Whistleblower reporting system

The whistleblower program is intended to promote openness, accountability, and a healthy corporate culture by providing a secure, confidential channel for reporting suspected serious misconduct relating to the Company or its activities. The program supplements—but does not replace—regular communication and reporting channels, including discussions with an immediate supervisor, the compliance function, or executive management.

The program is available to anyone who has obtained information about violations in a work-related context, including:

• Current and former employees, as well as job applicants.
• Members of executive management and the Board of Directors.
• Consultants, temporary staff, and interns.
• Business partners, suppliers, advisers, and their subcontractors.
• Investors, tenants, and other external stakeholders.

The program covers suspected serious violations or matters of public interest. Examples of reportable matters include:

The Company's whistleblower program is operated by an independent external provider to ensure confidentiality and separation from day-to-day operations. Reports may be submitted through the following channels:

Through the encrypted web form at nordicestates.whistleblowerportal.eu. Reports may be submitted anonymously, and the portal does not log IP addresses or other identifying metadata.

By telephone at +45 70 80 90 91 (available 24 hours a day, Copenhagen time). An in-person meeting can be arranged within seven days upon request.

Reports may also be submitted directly to the Danish Data Protection Agency's external whistleblower program under Section 17 of the Danish Whistleblower Protection Act, or to the relevant competent authority, including the Danish Financial Supervisory Authority where the matter concerns the Company's financial activities.

All reports are handled confidentially by the Company's whistleblower unit, which consists of the compliance officer and external legal counsel. Cases follow a defined process:

Individuals who report in good faith through the program are protected against retaliation under Chapter 3 of the Danish Whistleblower Protection Act. This means that reporting must not result in dismissal, demotion, reassignment, denial of promotion, withholding of pay, negative references, or other unfavorable treatment as a consequence of the report.

The Company ensures that:

• The reporting person's identity is kept strictly confidential and disclosed only with consent or where required by law.
• Anonymous reports are handled on the same basis as reports from identified individuals.
• Breaches of confidentiality may result in disciplinary and criminal sanctions.
• The reporting person can contact the whistleblower unit for guidance on protection against retaliation.

Individuals named in a report are presumed innocent and have the right to be heard during the case review, provided this does not compromise the investigation. Their identities are kept confidential, and information must not be disclosed before the relevant facts of the case have been established.

Knowingly false or harassing reports are not protected under the Danish Whistleblower Protection Act and may result in disciplinary, employment-related, and criminal consequences, including liability for damages and referral to the authorities under Section 165 of the Danish Criminal Code concerning false reports.

Personal data processed in connection with the program is handled in accordance with the GDPR and the Company's privacy policy. The legal basis is Article 6(1)(c) of the GDPR, read together with Section 22 of the Danish Whistleblower Protection Act. Data is deleted as soon as retention is no longer necessary, and no later than when the case is finally closed, unless longer retention is required by law or necessary for evidentiary purposes.

The compliance officer reports to the Board of Directors at least once a year on activity under the whistleblower program, including the number of reports received, the nature and outcomes of cases, and any lessons learned. Statistics are published in anonymized form in the Company's governance report.

This whistleblower policy has been approved by the Board of Directors and takes effect on the date stated above. The policy is reviewed at least once a year, or whenever material changes occur in legislation or the Company's organization.

Version 2.0 · Last updated May 1, 2026 · Approved by the Board of Directors, NE-POL-007.