Coor Service Management Holding AB

Governance roles

Reference: pages 63-66, 68, 78-79 (incorporated by reference to the Corporate Governance Report).

The Board of Directors has "ultimate responsibility for overseeing and monitoring the company's sustainability management" and receives regular reports on sustainability matters and targets. The Board "is actively engaged in the company's double materiality assessment, and the VP Head of Group Sustainability presents Coor's material impacts, risks and opportunities to the Board annually" (page 78).

The Executive Management Team handles operational implementation and follow-up. An ESG Board, chaired by the CFO and convened by the VP Head of Group Sustainability, also includes heads of sustainability from each country, the HR Director, Procurement Manager, Chief Legal Counsel, Communications Director, Compliance Officer and Head of Operational Development (page 79).

Board composition: seven external members plus three workers' representatives; 57% of external members are women, 43% men; 100% are independent of major shareholders and of the company (page 79). The Audit Committee follows up sustainability, risk management, internal controls and reporting.

Information provided to and sustainability matters addressed

Reference: pages 63-66, 68, 78-79.

At Board level, "sustainability matters are addressed on a regular basis, with a particular focus on strategic decisions and risk management related to environmental, social and governance matters" (page 78). During annual strategy meetings, the Board "discusses the sustainability strategy, and reviews and approves the company's overall sustainability strategy, monitoring of results, and actions to address potential risks and opportunities."

The VP Head of Group Sustainability reports directly to the CFO and indirectly to the Audit Committee and the Board (page 79). The ESG Board oversees identification and management of material IROs, prepares targets and follows up progress; formal decisions rest with the Executive Management Team and the Board. Due diligence is coordinated by the CFO with cross-functional input from Procurement, Sustainability, Business Development and Legal (page 80).

Integration of sustainability-related performance in incentive schemes

Reference: pages 79-80.

"Currently, 40 per cent of the bonus model consists of non-financial sustainability targets, including the Employee Motivation Index, TRIF and the share of suppliers validated by the SBTi." Climate-related targets linked to the share of SBTi-validated suppliers account for 10 per cent of annual bonuses. Coor also runs long-term share-based incentive programmes with a three-year performance period including both financial and environmental performance targets (page 79).

A distinct climate-linked financial mechanism: "Coor has ESG-linked loans, with interest on the loan linked to the outcome of our climate targets. This means that our financial conditions are directly linked to our climate work, providing a clear economic incentive" (page 80). Vested-model partnerships also carry incentive structures linked to emission reductions.

Statement on due diligence

Reference: page 80.

"Due diligence is integrated into Coor's governance and is coordinated by the CFO, with reporting to the Executive Management Team and the Board. The work is cross-functional: Procurement is responsible for the supply chain, Sustainability develops methodologies and conducts follow-ups, Business Development handles customer-related risks and Legal is responsible for information security."

A due-diligence core-elements table maps each element to its location in the statement (page 80): (a) embedding in governance/strategy/business model - GOV-2, GOV-4, SBM-1 (pp.79-82); (b) engaging affected stakeholders - GOV-2, SBM-2, S1, S2, G1 (pp.79, 83-84, 105, 114, 123); (c) identifying and assessing adverse impacts - IRO-1, topical SBM-3s (pp.85-89, 92-93, 104-105, 112-113); (d) taking action - pp.94, 106-107, 113-115; (e) tracking effectiveness - pp.95-96, 109, 116, 123-124.

Risk management and internal controls over sustainability reporting

Reference: pages 69-70, 80.

Coor "has developed a systematic approach to managing sustainability risks and opportunities. This approach includes risk assessments in areas such as climate impact, human rights and governance matters." The process is "integrated into the company's strategic planning" (page 80).

The Board of Directors has ultimate responsibility for risk and internal control and has appointed an Audit Committee to oversee the control systems. "The system is designed according to the COSO framework and covers control environment, risk assessment, control activities, information and communication, and monitoring." Internal control of sustainability data rests on "clear definitions of data components and source systems, process descriptions and feasibility assessments against comparative periods as well as the assessment and approval of the operational manager" (page 80).

Strategy, business model and value chain

Reference: pages 81-82.

Coor is "a leading facility management services company in the Nordic region," delivering cleaning, property management, workplace services, and food and beverages through a decentralised business model. "Over 90 per cent of all purchased goods and services fulfil Coor's environmental, social and governance sustainability standards" (page 82).

