Whistleblower Channel

Last updated: May 16, 2026

The Whistleblower Channel of Visto n' Visa, LLC is an institutional mechanism that is secure, confidential, and independent, designed to receive reports of conduct that is potentially unlawful, unethical, or contrary to our Code of Conduct, whether committed by employees, contractors, partners, suppliers, third parties, or by Visto n' Visa's own corporate structure.

The channel was designed in compliance with the principal legal frameworks governing compliance and whistleblower protection:

• Brazil — Federal Law 14,457/2022 (the Emprega + Mulher Program, which made whistleblower channels mandatory for companies with a CIPA internal accident prevention committee), Federal Law 12,846/2013 (Anti-Corruption Act), Decree 11,129/2022, Federal Law 13,608/2018 (Whistleblower Reward Act), and the Consolidation of Labor Laws (CLT) arts. 482 et seq.;
• European Union — Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (the Whistleblower Directive);
• United States — Sarbanes-Oxley Act (2002), Dodd-Frank Act (2010), Whistleblower Protection Act, and SEC regulations;
• United Kingdom — Public Interest Disclosure Act 1998 (PIDA).

What may be reported

The following are examples of conduct subject to the Whistleblower Channel:

• Fraud, corruption, bribery, and misappropriation of assets, in any form;
• Undisclosed conflicts of interest and improper favoritism;
• Workplace harassment — including bullying, sexual harassment, and organizational harassment;
• Discrimination based on race, ethnicity, national origin, gender, gender identity or expression, sexual orientation, age, religion, disability, socioeconomic status, or any other protected characteristic;
• Violence, intimidation, or threats in the workplace or directed at third parties;
• Money laundering, terrorism financing, or tax evasion;
• Unfair competition and anticompetitive practices;
• Violations of immigration law, unauthorized practice of law or immigration representation, or offering "services" beyond legally permissible limits;
• Personal data breaches, information security incidents, or non-compliance with the Privacy Policy;
• Breach of professional, commercial, or client confidentiality;
• Misappropriation of assets or improper use of Visto n' Visa's property, accounts, trademarks, intellectual property, or customer database;
• Deceptive commercial practices, abusive advertising, or false promises regarding visa approval;
• Retaliation against anyone who has used the Whistleblower Channel in good faith;
• Any other conduct that potentially violates applicable law, regulations, the Code of Conduct, or internal policies.

What should NOT be sent to the Channel

The Whistleblower Channel is not a commercial support channel and is not a substitute for legal advice, visa inquiries, questions about your account, or refund requests. For those purposes, please use the appropriate support channels:

• General questions and support: [email protected];
• Data subject rights (LGPD/GDPR/CCPA): [email protected];
• Consumer complaints (Brazil): also available through the consumidor.gov.br portal.

Whistleblower protections

To ensure the Channel fulfills its purpose, we guarantee:

• Absolute confidentiality with respect to the whistleblower's identity, when provided, and the content of the report, except to the extent strictly necessary for the investigation and compliance with legal obligations;
• The option of anonymous reporting, without prejudice to the review of the report. We do recommend, however, that the whistleblower identify themselves (even under confidentiality protection), as this allows us to seek clarification, request additional evidence, and provide updates on the status of the investigation;
• Zero tolerance for retaliation of any kind (dismissal, transfer, pay reduction, exclusion from opportunities, or intimidation) against whistleblowers who act in good faith, in accordance with art. 19 of Directive (EU) 2019/1937 and other applicable law;
• Independence of the investigation, with triage conducted by a team separate from the direct chain of command of any persons potentially involved;
• Compliance with data protection law, in accordance with our Privacy Policy;
• Presumption of good faith on the part of the whistleblower. Reports that are demonstrably false, frivolous, or made in bad faith may, however, subject the author to applicable legal sanctions.

How the investigation process works

1. Receipt — the report is logged in a restricted-access system.
2. Triage within 10 (ten) business days — preliminary review of admissibility, materiality, and minimum evidentiary threshold.
3. Investigation within 90 (ninety) days, extendable with justification — gathering of evidence, interviewing of relevant parties (with the whistleblower's identity protected), and documentary and technical analysis.
4. Decision — application of corrective, disciplinary, contractual, or legal measures as appropriate. If there is evidence of a criminal offense, the competent authorities will be notified.
5. Feedback to the whistleblower (when identified or when a contact channel has been provided) — general information about the outcome, consistent with applicable confidentiality obligations and the data protection rights of third parties, within a maximum of 3 (three) months from the date of registration, in accordance with Art. 9.1.f of Directive (EU) 2019/1937.

External channel (recommended for sensitive matters)

For serious reports involving members of senior management, or where the whistleblower prefers an additional layer of independence, we recommend using the external channel operated by the 1F TrustLine platform, which provides end-to-end encryption, protected identity, and independent management of the reporting workflow: