Corporate Governance & Business Ethics

According to the Organization for Economic Co-operation and Development (OECD) Principles of Corporate Governance, corporate governance constitutes the structure through which the company’s objectives are approached and set, the main risks it faces in its operation are identified, the means of attaining the goals of the company are identified, the risk management system is organized, and the monitoring of the management’s performance in implementing all the above is enabled. The Group’s Vision 2025, strategy and values are supported by individual aspects of the parent company’s governance model (Board of Directors’ Emergence & Function, Risk Management, Sustainable Development Strategy and Financial Performance).

Regulatory Compliance is a belief and commitment of the Management and aims to ensure that the Group’s overall operations are lawful and meet high standards of corporate responsibility. The HELLENIC PETROLEUM Group aims to conduct its activities in accordance with the principles of healthy competition, demonstrating zero tolerance to incidents of corruption, and to be governed by specific values and principles that apply to all aspects of corporate actions.

In this way, a climate of trust and security is fostered between the company and its stakeholders, including its employees, customers, suppliers and consumers, its shareholders and other stakeholders. At the same time, the company’s commercial position is strengthened and its reputation is consolidated.

The Code of Conduct sets out the principles that govern the Group’s activities in Greece and abroad, and determines the way in which the Group operates in order to achieve its business objectives, with the ultimate aim of ensuring its sustainability and growth. The Code of Conduct is binding for all employees of the Group in Greece and abroad, as well as for every third party that deals with the HELLENIC PETROLEUM Group.

The procedure of acceptance and reaffirmation of the said commitment is carried out regularly by the Group’s Division of Human Resources and Administrative Services and the Code has been translated into all the languages of the countries where the Group operates, as well as into English.

During a period of almost ten years of implementation of the Code of Conduct, extensive training of executives and employees of the Group companies has taken place as far as the content and key commitments of the Code are concerned. At the same time, the Regulatory Compliance Office ensures the implementation of the Code’s provisions, offering relevant advice and investigating reports or complaints regarding potential breaches of the aforementioned rules. Furthermore, the internal structure and corporate governance of the Group companies provide for adequate safeguards, partnerships of two or more persons, internal approvals and audits to prevent corruption.

The Code of Conduct is expected to be revised in 2022, as part of a broader review of the corporate governance system to comply with the latest legislative developments, which include the policy on combating violence and harassment in the workplace and the protection of persons who report or disclose information obtained in an employment context that relates to illegal acts (whistleblowing).

In order to ensure the proper and effective operation of the Company, Policies and Procedures are drawn up, within the framework of the responsibilities of the Divisions and the Departments, which are part of the Business Organization System (BOS), and are approved according to their content and scope, in accordance with the BOS Implementation Policy in force at any given time.

• Group Procurement Regulation
• Regulation for the Supply of Petroleum & Petrochemicals (Purchase, Sale, Transportation of Crude Oil and Products)
• Group Investments Regulation
• Project Implementation Regulation
• Internal Work Regulation
• Company-Level Collective Labour Agreement
• Operational Regulation of the Group’s Division of Legal Services
• Regulation of the Group’s Internal Audit Division
• Credit Policy
• Regulation on the Removal & Disposal of Useless or Surplus Equipment or Material and Sale of Assets to Third Parties
• Competition and Compliance Program Policy
• Group Personal Data Protection Policy

Tax & Customs issues for all Group companies are monitored, audited and coordinated centrally by the Group Tax & Customs Department (GT&CD). GT&CD ensures compliance with tax and customs legislation, as well as compliance, transparency and audit requirements, both in Greece and in all other countries where the Group operates, in accordance with the existing institutional framework and the Group’s practices and policies, in close cooperation with the competent authorities.

Specifically in Greece, where the Group’s main activities and the parent company are located, tax compliance is verified annually with all companies obtaining “unqualified” tax certificates issued by the auditors.

GT&CD also acts as a tax advisor to the Group, by providing suggestions and instructions, directly monitoring the developments and constant changes in the respective institutional framework, in addition to actively participating in committees and bodies for consultation and submission of additional proposals and adjustments, to the competent authorities. It also appropriately utilizes the framework for the optimization of tax cash flows and refunds, while it also examines the inclusion of investments within the framework of development laws, with the aim of optimal overall management of tax and customs issues at all levels, taking into account the respective impacts, risks and opportunities.

Since 2018, the Group has adopted a Competition Policy and Compliance Manual. This Policy reflects the Group’s ongoing commitment to comply with the provisions of Greek and European competition law, as well as the national laws of the countries in which it operates. Furthermore, the Policy aims to assist the Group’s Management, executives and employees to understand the fundamental rules of Fair Competition and their impact on the Group’s day-to-day operations and the formation of its business practices.

