Baringa Supplier Code of Conduct

1. Scope and compliance

This Supplier Code of Conduct sets the minimum environmental, social, ethical, security, privacy, resilience and governance standards expected of prospective and current suppliers to Baringa Partners LLP and its group entities. It applies throughout the supplier lifecycle, including sourcing, onboarding, contracting, delivery, supplier relationship management and offboarding.

Suppliers must comply with and communicate these requirements to their personnel, subcontractors and relevant supply-chain partners, and to maintain evidence that demonstrates compliance when requested by Baringa.

2. General requirements for prospective suppliers

• Prospective Suppliers shall keep all pre-contract data, negotiations and tender progress strictly confidential and, where requested by Baringa, enter into a non-disclosure agreement on agreed terms.
• Before entering into any contract, Baringa may undertake proportionate due diligence to comply with applicable law and assess the prospective Supplier against Baringa’s business, security, sustainability, privacy, Responsible AI and resilience requirements. This may include completion of Baringa’s Pre-Qualification Questionnaire and supporting assurance checks. Prospective Suppliers shall cooperate fully and promptly with such enquiries and provide accurate evidence when requested.
• All activity between Baringa and prospective Suppliers will be conducted with confidentiality and integrity. Contracts will be awarded on merit and at Baringa’s discretion. Hospitality or other inducements intended to encourage or reward a positive outcome must not be offered to Baringa personnel. Acceptance of such inducements during a competitive tender or negotiation is strictly prohibited.

3. General requirements for current suppliers

• Where Baringa enters into a contract with a Supplier, the relationship will be governed by the agreed terms and conditions. The Supplier shall also comply with this Supplier Code of Conduct and all applicable laws.
• Baringa may undertake ongoing due diligence, assurance and supplier governance activity to confirm continued compliance and alignment with Baringa’s business requirements. Suppliers shall cooperate fully and promptly with such enquiries, including refreshed PQQ, sustainability, security, privacy, Responsible AI and resilience reviews where relevant.
• Suppliers shall review their policies and procedures regularly so that changes in regulation, technology, risk, industry practice and their own organisation are captured and managed.
• Suppliers shall ensure that their personnel and subcontracted personnel comply with the principles of Baringa’s Code of Business Ethics in the Annex and with the requirements applicable to the services they deliver.

4. Priority of standards and updates

• If there is a conflict between applicable law or regulation, an agreement with Baringa and this Supplier Code of Conduct, the Supplier shall meet the most stringent standard to the extent legally permitted.
• Baringa may update this Supplier Code of Conduct from time to time. The current version is available on Baringa’s website at https://www.baringa.com/en/about/supplier-code-of-conduct/ and through Baringa’s approved supplier communication channels.

5. Employment and supply chain ethics

• Suppliers shall respect the human rights of employees, other personnel and local communities and comply with all applicable human-rights and labour laws.
• Suppliers shall take appropriate steps to identify, prevent and eradicate modern slavery, servitude, forced or compulsory labour and human trafficking, including within their supply chains.
• Suppliers shall maintain appropriate due diligence and provide relevant training to personnel to identify risks or actual instances of modern slavery.
• Suppliers shall respect lawful freedom of association and collective bargaining and shall not interfere with workers’ rights to form or join trade unions.
• Suppliers must compensate workers with wages, overtime premiums and benefits that meet at least the highest applicable minimum established by law, collective agreement or relevant industry standard.
• Suppliers shall maintain equal-opportunity practices and shall not unlawfully discriminate in recruitment, compensation, training, promotion or termination.
• Employment terms must be clear and accessible. Disciplinary practices and grievance procedures must be fair, documented and consistently applied.
• Suppliers shall provide evidence, on request, that labour and human-rights risks in their supply chain are identified and managed, and that goods and services are traded lawfully and ethically and all employment, labour and human rights laws applicable to the Supplier including the Right To Work checks are fully complied with.

