessions, interactive workshops, e-learning modules, and periodic campaigns delivered through newsletters, intranet postings, and visual materials.

XI. Effective Date

This policy is effective as of April 1st, 2026 and will remain in effect until amended or revoked by senior management.

XII. Versions