Whistleblowing policy

Reporting censurable conditions

Last updated: 2025-12-02

Purpose of scope
What is whistleblowing
How to report
The processing of alerts
Processing of personal data
Purpose and scope

Icehotel has established a whistleblower channel in the app Barma.

This procedure describes how employees, hired personnel, suppliers, guests, and others can report concerns about possible illegal actions and breaches that are contrary to the values and rules at Icehotel, and how such matters are handled.

The purpose of the procedure is to ensure that all incoming notifications are received and properly followed up for all parties involved, as well as to ensure a trustworthy and predictable process of handling of whistleblower cases at Icehotel. 

The purpose of the whistleblower channel and procedure for handling notification is to:  

ensure a working environment that provides a basis for a health-promoting and meaningful work situation, providing security against harmful physical and mental effects, and with a welfare standard that is always in line with the technological and social development in society,
ensure safe employment conditions and equality in working life,
facilitate openness and a good climate of expression in the company,
facilitate customizations in the employment relationship related to the employee’s individual conditions and life situation
provide a basis for the employer and the employees to care for and develop their working environment in collaboration with the social partners and with the necessary guidance and control from the public authority,
contribute to an inclusive working life.

What is whistleblowing

Whistleblowing is reporting issues of concern and suspicion of illegal conduct outside of ordinary reporting channels. Icehotel encourages everyone to speak up about conditions that could threaten the company's personnel, operations, finances, or reputation.

All employees and hired personnel have the right to report issues of concern in the company. Such issues of concern are conditions in the workplace that you have become aware of, that have a certain public interest, and that are not generally known or available.

Issues of concern are matters that are in conflict with legal regulation, written ethical guidelines in the company, or ethical norms to which there is broad support in society, for example, matters that may involve:

danger to life or health
danger to climate or environment
corruption or other financial crime
abuse of authority
unsafe working environment
breach of personal data security.

Statements about matters that only apply to the employee's own working conditions are not considered whistleblowing in accordance with this regulation unless the matters are included in the list above.

How to report concerns?

Icehotel encourages all employees to report and discuss issues of concern internally with their immediate manager or other persons in the company's management. However, if reporting concerns to line management is difficult or not possible, you may report directly to the Whistleblower Channel managed by the HR department at Icehotel. The HR department is committed to a high ethical standard and will handle all notifications confidentially.

There are three ways to contact the Whistleblower channel:

Through the Barma app if you have login access or Via the link on ICEHOTEL’s website, which leads to the reporting page. Whistleblowing | ICEHOTEL
Or send a letter to HR department, Icehotel AB, Marknadsvägen 63, 98191 Jukkasjärvi
Call 076 668 03 58 to talk to Beatrice Rongdén, HR Manager at Icehotel

The whistleblower decides what information is to be provided. However, to ensure sufficient information to be able to perform adequate follow-up actions, the reports should include as much details as possible and, if available, supporting evidence. Notifications should, as minimum provide the following:

time (period of time) and place of incident
specific information of the issue in concern and what the information is based upon
other people involved or others that may hold relevant information of the issue

Ground principles for handling reports of concerns

The basic principles of Icehotel for handling reports are:

All reports are taken seriously
Fair, open and objective follow-up
Protection of anonymous whistleblowers
Confidentiality and information security
Whistleblowers in good faith will not be subject to reprisals
Non-anonymous whistleblowers will get timely feedback and information about the process

Alerts received in the whistleblower channel

When Icehotel HR department receives a whistleblower alert, HR will send a receipt as confirmation that the alert has been received. Alerts shall receive a receipt no later than within seven days.

All incidents, allegations, or complaints reported to HR through the whistleblower channel, are marked with a reference.

Secondly, HR performs a risk assessment and quality assurance of the alert. The risk assessment involves a review and assessment of the possible consequences for Icehotel, such as reputation, staff, operations, finances, and possible sanctions - provided that the facts alleged are correct. Quality assurance involves trying to establish a dialogue with the whistleblower in order to obtain supplementary information, and possibly obtain necessary information from other sources (public registers, etc.).

