Supplier and Partner Code of Conduct

This Code applies to every supplier, subcontractor, associate, consultant, collaborator, and delivery partner engaged by Symolem Limited: anyone whose work, products, or services contribute to what we deliver or how we operate. It applies for the duration of an engagement and, where obligations by their nature survive (confidentiality, data protection, record-keeping), beyond it. Agreeing to work with us means agreeing to this Code. It complements, and does not replace, the contractual terms of any engagement; where this Code and a contract differ, the stricter provision applies. Where a supplier's own standards are stricter than ours, we welcome them and expect them to be maintained.

We advise businesses on accountability across their value chains. Our own value chain is short, but the principle does not scale down: what we expect of a global brand's supplier base, we expect of our own. This Code is how we make that expectation explicit and contractual rather than assumed. It is published because our clients and partners are entitled to know the standards behind the work we deliver to them.

Suppliers must comply with all laws and regulations applicable to their business and to the work they perform for us, in every jurisdiction where that work is performed. This includes, without limitation: employment and labour law, health and safety law, environmental law, data protection law, tax law, anti-corruption law, competition law, and export controls and sanctions regimes. Where our work involves regulated subject matter, such as product compliance, textiles, waste, or cross-border material flows, suppliers must hold any licences, registrations, or permits their role requires and produce evidence of them on request.

Suppliers must respect internationally recognised human rights, consistent with the UN Guiding Principles on Business and Human Rights, the ILO Declaration on Fundamental Principles and Rights at Work, and the UK Modern Slavery Act 2015. Specifically:

• Forced labour. No use of forced, bonded, indentured, or trafficked labour in any form. Workers must not be required to surrender identity documents or pay recruitment fees, and must be free to leave employment with reasonable notice.
• Child labour. No employment of children below the legal minimum working age in the jurisdiction concerned or below the age for completing compulsory education, whichever is higher. Workers under 18 must not perform hazardous work.
• Wages and hours. Workers must receive at least the legal minimum wage and legally mandated benefits, paid regularly and documented clearly. Working hours must comply with applicable law, and overtime must be voluntary and compensated as the law requires.
• Non-discrimination and dignity. No discrimination in recruitment, pay, promotion, or termination on the basis of race, ethnicity, sex, gender identity, sexual orientation, religion, disability, age, national origin, or any other protected characteristic. No harassment, abuse, intimidation, or degrading treatment of any kind.
• Freedom of association. Workers' rights to join or form trade unions and to bargain collectively must be respected where workers seek to exercise them, without retaliation.
• Health and safety. Working environments must be safe and healthy, with hazards identified and controlled, appropriate training and equipment provided, and incidents recorded and addressed.
• Grievance access. Workers must have a means of raising concerns without fear of retaliation, proportionate to the size of the supplier's operation.

Given the sector we work in, we are particularly alert to labour risk in textile-adjacent supply chains, including sorting, processing, and logistics operations in receiving markets. Suppliers operating in these areas should expect us to ask more, not less.

Suppliers must tell us before any part of our work is subcontracted onward, identify the subcontractor, and flow the substance of this Code down to them. Suppliers remain fully responsible to us for subcontracted work. Undisclosed subcontracting of our work is treated as a material breach.

Suppliers must comply with applicable environmental law and conduct their operations with care for their environmental impact. We expect suppliers to manage waste responsibly and in line with the waste hierarchy; to handle and dispose of any chemicals or hazardous materials lawfully and safely; to use energy, water, and materials efficiently where their operations make this material; and to be able to describe their environmental practices plainly and evidence them if asked, the same test we apply to any claim. We do not impose a blanket certification requirement, but where an engagement touches environmental subject matter, we may agree specific environmental requirements in the contract, and those requirements then form part of this Code's application to that engagement.

Suppliers must comply with the UK Bribery Act 2010 and all applicable anti-corruption law. No bribes, facilitation payments, kickbacks, political contributions on our behalf, or improper inducements of any kind may be offered, given, solicited, or accepted in connection with our work, directly or through intermediaries. Gifts and hospitality involving Symolem personnel must be modest, infrequent, transparent, and never offered around a procurement decision or contract negotiation. Suppliers must keep accurate books and records of transactions connected to our work, must not engage in money laundering or facilitate tax evasion, and must comply with applicable sanctions and export control regimes, including ensuring that no person or entity involved in delivering our work is a sanctioned party.

