Code of business conduct and ethics

Version 1.6 · 16 August 2025 · Initial version: 6 October 2016.

1. Purpose and core principles

MENSCH operates on the principles of integrity, responsibility, professionalism, respect, and trust. How we achieve results matters as much as the results themselves. Every decision, business relationship, and technological solution must comply with the law, professional standards, and company values. This Code sets minimum standards of conduct that MENSCH expects from everyone who represents the company or takes part in its business. Our business is based on the following principles:

• Integrity. We act honestly, transparently, and consistently.
• Responsibility. We take responsibility for decisions, actions, omissions, and outcomes.
• Respect. We respect the dignity, rights, diversity, and privacy of every individual.
• Confidentiality. We protect information entrusted to us.
• Quality. We deliver solutions that meet agreed requirements and professional standards.
• Independence. We make business decisions without improper influence and conflicts of interest.
• Sustainability. We consider the long-term consequences of our activities for society and the environment. No commercial goal, deadline, client request, or instruction from a superior justifies breaking the law or this Code.

2. Scope of application

The Code applies to employees, directors, managers, founders when acting on behalf of the company, consultants, engaged specialists, interns, subcontractors, and other representatives of MENSCH. Suppliers and business partners are expected to observe comparable standards, to the extent relevant to their engagement and contractual obligations. The Code applies to activities in physical and digital environments, including remote work, official travel, meetings, events, electronic communication, and public appearances connected with the company. If local regulations provide stricter obligations, those regulations apply. If there is a difference between contractual requirements and this Code, the stricter lawful standard applies.

3. Compliance with laws and regulations

MENSCH respects applicable laws and regulations of the jurisdictions in which it operates, and binding regulations relevant to a specific project. That includes regulations on employment, tax, accounting, data protection, competition, intellectual property, consumer protection, anti-corruption, international sanctions, and trade restrictions. Everyone acting on behalf of the company must:

• understand legal and contractual obligations relevant to their work;
• seek expert advice when there is legal or ethical uncertainty;
• cooperate with competent authorities within legally prescribed limits;
• not conceal, falsify, or destroy documentation to avoid liability.

4. Human rights and dignity

MENSCH respects internationally recognised human rights and principles contained in the Universal Declaration of Human Rights and relevant conventions of the International Labour Organization. Forced labour, human trafficking, labour exploitation, unlawful child labour, retention of personal documents for coercion, and any form of physical or psychological abuse are prohibited. We respect employees' rights to lawful organisation, collective bargaining, freedom of opinion, and other rights provided by applicable legislation.

5. Equal opportunities and prohibition of discrimination

Decisions on hiring, engagement, advancement, rewards, and end of cooperation are based on objective, professional, and lawful criteria. Discrimination is prohibited on grounds of sex, gender, gender identity, sexual orientation, age, disability, health status, nationality, ethnic origin, race, skin colour, language, religion, political or other belief, family status, trade union membership, or other personal characteristic protected by law. MENSCH supports reasonable accessibility measures and adaptation of working conditions in line with individual needs and legal obligations.

6. Prevention of harassment and violence

Zero tolerance applies to sexual harassment, mobbing, intimidation, threats, physical violence, humiliation, blackmail, retaliation, and other unacceptable behaviour. The prohibition covers direct communication, email, business applications, video calls, social networks, and work-related events. Reports are considered impartially, with protection of the dignity, privacy, and rights of everyone involved.

7. Fair and safe working conditions

MENSCH is committed to respecting regulations on working time, rest, compensation, occupational safety, and health. The work environment must be organised so that risks to physical and mental health are recognised and reasonably reduced. Particular attention is paid to ergonomics, computer work, professional burnout, safety when working from home, and prevention of excessive workload.

8. Professional conduct

All representatives of MENSCH must communicate clearly, politely, responsibly, and in good faith. Intentionally misleading clients, concealing significant problems, presenting unverified claims as facts, and promising results without reasonable professional basis are prohibited. Errors are reported in a timely manner. Problems are resolved with documentation and clearly defined responsibilities.

9. Conflict of interest

A conflict of interest exists when private, financial, family, or other interests may influence or create a reasonable impression that they influence impartial performance of business duties. Potential conflicts must be reported before a relevant decision is made. No one may use a business position, confidential information, or company resources to obtain improper personal benefit. A person with a conflict of interest is excluded from decision-making when needed to protect impartiality.

10. Prevention of corruption and bribery

MENSCH prohibits directly and indirectly offering, giving, requesting, accepting, or approving bribes and other improper benefits. The prohibition covers public officials, private companies, intermediaries, consultants, family members, and related persons. Small informal payments to speed up administrative procedures (facilitation payments) are also prohibited, except action necessary to protect immediately threatened safety, with mandatory subsequent reporting. Third parties must not be used for activities that would be prohibited for the company if performed directly.

11. Gifts, hospitality, and representation

Business gifts and hospitality are permitted only when lawful, appropriate, of reasonable value, transparent, and not influencing impartial business decisions. Cash gifts, hidden commissions, and benefits conditioned on awarding business are prohibited. Particular care is required during tenders, negotiations, bid evaluation, and relations with public institutions. Gifts and representation costs are recorded according to internal rules.

12. Public procurement, tenders, and donor-funded projects

MENSCH takes part in procurement and competition procedures with respect for equal treatment, transparency, integrity, and fair competition. The following are strictly prohibited:

• price fixing and bid coordination with competitors;
• rigging tenders and market sharing;
• use of unlawfully obtained confidential information;
• false presentation of references, employees, capacity, or certificates;
• falsification of project results, work records, and costs;
• concealing links with members of evaluation committees. For projects financed from public and donor funds, applicable funder conditions are respected, including rules on eligibility of costs, procurement, reporting, retention of documentation, and audit. Double funding of the same cost is prohibited when not expressly permitted.

13. Financial integrity

All business transactions must be lawful, accurately recorded, documented, and appropriately approved. Fictitious invoices, false expenses, hidden payments, undeclared business income, and intentionally inaccurate financial reporting are prohibited. Client and donor funds are used solely in accordance with the relevant contracts and funding rules. Business and private expenses must be clearly separated.

14. Prevention of money laundering, sanctions, and international business

MENSCH does not take part in activities whose purpose is concealing the origin of unlawfully obtained funds, financing terrorism, or circumventing applicable sanctions. Before business with high-risk entities, appropriate checks of identity, ownership, reputation, and sanction status are carried out, proportionate to risk and legal obligations. International transfer of technology, software, data, and services is subject to applicable rules on sanctions, export, and trade control.

15. Protection of personal data and privacy

MENSCH processes personal data lawfully, fairly, transparently, and only for specified, legitimate purposes. Principles of data minimisation, storage limitation, accuracy, security, and accountability apply. Access to data is limited to persons who need it to perform approved tasks. Rights of data subjects are respected in accordance with applicable legislation, including the Serbian Personal Data Protection Act and the GDPR when applicable. Transfer of data between countries is carried out only with an appropriate legal basis and safeguards.

16. Information and cyber security

MENSCH applies security measures proportionate to risks and the nature of systems and information it processes. Responsibilities include protection of user accounts, access control, use of multi-factor authentication where provided, secure management of secrets and passwords, software updates, backups, and timely response to incidents. Unauthorised access to systems, sharing access credentials, disclosing confidential information, and bypassing security controls without express approval are prohibited. Any suspected security breach must be reported without delay.

17. Responsible software development

Software solutions are developed with appropriate standards of quality, security, sustainability, and documentation. Particular attention is paid to version control, review of changes, dependency management, testing, error handling, data protection, and prevention of unauthorised access. Client production systems must not be changed without appropriate authorisation and risk control. Security vulnerabilities must not be intentionally concealed from responsible persons.

18. Responsible use of artificial intelligence

MENSCH supports use of artificial intelligence when it brings verifiable benefit and when risks are reasonably assessed. Use of AI systems for unlawful discrimination, fraud, unauthorised surveillance, deceptive representation of persons, or unauthorised processing of confidential data is prohibited. Client confidential information must not be entered into external AI services without an appropriate legal basis and approval. Results of AI systems are subject to human review when they may significantly affect rights, safety, finances, or other important interests of individuals and organisations. Use of AI tools does not release responsibility for accuracy, lawfulness, and quality of work delivered.

19. Intellectual property and licences

MENSCH respects copyright, patents, trademarks, trade secrets, and third-party rights. Software, design, content, photographs, fonts, libraries, and other materials are used only in accordance with valid rights and licences. Contracts clearly govern ownership of work results, usage rights, transfer of rights, access to source code, and use of third-party components. Unauthorised copying, distribution, or appropriation of others' intellectual property is prohibited.

