HGA hereby strictly prohibits any form of retaliation against anyone who, in good faith, reports a concern or cooperates with an investigation under this Policy. Retaliation itself is a serious violation of this Policy and, in many cases, a violation of the law (for example, U.S. law explicitly forbids employers from retaliating against individuals for raising discrimination or harassment claims[10]).

Protection for Reporters and Witnesses: If you file a complaint or report of discrimination, harassment, or other misconduct, or if you provide information as a witness in an investigation, you are safeguarded by this non-retaliation policy. No supervisor, manager, client, consultant, or other person may fire, demote, harass, threaten, or otherwise “get back at” you for your role in reporting or testifying about a policy violation. This protection extends to any good-faith report, even if the investigation does not find a Policy breach. In other words, as long as you honestly believed the conduct you reported was inappropriate or unlawful, you are protected from retaliation. (This remains true even if it turns out you were mistaken about some facts or the severity of the issue – HGA wants issues reported and will not punish those who speak up out of sincere concern.)

Examples of Retaliation: Retaliation can take many forms. Obvious examples include termination, discipline, denial of further contracts or projects, blacklisting a consultant from being considered for new opportunities, salary reduction, poor performance reviews that are unjustified, or reassigning someone to a lesser role because they complained. More subtle retaliation could involve ostracizing the person, spreading rumors about them, or making their work more difficult or unpleasant. All such acts are forbidden. HGA will treat any evidence of retaliatory conduct as a separate and serious violation, subject to disciplinary action on its own.

Reporting Retaliation: If you suspect that you or someone else is being retaliated against for reporting a violation or participating in an investigation, you should report this to HGA immediately (using the same Reporting Procedure described above). Retaliation can sometimes be difficult to recognize, so we urge you to err on the side of reporting if you have any concern. HGA will investigate retaliation reports separately and will impose appropriate sanctions if retaliation is confirmed.

Consequences for Retaliators: Individuals found to have engaged in retaliation will face disciplinary measures, up to and including termination of employment or contract. In addition, acts of retaliation may expose the retaliator (and HGA) to legal liability. HGA has a zero-tolerance stance on this: we consider retaliation just as harmful as the initial misconduct. Goodyear’s policy statement captures our ethos well: the company “strictly prohibits any… retaliation against any person who, in good faith, reports concerns… or participates in an investigation”[11]. HGA fully subscribes to that principle.

False or Bad-Faith Reports: While we strongly encourage reporting, this Policy does not protect individuals who make deliberately false allegations or reports in bad faith (for example, fabricating a complaint to harm someone else or to avoid blame in a performance issue). Such conduct is itself a violation of this Policy. If an investigation reveals clear evidence that a complainant knowingly made a false accusation or provided false testimony, that individual may be subject to disciplinary action. This caveat is not intended to discourage anyone from reporting – we recognize that most reports are well-intentioned and that sometimes allegations cannot be proven. We will never punish someone for an unsubstantiated complaint as long as it was made in good faith. The purpose of this provision is only to hold accountable those rare instances of malicious reporting.

In summary, non-retaliation is absolutely guaranteed at HGA. We need everyone’s cooperation to maintain a culture where people can speak up without fear. Any breach of this non-retaliation commitment will be addressed immediately and firmly by HGA leadership.

