Whistleblowing / Speaking Up Policy

Reviewed: 29 January 2026

Purpose

To enable people to raise genuine concerns about wrongdoing, risk or misconduct in or connected with UK Postbox, safely and without fear of retaliation, in line with the Public Interest Disclosure Act 1998 (PIDA).

Scope — what to report

Criminal offences; fraud, bribery or financial malpractice; breach of law or regulation; modern slavery or human rights abuse; health & safety risk; data protection or security incidents; environmental damage; miscarriage of justice; concealment of any of the above. Grievances about personal employment matters should follow the Grievance Procedure (if applicable) rather than this policy.

Speaking up channels

  • Primary: Speak Up submission (monitored by Compliance) or ethics@ukpostbox.com.
  • Alternative: line manager, HR, or the DPO for privacy/security concerns (dpo@ukpostbox.com).
  • Anonymous reporting is accepted where lawful; however, anonymity may limit our ability to investigate fully or provide feedback. We encourage reporters to provide contact details confidentially where possible.
  • Where appropriate, protected disclosures may be made to prescribed external bodies (e.g., ICO, HSE, police).

Our commitments

  • No retaliation against good‑faith reporters; disciplinary action for any victimisation.
  • Confidentiality protected as far as possible consistent with a fair investigation. The identity of the reporter will only be disclosed where required by law, with the reporter’s consent, or where necessary for a fair disciplinary process (in which case we will inform the reporter first where possible).
  • Timely response: acknowledge within 2 business days, give a named contact, complete initial triage within 5 working days, and provide progress updates where we can.
  • Fair investigation: proportionate, impartial, evidence‑based.

Process (summary)

  1. Receive and log the concern.
  2. Initial triage (scope, urgency, risk).
  3. Assign investigator(s); gather evidence. We aim to complete investigations within 30 working days where possible. Complex cases may take longer, and we will keep the reporter informed of progress.
  4. Outcome and actions: where a disclosure is substantiated, we will take appropriate action which may include disciplinary measures, policy changes, process improvements, or referral to external authorities.
  5. Feedback to reporter (within legal/privacy limits).
  6. Close and record for monitoring.

Records & protection of data

Records are kept securely with restricted access and retained for 6 years (or longer under legal hold), in line with our Data Protection Policy. If your concern involves a member of the senior leadership team, you may report directly to the Chair of the Board or to an external prescribed body. Deliberately false or malicious reports may result in disciplinary action; however, a report made in good faith that is not substantiated will not be treated as misconduct.

UK Postbox Limited

13 Freeland Park, Wareham Road, Lytchett Matravers, Poole, Dorset, BH16 6FH, United Kingdom


Support: support@ukpostbox.com

Security: security@ukpostbox.com

Legal notices: legal@ukpostbox.com

Data protection: dpo@ukpostbox.com

Complaints: complaints@ukpostbox.com

Accessibility: accessibility@ukpostbox.com

Website: www.ukpostbox.com


Registered in England and Wales Company Number: 06723381

MLR registration no: XLML00000192390

ICO registration no: ZA038907