Wirtualna Polska Holding

Governance roles

Reference: page 99 (listed in the ESRS compliance table as both GOV-1 and GOV-1 G1 at page 99, page 121).

At 31 December 2025 the Supervisory Board had six members, four of whom (66.7%) met the independence criteria, against six of eight a year earlier; the Management Board had four members. Women to men: Supervisory Board 4/2 (2024: 3/5), Management Board 1/3 (unchanged). "There is no representative of employees and other workers at the Management Board", and the composition of Group bodies "does not distinguish between executive and non-executive members" (page 99).

Four bodies oversee impacts, risks and opportunities (page 99): the Supervisory Board's Sustainability Strategy Committee (reporting to the Supervisory Board at least annually), the Audit Committee (three members, at least two independent including the chair), the CFO responsible for sustainability (Elzbieta Bujniewicz-Belka), and the Strategy and Development Committee advising the Management Board.

Management is distributed among business owners, with escalation on significant change. The Group states plainly that "The policy in this regard is not formalized in view of the growing importance of ESG-related areas", and that practice will be written up once established (page 99). Expertise spans law and governance, finance and audit, and media and digital, supported by external advisers (pages 100-101).

Reference: page 101.

A review of the Group's risks "is moderated by the Internal Audit Manager once a year at the end of the fourth and the first quarter", covering risks, opportunities and changes in environmental impacts, and based on meetings with the management of the subsidiaries and the parent. The Audit Committee of the Supervisory Board is informed of the results (page 101).

Monitoring of material IROs sits with departmental managers, with escalation to the Management Board or Supervisory Board on significant market change. Materiality assessment results are presented to the Chief Financial Officer and to the Sustainability Committee, which reports to the Supervisory Board at least once a year (page 101).

The Group lists the matters the two boards address: business impacts (market trends, competitiveness, technological innovation, consumer preferences), social, environmental and economic impacts, operational and strategic risk, ethical and legal risk, innovation, financial aspects of decisions, environmental impact including greenhouse gas emissions and access to reliable independent information, and regulatory compliance (pages 101-102).

"Throughout 2025, the Management Board of Wirtualna Polska analysed a number of risks monitored as part of its internal audit. Those risks included risks related to climate change and sustainability." The basis for the 2025 review was the previous year's risk map and the expert report Risk in Focus 2025 (page 102).

Reference: page 102 (the ESRS compliance table lists GOV-3 and GOV-3 E1 at page 102, page 121).

Management Board members receive fixed remuneration set by Supervisory Board resolution and may receive variable remuneration for meeting targets. "It is worth noting that the remuneration of the Management Board members is in part linked to sustainability goals - as of H2 2021 that was at least 5%" (page 102).

The 2025 sustainability goals covered two areas: in the first half, publication of the 2024 non-financial statement in accordance with ESRS together with the attestation opinion; in the second half, an update of the double materiality assessment after the Invia Group acquisition. The Group states directly: "Currently, sustainability goals do not include reducing the carbon footprint" (page 102).

Weight of ESG goals by role, 2025 against 2024 (page 103): CEO Jacek Swiderski 5% (5%); CFO Elzbieta Bujniewicz-Belka 10% (10%); Chief Strategy Officer Michal Branski 1% (1%); Chief Technology Officer Krzysztof Sierota 5% (1%, +4 percentage points).

Supervisory Board members "may only receive fixed remuneration"; additional remuneration for chairs and committee members "may not be variable and linked to any performance, including financial performance of the company" (page 103).

Reference: page 103.

The due diligence statement is given as a table mapping the core elements of due diligence to sections of the sustainability statement (page 103):

• Embedding due diligence in governance, strategy and business model - E1-2, S1-1, S4-1, G1-3, GOV-2, GOV-3, SBM-3
• Engaging with affected stakeholders in all key steps - S1-2, S4-2, SBM-2
• Identifying and assessing negative impacts on people and the environment - IRO-1, SBM-3, GOV-5
• Taking action to address negative impacts - E1-3, S1-3, S4-3, G1-3
• Tracking the effectiveness of these efforts - E1-2, S1-5, S4-5

The mapping uses the 2023 ESRS numbering, so E1-2 and E1-3 in the table are the climate policies and actions disclosures. The identification and assessment process is described as "linked to the Group's due diligence processes, in particular value chain analysis and the risk map" (IRO-1, page 116).

Reference: page 103.

The Group is explicit about the limits of its control environment: "There are no specified sustainability controls within the unified internal control system." The separate process is the identification of risk and opportunity levels as part of the materiality assessment, carried out by a designated group of employees with a specialised external consultant, the results of which "have been accepted by the Management Board" (page 103).

Risks, including sustainability risks, are assessed on probability, impact on the Company's operations, impact on its financial performance and impact on the Group's operations, with three time horizons applied to selected risks. The main risks are described on pages 46-56 and include business resilience, supply chain and e-commerce risks, and changes in the employment structure. Where a material sustainability risk has no business owner, it is assigned to a company or department (page 104).

Internal audit covers all companies under the Internal Audit Charter; the head of internal audit prepares and updates the risk map, using guided interviews that ask stakeholders to comment on the risks in the World Economic Forum Global Risks Report. In 2025 internal audit "did not identify any processes that would prevent or hinder accurate and reliable reporting" (page 104).

Reference: page 105.

Wirtualna Polska Group is "a technology holding undertaking" operating across media, advertising, subscription-based services and e-commerce, with its registered office at 16 Zwirki i Wigury Street, Warsaw, and other entities in Gdansk, Wroclaw, Lublin, Chorzow, Leipzig and Miskolc. It owns the WP homepage and subscription services including Audioteka, Pilot WP and Poczta WP; in e-commerce it operates in travel (Invia Group, Wakacje.pl, Szallas Group, Nocowanie.pl) and financial services (Superauto.pl, Totalmoney.pl). Operations are primarily in Poland and, since 2022, across the CEE region; the Invia Group acquisition completed in 2025 added the DACH region plus the Czech Republic, Slovakia, Hungary and Poland (page 105).

