Whistleblowing policy and complaints procedure, explained

What a whistleblowing policy and a complaints procedure actually are

A whistleblowing policy and a complaints procedure often live in one document, and SKT-1 does exactly that: it is the channel a client, partner, supplier, employee or candidate uses to raise two different things, an ordinary complaint about service, and a report that someone broke the law, the company's ethics code, or another internal policy.

The distinction matters because the two get handled the same way procedurally but mean different things. A complaint is usually about outcome or service; a report of a breach is about conduct that should not have happened at all, and can be made anonymously, without the reporter ever identifying themselves.

A search for "whistleblowing policy meaning" usually wants this exact distinction: a whistleblowing channel is specifically for reporting wrongdoing, not for general dissatisfaction, and a well-built procedure like SKT-1 keeps both paths open under one channel rather than forcing a reporter to guess which document applies to them.

A customer running vendor due diligence checks for this document because its existence, and its confidentiality and anti-retaliation rules, say something about how a company would actually behave if an employee or a partner saw something wrong.

The EU threshold that decides who actually has to have one

The EU Whistleblower Directive, (EU) 2019/1937, set the deadline for public-sector bodies and private entities with 250 or more workers to have an internal reporting channel by 17 December 2021. Private entities with between 50 and 249 workers got until 17 December 2023 for the same obligation. The net effect across the whole directive is a single EU-wide minimum: 50 employees is the threshold at which an internal reporting channel becomes mandatory.

The directive lets a member state go further in two directions. It may require even a company under 50 workers to set up a channel where the sector's risk profile justifies it, for example in environmental or public health activity. Short of that, the directive's own recital says a member state may simply encourage smaller entities to set up a voluntary channel with lighter requirements, rather than mandate one.

Lithuania's Law on the Protection of Whistleblowers sets its own threshold at the same point as the EU minimum: a business entity needs at least 50 employees before the internal-channel obligation applies. One source describes this Lithuanian threshold as predating the EU directive's own deadlines; this article treats that detail as reported rather than independently confirmed against the law's original text.

UAB "Kofi Tech," the company behind Ripe Leads, employs far fewer than 50 people and sits below every version of the threshold in EU or Lithuanian law. SKT-1 exists because the company chose to adopt a channel, not because a law compelled it to.

What belongs in a complaints and reports procedure

A working procedure states two channels a reporter can actually use without needing to already know company jargon, typically email and post, each with a stated marker so the report is routed correctly rather than sitting in a general inbox. It states plainly that a report can be anonymous, and that anonymous reports are handled the same way as named ones.

It states three deadlines a reporter can hold the company to: a confirmation of receipt, a decision, and an extended deadline for a genuinely complex case, each stated in working or calendar days rather than "as soon as possible."

It names who handles a report, and, separately, who handles a report about the person who would normally handle reports, since a procedure naming only "the director" as decision-maker has no answer for a report about the director.

It states, explicitly, that no adverse consequence follows a good-faith report: no dismissal, no reduced pay, no worsened conditions, no other pressure, and that retaliation is itself treated as a breach of the procedure.

It also states how long a record of the report is kept, and who is allowed to see it. A register with no stated retention period and no stated access limit leaves a reporter unable to judge how long their own report, and their identity, stays on file after the case is closed.

What a reporter should actually expect to happen

After sending a report, a reporter should expect a confirmation of receipt within a stated number of working days, not silence until a final decision arrives. A well-built procedure states that figure rather than leaving it open.

Next, the reporter should expect the handler to gather facts and hear the people involved, and to reach a decision within a stated deadline, with a longer, clearly stated extension available for a genuinely complex case, and a notice to the reporter if that extension is used.

If contact details were given, the reporter should expect to be told the outcome, not just told that the case is closed. If the report was anonymous, the outcome typically cannot be communicated back, which is the trade-off anonymity carries.

A reporter should also expect that going to the company first is not compulsory. Under the EU and Lithuanian frameworks this kind of policy draws on, a reporter may go directly to an external authority, a labour inspectorate, a data protection authority, or a prosecutor's office, without reporting internally first.

What Ripe Leads' SKT-1 actually commits to

Ripe Leads is the trading name of UAB "Kofi Tech." Its complaints and reports procedure, document code SKT-1, covers reports from clients, partners, suppliers, employees and candidates, and implements the whistleblower channel named in the company's wider ESG statement.

SKT-1 sets two channels: an email to info@kofitech.eu with "Skundas" (complaint) or "Pranešimas" (report) in the subject line, or a letter to the registered address marked "Pranešimas" (report) on the envelope. A report may be anonymous and is handled the same way regardless. It should ideally state what happened, when, who was involved, and any evidence, though the procedure does not require all of that to be usable.

Receipt is confirmed within 3 working days where contact details are given, a decision follows within 10 working days, and a genuinely complex case can extend to 30 calendar days, with notice to the reporter. The director normally handles a report; if the report concerns the director personally, an independent lawyer or auditor appointed by the shareholder handles it instead.

No adverse consequence follows a good-faith report: no termination, no reduced fee, no worsened conditions, no other pressure, and retaliation is itself treated as a breach of the procedure. Every report is logged in a register kept for 3 years, accessible only to the director, with an annual summary, stripped of personal data, going into the company's ESG review. A reporter may also go directly to Lithuania's State Labour Inspectorate, State Data Protection Inspectorate, the prosecutor's office, or another body under the Law on the Protection of Whistleblowers, with no requirement to contact the company first. The full text sits at the SKT-1 document on the sustainability page, alongside the twelve other policies it cross-references.

Why a company below the threshold publishes one anyway, and how it stays current

A company this small has no legal duty to run a whistleblowing channel at all, under either the EU directive or Lithuania's own law. SKT-1 exists because a voluntary channel, built to the same confidentiality and anti-retaliation standard the law sets for a much larger company, is more useful to a genuine reporter than no channel at all, and more credible to a customer running due diligence than a single line promising to "take concerns seriously."

The procedure sets its own review point: the director reviews it annually and approves any change by order. It cross-references the company's ethics code and its human rights and fair work policy, since a breach of either is reportable through the same channel rather than through a separate route for each policy.

The document is published at kofitech.eu in plain HTML, alongside all thirteen documents in the same set, rather than handed out only on request.

What this document does not prove

SKT-1, and the other twelve documents in the same set, are self-authored and approved internally by UAB "Kofi Tech." They are not audited, certified or verified by any third party, and no sustainability label, badge or score is claimed anywhere in connection with them. From 27 September 2026, the Empowering Consumers Directive, (EU) 2024/825, bans a self-awarded sustainability label outright, one more reason these pages carry no badge.

A stated deadline and a stated anti-retaliation rule are not the same as a track record of reports actually handled that way. A reader who needs that evidence, rather than the company's own written procedure, should ask for it directly, because none is published here.