Value chain: upstream covers suppliers of primary services, materials, equipment and food; downstream covers customers and end consumers across the public sector, telecom and IT, industry and energy, transportation and logistics, banking and finance, property companies and retail. Four key value chains were mapped by business area (page 82). Total Group employees on 31 December 2025: 11,934 (page 81). Per Appendix 3/SBM-1 datapoints, involvement in fossil fuel, chemical production, controversial weapons and tobacco activities is marked Not material (page 126).

Interests and views of stakeholders

Reference: pages 83-84.

Key stakeholder groups: employees, customers, potential customers, suppliers, trade unions, authorities, stakeholder organisations (e.g. IFMA, NMC), and investors and analysts (page 84 table). Engagement methods per group include workplace meetings and employee surveys; customer visits and surveys; supplier monitoring and digital tools; trade union liaison meetings; and annual/interim/sustainability reports for investors.

"External consultants helped to conduct in-depth stakeholder dialogues in 2022 that provided valuable insights into relevant sustainability matters. These dialogues have continued" (page 83). "The Board receives regular reports on stakeholder expectations in connection with strategy meetings and quarterly follow-ups. Nothing was identified in 2025 that led to revisions to the business model."

Material impacts, risks and opportunities and their interaction with strategy and business model

Reference: page 90; per-topic tables pages 88-89, 91-92, 103, 112, 117, 119.

"Coor's double materiality assessment identified a number of material sustainability matters, including positive and negative impacts, risks and opportunities, for the entire value chain. The material IROs pertain to Coor's service-based business model (cleaning, property management, food and beverages, workplace services)" (page 90).

The sustainability topics deemed material are: E1 Climate change, S1 Own workforce, S2 Workers in the value chain, S4 Consumers and end-users and G1 Business conduct (page 87). "We are currently unable to identify any actual material impacts on Coor's flexible business model, strategy and overall value chain... Nor were any entity-specific IROs identified" (page 90). The SBM-3 paragraph 48(e) anticipated financial effects datapoint is phased in (page 78).

Description of the processes to identify and assess material impacts, risks and opportunities

Reference: pages 85-89.

A four-step process: (1) mapping of value chain and stakeholders; (2) assessment of impact on the environment and people, by business area then consolidated Group-wide; (3) assessment of financial materiality at Group level via Coor's ERM model; (4) decisions on material matters, validated by the ESG Board with final review by Executive Management and the Board (page 86).

Thresholds: an impact is material "if the severity is high or if the likelihood is at least moderate (3 out of 5). For human rights, severity is prioritised over likelihood" (page 87). A risk/opportunity is material "if it has at least a moderate financial effect (greater than 3 on the scale) and the likelihood is at least 2 out of 5."

Climate scenarios: IPCC RCP 1.9 and RCP 4.5, time horizon 1-3 years; "Coor plans to also apply a high-risk scenario (RCP 8.9) and a longer time horizon... for the next financial year" (page 86). Climate-specific risk identification and scenario analysis is also presented under E1-2 (2025 ESRS numbering).

Disclosure requirements in ESRS covered by the undertaking's sustainability statement

Reference: page 87; Appendix pages 125-131.

"The sustainability topics deemed to be material are: E1 Climate change, S1 Own workforce, S2 Workers in the value chain, S4 Consumers and end-users and G1 Business conduct. Coor is applying the phase-in provisions for the topic S4 Consumers and end-users, and therefore only provides an overall description of its material impacts... in this area" (page 87).

"E2 Pollution, E3 Water and marine resources, E4 Biodiversity and ecosystems, and E5 Resource use and circular economy are part of the double materiality assessment but were below the materiality threshold values" (page 87). The ESRS index (Appendix, pp.125-131) lists each disclosure requirement and datapoint with its Material/Not material status and page reference, plus SFDR, Pillar 3, Benchmark Regulation and EU Climate Law cross-references.

Transition plan for climate change mitigation

Reference: pages 94-95.

"Coor's transition plan was developed in conjunction with the external SBTi validation of our net-zero commitment in 2022, and the plan was set out in practice in 2024. The Board has approved the transition plan and regularly follows up how work is progressing" (page 94).

Six decarbonisation levers, the first three driving emission reductions and the last three enabling them: (1) electrification and energy efficiencies; (2) circular material flows; (3) climate-smart food/reduced food waste; (4) technology and business innovation; (5) partnerships and supplier collaboration; (6) green financing (ESG-linked loans) (page 94).

