Our whistleblowing procedure.

Purpose

Pametan Ltd (“Pametan”, “we”) is committed to operating ethically, lawfully, and honestly. We expect anyone connected with our work to do the same — and we want anyone who suspects we’re falling short, in any material way, to feel able to tell us.

This procedure exists because two things are simultaneously true. First, the most important early-warning signal a business can have is someone willing to raise a concern. Second, raising a concern at work is hard — particularly in a small company where the people involved know each other well. We’ve designed this procedure to make the second part as easy as we honestly can.

The legal framework underneath is the Public Interest Disclosure Act 1998 (PIDA), which amended the Employment Rights Act 1996. PIDA protects workers who make “protected disclosures” about certain categories of wrongdoing from being dismissed or subjected to detriment for having done so. We honour those protections — and we go further, because PIDA only protects you after something has gone wrong and you’ve raised it. We’d rather you didn’t need protecting in the first place.

Who can use this procedure

You can use this procedure if you are, or have ever been, any of the following:

• An employee of Pametan, current or former.
• A director, contractor, freelancer, agency worker or intern engaged by us.
• A supplier, sub-contractor or partner — including individuals working at those organisations.
• A job applicant.
• A client team member who has worked with Pametan on a delivery and has concerns about how that delivery was conducted.
• A member of the public who has substantive information about something we’ve done.

You don’t need to be a “worker” in the strict legal sense to raise a concern with us. You do need to act in good faith — see §Bad-faith reports.

What’s covered

This procedure is for “qualifying disclosures” as defined in PIDA, plus anything else you reasonably believe is a serious matter. PIDA lists six categories of disclosure — and we accept any one of them. A concern is in scope if you reasonably believe it shows one or more of the following:

• A criminal offence has been, is being, or is likely to be committed.
• A person has failed, is failing, or is likely to fail to comply with a legal obligation.
• A miscarriage of justice has occurred, is occurring or is likely to occur.
• The health or safety of any individual has been, is being, or is likely to be endangered.
• The environment has been, is being, or is likely to be damaged.
• Information tending to show any of the above has been, is being, or is likely to be deliberately concealed.

In addition, we accept concerns about breach of any Pametan policy — particularly the Anti-bribery and corruption policy, Modern Slavery statement, Privacy Policy, and the Supplier Code of Conduct — as well as anything else that, if true and uncorrected, would seriously damage our trust with clients, regulators or our team.

You do not need proof. You do need a reasonable belief that what you’re raising is true.

What this procedure is not for

This procedure is for matters in the public interest, broadly defined. It is not the right route for:

• Personal employment grievances about your own treatment at work — pay, promotion, working relationships, performance management. Use the grievance procedure (in the employee handbook, on request).
• Routine complaints about a Pametan service or invoice — write to hello@pametan.co.
• Complaints about a regulated financial product (we don’t sell one).

If you’re not sure which route fits, use this one. We’d rather an in-scope concern arrived via the wrong door than be lost because someone hesitated.

How to raise a concern

There are two routes. You can use whichever you’re most comfortable with. There is no expectation that you start with route 1 — but in most cases it’s the fastest way to get something resolved.

Route 1 — Direct to the Founder

Email Adam Murray (Founder) at hello@pametan.co or speak to him directly. Mark the email Confidential — Whistleblowing in the subject. The Founder will acknowledge receipt within two working days and will not share your identity with anyone else without your written consent (subject to the legal exceptions in §Anonymity & confidentiality).

Pametan is a small company without a senior management layer above the Founder, so Route 1 cannot offer an internally-independent route where the concern is about the Founder. In that case — or whenever you’d prefer not to raise the concern internally — use Route 2.

Route 2 — A prescribed external regulator

You have the right under PIDA to make a protected disclosure directly to a prescribed regulator. You don’t need to raise it with us first. This is the appropriate route if your concern is about the Founder, about anyone else senior at Pametan, or you’d simply prefer not to raise it internally. The most relevant regulators for our sector are:

• Financial Conduct Authority (FCA) — for financial-services-related concerns.
• Information Commissioner’s Office (ICO) — for data-protection concerns.
• Health and Safety Executive (HSE) — for health and safety.
• Serious Fraud Office (SFO) — for serious or complex fraud and corruption.
• The full list of prescribed bodies is published by the UK government and is also available from Protect, the UK whistleblowing charity.

A disclosure to a prescribed regulator is a protected disclosure under PIDA, provided you reasonably believe the information disclosed is substantially true and that it falls within the matters that regulator is prescribed to handle.