"The Group does not operate in sectors related to fossil fuels, the production of chemicals, controversial weapons or tobacco products" (page 105).

The value chain treatment is unusual and stated openly: "the Group has adopted an approach under which only end users are classified as downstream. Consequently, business partners that could otherwise be classified as customers (such as advertising agencies, global technology platforms, travel agencies, or accommodation providers) are presented as upstream (suppliers)" (page 105). Value chain tables by segment set out key resources, customer, investor and stakeholder benefits, and upstream, own-operations and downstream elements (pages 106-108).

Reference: page 109.

Key stakeholders were identified during the materiality assessment using the business model and value chain, through a survey of representatives of all major management areas who assessed the strength of influence in both directions. Additional interviews and surveys were conducted "primarily with upstream representatives (suppliers and business partners)" (page 109). Downstream end customers were "identified as a very diverse and fragmented group of approximately 20 million internet users", so their expectations were examined through the expectations of ESG rating agencies and comparable companies (page 96).

Six groups and their engagement channels are described (pages 109-110): investors; business partners and suppliers; society (the Wirtualna Polska Image Survey, satisfaction surveys, the Customer Service Office); users; government institutions, regulators and industry organisations; and employees and associates, where "Representatives of the WP Media Works Council participated in the materiality assessment process" through an anonymous survey and interviews.

The Group also records a negative impact arising from its own model: in the Travel segment "cases have been identified where discrepancies occur between the prices presented and the final prices of travel services" (page 109). NPS and internal employee survey results are presented at Supervisory Board and Management Board meetings (page 110).

Reference: page 111.

Material IROs are set out in a single typed table spanning pages 111-114, with columns for topic, IRO description, segment, place in the value chain, time horizon and link to the business model or strategy. Each row carries an explicit type label (Risk, Opportunity, Negative impact (actual), Positive impact (actual)). Counting the rows gives 38 material IROs: 14 under climate change and energy, 9 under own workforce, 9 under consumers and end-users and 6 under business conduct. IROs added in 2025 are marked with an asterisk (page 114).

The Group states that "The Group has not identified the current financial implications, significant risks and opportunities" (page 115).

Changes from the prior year are explained (page 115): the Invia acquisition raised the weight of the travel segment, so "some travel-specific IROs have crossed the materiality threshold and have been added to the list". In business conduct the positive impact on whistleblowing "was removed, as it was considered to stem from legal requirements", and the risk of failing to detect all discrimination and harassment cases "fell below the materiality threshold due to enhancements made to the whistleblowing system".

Climate-specific risk identification and scenario analysis is also presented under E1-2 (2025 ESRS numbering), and climate resilience under E1-3.

Reference: page 116.

The Group assessed materiality in 2023 and 2024 and "updated it in 2025 due to changes in the Group's structure following the acquisition of Invia Group in May 2025". The 2023 exercise used the MAX 4 - Materiality Assessment Matrix (version 4) methodology with an external adviser and covered "impacts, risks and opportunities related to all 90 sustainability matters included in the table set out in AR 16 of ESRS 1". Inputs included benchmarking of 17 media sector entities, questionnaires with 25 representatives of key management areas and 25 internal experts, and interviews with 8 external stakeholder representatives. "Representatives of employees... participated in the above assessment. Other affected stakeholders did not participate directly in the process" (page 116).

In 2025 the assessment incorporated Invia Group's own assessment, which involved "more than 30 stakeholders", with weighting reflecting "the relative weight of segments in the Group's pro forma EBITDA for 2024". Results were approved by the Management Board member responsible for sustainability and presented at the Sustainability Strategy Committee meeting on 7 November 2025. Entity-specific issues were considered but none identified (page 117).

Impact materiality scored strength, scope, irremediable character and probability 1-5, with severity averaged then weighted by probability and a materiality threshold of 2; financial materiality used the same threshold (pages 117-118).

Reference: page 120.

The report prints a genuine ESRS content index. Table 1. ESRS compliance table (pages 121-123) lists each disclosure requirement with its name and a page number, covering ESRS 2 (BP-1 through IRO-2, including the topic-specific IRO-1 rows for G1, E1, E2, E3, E4 and E5), E1 (E1-1 at page 127 through E1-8 at page 138), S1 (SBM-3 at page 153 through S1-17 at page 172), S4 (SBM-3 at page 173 through S4-5 at page 182) and G1 (G1-1 at page 184 through G1-4 at page 188).

Six E1 and S1 entries carry "Omission of disclosure under Appendix C of ESRS1." in place of a page number: E1-9, S1-7, S1-11, S1-12, S1-13 and S1-15 (page 122). G1-5 and G1-6 are marked "Not material" (page 123). E2, E3, E4, E5, S2 and S3 have no topical rows at all, consistent with the statement that these standards were "indicated as irrelevant" (page 98).

Table 2 lists the datapoints derived from other EU legislation with page references or "Not material" (pages 124-126); the S1-14 days-lost datapoint is also marked as an Appendix C omission (page 125).

The index is introduced with the mapping rationale: the Group "conducted a mapping process of material impacts, risks and opportunities (IROs) against the ESRS disclosure requirements and specific data points", and the identified datapoints "refer to the ESRS E1, ESRS S1, ESRS S4 and ESRS G1 areas" (page 120).

Reference: page 127.

The disclosure is a three-sentence negative return, quoted in full: "In 2025, Grupa Wirtualna Polska Holding did not have a formalized climate transition plan. Plans to decarbonise the business model are included in the Group's Sustainable Development Strategy. The Group plans to adopt and disclose a transition plan within the next three years, i.e. during the transition period provided for in the ESRS" (page 127).

Supporting material sits in the surrounding disclosures rather than in E1-1. The Group "is currently in the process of developing a Decarbonisation Strategy for the coming years. As part of this process, key decarbonisation levers across all scopes (including the value chain) are being identified and will be implemented in the coming years" (page 130), with publication planned for 2026 (page 132). Targets under the 2022-2030 Sustainable Development Strategy are set out under E1-4, with the caveat that "These targets are not aligned with the requirements set out in ESRS" (page 132).