The implementation of the Group’s business objectives, in accordance with the rules of Fair Competition, contributes to Sustainable Development, enhances the Group’s competitiveness and prevents any violation of competition law that may expose the Group and each individual employee to the risk of severe penalties.

All activities relating to advertising and product promotion are fully in line with the Code of Conduct of the Hellenic Advertising Association and the Association of Advertising and Communication Companies (see also index 417-3). Marketing Department executives participate in training programs and seminars to keep up to date with best practices and new regulations.

The Group’s risk management system is designed to identify and manage threats and opportunities and includes safeguards and audit mechanisms at various levels within the Group, as detailed in the Annual Financial Report for Fiscal Year 2021 (pp. 238-245, 257-262, 276-279).

Part of the Internal Audit System is the Group’s Internal Audit Division (GIAD), which contributes to the improvement of the Risk Identification, Assessment and Management environment, the Internal Audit Systems and Corporate Governance, with the objective of attaining the Group’s strategic objectives.

Major actions undertaken in 2021:

• The Group-Wide Risk Assessment process was carried out for the 7th consecutive year. The work was completed by the heads of the Group’s administrative units and companies, and was coordinated by GIAD. This year, for the first time, a briefing of the Directors of the Division of Refineries on the necessity and usefulness of the Group Risk Assessment process and on the uniform way of identifying risks was carried out by GIAD executives. It is the intention of GIAD to extend this briefing to other Group Divisions in the coming years, in order to achieve a more complete mapping of risks and a more precise formulation, throughout the Group. In 2021, GIAD continued to introduce improvements to the process, based on the relevant Internal Audit Implementation Guide of the International Professional Practices Framework (IPPF). Improvements will continue in the coming years until the full implementation of the Standard is complete.
• The Quality Assurance Department of GIAD provided for the continuation of the implementation of the Quality Assurance and Improvement Program, with 2 (out of a total of 6) actions starting in 2021.
• In 2021, the audits undertaken by GIAD to ensure compliance with the relevant protection measures against the COVID-19 pandemic continued. The audits were carried out every 15 days and reports were drafted upon completion.
• The Rules of Procedure of GIAD were updated in view of the new law on Corporate Governance (Law 4706/2020). Subsequently, the Operations Manual and the “GIAD Vision-Strategy-Principles” statement were also updated.
  In addition, a total of 56 audits (42 regular and 14 ad hoc) were completed during the year, thus exceeding the audit program that was initially established. The audits were extended to areas that had not been audited in the past, such as the Refineries’ new operational performance indicators, the Safety and Environment Committees, and the coordinating organizational units, in order to provide audit coverage of all the Group’s activities.The main categories of audits carried out during 2021 are presented below:

• Finally, 1 complaint at a commercial loading facility was reviewed for improper management of numbered Tanker Car security seals and improvement actions were recommended towards optimizing management.

Internal Audits Program

HELLENIC PETROLEUM Group’s commitment to manage the personal data that come to its possession in the context of its business activities in accordance with the General Data Protection Regulation, Greek legislation and internationally recognized best practices and modern technological developments is reflected in the Personal Data Protection Policy, which applies to and is implemented by the entire Group. In order to ensure good governance on personal data issues at Group level, as well as in all organizational units and subsidiaries in Greece and abroad, a Group Data Protection Officer and Privacy Protection Officers have been appointed in each organizational unit and subsidiary. Five of the subsidiaries (EKO SA, EKO KALYPSO MEPE, ELPEFUTURE, EKO Bulgaria and OKTA) have appointed independent Data Protection Officers, who collaborate with the Group Data Protection Officer. This way, an organizational structure has been created throughout the Group in order to ensure the implementation of the applicable legislation, Personal Data Protection Policy and the individual procedures and actions by which the Policy is implemented in the context of the Group’s day-to-day activities.

The Group aims to ensure that its activity is fully in line with applicable legislation and is governed by transparency and respect for the rights of its Personnel, Customers, Suppliers and Partners.

The Group acknowledges the criticality of Information Systems Security for its sustainability and evolution, primarily for the secure operation of its facilities, but also for the digital transformation of its internal processes. Having been recognized as a BSO (Basic Services Operator) by the National Cybersecurity Authority, it is committed to harmonization and compliance with the NIS Directive (EU 2016/1148) and the relevant National Legislation (Law 4577/2018), already following best practices and investing in cutting-edge technologies in the field of Information Systems Security. For the above purposes, an employee training program is being implemented, while a technological investment action plan has been developed in order to achieve the optimal balance between business needs and security. In 2021, 480 man-hours of training on cybersecurity matters were carried out.