Resources: "Our activities to reduce GHG emissions have been driven by our workforce and have so far not required any major operating expenditure (OpEx)," while CapEx of SEK 70 million was invested in vehicle-fleet electrification and charging infrastructure (page 95). "We have no locked-in GHG emissions in our operations" (page 95).

Identification of climate-related risks and scenario analysis

Back-filled from ESRS 2 IRO-1 and the E1 resilience/scenario-analysis subsection, disclosed in the FY2025 report (pages 86-87, 92-93). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Scenarios used: IPCC RCP 1.9 (below 1.5degC, limited warming) and RCP 4.5 (increased extreme weather, heatwaves, flooding risk in the Nordic region), assessed over a 1-3 year time horizon aligned with Coor's ERM and business planning (pages 86, 92-93). "Scenario 1 (1.5degC) is assessed as having a high likelihood of occurring within one to three years and having limited physical impacts, but involving high transition requirements. Scenario 2 (RCP 4.5) has a low likelihood within the same time horizon, and was therefore excluded from Coor's resilience analysis" (page 93).

Scope: the Nordic region and the most significant parts of the upstream and downstream value chain. Transition risks (regulatory change, customer demand) "have been assessed as material for Coor," while physical risks have not yet been assessed as material given the short time horizon (page 92). Coor "plans to also apply a high-risk scenario (RCP 8.9) and a longer time horizon" next year (page 86).

Resilience in relation to climate change

Back-filled from ESRS 2 IRO-1/SBM-3 and the E1 resilience-analysis subsection, disclosed in the FY2025 report (pages 86, 92-93). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

"Coor continuously evaluates its ability to adapt its strategy and business model to changing climate conditions... The resilience analysis is an integral part of Coor's central risk management process (ERM) and strategic planning" (page 92).

"The dominant risk in the assumed time perspective is transition risk: if Coor fails to meet customers' sustainability requirements, it could lose business... The assessment is that Coor's investments in energy efficiency, fossil-free transportation, climate-friendly solutions and emissions reductions address this risk. Overall, Coor's strategy is considered adaptive and resilient. However, further changes are needed to meet long-term climate challenges and achieve the net-zero target" (page 93). Food and Beverages is named as the area needing the greatest effort to reach climate-neutral delivery (page 93).

Policies related to climate change mitigation and adaptation

Reference: pages 93-94.

Sustainability Policy and Environmental and Climate Policy, both Group-wide, approved by the Executive Management Team and owned by the VP Head of Group Sustainability, applying to all employees, directors, suppliers, customers and contract staff (page 93).

Commitments: "Strive to achieve net-zero emissions throughout the value chain by 2040, in line with the Paris Agreement and the SBTi"; "Reduce environmental and climate impacts through resource efficiency, a transition to renewable energy and circular material flows"; "Integrate environmental and climate matters into daily decisions, purchasing, the choice of suppliers and the development of new services"; "Follow the precautionary principle and have a preventive approach to environmental risks" (page 94). Compliance is followed up via ISO 14001 audits and KPI monitoring.

Actions and resources in relation to climate change policies

Reference: pages 94-96.

Scope 1 & 2: gradual vehicle-fleet electrification (using HVO during the transition) and a shift to 100% renewable electricity contracts; renewable electricity share rose from 77% to 87% in 2025, contributing to a 54% reduction in Scope 1 and 2 (market-based) emissions since the 2018 base year (page 96).

Scope 3: supplier engagement toward SBTi-validated targets - 48% of suppliers validated in 2025 against a 20% target; reduced climate impact from food, down 37% per kg of purchased ingredients since 2018 (goal: 30%), driven by more plant-based meals and regeneratively grown coffee (page 96).

Cross-cutting actions: improved climate data/reporting tools; customer-facing tools Envirosense and Carbon Insight; a pilot on reducing plastics in cleaning and increasing circularity in the property sector (page 96). Investment: SEK 70 million CapEx for EV purchases and charging infrastructure in 2025; no significant OpEx (page 95).

Targets related to climate change mitigation and adaptation

Reference: pages 95-97.

SBTi-validated targets, aligned with the Paris Agreement's 1.5degC pathway. Short-term (2025): halve Scope 1 and 2 emissions vs the 2018 base year; 75% of suppliers/upstream transportation emissions covered by SBTi-validated targets by end-2026; 30% reduction in food and beverage emissions (kg CO2eq/kg) vs 2018. Medium-term (2030): 75% reduction in Scope 1 and 2; 58% reduction in food and beverage emissions. Long-term (2040): net-zero across the value chain, a 90% absolute reduction in all three scopes, with the remaining 10% offset through high-value carbon credits (pages 95-96).