Anonymity and confidentiality

You can raise a concern anonymously. We will take it seriously and investigate as far as we can. The honest disadvantage of anonymity is that we can’t come back to you for the clarifying information that almost every investigation eventually needs — which sometimes means an anonymous concern goes nowhere not because we don’t believe it but because we can’t develop it.

Raising a concern in confidence — telling us who you are but asking us not to disclose your identity — is usually more effective. We will protect your identity within the limits of:

• What the law requires us to disclose (for example, in response to a court order or to a regulator with a lawful right to compel disclosure).
• What is genuinely necessary to investigate (in practice, the investigator will sometimes need to act in a way that makes your identity guessable to the subject — we will tell you in advance if that’s the case and discuss it with you).

If we ever need to disclose your identity, we will tell you first and will explain why.

Protection from detriment

Under PIDA, you are protected from dismissal and from any detrimental treatment for having made a protected disclosure. Pametan goes further as a matter of contract and culture:

• We will not subject you to any detriment — formal or informal — for raising a concern in good faith, whether or not your concern is ultimately substantiated.
• We will not require you to sign any settlement agreement, non-disclosure agreement or other contract that purports to prevent you from making a protected disclosure. Such a clause is void under PIDA.
• Any detriment you experience after raising a concern that you reasonably believe is connected to having raised it should be reported immediately — to the Founder at hello@pametan.co, or, if the detriment relates to the Founder, directly to a prescribed external regulator under PIDA. This includes detriment from clients, suppliers or third parties.

Investigation

Every concern raised under Route 1 is acknowledged in writing and recorded. The Founder decides who investigates and ensures the investigator is independent of the subject matter of the concern. If the concern is about the Founder, this procedure cannot offer an internally-independent investigation; in that case Route 2 is the appropriate route, and Pametan will cooperate fully with any external investigation that follows.

Investigations are proportionate to the seriousness of the concern. We aim to:

• Acknowledge receipt within two working days.
• Provide an initial response within four weeks setting out what we’ve done so far.
• Conclude most investigations within twelve weeks. Where that’s not possible, we’ll tell you why and give a revised expected date.

If a regulator, the police or another external body is investigating in parallel, we may pause or adjust our internal process to avoid prejudicing their work.

Possible outcomes

At the end of an investigation, possible outcomes include:

• The concern is substantiated and action is taken — a process change, a disciplinary outcome, a contract termination, a referral to a regulator or to the police.
• The concern is partially substantiated and proportionate action follows.
• The concern is not substantiated but lessons are learned and changes made.
• The concern is not substantiated and no further action is needed.

You will be told the outcome at a level of detail that is consistent with privacy, confidentiality and any ongoing external process. You may not be told everything we did, but you will be told whether we acted on what you raised.

Bad-faith reports

This procedure protects people who raise concerns in good faith — meaning that you reasonably believe the information is true at the time you raise it, even if it later turns out not to be. You don’t have to be right.

Knowingly false or malicious reports — for example, fabricating an allegation to damage a colleague — are a separate matter and may themselves be a disciplinary offence. We have not had to use this provision and we would expect to do so very rarely; we include it for completeness.

External regulators and support

• Protect — the UK whistleblowing charity. Free, confidential advice for anyone considering raising a concern. We recommend speaking to them if you’d like an independent view before deciding what to do.
• Acas — for advice on workplace rights and on the boundary between grievance procedures and whistleblowing.
• GOV.UK — Whistleblowing for employees — plain-English government guidance.
• Financial Conduct Authority — Whistleblowing.

Record keeping

We keep a record of every concern raised under this procedure, the investigation steps taken, and the outcome. Records are kept securely, with access restricted to the people who need them for investigation or oversight. They are retained for seven years from the conclusion of the matter — longer if a regulator requires it.

The Founder reviews an aggregated, anonymised summary of concerns at each annual policy review. The review never identifies individuals or specific facts that could allow identification.

Training and review

Everyone covered by this procedure receives a briefing on it within their first month at or with Pametan. The Founder reviews this procedure at least annually, and immediately following any concern that suggests the procedure itself needs to change. Each year we publish a short note on the previous year’s review — the number of concerns received (no detail), whether the procedure changed, and the date of the next review.

Contact

To raise a concern: see §How to raise a concern above. Two routes.

Questions about the procedure itself (without raising a concern): hello@pametan.co.

Pametan Ltd · Companies House No. 16023621 · Registered office: 20 Wenlock Road, London N1 7GU. This procedure is published in plain English; if you need it in an alternative format, write to hello@pametan.co. Pametan is not a financial-services firm authorised by the FCA and is therefore not subject to FCA SYSC 18; this procedure adopts SYSC 18’s principles voluntarily where they make sense for a small consultancy.