• Official Email Use: HGA provides corporate email accounts to employees and certain contractors. These accounts (typically ending in an HGA domain) should be used for all HGA-related correspondence. Using official email ensures that communications are secured, archived, and accessible for compliance as needed. Do not use personal email addresses (Gmail, Yahoo, etc.) for business matters involving Confidential Information. If a consultant or partner does not have an HGA-issued email, they should take care to use their business-affiliated email (if any) and to implement security measures (like strong passwords and enabling encryption options) on their email accounts. Never configure an HGA email account to auto-forward to a personal account, as this could result in HGA losing control over the data. HGA’s IT team may actively block automatic forwarding rules to external domains for security.
• Email Confidentiality Notices: HGA email signatures may include a confidentiality notice. While such notices themselves do not guarantee protection, they serve to remind recipients that the content may be confidential. Users should still use discretion — do not assume that adding a disclaimer allows free sharing of sensitive info. Always verify recipients before sending: double-check email addresses, especially when sending to mailing lists or external domains, to avoid misdirected emails. If you realize you sent an email with Confidential Information to the wrong party, notify HGA Security immediately (so we can attempt remediation) and inform your supervisor; do not just recall the message and ignore the incident.
• Secure Email Practices: Use the email encryption features available. For highly sensitive information, HGA can provide encrypted email solutions or you can encrypt attachments as noted in Section 5. If you need to send a password or access token to someone, never send it in the same email as the link or file it protects. Consider using a phone call or an SMS for the password, or sending it in a separate email if absolutely necessary (and in that case, mention it vaguely, e.g., “The password is the project code plus 99” rather than writing it explicitly).
• Avoid Unapproved Communication Channels: Do not use messaging apps (WhatsApp, WeChat, Telegram, etc.) or social media to conduct official HGA business or to share Confidential Information, unless HGA has expressly approved a channel as secure and necessary. While we recognize that consultants and team members may sometimes communicate through convenient channels, any substantive transfer of documents or discussions of sensitive details should be moved to official channels (email, Platform messaging, or a recorded call). If you do use a messaging app for a quick discussion (e.g. to arrange a meeting), avoid detailed confidential specifics and ensure that the app has end-to-end encryption and that you are messaging the correct person. In no case should you create group chats or forums on external apps to discuss HGA projects without management approval.
• Document Management Systems: HGA may utilize secure document management systems (such as an internal SharePoint site, Google Workspace/Drive with enterprise controls, or other cloud collaboration tools) for storing and collaborating on documents outside of the main Platform. When using any such system, follow the access permissions as configured – do not attempt to broaden access to documents unless it is for authorized colleagues. For instance, if a folder is shared with only your project team, do not re-share individual files from it to people outside the team without permission. If you need to collaborate with someone new, ask the document owner or IT admin to grant proper access rather than sharing copies. Always prefer to use links with access control (where the recipient must log in) over sending file attachments, since links can be centrally revoked if needed. Ensure that any sync clients (like OneDrive, Google Drive backup, etc.) on your device are themselves secured (the device is not shared, and has a login).
• Local Storage and Backups: Avoid storing HGA Confidential Information on the local hard drive of personal computers or unencrypted USB drives. If you must do so (for example, working offline on a document), ensure your device is encrypted (see Section 8 on Device Security) and move the file back to the secure server or Platform as soon as feasible, then wipe the local copy. Do not leave copies in “Downloads” folders or recycle bins. If you back up data, use only IT-approved backup solutions – never back up HGA data to personal backup services. Note that HGA’s IT department performs regular backups of central systems[21], so there is rarely a need for users to create their own separate backups of emails or shared drive content. If you are worried about preserving something, contact IT rather than saving extra copies.
• Printing and Physical Documents: Only print confidential documents if absolutely necessary. Collect printouts immediately from printers, and use secure print functions (where you enter a code at the printer to release the job) if available, especially for printers in shared offices. Be mindful of printer logs and output trays – leaving a confidential report on a printer could expose it. If you prepare physical reports or binders for a client, clearly mark them “CONFIDENTIAL” and seal them during transit. Keep a record of how many copies exist and retrieve them at the end of the meeting if possible. Physical documents should be returned to HGA for secure storage or shredding when no longer needed (see Section 9 on Destruction).
• Email and Data Retention: While Section 9 details retention, note that email servers and document systems often auto-archive or delete older items as per policy. Users should not attempt to circumvent these retention settings by storing data offline or in personal locations. If something needs to be retained longer for legal reasons, notify management – don’t just squirrel away a copy. Conversely, do not delete or purge business emails and files in an attempt to hide them; records must be kept in compliance with retention rules and potential legal holds. If you receive a notice to preserve documents (for litigation or investigation), strictly follow it.

In essence, treat email and document systems as an extension of HGA’s controlled environment. Be disciplined in how you share and store files. When in doubt, consult IT or a manager about the proper way to handle a particular communication or document. By using only approved channels and being careful with how we disseminate information, we reduce the risk of a confidentiality breach.