Progress table (page 96): Scope 1&2 fell from 4,180 tCO2e (2018 base) to 2,090 tCO2e in 2025 (-50%), against a 2030 target of 1,045 tCO2e; food intensity fell from 2.82 to 1.97 kgCO2eq/kg (-30%), already meeting the 2025 goal; SBTi-validated suppliers reached 48% against a long-term target of 75%. Coor states it "is not considered to be excluded from" the EU Paris-aligned Benchmarks index (page 96).

Energy consumption and mix

Reference: page 97 (Energy mix table).

All energy consumption is purchased electricity, heating and cooling; Coor "neither produces its own energy nor directly uses fuel other than for its vehicle fleet and a small stationary combustion unit operated on behalf of a customer in Finland" (page 97). 2025 is the first year reported under ESRS E1-5, so no comparative year is given.

Energy mix is based on certificates (69%), renewable energy contracts, supplier-specific mixes, or the Nordic grid mix (AIB, Energiforetagen).

Gross Scopes 1, 2, 3 and Total GHG emissions

Reference: pages 98-99 (GHG emissions table; intensity page 99).

Scope 3 is dominated by Purchased goods and services (142,380 tCO2e, 92% of Scope 3), split across cleaning, property/security, food and beverages, workplace services and other services (page 98). *The 2018 base year was restated in 2025 (+54% overall) for acquisitions and improved spend-based emissions factors (page 100).

GHG intensity: 13 tCO2eq/SEK million net revenue, both market- and location-based (page 99, net revenue SEK 12,480 million). Two-thirds of Scope 3 is calculated using spend-based methodology; only 1% is primary data (AMEX travel portal) (page 99).

Policies related to own workforce

Reference: page 105.

Six named policies, each Group-wide and applying across all countries: Sustainability Policy (VP Head of Group Sustainability, approved by Executive Management); Diversity and Inclusion Policy, covering "sex, gender identity, sexual orientation, ethnicity, skin colour, religion, political conviction, disability, age, and national and social origin," approved by the CEO; Human Rights Policy, aligned to the UNGP, ILO Declaration and OECD Guidelines, covering trafficking, forced and child labour; Safety Policy, with a "vision of zero work-related accidents," approved by the CEO; Recruitment Policy, owned by the HR Director; and Data Protection Policy (GDPR), approved by Coor's Data Protection Officer.

Processes for engaging with own workforce and workers' representatives about impacts

Reference: page 106.

"Coor engages in an active dialogue with workers' representatives and trade unions, in accordance with legislation and applicable collective bargaining agreements... to ensure that employees' rights are respected and that they are able to influence decisions relating to health and safety, working conditions and company-wide strategies" (page 106).

The Health & Safety Board, meeting monthly with health and safety managers from every country, "ensures that employees are involved in risk identification and evaluation of health and safety measures." The annual employee survey provides insight into "employees' well-being and engagement and their views on the company's impacts," feeding action plans; results are also used to monitor perceived inclusion and discrimination (page 106). Ultimate responsibility for taking these perspectives into account rests with the Executive Management Team.

Processes to remediate negative impacts and channels for own workforce to raise concerns

Reference: page 106.

Coor "offers several channels where employees can raise issues or report problems related to working conditions and human rights," including an anonymous whistleblower function open to employees and other stakeholders, and direct contact with HR or trade union representatives (page 106).

"Coor has established clear procedures for managing and remediating negative impacts... Our process is based on the UN Guiding Principles on Business and Human Rights and includes both preventive measures and corrective actions. If a material negative impact is identified, an investigation is initiated and an action plan prepared and followed up until the matter has been resolved." Coor "has a well-defined policy to protect people using the reporting channels from retaliation," including confidentiality, anonymity and the right to damages (page 106).

Taking action on material impacts on own workforce

Reference: pages 106-107.

"Coor has established a structured process to identify potential negative impacts on its own workforce... The focus for 2025 was on actions related to health and safety, and establishing a Nordic HR organisation" (page 107).

