Whistleblower Policy

Effective date: 27th of November 2025

1. Purpose

Atmail is committed to upholding the highest standards of ethical conduct, integrity, and accountability in all aspects of its operations. This Whistleblower Policy provides a secure, confidential and accessible process for any individual, whether within or outside Atmail, to report suspected misconduct relating to Atmail without fear of retaliation. 

The purposes of this policy are to: 

• Encourage people to report concerns in good faith where there are reasonable grounds to suspect misconduct. 

• Provide clear and safe reporting channels for raising concerns. 

• Protect whistleblowers from victimisation, retaliation or other adverse outcomes. 

• Ensure disclosures are managed sensitively, impartially, confidentially and in accordance with relevant laws. 

• Support Atmail’s commitment to ethical, transparent and lawful business practices. 

• Ensure compliance with the whistleblower protection provisions of the Corporations Act 2001 (Cth) and other relevant legislation. 

 

2. Disclosures

A disclosure can be made by any person who becomes aware of potential misconduct involving Atmail. This includes: 

• Members of the public.

• Current or former employees, contractors, consultants, suppliers or partners.

• Relatives, dependants or associates of any of the above. 

• Any other individual who has knowledge or reasonable suspicion of misconduct related to Atmail. 

• A disclosure may be made regardless of whether the individual is currently involved with Atmail, was formerly involved, or has no direct connection other than becoming aware of the relevant information.

 

3. Definitions

Whistleblower 

A whistleblower is a person who, whether anonymously or not, reports or attempts to report misconduct, dishonest activity or illegal activity in connection with Atmail, and who seeks protection from reprisal for having made the report.

Reportable conduct 

Reportable conduct refers to any past, present or likely future activity, behaviour or state of affairs that is considered to involve: 

• Fraud, theft or corruption.

• Breaches of law or regulations.

• Misuse of company resources or information. 

• Unsafe, discriminatory or harassing behaviour. 

• Breaches of privacy or data protection. 

• Retaliation against a whistleblower. 

• Conduct that endangers health, safety or the environment. 

• Concealment of any such conduct. 

• Serious wrongdoing or conduct that is inconsistent with Atmail policies or codes.

Non-reportable conduct 

Not all concerns fall within the scope of this policy. The following matters are not considered reportable conduct unless they relate to victimisation for whistleblowing or form part of a broader pattern of misconduct: 

• Personal employment or workplace grievances. 

• Customer service issues. 

• Commercial disputes unrelated to unethical or unlawful behaviour. 

These matters should be raised through the relevant complaint or feedback channels.

 

4. How to make a disclosure

A disclosure may be made when the discloser knows, or has reasonable grounds to suspect, that reportable conduct has occurred or is likely to occur. For a report to be investigated, it must contain enough information to form a reasonable basis for inquiry. Whistleblowers are encouraged to provide as much detail as possible, including: 

• What happened and when. 

• Who was involved. 

• Any witnesses. 

• Any supporting evidence such as documents, emails or screenshots. 

 

A report may be made through the following channels: 

Email
Send details of the report to: [email protected] 

Mail (for anonymity)
Atmail
Level 18
324 Queen Street
Brisbane City QLD 4000
Australia

Eligible recipients under Australian law 

A disclosure may also be made to an eligible recipient as defined under the Corporations Act 2001 (Cth), including: 

• A director of Atmail. 

• A senior manager of Atmail. 

• Atmail’s auditors or actuaries. 

• A legal practitioner for the purpose of obtaining legal advice about whistleblower protections. 

• Regulatory bodies such as ASIC, APRA or the ATO. 

 

Anonymous disclosures 

A disclosure may be made anonymously. Atmail will take reasonable steps to protect the identity of an anonymous whistleblower and will not attempt to identify the individual. Anonymous whistleblowers are encouraged to provide a method of contact so that clarification can be sought if required. 

Confidentiality 

Information relating to a disclosure will be shared only on a strict need-to-know basis or where required by law. Atmail will take reasonable steps to maintain confidentiality and ensure the secure handling of all information received. 

 

5. Investigation process

Once a disclosure is received, Atmail will make an initial assessment within seven days to determine whether it qualifies for protection and whether a formal investigation is required. Where possible, Atmail will provide the discloser with updates on the progress of the matter. 

Atmail may be unable to proceed with an investigation if it cannot contact the discloser or if insufficient information has been provided to understand the allegations. In all cases, disclosures will be handled sensitively and in accordance with relevant laws. 

Investigations will be conducted in an objective, fair and independent manner. Atmail may appoint internal or external investigators, depending on the nature and seriousness of the allegations.

The investigation process may include: 

• Interviewing the whistleblower, if their identity is known and they are willing to participate 

• Documenting the allegations and notifying the respondent, where appropriate 

• Providing the respondent with an opportunity to respond 

• Obtaining witness statements and collecting relevant evidence 

• Assessing the information and making findings on whether misconduct has occurred 

• Implementing appropriate actions in accordance with Atmail’s Disciplinary Policy and any applicable laws 

Atmail reserves the right to investigate serious allegations even if the whistleblower does not pursue a formal complaint. 

 

6. Confidentiality

Atmail is committed to protecting the identity of whistleblowers and the confidentiality of any information disclosed. Whistleblowers may remain anonymous during the disclosure process and after the matter has been finalised. 

Atmail will take reasonable steps to protect the identity of a whistleblower, including: 

• Limiting access to information to authorised personnel only. 

• Storing information securely and restricting internal distribution. 

• Removing identifying details from records and correspondence. 

• Referring to the whistleblower in de-identified terms where practicable. 

 

Atmail will not disclose the identity of a whistleblower unless: 

• The whistleblower provides written consent. 

• Disclosure is required by law, such as to a regulator or law enforcement agency. 

• Disclosure is necessary to prevent a serious threat to health, safety or welfare. 

Unauthorised disclosure of a whistleblower’s identity or information likely to lead to their identification is prohibited and may constitute a breach of the Corporations Act 2001 (Cth).

 

 7. Protections for Whistleblowers 

Atmail strictly prohibits any form of retaliation, victimisation or intimidation against a person who makes a disclosure under this policy. This applies whether or not the disclosure is ultimately substantiated, provided it was made honestly and on reasonable grounds. 

Whistleblowers are protected under Australian law, including the Corporations Act 2001 (Cth) and the Taxation Administration Act 1953 (Cth). These protections may include: 

• Protection from civil, criminal and administrative liability for making a protected disclosure. 

• Protection from enforcement of contractual or other remedies that would otherwise apply to the disclosure. 

• Protection from dismissal, demotion, discrimination, harassment or other adverse treatment.

• The potential right to seek compensation if they suffer detriment because of making a protected disclosure. 

Any person who engages in detrimental conduct towards a whistleblower may be subject to disciplinary action and, where applicable, legal consequences. 

 

 8. Conclusion

This policy is reviewed annually, or sooner if required due to changes in legislation or Atmail’s structure or operations. Any updates will be published on Atmail’s website to ensure continued transparency and accessibility. 

The Atmail Board of Directors is responsible for the implementation, maintenance and oversight of this policy, and for ensuring that whistleblower protections remain effective and compliant with applicable laws.