On funding: "In 2025, the Group did not estimate expenditures related to the implementation of the policy" (page 131). The Group does hold "a Sustainability Linked Loan, in which the margin is linked to the achievement of ESG goals, which include an increase of the percentage of energy produced from photovoltaic panels in the Group's total electricity consumption" (page 131).

Identification of climate-related risks and scenario analysis

Back-filled from ESRS 2 IRO-1 (page 118) and the E1 SBM-3 climate risk table (pages 127-129). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Reference: pages 118, 128.

Classification. The E1 risk table splits the five material climate risks into "Physical risks" - power outages or unstable supply affecting data infrastructure, and value chain disruption at tourist destinations - and "Transitional risks" - cost and availability of energy-efficiency technology, carbon footprint pressure, and rising energy costs. Each row carries the place in the value chain, time horizon and management method.

Methodology. An internal team analysed own operations and the value chain, with identification "based on an analysis of the sources of greenhouse gas emissions, identifying the Group's IT infrastructure and use of services and products as key areas". A 2021 ESG risk identification used the AXIS methodology with an external adviser, "aligned with the principles of ISO 31000 Risk Management". In 2025 it "was enhanced by incorporating the identification of physical risks conducted by Invia Group" (page 118).

Scenarios. Physical risk used RCP 4.5 and RCP 8.5 from the Klimada portal plus municipal adaptation plans for data centre locations (page 129). No 1.5C-aligned transition scenario is named and no temperature projection per scenario is given.

Resilience in relation to climate change

Back-filled from the "Business model resilience analysis" subsection of E1 SBM-3 (page 129). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Reference: page 129.

Results. "To assess the resilience of its business model, in 2024 the Group conducted a simplified scenario analysis using data from the Klimada portal for RCP 4.5 and RCP 8.5 scenarios, as well as municipal adaptation plans for... data centers". In the short term critical assets are "not significantly exposed" to high temperatures, strong winds or storms, but "in the case of prolonged electricity supply disruptions... current solutions may prove insufficient". Invia Group's assessment found storms "the only material hazard affecting leased office spaces in Germany and the Czech Republic", and under RCP 8.5 "confirmed very low financial exposure" (page 129).

Capacity to adapt. "the Group assesses that it has the capacity to adapt its strategy and business model to climate change over the short-, medium-, and long-term", citing low financial exposure and a model "largely based on digital assets and intermediation services... characterised by high flexibility" (page 129).

Uncertainty. "The analysis is based on national and regional data, which determines its general nature" (page 129). The Group "plans to systematically monitor the identified IROs to assess its long-term resilience".

Reference: page 129.

The Climate and Environmental Policy is the single policy disclosed. It "aims to manage environmental protection and climate change matters" and "addresses climate change mitigation through actions focused on achieving targets such as climate neutrality in Scope 1 and Scope 2 by 2030, as well as the measurement and reduction of Scope 3 emissions". It also covers climate content published by Wirtualna Polska "which may contribute to raising public awareness of climate change mitigation and adaptation", and promotes renewable energy and energy efficiency (pages 129-130).

Scope and accountability are stated: "The Policy applies to all subsidiaries of the Wirtualna Polska Holding Group, and covers both own operations as well as the upstream and downstream value chain, including actions related to setting emission reduction targets across all three scopes." Oversight sits with the Sustainability Strategy Committee and implementation with "the Member of the Management Board responsible for finance" (page 130).

Monitoring is "carried out through the tracking and analysis of the Group's carbon footprint data across Scopes 1, 2, and 3 on a semi-annual and annual basis, in accordance with the GHG Protocol, as well as through the annual update of ESG risks, including climate-related risks". The policy reflects commitments from the United Nations Global Compact and the GHG Protocol and is publicly available on the Group's websites (page 130).

Reference: page 130.

Actions continue work begun in 2021: electricity for data centres covered by guarantees of origin, and own photovoltaic generation with "a total capacity of 3 MWp" plus an additional 1.85 MWp installation operating since May 2023 (page 130).

The 2025 action is integration rather than new abatement: "In 2025, the Group focused on the operational integration of newly acquired assets and the harmonisation of reporting standards following the acquisition of Invia Group. A key action undertaken during the reporting period was maintaining a high share of electricity sourced from renewable energy within the expanded Group structure", secured with guarantees of origin from Poland, the Czech Republic and Germany. "In 2025, the share of electricity purchased from renewable sources amounted to 93%. The decrease from 95% (reported in 2024) results from the inclusion of new infrastructure and offices of Invia Group in the reporting scope." Because 2025 was set as a new base year, "the Group does not report year-on-year emission reductions" (page 130).

Education counts as an action: "In 2025, the Group published more than 700 articles promoting environmental protection" (page 130).

On resourcing the disclosure is a negative: "In 2025, the Group did not estimate expenditures related to the implementation of the policy" (page 131). A Decarbonisation Strategy identifying levers across all scopes is in development (page 130).

Reference: page 131.

Targets come from the 2022-2030 Sustainable Development Strategy, as 2025 targets against 2030 ambitions (pages 131-132): E.1.1 Scopes 1 and 2 "-70% compared to the base year 2019", with a 2030 ambition of "0 Mg CO2e (net-zero according to the SBTi methodology)"; E.1.2 energy audit of server rooms and ISO 50001 certification; E.1.3 "80% share of zero-carbon energy in the electricity mix" and "90% share of zero carbon energy in the heating energy mix"; E.1.4 calculate Scope 3 for 2022 and set a reduction target; E.4.1 1,000 published climate and environment materials a year.

The Group is candid: "These targets are not aligned with the requirements set out in ESRS. The policies of Wirtualna Polska Holding are not fully aligned with ESRS and the Minimum Disclosure Requirements for targets (MDR-T)". The Strategy reference year is 2022, "though not within the meaning of ESRS"; for reporting the base year is 2025, and "These targets do not include Invia Group". Alignment is claimed but unverified: the targets "are aligned with the objective of limiting global warming to 1.5 degrees C; however, they have not been externally verified" (page 132).