  6. Right to Work (RTW) checks  

• Right to Work (RTW) checks Supplier must comply with all legal requirements, official guidance and binding codes of practice in respect of RTW checks (as amended from time to time), including:
• conducting any prescribed RTW checks on any individual employed to perform any work or services within Baringa’s supply chain, and
• not subcontracting without the prior written consent of Baringa and if permitted, flowing down to subcontractors RTW requirements equivalent to those in this section.
• Baringa may audit all Supplier RTW processes to ensure compliance with such legal requirements, official guidance and binding codes of practice.
• Baringa may suspend or terminate with immediate effect the Supplier contract where illegal working has been established within Supplier’s supply chain.
• Supplier must cooperate with any government investigations by providing any information required by an investigating government body.
• Where the Supplier is permitted to substitute individuals employed to provide any work or services within Baringa’s supply chain, the Supplier must not permit such individuals to begin such work or services before the Supplier ensures the correct RTW checks have been completed.
• Supplier must maintain proportionate systems and processes on identity verification to ensure that the individual carrying out the work or services is the same individual on whom a RTW check has been conducted.

7. Community and supplier diversity

• Suppliers should understand the impact of their activities on local communities and seek to make positive contributions, for example through local employment, volunteering or charitable activity, while minimising disruption.
• Baringa seeks to provide small, local and diverse businesses with fair opportunities to participate in procurement and sourcing. Suppliers are encouraged to extend fair access and inclusive sourcing practices through their own supply chains and to provide relevant information on request.
• Any statement about diverse-supplier participation, ownership or programme outcomes must be accurate, evidence-based and capable of verification.

8. Prevention of financial crime

• Suppliers shall comply with laws relating to bribery, corruption, money laundering, terrorist financing, tax evasion, facilitation of tax evasion, sanctions, fraud and competition.
• Suppliers shall maintain proportionate policies, controls, training, oversight, risk assessment, due diligence and audit arrangements to prevent and detect Financial Crime.
• Suppliers must prohibit bribes, facilitation payments, improper gifts or hospitality, undue influence through sponsorship or advertising, and unauthorised charitable or political donations.
• Suppliers shall verify the legitimate origin of goods and services and the identity and legitimate nature of businesses with which they contract.
• Suppliers shall maintain a responsible tax strategy and comply with applicable competition and antitrust laws, including prohibitions on price fixing, bid rigging and improper information sharing.
• Suppliers shall provide protected reporting routes, prohibit retaliation against good-faith reporters, maintain appropriate records and promptly notify Baringa of actual or suspected Financial Crime connected with the relationship or capable of affecting Baringa.

9. Environmental responsibility

• Suppliers shall comply with applicable environmental laws and operate in an environmentally responsible manner.
• Suppliers shall work proactively with Baringa to reduce environmental impacts associated with the goods or services provided.
• Suppliers shall minimise resource use, including energy and water; reduce waste; favour sustainable, recycled or reusable materials where practicable; manage packaging responsibly; and ensure hazardous or toxic waste is handled by licensed and competent bodies.
• Suppliers shall maintain an Environmental or Sustainability Policy proportionate to the size, nature and impacts of their operations.
• Suppliers shall review environmental performance and that of relevant supply-chain partners regularly, retain evidence of findings and remediation, and provide it to Baringa on request.
• Suppliers shall maintain processes to measure and report relevant Scope 1, 2 and 3 greenhouse-gas emissions and set meaningful reduction targets supported by a transition plan or equivalent, where proportionate and applicable.
• Suppliers shall hold ISO 14001 certification, be demonstrably working towards certification, or operate in alignment with ISO 14001 principles where proportionate to the services and associated environmental risks.

10. Information security

• Each Supplier shall comply with the information-security requirements in its contract with Baringa and, where applicable, Baringa’s Information Security Policy for Suppliers.
• Information-security controls shall be proportionate to the sensitivity, criticality and risk of the information, systems and services concerned. Suppliers shall protect confidentiality, integrity and availability and apply least-privilege and need-to-know access.
• Suppliers shall maintain governance, risk-management, asset-management, access-control, vulnerability-management, continuity and assurance arrangements appropriate to the services.
• Suppliers shall provide timely and accurate evidence as part of Baringa’s security due diligence and respond promptly to security questionnaires and remediation requests.