The risk assessment shall also include an assessment of how to attend to the whistleblower. Whistleblowing reports on possible illegal or censurable conditions are of a sensitive character that requires a focus on personal protection and the need for confidentiality, and principles of independence, objectivity, and contradiction.

In a summary note, HR summarizes its assessments, advice, and proposals for further actions (if applicable) which will serve as the company’s basis for decision-making. If the issue is considered not to be a breach of laws or regulations, or otherwise contrary to the values at ICEHOTEL, the HR department or the relevant manager at ICEHOTEL must close the case and document the assessment.

Alerts received in “the line”

Any manager or employee in the line who receives an alert, must handle it confidentially and in accordance with this policy. This is to ensure trust in the Whistleblower channel at Icehotel. If you receive an alert, you shall:

Report to the whistleblowing channel or contact HR.
Give feedback to the person who came with the alert about what you have done.
If the severity of the alert is not considered as a whistleblower alert, please handle it accordingly or contact HR.

The identity of the reporter shall not be made known to others more than is absolutely necessary. If the nature of the case so requires, the person receiving an alert shall inform the whistleblower that the recipient may be summoned as a witness in a possible legal proceeding, and thus be required to inform the court of the whistleblower’s identity.

The person who receives a whistleblower alert shall, without undue delay, send a summary of the alert to the whistleblower channel or contact HR, so that the case can be logged for reference.

The summary must at least contain:

A summation of the content of the case
Dates (time period) and place of the event
The name/department of the reporter and the person being reported upon, if the reporter does not wish to remain anonymous
The recipient's assessment of the alert’s possible consequences for ICEHOTEL.
An overview of which follow-up actions the recipient believes are necessary, including an assessment of how the reporter can be taken care of in the best possible way during the process.

The processing of alerts

The purpose of case processing is to investigate whether there are censurable conditions or not. How extensive these investigations should be, will depend on the nature of the specific case. 

HR department assesses of the case is founded on the following principle:

All reports are taken seriously and treated as an issue of concern, including those which are anonymous
The choice of whistleblowing method shall not affect how the case is handled
All reports will be sufficiently investigated within a reasonable timeframe and in a fair, open-minded, and objective manner
The whistleblower will get timely feedback and information about the process
Any person accused of a breach of the Code has the right to be informed of the nature and cause of the accusation against them and to be heard (contradiction)
Confidentiality must be taken into account for the person whistleblowing and those subject of the alert
The employer shall initiate adequate investigations and ensure that the case is sufficiently clarified before a decision is made.
The employer shall assess whether actions to take care of the parties involved should be implemented pending a conclusion in the case.
Processing of the case must be documented in writing, and it must be concluded whether the censurable conditions have occurred
The parties shall be informed as soon as possible of the outcome of the case
In case censurable conditions have occurred, the employer shall implement mitigating actions to the extent this is appropriate
Retaliation shall not occur
The focus should be on the issue at hand, not on the person
Investigations to identify anonymous whistleblowers, shall not occur.

The HR department will perform a pre-assessment and decide how the report is to be handled and by whom. The HR department will also request timely feedback and updates and ensure all cases are being fully assessed and closed. 

The HR department will also assess whether there is a duty to inform top management and the board and enter the case into the case log.

In cases involving individuals, which contain personal data, the HR department shall ensure that these are processed in accordance with the requirements of the Personal Data Act. The reporter’s right to confidentiality, integrity and availability must be addressed throughout the process.

As far as possible, the case manager shall inform the whistleblower of the follow-up of the case. Feedback must be given that the case has been received and that the case will be processed. When the case is closed, the whistleblower should, as a general rule, be informed of the outcome. As a general rule, also the person reported upon should be informed. When the case has been processed, the person reported upon shall, as a general rule, be notified of the report's conclusions.

Rights and protection of those involved 

One of the main objectives of whistleblowing is to ensure that employees who experience censurable conditions in the workplace are empowered to speak out. It is then especially important to protect the reporter and ensure him or her a fully safe working environment. Here, the legal text is specified and, if necessary, the employer must provide measures that are suitable for preventing retaliation against the whistleblower.