Progress (pages 132-133): Scopes 1 and 2 down 84% against 2019 versus a -70% target, excluding Invia; the ISO 50001 target "was not achieved"; 93% zero-emission electricity against an 80% target; the 90% heating target "was not achieved due to infrastructural constraints in leased office spaces".

Reference: page 133.

Total energy consumption was 14,229.13 MWh in 2025 against 13,286.50 MWh in 2024 (+7.09%). Fossil energy was 4,593.73 MWh, a 32.28% share; renewable energy 9,543.27 MWh, a 67.07% share (down from 69.05%); nuclear sources 92.13 MWh, 0.65%. Within the fossil total, purchased electricity, heat, steam and cooling from fossil sources rose 57.21% to 2,250.12 MWh, fuel from crude oil and petroleum products fell 16.12% to 1,969.66 MWh, natural gas rose 12.51% to 373.96 MWh and coal was nil. Renewable consumption comprises 9,502.56 MWh purchased plus 40.71 MWh of self-generated non-fuel renewable energy (page 133).

Energy intensity is reported for the two entities whose NACE activities fall in high climate impact sectors: Superauto 6.95 MWh per PLN 1 million of net revenue (2024: 9.31) and WP Naturalnie 20.44 (2024: 15.90), on net revenue from those sectors of PLN 198.96 million against total net revenue of PLN 2,213.62 million. Gross electricity generated from photovoltaics fell 7.8% to 4,837.25 MWh after "a technical failure of one of the photovoltaic (PV) installations" (pages 133-134).

Factors are DEFRA (2025), IEA (2023) and, for Poland, KOBiZE (2025) and URE (2025); estimates were used for office energy and fleet fuel. "The reported metrics have not been validated by any external body other than the assurance services provider." 2025 is the new base year and the Group states the two years are not comparable.

Reference: page 134.

2025 emissions (page 137): Scope 1 547.60 tCO2e (-14.43%), with 0% from regulated emission trading schemes; Scope 2 location-based 6,131.30 tCO2e (+1.69%) and market-based 1,010.97 tCO2e (+95.79%); Scope 3 total 101,657.04 tCO2e (-60.24%). Scope 3 by category: purchased goods and services 31,763.29; capital goods 4,191.86; fuel and energy-related activities 1,895.46; employee commuting 1,126.86; use of sold products 56,211.19; franchises 2,874.27; investments 3,594.12. Scopes 1+2 location-based 6,678.89 tCO2e and market-based 1,558.57; Scopes 1+2+3 location-based 108,335.93 and market-based 103,215.61. Intensity was 48.94 tCO2e per PLN 1 million of net revenue location-based and 46.63 market-based.

Boundaries and data quality (pages 135-136): calculation follows the GHG Protocol corporate, Scope 2 and Scope 3 standards; GWP factors are "indirectly aligned with the IPCC Fifth Assessment Report (AR5)"; renewable electricity with guarantees of origin was assigned a factor of 0 kg CO2e per kWh. Categories 9 and 10 are "not relevant" and categories 4, 5, 6, 12 and 13 "were assessed as non-material". "Within Scope 3, the Group obtained 4.55% direct data... and 0% primary data". Biogenic Scope 1 emissions were 27.60 tCO2.

The fall in Scope 3 reflects a methodology change, not abatement: Category 11 now uses page views and time spent by device type plus the Sustainable Web Design Model (page 138).

Reference: page 138 (listed at page 138 in the ESRS compliance table, page 122).

A complete nil return: "In 2025, the Wirtualna Polska Holding did not acquire carbon credits" (page 138).

No GHG removals or storage in own operations or the value chain are reported, and no mitigation projects financed through carbon credits are disclosed. This is consistent with the Group's targets, which are framed as reduction targets under the 2022-2030 Sustainable Development Strategy, with the 2030 ambition expressed as "0 Mg CO2e (net-zero according to the SBTi methodology)" (page 131), and with the absence of any neutrality claim elsewhere in the climate chapter.

Reference: page 138 (listed at page 138 in the ESRS compliance table, page 122).

A complete nil return: "In 2025, the Wirtualna Polska Holding did not apply Internal Carbon Price" (page 138).

No carbon pricing scheme, shadow price or internal levy is disclosed, and none is referenced in the climate policy, targets or capital allocation discussion. Where the Group does link financing to climate performance it does so through a Sustainability Linked Loan whose "margin is linked to the achievement of ESG goals, which include an increase of the percentage of energy produced from photovoltaic panels in the Group's total electricity consumption" (page 131), rather than through an internal carbon price.

Reference: page 154.

The Group opens with a limitation: the policies "were originally developed for internal purposes and do not, in all cases, meet the requirements set out in the MDR included in ESRS. Most of these policies were established prior to the introduction of the ESRS" (page 154).

Human rights. Under the Code of Ethics the Group "conducts its activity with respect for human rights and dignity of all people and complies with all applicable laws that... prohibit slavery, human trafficking or exploitation of minors", and states "We respect all the Conventions of the International Labor Organisation (ILO)" (page 154).

Health and safety. Procedures follow national requirements: a pre-employment medical examination, first-day onboarding training, periodic OHS training, occupational risk assessment and an annual OHS analysis, and a qualified OHS specialist (page 155).

Diversity. A diversity policy adopted in 2022 covers gender, ethnicity, religion, age, health condition and gender identity, commits to the Diversity Charter and the UN Global Compact, and is monitored by the Sustainability Strategy Committee (pages 155-156).

The gaps are stated: "The Group does not have separate policies specifically addressing job security, working time, adequate wages, social dialogue, work-life balance, equal pay for work of equal value, training and skills development, or the employment and inclusion of persons with disabilities" (page 156).

Reference: page 156.