Safety focus: TRIF (total recordable injury frequency) target of 3.5; risk identification through inventories, assessments, safety inspections and daily reporting; injury escalation processes in all countries. "In 2025, we introduced a shared health and safety roadmap" and "carried out the first Group-wide 'I Care' campaign" on Life Saving Rules (page 107).

Human rights: a 2022-2023 human rights impact assessment (HRIA) found risks "linked to physical injuries and mental health problems, especially for Coor's in-house cleaning and property management staff," driving increased manager/staff training on fair working conditions (pages 106-107).

Targets related to own workforce

Reference: page 109.

Qualitative, continuously-monitored targets tied to each material impact area, "not based on a specific base year, but rather... reviewed annually and monitored continuously" (page 109):

2025 results (page 109): EMI 78 (2024: 77, target 70); TRIF 3.5 (2024: 8.3); manager-level gender split 52/48 women/men (target 50/50); serious personal data breaches zero. Targets are set at management-team meetings using survey results, HR dialogue, liaison meetings and whistleblower data.

Characteristics of the undertaking's employees

Reference: pages 109-110.

Total employees, Coor Group, 31 December 2025: 11,934 (59% women), versus 12,196 (59%) in 2024 (page 109). By country: Sweden 6,424 (61% women); Denmark 2,952 (58%); Norway 1,607 (62%); Finland 810 (51%); Other (Belgium, Estonia) 141 (28%).

By employment type (Group total): permanent employees the large majority, with fixed-term, contract staff and auxiliary/on-call staff also reported per country. Employee turnover: 12% in 2025 (2024: 14%), calculated as terminations during the year divided by average headcount (page 110). Age distribution: under 30 - 12%; 30-50 - 48%; over 50 - 39% (page 110).

Characteristics of non-employees in the undertaking's own workforce

Reference: pages 109-110.

Non-employee categories are reported within the S1-6 employee tables by country: contract staff ("individuals who act as a temporary substitute for an employee for a defined period of time, such as during parental leave") and auxiliary/on-call staff ("employees with non-guaranteed hours, often seasonally employed") (page 110). Group-wide in 2025: contract staff and auxiliary/on-call staff are broken out per country alongside permanent and fixed-term employee counts (page 109).

Phase-in note: the general-information chapter states Coor "has chosen to phase in... portions of S1-7 Characteristics of non-employees in the undertaking's own workforce" (page 78), so the full S1-7 datapoint set (e.g. non-employee headcount by country/gender in all required breakdowns) is not yet complete for FY2025.

Collective bargaining coverage and social dialogue

Reference: page 110.

"Employees who do not have an ordinary collective bargaining agreement are covered by contracts in line with collective bargaining agreements." Percentage of employees covered by collective bargaining agreements: 93% in 2025 (2024: 92%) (page 110).

Coor is "covered by a number of different collective bargaining agreements" given its wide range of areas of operation. Employees not covered receive terms of employment equivalent to the relevant industry collective bargaining agreement. Dialogue takes the form of workplace meetings, liaison meetings with trade union representatives, and business council meetings (pages 105, 110).

Diversity metrics

Reference: page 110.

Manager-level gender split, 2025: 542 women (52%), 497 men (48%) among managers - versus 551 women (52%) / 515 men (48%) in 2024 (page 110). Gender equality at manager level is tracked against a 50/50 target (page 109 target table), with 2025 at 52/48, 2024 at 52/48, 2023 at 53/47.

Diversity is governed by the Diversity and Inclusion Policy, which "aims to achieve a gender balance at all management levels" and specifically covers "sex, gender identity, sexual orientation, ethnicity, skin colour, religion, political conviction, disability, age, and national and social origin" (page 105).

Adequate wages

Reference: page 110.

"Wages are set according to collective bargaining agreements, and there are no employees who earn below the applicable reference level for decent pay" (page 110). For employees not covered by collective bargaining agreements, "we apply the principle that their wages and benefits should reflect the terms offered to employees covered by collective bargaining agreements" (page 108).

93% of employees are covered by collective bargaining agreements (page 110), and the majority of employees are covered by agreements that "include terms for pensions, parental leave, health insurance and other social benefits" (pages 107-108).

Social protection

Reference: page 110.

"All employees are covered by social protection against loss of income in the event of sickness, unemployment, work-related injury, acquired disability, parental leave and retirement through public social security systems and, in some cases, collective bargaining agreements or company benefits" (page 110, reported at 100%).