11. Resilience and business continuity

• Baringa expects Suppliers to maintain business-continuity arrangements proportionate to the scale, nature, complexity, criticality and geography of the services provided.
• At a minimum, resilience arrangements should consider people, data and technology, including systems, premises and critical third parties.
• Suppliers providing critical products or services must maintain appropriate plans, controls and recovery arrangements informed by risk assessment and, where appropriate, business-impact analysis, threat assessment and identification of critical processes, systems, personnel, infrastructure and third-party dependencies.
• Where applicable, Suppliers shall agree recovery objectives with Baringa and manage continuity risks, controls and actions in a structured manner.
• Plans and supporting arrangements must be reviewed, updated and tested regularly and at least annually where relevant. Key personnel must understand their roles during a disruption.
• Suppliers shall maintain effective communication channels to provide Baringa with timely and accurate information during an incident or disruption.
• Baringa may request information and evidence relating to continuity frameworks, assessments, plans, recovery arrangements, testing outcomes, communications and remediation during onboarding, assurance or ongoing contract management.

12. Cyber security

• Suppliers shall comply with applicable cyber-security requirements in their contract and relevant Baringa policies.
• Suppliers shall maintain proportionate controls to protect people, property, information assets, data and services from unauthorised access, loss, damage, disruption or interference.
• Suppliers shall maintain appropriate governance, oversight, risk assessment, security testing and staff training to protect availability, integrity and confidentiality.
• Suppliers shall ensure their own critical suppliers and subcontractors are subject to proportionate cyber-security requirements and oversight.

13. Cyber security incidents and breaches

• Suppliers shall maintain effective incident identification, escalation, response, investigation, containment, recovery and lessons-learned processes.
• Suppliers shall notify Baringa without undue delay and, wherever possible, within 24 hours after becoming aware of a cyber-security incident that has compromised or could materially compromise Baringa data, systems or services.
• Where an incident involves personal data, it must also be managed under section 1.12 Data Privacy.
• Suppliers shall retain sufficiently detailed incident records, cooperate with Baringa’s investigation and provide a remediation plan and progress updates on request.

14. Data privacy

• Suppliers must comply with applicable data-protection and privacy laws, Baringa’s data-privacy requirements and contractual data-protection obligations.
• Where a Supplier collects personal data in circumstances where Baringa is a controller or joint controller, the Supplier must ensure that individuals receive an appropriate privacy notice.
• Suppliers must notify Baringa without undue delay of actual or suspected incidents involving personal data by contacting Privacy@Baringa.com and, where legally permitted, before notifying a regulator so that Baringa can assess remediation and reporting duties.
• Suppliers shall apply purpose limitation, lawfulness, fairness and transparency, data minimisation, accuracy, integrity and confidentiality, storage limitation and accountability when processing personal data connected with Baringa.
• Suppliers shall use secure transfer and access methods, appropriate encryption and technical and organisational controls. Personal data must not be transferred internationally without the approvals and safeguards required by the applicable contract and law.
• Suppliers shall delete, return or transfer personal data when it is no longer required and provide written confirmation of deletion on request.
• Suppliers shall inform Baringa within 24 hours of receiving a data-subject or regulatory request relating to Baringa personal data and shall not respond without Baringa’s written instructions unless required by law.
• Suppliers shall give at least 30 days’ advance notice before appointing a new sub-processor that may access Baringa data, unless the contract specifies a different lawful mechanism. Equivalent protections must be flowed down and the Supplier remains accountable for its sub-processors.
• Baringa may audit compliance with applicable data-protection law, the contract and this Code. Suppliers shall provide reasonable assistance, including with Data Protection Impact Assessments, in a timely manner.