The engagement model changed in 2025: "The previous model of an annual, standardised engagement survey conducted across all Group entities has been replaced with a decentralised approach, providing individual entities with greater flexibility in selecting survey tools, timing, and content" (page 156).

In selected entities the #pulsecheck survey runs "on a regular basis (at least twice a year), covering all employees and collaborators, including individuals who may be particularly vulnerable to impacts or at risk of marginalisation". It is anonymous and covers "trust in direct supervisors, feedback culture, cross-team collaboration, quality of internal communication, perception of company actions related to physical and mental health, acceptance of diversity, and a sense of inclusion" (pages 156-157).

Three further channels are described (page 157): targeted surveys during organisational or technological change, including a "Moodcheck" survey run in the Travel segment after the acquisition; onboarding monitoring asking about work pace, workload, work-life balance and job satisfaction; and exit interview surveys followed by in-depth interviews with HR Business Partners.

Accountability is named: "Responsibility for employee surveys lies with the Management Board and the HR Directors of individual entities", and "The results of these surveys are discussed at Management Board meetings" (page 157).

Reference: page 158.

A whistleblowing channel is available for potential breaches of internal policies, with the number of confirmed reports used as an effectiveness indicator and reported at Management Board meetings "in a manner that ensures discretion and confidentiality" (page 158).

The only figures given relate to the newly acquired business: "In 2025, a total of three reports were received within Invia Group. All of them were analysed, assessed and processed within the required timeframe. One report was classified as a test submission, while in the other two cases no material breaches or need for further corrective actions were identified." Data collection "is coordinated by the ESG department" (page 158). Elsewhere the Group describes confirmed cases as "very low (0-2 cases annually)" (page 156).

Eight routes are listed, from an online form and the HR Business Partner to the Management Board, the Supervisory Board and the Compliance Officer. Reports may be anonymous. "The entity establishes an Irregular Conduct Commission within 2 days of receipt of a report. The Commission begins its investigation no later than 7 days of its appointment." Every employee and associate "is required to complete training on counteracting workplace harassment and discrimination" (page 158).

The procedure "has been designed in compliance with the requirements of the Whistleblower Protection Act" and includes "the prohibition of retaliation".

Reference: page 159.

Actions are organised by IRO. Against the risk of rising labour costs and limited availability of qualified employees, the Group reports "establishing cooperation with a higher education institution, defining a strategic approach to remuneration levels within the budgets of individual Group entities, and supporting managers through training initiatives" (page 159).

Against the positive impacts of flexible working and well-being, the named actions are hybrid, remote and flexible hours; private medical care through Luxmed; fit profit and fit sport cards; gyms and group insurance; the Worksmile cafeteria platform; psychological consultations and mental health workshops; the Badabus screening programme for women; and first aid training (page 159).

On pay and development: "A remuneration policy has been implemented for the management board and the supervisory board, while a remuneration policy for all employees is expected to be implemented within the next 1-2 years". Development includes the WP Academy and "change management and feedback training using virtual reality and artificial intelligence" (page 160).

Against workload and stress the Group "organises educational activities regarding the use of AI tools and has also made available a tool intended to reduce employee workload"; against the gender pay gap it analyses "remuneration and bonus levels by gender" (page 160).

Reference: page 161.

Workforce targets come from the 2022-2030 Sustainable Development Strategy, each with a 2025 target and a 2030 ambition (page 161): equality and diversity - "Reducing GPGR to 10%" by 2025 and "GPGR at 0%" by 2030, with at least 30% women on supervisory and management boards; employee well-being - 70% satisfaction by 2030; competitive working conditions - turnover down 3 percentage points with unwanted departures no more than 10%; plus two ethics targets covering violation handling, employee training and a business partner code.

The MDR-T caveat is stated: "The policies and targets presented were developed prior to the publication of ESRS and MDR-T and, therefore, not all aspects meet those requirements" (page 161).

Progress is reported both ways (pages 161-162). Achieved: the adjusted gender pay gap for Polish entities fell below 10%, "As at the end of 2025, this indicator amounted to 6.52%", although "The target set in 2022 did not include the Group's foreign entities"; female representation on boards "was significantly exceeded" at 50%. Missed: "The overall employee turnover rate in 2025 amounted to 26.7% (compared to 19% in the 2021 base year)." On ethics, 100% of reports were handled to procedure, while "79% of employees received training on the Code of Ethics, and 50% received training on Compliance Policies".

Reference: page 162.

Headcount under employment contracts at 31 December 2025 was 2,995 against 2,116 a year earlier: 1,864 women, 1,129 men, 2 other (page 165). By country: Poland 1,828, Czech Republic 374, Germany 353, Hungary 269, Romania 88, Slovakia 57, Lithuania 18, Croatia 8, with Germany and Slovakia entering the reporting scope in 2025 (page 165).

By contract type (page 166): 2,626 permanent and 369 temporary, 9 on non-guaranteed hours, 2,824 full time and 171 part time. The Group notes "as many as 88% of employees employed under permanent contracts" and "the 5.7% share of employees working part-time" (page 167).

Turnover: "During 2025, a total of 800 employees left the Group. The employee turnover rate in 2025 amounted to 26.7% and was calculated as the ratio of leavers to the total number of employees employed under employment contracts. In 2024, 566 employees left the Group and the employee turnover rate amounted to 26.8%" (page 167).

Methodology is set out at length (pages 162-164): headcount rather than FTE at the reporting date; intra-group transfers excluded from hires and leavers; repeated entry and exit with the same entity counted separately; a change from a civil law to an employment contract treated as continuation, not a new hire; individuals employed in more than one entity reported once. Job levels use WTW job mapping for eight named entities, with EX and M4 treated as top management.

Reference: page 168.

A complete negative return with the underlying structure explained. "In the 2024 and 2025 reporting years, none of the Group's employees were covered by a collective bargaining agreement. Employment terms are determined individually, in accordance with the applicable labour law regulations in each country. In 2025 and 2024, no trade unions operated in the entities of Wirtualna Polska Holding Group, and the collective bargaining coverage rate was 0% globally" (page 168).