20. Confidentiality and trade secrets

Confidential information includes technical documentation, source code, business plans, offers, financial data, access credentials, contracts, and client information. Such information is used only for authorised business purposes and shared exclusively with persons who have a justified need for access. The duty of confidentiality continues after the end of employment or contractual relationship, in accordance with law and contract.

21. Relationship with clients

MENSCH seeks to build long-term relationships based on reliability, clear expectations, and mutual respect. Offers, contracts, deadlines, prices, limitations, and responsibilities are presented clearly and accurately. Clients are informed in a timely manner of significant changes that may affect scope, quality, security, price, or project deadlines. Unjustified withholding of data or access to pressure a client is not permitted.

22. Relationship with suppliers and subcontractors

Suppliers and subcontractors are selected on the basis of relevant criteria, including competence, quality, price, reliability, security, and ethical business conduct. MENSCH does not accept forced labour, corruption, discrimination, or serious human rights violations in its supply chain. Appropriate statements, proof of compliance, and corrective measures may be required from partners, in accordance with contract and risk assessment.

23. Fair competition

MENSCH competes on the quality of its services, professional experience, and legitimate competitive advantages. Cartel agreements, exchange of competitively sensitive information contrary to law, unlawful market restriction, and misleading market behaviour are prohibited. Information about competitors is collected only by lawful and ethical methods.

24. Political neutrality and the public sector

Company business resources are not used for unlawful financing of political activities. Personal political views of employees and associates do not represent official views of MENSCH. In relations with public institutions, politically exposed persons, and holders of public office, special care, transparency, and conflict of interest rules apply.

25. Social responsibility and environmental protection

MENSCH seeks to reduce unnecessary consumption of energy and resources, extend equipment lifetime, and encourage responsible management of electronic waste. When developing digital products, performance, infrastructure efficiency, accessibility, and long-term sustainability are considered. Socially responsible activities must not be used as cover for corruption, conflict of interest, or misleading presentation of results.

26. Protection of children and vulnerable groups

When projects include children, young people, or other vulnerable groups, MENSCH applies additional safeguards proportionate to risk. Exploitation, abuse, sexual exploitation, and inappropriate use of personal data or photographs are prohibited. Special funder and partner requirements on protection of children and prevention of sexual exploitation and abuse must be respected when applicable.

27. Public communication and reputation

Public statements on behalf of the company are made only by authorised persons. Information published on websites, social networks, in marketing materials and references must be accurate, verifiable, and consistent with the rights of clients and third parties. False presentation of partnerships, certificates, awards, references, technical capabilities, or social impact is prohibited.

28. Records, documentation, and audit

Business documentation must be kept accurately, completely, and retained in accordance with statutory, contractual, and internal deadlines. Intentional destruction, alteration, or concealment of documentation relevant to audit, investigation, dispute, or regulatory procedure is prohibited. Authorised auditors and competent authorities are given access to information in accordance with law and appropriate authorisation.

29. Reporting irregularities

Anyone who has reasonable suspicion of a breach of law or this Code may report an irregularity to a competent person in the company or use another legally provided channel. Reports may include corruption, fraud, discrimination, harassment, security breaches, misuse of data, and other serious irregularities. Reports are handled confidentially, impartially, and within a reasonable time, with respect for the legal rights of persons involved.

30. Protection of whistleblowers and prohibition of retaliation

Retaliation against persons who in good faith report an irregularity, take part in a lawful investigation, or refuse to take part in unlawful activity is prohibited. Retaliation includes threats, dismissal, demotion, unjustified denial of business opportunities, intimidation, and other harmful measures. Protection applies in accordance with law, including relevant whistleblower protection regulations.

31. Investigations and corrective measures

Suspicions of breach of the Code are considered objectively, proportionately, and with appropriate protection of confidentiality. Measures may include additional training, process change, access restriction, disciplinary measures, termination of contract, or notification of competent authorities when necessary or prescribed. Everyone to whom a report relates has the right to a fair procedure and the opportunity to present relevant facts.