Suppliers must not make false, misleading, or unsubstantiated claims about their services, credentials, certifications, experience, or sustainability performance in connection with work for us. Suppliers must not represent Symolem, use our name, brand, or frameworks, or speak on our behalf without prior written agreement, and must not claim Symolem as a client or reference without consent. Where a supplier's output contributes to claims that we or our clients publish, whether data, analysis, measurements, or attestations, the supplier must retain the underlying evidence for that contribution and produce it on request. If a supplier becomes aware that something it supplied to us was inaccurate, it must tell us promptly, even after the engagement has ended.

Information shared for an engagement is confidential by default, whether or not a separate NDA exists, and remains confidential after the engagement ends. It may be used only for the engagement, shared only with those who need it to deliver the work, and returned or securely destroyed at the end of the engagement or on request. This applies with equal force to our clients' information, which suppliers may only ever receive under our instruction. Suppliers must respect intellectual property: ours, our clients', and third parties'. Work products created for us under an engagement are governed by the contract; our pre-existing frameworks, methodologies, and materials remain ours and may not be reused, adapted, or disclosed outside the engagement without written permission.

Suppliers handling personal data in connection with our work must comply with UK GDPR, the Data Protection Act 2018, and EU GDPR where applicable; process personal data only on our documented instructions; apply appropriate technical and organisational security measures; and not engage sub-processors for our data without our prior agreement. Any actual or suspected breach of security affecting our information or our clients' information must be reported to us without undue delay and in any event within 48 hours of the supplier becoming aware of it, with enough detail for us to meet our own legal obligations.

Suppliers using AI tools in the delivery of work for Symolem must disclose that use to us before or at the point of delivery; must not enter our confidential information, our clients' information, or personal data into AI tools that lack contractual data protection commitments appropriate to that information; must not use our information or our clients' information to train AI models; and must not present AI-generated output as independently verified human work. These expectations mirror our own published Data Ethics and Responsible AI Statement, and we apply them to suppliers because our accountability to clients does not stop at our own keyboard.

Suppliers must disclose, before an engagement begins, any interest, relationship, or concurrent work that could conflict with the work they do for us or for our clients, including financial interests in relevant companies, roles in standards bodies or industry associations that bear on the engagement, and work for our clients' competitors where it is relevant to the engagement. Conflicts arising during an engagement must be disclosed as soon as the supplier becomes aware of them. A disclosed conflict can usually be managed; an undisclosed conflict discovered during or after an engagement is grounds for termination and may affect our willingness to work together again.

Suppliers must keep accurate records of the work performed for us, and of the matters this Code addresses where they are relevant to the engagement, for at least six years or such longer period as law or contract requires. Where we, or a client of ours, reasonably need information to meet a legal or regulatory obligation, including due diligence, reporting, or audit obligations that apply to our clients, suppliers agree to cooperate with reasonable, proportionate information requests.

We apply this Code proportionately, and we are honest about what that means. For most engagements, acceptance of this Code, accurate disclosure, and honest dealing are sufficient. For engagements that are sensitive, client-facing, sustained, or higher-risk, including any engagement touching personal data, client confidential information, or labour-intensive operations, we may ask for supporting information before or during the work: policies, registrations, insurance details, references, or evidence of specific practices. Suppliers agree to answer such requests candidly and within a reasonable time.

We do not run an audit programme, and we do not pretend to. What we rely on is disclosure; what ends a relationship is concealment. Where a breach of this Code comes to light, our first response is remediation: we will raise it, hear the supplier's account, and agree corrective action with a timeframe where the breach is capable of correction. Breaches that are serious, deliberate, concealed, or uncorrected may lead to suspension or termination of the engagement, and where the law requires, to reporting to relevant authorities. Zero-tolerance matters (forced labour, child labour, bribery) are not subject to remediation timelines.

Suppliers, and workers within supplier organisations, who see conduct, ours or anyone's, that may breach this Code, the law, or a client obligation should raise it with the founder directly at lavinia@symolem.com. Concerns raised in good faith will be handled seriously, promptly, and with discretion, and will never prejudice a supplier's commercial relationship with us. If the concern involves the founder, it may be raised with the company's professional advisers.

This Code is owned by the founder and is under continuous review, alongside our Code of Conduct and our Data Ethics and Responsible AI Statement. It is formally reviewed at least annually, and the next scheduled update will follow the close of our financial year on 31 August 2026. Acceptance of a new engagement after a revision constitutes acceptance of the revised Code. Questions can be sent to lavinia@symolem.com, or via our contact page.