Social dialogue is reported by country at the ESRS S1-8 threshold, "where the number of employees in a given country accounts for at least 10% of the Group's total headcount". For 2025 Poland sits in the 80-100% band, where the Works Council in the Polish entities represents all employees, while the Czech Republic and Germany sit in the 0-19% band because neither has a Works Council (page 168).

The Group explains the change in the reporting structure: "the share of employees in the Hungarian entity in the Group's total workforce fell below the 10% threshold, and therefore Hungary was no longer reported as a separate country", while "headcount in the Czech entities increased compared with the previous year, and in addition, a German entity was included in the Group in 2025". It also notes that one Lithuanian entity has a Works Council but falls below the 10% threshold and so is not shown separately (page 168).

Reference: page 169.

Gender and age distribution at 31 December 2025 (page 169). Women 1,864 in total: 555 below 30, 1,249 aged 30-50 and 60 over 50. Men 1,129 in total: 316 below 30, 774 aged 30-50 and 39 over 50. Two employees are recorded as other, one below 30 and one aged 30-50; none are undisclosed. The 2024 comparatives are 1,303 women (416 / 843 / 44) and 813 men (269 / 512 / 32).

At board level: "In 2025, the share of women on the Management Board and the Supervisory Board amounted to 50% (33% in 2024). The diversity ratio for the administrative, management and supervisory bodies is calculated as the percentage share of women on the Supervisory Board and the Management Board of Wirtualna Polska Holding" (page 169). This tracks the GOV-1 composition of four women and two men on the Supervisory Board and one woman and three men on the Management Board (page 99).

Top management, defined by the WTW job mapping described under S1-6, "comprises 41 individuals in total, of whom 16 are women (39%) and 25 are men (61%). In 2024, top management comprised 63 individuals, of whom 19 (30%) were women and 44 (70%) were men" (page 169). The female share of top management therefore rose while the absolute size of that population fell by a third.

Reference: page 169.

"No employees in Wirtualna Polska Group were identified as receiving remuneration below the applicable minimum wage" (page 169). The supporting table reports the percentage of employees under employment contracts earning below the set level of adequate wages as zero in both 2024 and 2025 for each of the eight countries in which the Group employs people: Poland, Germany, Hungary, the Czech Republic, Romania, Slovakia, Lithuania and Croatia (page 169).

The benchmark used is the applicable statutory minimum wage rather than an adequate-wage benchmark derived independently, and the Group does not name a reference source for it. The related policy position is stated under S1-1: the Group "does not have separate policies specifically addressing job security, working time, adequate wages, social dialogue, work-life balance, equal pay for work of equal value, training and skills development, or the employment and inclusion of persons with disabilities" (page 156), and the associated action is that "The Group monitors and ensures competitive remuneration, supporting fair pay and a decent standard of living for employees" (page 159).

Reference: page 169.

"All employees across the Group are covered by the OHS management system" (page 169). Recorded work-related accidents among employees were 4 in 2025 against 2 in 2024, all minor, with no serious, fatal or mass accidents in either year. Accidents involving people under contracts other than employment contracts and people employed by subcontractors working on the Group's site were nil in both years. "The accident rate amounted to 0.09% in 2024 and 0.13% in 2025" (pages 169-170).

The Group sets out the four criteria it applies in recognising a work-related accident - suddenness, external cause, injury or death, and work-relatedness - and explains that an accident may be recognised where an employee acts for the benefit of the employer even if the task was not formally assigned, and during business travel while at the employer's disposal (page 170).

Part of S1-14 is withheld. The basis of preparation applies the Appendix C phase-in to "ESRS S1-14 - Health and safety at work (for work-related ill-health, number of days of incapacity for work due to injuries, and for non-workers)" (page 98), and Table 2 records "Omission of disclosure under Appendix C of ESRS1." against the S1-14 datapoint on "Number of days lost due to injuries, accidents, deaths or illnesses, point 88(e)" (page 125). The number of work-related deaths and the number and rate of work-related accidents datapoint, point 88(b) and (c), is mapped to page 169 (page 124).

Reference: page 170.

The headline metrics are disclosed for both years (page 171): Gender Pay Gap 22.39% in 2025 against 22.69% in 2024, and CEO Pay Ratio 41.27 against 40.85. The ratio is defined as the annual total remuneration of the highest-paid individual over the median annual total remuneration of an employee excluding that individual (page 171).

The unadjusted gap is broken down by job level on three bases (page 172). On average gross hourly wage: senior management 12.33% in 2025 against 29.47% in 2024, managers and leaders 8.66% against 7.95%, other employees 20.23% against 18.99%. Adding fixed allowances: 10.41%, 9.74% and 20.14%. Adding variable allowances: 17.58%, 11.26% and 20.38%. The Group attributes the level to employment structure: "Differences in the distribution of employees across job levels may affect the level of the pay gap, which is reflected in the varying values of the indicator across countries" (page 172).

Total remuneration comprises base salary and fixed position-related allowances at 31 December 2025, cash allowances paid in 2025, and benefits in kind (page 171). The 22% unadjusted gap is itself recorded as a material negative impact (page 113), and the Strategy target to reduce the adjusted indicator below 10% for Polish entities was met at 6.52% (page 161).

Reference: page 172.

A complete nil return covering both years: "In 2025 and 2024, Wirtualna Polska Holding Group did not identify any incidents related to human rights violations or cases of discrimination involving its workforce. During the reporting period, no monetary penalties or non-monetary sanctions related to breaches in this area were imposed on the Group's entities. Information on grievance and incident reporting mechanisms is provided in disclosure S1-3" (page 172).

Table 2 of the index maps both related datapoints derived from other EU legislation to this page: "Cases of discrimination point 103(a)" and "Non-compliance with the UN Guiding Principles on Business and Human Rights and OECD Guidelines, paragraph 104(a)" are both referenced to page 172 (page 125).