This is consistent with Coor's description of collective bargaining coverage, which "include[s] terms for pensions, parental leave, health insurance and other social benefits" (pages 107-108), and its redeployment programmes for scaled-back operations, e.g. Sweden's TRR Trygghetsradet and the Job Security Foundation (page 108).

Training and skills development metrics

Reference: page 110.

Training hours completed per employee, 2025: employees with staff management responsibilities - 11 hours (women), 12 hours (men); other employees - 2 hours (women), 3 hours (men). 2024 comparatives: 9/9 and 4/4 respectively (page 110).

Performance reviews, 2025: 68% of women and 66% of men completed a performance review (2024: 66%/66%), based on employee-survey responses to whether the worker received a review in the last 12 months. Coor's Learning Management System underpins continuous training and monitoring; each employee has a personal development plan agreed at the annual Coor Development Dialogue (pages 108, 110).

Health and safety metrics

Reference: pages 110-111.

"All employees are covered by a health and safety management system" (100%, both 2025 and 2024). Number of work-related injuries: 157 in 2025 (2024: 142). TRIF: 8.3 (2024: 7.2). Number of fatalities: 0 (both years). Number of days lost to work-related injuries: 1,555 (page 110).

TRIF is calculated as "total number of injuries x 1,000,000/number of working hours," excluding commuting injuries, using US OSHA classification definitions (page 110). Note the E1/S1 target-table TRIF figure of 3.5 (page 109) is the 2025 target, distinct from the 8.3 actual outturn reported here. Phase-in note: the breakdown of documented ill health and injuries between employees and non-employees is phased in (page 78).

Work-life balance metrics

Reference: page 111.

Percentage of employees entitled to take family-related leave: 100%. Percentage that took family-related leave: 23% (women: 24%, men: 22%) (page 111).

Data is based on Coor's time reporting system; "Estonia and Belgium, along with smaller parts of the Norwegian and Danish operations, were gradually added during 2025. As a result, the data for 2025 is not comprehensive, but the plan is that it will be comprehensive in 2026" (page 111).

Remuneration metrics (pay gap and total remuneration)

Reference: page 111.

"Pay gap: 12% - the difference of average pay levels between female and male employees, expressed as a percentage of the average pay level of male employees. All roles, including the highest-paid individual, are used when calculating the pay gap" (page 111).

"Total remuneration ratio: 31 - the annual total remuneration ratio of the highest paid individual to the median annual total remuneration for all employees (excluding the highest-paid individual). The salary for the highest-paid individual includes annual salary, including bonus based on the amount that would have been paid if this individual had worked for 12 months" (page 111). Data is drawn from Group-wide systems covering all roles and countries.

Incidents, complaints and severe human rights impacts

Reference: page 111.

2025 figures: total incidents of discrimination (including harassment) reported - 21; complaints filed through channels for own workforce to raise concerns (including the whistleblower channel) - 84; total fines/penalties/compensation for damages from these incidents and complaints - 0; number of severe human rights incidents connected to the workforce - 0; total fines/penalties/compensation for those incidents - 0 (page 111).

"The number of complaints filed through channels that constitute cases from the whistleblower channel" is the basis for the 84 figure. No systematic cases of child labour or forced labour were identified in Coor's operations or value chain (page 106).

Policies related to value chain workers

Reference: pages 113-114.

"Coor has established policies and governance documents based on internationally recognised standards that cover all workers in the value chain," consistent with the UNGP, the ILO Declaration on Fundamental Principles and Rights at Work and the OECD Guidelines for Multinational Enterprises (page 113).

Named instruments: Human Rights Policy (shared with S1); Supplier Code of Conduct, approved by Executive Management, requiring compliance with the UN Global Compact, UN human rights framework, ILO Declaration and OECD Anti-Bribery Convention (page 113); Procurement Policy, approved by the Group CFO, setting sustainable-procurement requirements; and Supplier Sustainability Requirements, appended to all supplier agreements, addressing due diligence and human rights (page 114). "No reported cases of non-compliance with these international standards were identified in our value chain during the year" (page 113).

Processes for engaging with value chain workers about impacts

Reference: page 114.

"Dialogues with suppliers and their workers take place though supplier monitoring, third-party audits and social dialogue meetings. Contact is initiated at several stages of the supplier relationship: during the onboarding process for new suppliers, when major changes occur to the delivery, in regular contacts and in the event of incidents or risk identification" (page 114).