Retaliation against whistleblowers who have reported in accordance with the Working Environment Act is prohibited. The person who receives the alert has a special responsibility to ensure that retaliation does not take place, and must therefore assess and clarify measures to prevent this. In this respect, the need for support or other follow-up actions must also be considered. However, factual counter-argumentation and presentation of facts that weaken or refute allegations stated, are not considered retaliation.

It is ICEHOTEL that must prove that retaliation has not taken place when an employee provides information that gives reason to believe that retaliation may have taken place.

The subject(s) of the report has, as far as there is a basis for it, the right to be heard, and give a statement or comment in whistleblower cases before a decision is made. In addition, confidentiality shall be taken into account during and after the processing of the case. Basic principles such as objectivity, notoriety, and adversarial proceedings shall be used as a basis for case processing.

Severe alert investigation

If the whistleblowing leads to an investigation, and it is considered appropriate, a separate investigation group shall be established. The investigation is normally led and carried out by HR department Icehotel, following a detailed mandate given by the management, and/or the board. Thus, the investigation is carried out by an independent and professional third party and according to recognized principles, such as independence and objectivity, and in a way that ensures that all affected parties have the opportunity to present their views on the issue at hand. HR department at ICEHOTEL shall continuously inform the board about the status and progress.

The case processing shall take place in accordance with the provisions of the Personal Data Act and the Public Administration Act's general rules on case processing. The legal security of the reporter and the person reported upon shall be safeguarded. This also includes ongoing assessments related to the time of information, involvement, and contradiction to and for the parties.

The reporter’s identity shall always be treated as confidential information. The privacy of the reporter and the person being reported upon must be safeguarded. According to the Personal Data Processing Act, the person reported upon will have the right to information about and access to, information about himself or herself and how the information is processed.

Although the identity of the reporter and the person being reported upon must be treated confidentially, it may, however, be necessary to account for both the content of the case and the reporter’s identity to other subjects related to the case. If, as a result of the whistleblower report, a duty to testify arises in the court, the duty to testify will take precedence over the principle of confidential treatment.

The head of the investigation shall, together with the Board, ensure that the need for legal advice is continuously assessed during the investigation. In addition, the need to inform others in the company (e.g. communications manager) should be assessed on an ongoing basis.

After conducting an investigation, and depending on the outcome of the investigation, a recommendation shall be given to all relevant parties to the incident to ensure adequate follow-up. If there is reason to believe that the reported issue may indicate a criminal act that will normally give rise to public prosecution, the case shall be reported to the board. The board will then decide whether the incident should be reported to the relevant police authorities. The log register shall also be updated by noting work performed, findings, recommendations, and any follow-up actions. The follow-up actions may be approved by the board.

If it is concluded that there is no factual basis in the alert, the case shall be closed without further follow-up. The reporter shall be informed that the case is closed.

All cases must be concluded with a report that describes the alert's content, case processing, conclusion, and any measures. The HR department assessment and final report are the basis for concluding the case.

Processing of personal data

Personal data shall be processed in accordance with the Personal Data Act and regulations on the processing of personal data, as well as the Working Environment Act and internal governing documents. The CEO is responsible for ensuring compliance.

The relevant department at ICEHOTEL is responsible for the implementation of internal control and information security measures on the basis of a documented risk assessment in the area of privacy. Such risk assessments are made regularly. This is to ensure that personal data is handled in accordance with the regulations when handling notification cases.

The log and all other documents must be stored electronically with limited access and otherwise maintained in a secure and confidential manner. All physical documents must be locked inside cabinets. Documents and information shall not be transferred to personnel files or other archive/case processing systems.

All individuals are required to comply with the duty of confidentiality for sensitive information and must sign a declaration of confidentiality if deemed necessary by CEO.

Deletion routines

All personal data collected during the investigation, except for the final report, shall be deleted as soon as the investigation is completed. In the final report, individuals should, as a general rule, only be mentioned by title or position. If legal proceedings follow in the wake of an investigation, the personal data shall be stored until these have been completed. The relevant department and PwC shall review deletion routines for personal information in order to verify compliance with this procedure within two months after the investigation has been completed.