Context from the whistleblowing disclosure is consistent rather than contradictory: confirmed reports are described as "very low (0-2 cases annually)" (page 156), and the three reports received within Invia Group in 2025 resolved as one test submission and two cases where "no material breaches or need for further corrective actions were identified" (page 158). The Group also records that the risk of failing to detect all cases of discrimination and harassment "fell below the materiality threshold due to enhancements made to the whistleblowing system" in the 2025 materiality update (page 115).

Reference: page 178 (the index places S4-1 to S4-3 at page 178).

The same MDR caveat as S1-1 applies: the policies "were originally developed for internal purposes and do not, in all cases, meet the requirements set out in the MDR included in the... ESRS"; they "are adopted by the Management Board and supervised by the Directors of the Departments" (page 174).

Code of Journalistic Ethics. It requires independence "of all external and internal pressures" and a duty "to seek the truth, to separate information from interpretations and opinions". The Code "applies to companies operating in Poland and is only made available internally through the #mojemiejsce platform" (page 174).

Cybersecurity. A dedicated team operates within a Security Operations Center built on three pillars: network and system security, pentesting, and automation and machine learning. "In 2025, the Wirtualna Polska Group recorded approximately 3.5 thousand alerts (compared to almost 3000 in 2024)... leading to the elimination of hundreds of vulnerabilities" (pages 175-176).

Data privacy. A Personal Data Protection Policy and a Privacy Policy are in place, security follows the ISO 27000-series, and a Data Protection Officer and the DBiODO department are appointed. Complaints remained "at a minimum level despite a high number of requests submitted (about 400 in 2025)", with "no administrative proceedings ending in fines or court decisions concerning customers' privacy" (page 177).

Reference: page 178.

Engagement runs through several named channels (page 178): NPS surveys analysed by the WP research and analysis department and presented to area managers, with results "used to streamline and improve the services provided and texts published"; an opinion and rating system; image research covering "perception of service security, information quality or social inclusion"; social inclusion initiatives including "the creation of content tailored to the needs of people with disabilities"; and online data and feedback analytics.

Two channels are specific to the enlarged travel business. Customer feedback is monitored "through brand perception surveys, operational NPS, and various feedback channels", alongside analysis of "Operational signals related to travel disruptions, such as partner failures, destination-related restrictions, or weather events", feeding improvements to communication, booking change processes and the transparency of information (page 178).

Accessibility engagement is tied to EU legislation: travel entities "support the accessibility of services by analysing user feedback and adapting content and functionalities to the requirements of the European Accessibility Act", with "dedicated webpages, such as Barrierefreiheit on ab-in-den-urlaub.de" enabling travellers to access accessibility information and submit feedback (page 178).

Reference: page 178.

The primary channel is the Customer Service Offices, which "respond to user needs, including reported cybersecurity incidents. This enables the Group to quickly identify and address potential security issues and gather opinions on the quality of its customer service" (page 178).

The Group discloses a gap plainly rather than asserting coverage: "There is no direct formal evaluation process in place to determine whether consumers and end-users are aware of the opportunity to voice their concerns or needs and to what extent they are being addressed" (page 178).

Two structural additions are described (page 179). The User Rights Advocate role was created following a project begun in 2023 "to collect and respond to user feedback in an even more thorough manner", with responsibilities including "analyzing user behavior to identify areas for improvement and collecting customer feedback"; "In 2024, the first recommendations developed by the User Rights Advocate were implemented on Wirtualna Polska Media sites." The Code of User Rights, created by that office, is "a set of rules and guidelines that aim to ensure transparency, fairness and full respect in the relations between Wirtualna Polska and its users".

Privacy-specific handling runs through the DBiODO department and the SOC team, with escalation where appropriate to the Polish data protection authority (UODO) or CERT Polska (page 177).

Reference: page 179.

Actions are organised by IRO, with resourcing described as "significant human resources as well as financial and technological investments, focusing on the development of artificial intelligence-based technologies, digital security, and... UX/UI standards" (page 179).

Information impacts. In 2025 the Group received 13 Grand Press nominations and 3 awards, plus PAP Ryszard Kapuscinski Awards and the Dariusz Fikus Award 2025 (pages 179-180).

Travel price discrepancies. The Group reports the consequences: "In December 2023, the President of the Office of Competition and Consumer Protection (UOKiK) imposed a fine of PLN 1.06 million on Wakacje.pl S.A.", a decision that "is not final, and the company has appealed against it"; proceedings are also open against Travelplanet.pl, against Wirtualna Polska Media on the marking of advertising materials, and over Pilot WP advertising, where "The Group has ceased publishing the advertising campaign that raised UOKiK's concerns" (page 180). A Responsible Advertising Code with an Advertising Verification Committee reviews contested advertising (page 180).

Access to products and services. OTA systemic risk mitigations include supplier diversification, monitoring of unusual cancellation patterns, rebooking processes and monitoring of suppliers' financial stability, with the qualifier that "these measures do not constitute a formalised operational resilience system" (page 181).

Reference: page 182.

User-related targets come from the 2022-2030 Sustainable Development Strategy, each with a 2025 target and a 2030 ambition (page 182): "Creating, implementing and regularly training 100% of journalists on guidelines for using non-exclusionary language"; "Conducting a fact-check project"; "Wirtualna Polska is a safe place online", covering the Stop-Hate programme and promotion of comments by logged-in and credible users; maintaining "a high level of availability of WPH services"; and fighting digital exclusion through "Implementation of a program for the elderly".

The MDR-T caveat is stated: "In the reported year, the Wirtualna Polska Holding Group was in the process of adjusting its policies to the requirements of the ESRS and MDR-T, so not all issues meet the listed requirements" (page 182).

Progress includes a clear failure (pages 182-183). Inclusive language guidelines were developed with training in 2023; a fact-checking procedure "supported by a proprietary AI tool" was implemented; comment moderation continues with AI support. On digital inclusion: "The target involving the implementation of a dedicated programme for older persons and the development of good practices in this area was not achieved. This resulted from the deprioritisation of this area in favour of strengthening activities related to cybersecurity and combating disinformation."