32. Management responsibility

Management of MENSCH is responsible for applying and improving this Code. Managers must set an example by their conduct, prevent irregularities within their remit, and ensure that employees and associates know whom they can report problems to. No one has the right to demand breach of the Code by invoking their position or business benefit.

33. Training and familiarity with the Code

MENSCH ensures that persons to whom the Code applies are familiar with its relevant provisions. Additional training may be required for areas of increased risk, such as data protection, information security, public procurement, financial management, and protection of vulnerable groups.

34. Monitoring and periodic review

The Code is reviewed at least once a year, and when significant regulatory, organisational, or business changes require earlier revision. Amendments are approved by the competent body or authorised management of the relevant legal entity.

35. Entry into force

This Code enters into force on the day of formal adoption by the competent body of MENSCH. The Code is published or made available to employees, associates, and relevant business partners. Everyone covered by the Code is responsible for complying with its provisions within their duties.

36. Additional obligations for digital products and services

Given the nature of MENSCH's business, the following standards are of particular importance.

36.1. Security by design

Data protection and system security are considered from the start of development, not only at delivery. Security by design and privacy by design principles apply, with measures proportionate to risk.

36.2. Accessibility of digital products

MENSCH seeks to design digital products so they are usable by as wide a range of users as possible, including persons with disabilities. Relevant accessibility requirements, including WCAG when applicable, are considered when defining and implementing a project.

36.3. Ethical handling of user data

Unauthorised collection of data, covert tracking of users, use of deceptive user interface patterns (dark patterns), and intentional obstruction of exercising statutory user rights are prohibited.

36.4. Responsible testing and vulnerability disclosure

Security testing is carried out only within approved authorisations. Discovered vulnerabilities are documented and reported to responsible persons, with protection of confidential information.

36.5. Business continuity and system handover

During maintenance, migration, or end of cooperation, MENSCH acts in accordance with contractual obligations, protects data integrity, and enables appropriate handover of systems and documentation.

36.6. Responsibility for subcontractors and external services

Use of cloud infrastructure, external API services, AI providers, and subcontractors must align with contractual, security, and legal requirements of the specific project.

37. Humanitarian, development, and internationally funded projects

For projects with international organisations, donors, public institutions, and civil society organisations, additional obligations apply when relevant. MENSCH prohibits sexual exploitation and abuse, including any exchange of money, employment, goods, services, or aid for sexual services. Sexual activity with persons under 18 is prohibited in the context of safeguarding standards for such engagements, regardless of local age of consent. Abuse of position over aid beneficiaries, discriminatory denial of services, improper use of donor funds, falsification of project indicators, and concealment of serious incidents are prohibited. In work with communities and programme beneficiaries, dignity, privacy, informed consent, and the do no harm principle are respected. If a funder requires special standards on protection from sexual exploitation and abuse (PSEA), safeguarding of children, fraud prevention, or incident reporting, they are included in appropriate project procedures.

38. Additional questions of business integrity

MENSCH also applies the following rules:

• Business opportunities: employees and associates must not appropriate company business opportunities using confidential information or abuse of position.
• Donations and sponsorships: must have a lawful purpose, documented approval, and must not serve as disguised bribery.
• Business intermediaries: commissions and fees must correspond to actual, lawful, and documented services.
• Related parties: transactions with related parties must be transparent and lawful.
• Insider information: misuse of confidential information for unauthorised financial or other benefit is prohibited.
• Personal devices and remote work: business information is protected by appropriate technical and organisational measures.
• Retention and deletion of data: information is kept only as long as needed or prescribed, with appropriate deletion and archiving procedures.
• Responsible advertising: false portrayals, misleading claims, hidden commercial messages, and unfounded sustainability claims are prohibited.
• Cooperation with regulators: information is provided accurately and lawfully, with protection of the rights of the company and third parties.

39. Application, responsibility, and interpretation

This Code is the basis of MENSCH's business integrity system. Everyone acting on behalf of the company must assess whether a given activity is lawful, consistent with this Code, justified, and such that it can be explained transparently to a client, business partner, or competent authority. When there is justified doubt, the activity is postponed until appropriate clarification or approval is obtained, except when immediate action is necessary to protect life, health, or safety. No provision of this Code limits the statutory right of employees and other persons to report irregularities to competent authorities, cooperate in lawful procedures, or exercise other legally guaranteed rights. Questions about the Code may be sent to hi@mensch.rs.