"In connection with audits and social dialogue meetings, suppliers' workers are given the opportunity to express their views anonymously or directly through Coor's representatives." Operational responsibility rests with the Group Procurement Manager, and effectiveness is evaluated through audit-related KPIs (page 114).

Processes to remediate negative impacts and channels for value chain workers to raise concerns

Reference: pages 114-115.

Workers in the value chain "have access to an anonymous whistleblower system to report grievances or violations without the risk of retaliation," open to employees of suppliers and subcontractors and managed by an external party in the eight most widely spoken languages, with cases investigated by Coor's whistleblower team (pages 114-115, 122).

"When negative impacts are identified... Coor takes responsibility for mitigating and correcting these impacts and requires the supplier to develop a corrective action plan (CAP)... If a supplier does not take the necessary steps to address serious negative impacts, Coor reserves the right to terminate the business relationship" as a last resort (page 115).

Taking action on material impacts on value chain workers

Reference: pages 114-116.

"All procurement categories are risk-assessed based on four aspects: human rights, labour rights, environmental protection and anti-corruption. When a high risk is identified in one or more areas, action is taken to mitigate the effects and prevent their recurrence" (page 115).

"Coor carries out regular audits and inspections of its suppliers, focusing on labour rights, health and safety, and human rights compliance... All deviations are followed up with a corrective action plan (CAP)." No severe human rights incidents connected to the upstream and downstream value chain were reported or confirmed during the year (page 115). Effectiveness is measured through social audits, deviation rate and contractual loyalty (page 115).

Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities

Reference: page 116.

"Coor has not defined specific targets per material impact area for workers in the value chain, but measures the effectiveness of the policy... through an annual process that includes supplier follow-ups on social topics" (page 116).

2025 supplier social-compliance metrics: suppliers audited for social compliance - 88 (2024: 130; 2023: 110); percentage with deviations identified - 45% (2024: 10%; 2023: 34%); percentage of contracts terminated as a result - 0% (all years); contractual loyalty (share of purchases from Code-of-Conduct-approved suppliers) - 92% (2024: 90%; 2023: 90%) (page 116). "No specific base year or ambition/target level was set for 2025."

Policies related to consumers and end-users

Reference: page 118.

Information Security Policy - protects data following "the principles of confidentiality, integrity, availability and traceability," covering employees and suppliers, approved by the CISO. Data Protection Policy - GDPR compliance, approved by the Data Protection Officer. Human Rights Policy - shared with S1/S2. Safety Policy - shared with S1, "vision of zero work-related accidents" (page 118).

Materiality note: "Coor is applying the phase-in provisions for the topic S4 Consumers and end-users, and therefore only provides an overall description of its material impacts, the connection to the business model and the policy's action plan in this area" for FY2025 (page 87), consistent with the ESRS index marking S4 rows "To be phased in" (pages 126-131).

Processes for engaging with consumers and end-users about impacts

Reference: page 118.

"Coor works systematically to ensure data protection and privacy for consumers and end-users by taking actions that involve both prevention and incident management. End-users are informed of their rights via customer portals, direct emails and guidelines published on the Coor website, where security measures and instructions are also available" (page 118).

Risk assessments "are conducted to identify and manage potential threats and risks, when new services are initiated, and regularly during the course of the delivery." Development follows "privacy by design and by default" (page 118). This is a first-year, phase-in-scoped disclosure (page 87).

Processes to remediate negative impacts and channels for consumers and end-users to raise concerns

Reference: page 118.

"To manage potential negative impacts on data protection and privacy, Coor has established processes for incident identification and management as well as actions in the event of incidents, including hacking and GDPR breaches. There is a dedicated contact channel for grievances and questions in the event of such incidents" (page 118).

"The management system has processes for incident management, reporting to affected parties, and corrective actions to ensure compliance and protection." Employees are trained in data protection and incident reporting to speed correct handling of breaches (page 118). Reported under the S4 phase-in provisions for FY2025 (page 87).

Taking action on material impacts on consumers and end-users

Reference: page 118.

"Coor has a systematic approach to improving safety and preventing injuries and accidents, both in our own and our customers' premises." Risks are identified "through risk inventories, risk assessments, regular safety inspections and daily reporting of risk observations," with "injury escalation processes... implemented in all countries" and collaboration with customers on safety inspections and training (page 118).

On data protection: "Risk assessments are conducted to identify and manage potential threats and risks... Responsibility for the GDPR and data security rests with designated individuals in the company." Effectiveness is not yet metric-based: this is the first year of the S4 phase-in, so only a qualitative account of actions is given (pages 87, 118-119).

Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities

Reference: page 119.

"Coor has a vision of zero work-related accidents, which also applies to consumers and end-users who use Coor's premises... We endeavour to ensure a high level of information security and personal data protection... Our aim is to have zero serious personal data incidents, which helps to minimise risks for consumers and end-users" (page 119).

"Since this is the first year we are applying the phase-in provisions for this part of the value chain, we are only providing an overall report on our qualitative targets in this section for 2025. We will review which metrics to apply for future periods" (page 119). No quantified 2025 S4-specific KPI is yet reported beyond the qualitative zero-accident/zero-breach aims.

Business conduct policies and corporate culture

Reference: page 121.

Code of Conduct, approved annually by the Board, "describes how the company's employees should work to prevent corruption, conflicts of interest and discrimination," forms part of employees' terms of employment, and is reinforced through mandatory digital training including a video-based version for service staff (page 121).

Anti-Corruption Policy, owned by the Chief Legal Counsel and adopted by the Board, aligned with the UN Convention against Corruption, "in many cases stricter than the applicable laws," covering know-your-customer, money laundering and conflicts of interest (page 121). A whistleblower portal, run by an external supplier, is available in the eight most widely spoken languages, with reports handled within seven days and protection against retaliation (pages 121-122).

Management of relationships with suppliers

Reference: page 123.

"A new supplier is required to meet our environmental and social sustainability and information security requirements, sign our Supplier Code of Conduct and accept our general terms of purchase before being approved to deliver products or services to Coor" (page 123).

"Every year, a plan for supplier monitoring is formulated based on the risk assessment for our supply chain," covering compliance, quality, environment, work environment, and health and safety. Supplier engagement is also linked to climate: "75 per cent of suppliers' emissions should be covered by SBTi-validated climate targets" (page 123). "Coor works continuously to increase compliance with standard contract terms, including payment terms" (page 123).

Prevention and detection of corruption and bribery

Reference: pages 122, 124.

"All employees are required to take one of these [Code of Conduct] courses at least every two years, regardless of their role and country of employment... All employees are covered by our Code of Conduct training programme, includes anti-corruption and bribery... everyone (100 per cent) in this group [executive positions] is covered by the training programme" (pages 122, 124).

Investigation process: "suspicions or incidents related to corruption or bribery are mainly identified through the whistleblowing channel or in internal reporting." Investigations are "generally led by the Compliance Officer," kept independent and confidential, with results reported to the Executive Management Team and the Board (page 122). 2025 G1-4 data: 7 reported/investigated suspected Code of Conduct violations; 0 convictions; 0 fines (page 124).

Targets related to business conduct (part of MDR-T/GDR-T disclosures)

Reference: page 124.

"We have qualitative targets in the area of G1 Business conduct, which means that we do not have base years, base year values or milestones for these targets. We work on them continuously and annually to maintain high quality" (page 124). Stated per material impact area:

Effectiveness is tracked via the G1-3/G1-4 KPIs (Code of Conduct training coverage, investigated cases, convictions, fines) (page 124).

Incidents of corruption or bribery

Reference: page 124.

2025 figures (2024 in brackets): number of reported and investigated cases of suspected violations of the Code of Conduct - 7 (7); number of specifically investigated cases with concrete suspicion of actual violation of Coor's Anti-Corruption Policy - 0 (0); number of convictions for violation of anti-corruption and anti-bribery laws - 0 (0); fines issued for violation of anti-corruption and anti-bribery laws - 0 (0) (page 124).

Number and percentage of managers and specialists who completed anti-corruption training and Code of Conduct training are also reported for 2025 (page 124, table continues). "The metrics in G1 Governance [are] validated by our external auditors" (page 125).

Payment practices

Reference: page 124.

"The average time in days to pay a supplier invoice was 53 days for 2025. This includes disputed invoices and credit notes... The metrics refer to all Coor companies" (page 124).

Payment terms breakdown (2025): consulting assignments - 30 days (25% of invoices, 79% paid within terms); products - 60 days (51% of invoices, 89% paid within terms); framework agreements - 90 days (2%) and 120 days (7%); other - 16%. Total invoices: 1,569 (2024: 1,459). "Coor had no legal proceedings outstanding regarding late payments at the end of 2025." The metrics are validated by Coor's external auditors (page 124).