Whistleblowing
CoSustain is committed to integrity, lawful conduct, and ethical business. We encourage anyone with a genuine concern about wrongdoing connected to CoSustain to raise it, and we will treat every report seriously, fairly, and in confidence.
Offered voluntarily. The Croatian Whistleblower Protection Act requires employers with 50 or more workers to have a formal internal channel. CoSustain is below that threshold and is not legally obliged to operate one — this channel is offered voluntarily, consistent with the firm’s own advisory positioning.
Who may use this channel
Anyone connected to CoSustain’s work — current and former staff, contractors, clients, suppliers, members of our partner network, and any other person who acquires information about wrongdoing in a work-related context.
What may be reported
Breaches of EU or Croatian law, including the areas listed in Directive (EU) 2019/1937 — public procurement, financial services, money laundering, product and environmental safety, data protection, and privacy.
Fraud, bribery, corruption, or conflicts of interest.
Breaches of professional or ethical standards.
Conduct that endangers health or safety.
Any attempt to conceal the above.
This channel is for genuine concerns — not routine client-service complaints, which should go to your usual CoSustain contact.
How to report
By email:whistleblowing@cosustain.eu
By post, marked “Confidential — to be opened by the addressee only”: Petar Kostović, Common Sustainability d.o.o., Viška ulica 22, 21000 Split, Croatia.
In person: Request a confidential meeting by writing to the email address above.
You may report openly or anonymously. With your contact details, we can keep you informed; without them, we will still act on the report as far as we are able.
Confidentiality & protection from retaliation
We will protect your identity — information that could identify you will not be disclosed beyond those authorized to follow up, unless you consent or the law requires it. No one who reports in good faith will suffer retaliation of any kind, even if the concern turns out to be unfounded, provided the report was made on reasonable grounds. Knowingly false or malicious reports are not protected.
How we handle a report
Acknowledgment within seven days, where you have given us a way to reach you.
Assessment by a designated person independent of the matter reported.
A fair, objective, confidential investigation where warranted.
Feedback on the action taken within a reasonable period, and in any event within three months.
A confidential, secure record, retained no longer than necessary.
External reporting
You are not obliged to report to us first. In Croatia, the central external reporting body is the Ombudsman of the Republic of Croatia (Pučki pravobranitelj) — ombudsman.hr. Depending on the subject, other competent authorities — such as AZOP for data-protection matters — may also receive reports.
Last updated: 1st of June 2026 · Version 1.0