Targets are stated qualitatively; no measurable percentage outcome is given.

Reference: page 184.

Four documents carry the Group's business conduct commitments: "The Code of Ethics, The Code of Journalistic Ethics, The Sustainable Development Strategy, Code of Responsible Advertising", all "developed with the involvement of our stakeholders and top governing bodies" (page 184).

The Code of Ethics "forms the foundation of all policies, procedures and internal rules of Wirtualna Polska Holding Group and applies across all geographical areas in which the Group operates", and is "an updated and expanded version of the previously existing Ethics Compass". "Tomasz Siemieniec was appointed Ethics Officer of Wirtualna Polska Group". Its priorities are freedom of speech, truth, objectivity, freedom of choice and environmental protection (pages 184-185).

Corporate culture actions are listed: "Mandatory training on the code of ethics for all employees across the group; Diversity months...; Training for managers on labour law, communication and anti-bullying behaviours; Strengthening managers' knowledge in the area of diversity and equal treatment" (page 184).

Whistleblower protection is tied to legislation: "Pursuant to the provisions of the Act of 14 June 2024 on the Protection of Whistleblowers, the Management Board adopted a procedure for handling reports", open to "the Group's employees, collaborators, partners and other stakeholders", under which "no retaliatory actions... may be taken against whistleblowers" (page 186).

Reference: page 186.

Two strands are disclosed. The first is late payment prevention, built on four principles: "Dedicated cash flow management departments"; document circulation "entirely in the company's accounting and financial system, which ensures transparency and control over the payment process"; payment sessions, with "a minimum of two sessions per week"; and delay analysis, where "The Group always analyses and explains any payment delays" (page 186).

The second is the Supplier Code of Conduct, adopted by the Management Board in December 2024, "aligned with international frameworks such as the UN Global Compact and the OECD Guidelines", defining requirements including "compliance with anti-corruption laws, avoidance of conflicts of interest, and enabling the monitoring of compliance" (pages 186-187).

The Group is explicit about two limitations. "Currently, no formalised supplier selection process is in place at the Group level that would incorporate specific social and environmental criteria" (page 186). And on monitoring: "One of the key challenges addressed by the Code is the limited ability to monitor suppliers' compliance... The adoption of the Code constitutes a first step towards introducing control, assessment and monitoring mechanisms" (page 187). This matches the material negative impact in the IRO table on limited capacity to monitor supplier compliance (page 114).

Reference: page 187.

"Matters relating to the prevention of corruption within Wirtualna Polska Group are governed by the Code of Ethics. In addition, the Group applies the Best Practice for GPW Listed Companies with regard to the management of conflicts of interest and anti-corruption measures" (page 187).

An Anti-Corruption Policy was adopted at the end of 2024 and "the Group is currently in the process of implementing it across all entities, including Invia Group, which was acquired in May 2025". It "is also available on the WP Holding website" (page 187).

Training was delivered for the first time in 2025, with coverage reported rather than asserted (page 187). Of 215 people in functions at risk, 77 were trained (36%); of 66 in the Management Team, 17 were trained (26%); of 2,995 employees, 1,237 were trained (41%). The e-learning module ran "approximately one hour" and "was made available to employees in the Group's Polish entities (excluding Travelplanet, an entity belonging to Invia Group)" (pages 187-188).

Investigation arrangements use an independent team "tailored to avoid pressure or personal or reporting dependencies between the parties involved". A gap is admitted: "The Group does not currently have a procedure for presenting the results to the administrative, management and supervisory bodies. The Group will consider adopting such a procedure in the next reporting period" (page 187).

Targets related to business conduct

Back-filled from the business conduct targets in the 2022-2030 Sustainable Development Strategy, which the report prints in the own workforce chapter and reports progress against under G1 headings. G1-3 became a standalone DR only in the 2025/2026 ESRS; under the 2023 ESRS these targets fell within MDR-T.

Reference: pages 161-162.

Two business conduct targets are stated (page 161): "We will develop an effective model for managing the ethics in the organisation" - "Every year, 100% of reported violations handled in accordance with the procedure and deadlines in place; 100% of employees trained over the past 2 years"; and "We will develop an effective model for managing the ethics in relations" - "Development of the Code and Statement of Compliance with the Code: 80% of business partners".

Progress is reported under G1 headings (page 162). "Handling of violations: The standard of 100% of reports being handled in accordance with the adopted procedures and timelines was maintained. Training: ... 79% of employees received training on the Code of Ethics, and 50% received training on Compliance Policies." On business relations: "At the end of 2024, the Business Partner Code of Ethics was implemented."

Effectiveness is also tracked through the number of confirmed whistleblower reports (page 158) and anti-corruption training coverage (page 187). The MDR-T caveat applies (page 161).

Reference: page 188.

A complete nil return covering both years: "Wirtualna Polska Group did not identify any incidents or convictions related to breaches of anti-corruption laws in 2025 or 2024" (page 188). Table 2 of the index maps both related datapoints derived from other EU legislation - "Fines for breaches of anti-corruption and anti-bribery rules point 24(a)" and "Anti-corruption and anti-bribery standards, paragraph 24(b)" - to page 188 (page 126).

The G1-3 disclosure is consistent and adds detail: "In 2025, no confirmed cases of corruption occurred within Wirtualna Polska Group, which means that there was no need to initiate legal action in this respect. No public court proceedings concerning corruption or bribery were conducted. Nor were there any convictions or fines for breaches of anti-corruption laws" (page 187).

The threat of corrupt behaviour "(also among suppliers and business partners)" is nonetheless carried as a material risk in the Group's own IRO table, spanning own operations and upstream across short, medium and long-term horizons (page 114). Separately, and distinct from corruption, the report discloses consumer protection enforcement: a PLN 1.06 million UOKiK fine imposed on Wakacje.pl in December 2023, under appeal, and three further sets of open UOKiK proceedings (page 180).