15. Responsible AI

• Where a Supplier develops, deploys or uses artificial intelligence in connection with goods or services provided to Baringa or in processing Baringa data, it must do so lawfully, ethically and responsibly and in accordance with applicable laws, regulations and recognised standards, including the EU AI Act where relevant.
• Suppliers must maintain appropriate AI governance, accountability, documented risk assessment and meaningful human oversight, with clearly assigned responsibility for AI-related risks and decisions.
• Suppliers must identify, assess and mitigate risks of bias, discrimination, inaccuracy, misuse, safety failure, security vulnerability and adverse impact throughout the AI lifecycle.
• Suppliers must be transparent with Baringa about material use of AI in service delivery and notify Baringa in advance where AI will materially process Baringa data or support decisions affecting Baringa, its clients or individuals.
• Suppliers must not use Baringa data, including personal data or confidential information, to train, fine-tune or develop AI models without Baringa’s prior written consent.
• Suppliers shall retain appropriate records of relevant AI systems, including purpose, material data use, risk assessment, oversight and incidents, and provide reasonable information to Baringa on request.
• Suppliers shall promptly notify Baringa of any AI-related incident that could materially affect Baringa, its data, clients or individuals and cooperate with investigation and remediation.

16. Health, safety and wellbeing

• Suppliers shall protect the health, safety and wellbeing of persons affected by their activities and comply with relevant laws, regulations and recognised standards in each jurisdiction in which they operate.
• Suppliers shall maintain documented policies, procedures, responsibilities, risk assessments, controls and safe systems of work proportionate to their activities.
• Personnel must be competent, suitably trained, qualified and supervised. Plant, equipment and substances must be safe, maintained and used with appropriate protective equipment.
• Suppliers shall comply with relevant site induction, local rules, permit-to-work, emergency, fire and first-aid arrangements.
• Accidents, incidents, near misses and hazards relevant to Baringa must be reported promptly. Suppliers shall cooperate with investigations and implement corrective action.
• Suppliers shall take reasonable steps to safeguard physical and mental wellbeing, including management of fatigue, lone working and other foreseeable risks.
• Suppliers shall work openly with Baringa, share relevant safety information and permit reasonable monitoring, audit or inspection.

17. Training

• Suppliers shall provide appropriate training so that their workers understand the requirements relevant to this Supplier Code of Conduct and their role.
• Suppliers shall maintain records of training offered and completed and provide relevant evidence to Baringa on request.

18. Certifying compliance and audit

• Suppliers shall provide written confirmation at least annually, where requested, that they maintain systems to monitor compliance and can comply with this Code for the duration of their relationship with Baringa.
• Baringa may undertake proportionate audits to verify compliance. Suppliers shall provide reasonable access, information and assistance. Baringa is not obliged to conduct an audit, and an audit does not reduce the Supplier’s responsibility for compliance.

19. Breach, remediation and termination

• Suppliers shall monitor compliance and report actual or suspected breaches as soon as possible to LegalDept@Baringa.com or another reporting route specified by Baringa.
• Suppliers shall not retaliate or take disciplinary action against any person who, in good faith, reports a concern or seeks advice about this Code.

20. Breach, remediation and termination

This section should be read with each Supplier’s contract with Baringa. Failure to comply with this Supplier Code of Conduct, applicable law, or any related contractual obligation may constitute a breach and may require corrective action, enhanced monitoring, suspension of work, or termination where permitted under the relevant contract.

• Suppliers must notify Baringa promptly of any actual or suspected breach of this Code, including breaches involving law, ethics, human rights, environmental standards, security, privacy, resilience, Responsible AI, health and safety, or financial crime.
• Where Baringa requests remediation, Suppliers shall provide a clear remediation plan, named owner, target dates and progress updates, and shall cooperate with any reasonable assurance, audit or investigation activity.
• Baringa may require additional controls, temporary restrictions, suspension of activity, replacement of personnel or subcontractors, or other proportionate steps to manage risk while remediation is underway.
• Where a breach is material, repeated, not capable of remediation, or not remediated within a reasonable period, Baringa may exercise any contractual rights available to it, including termination, without limiting any other rights or remedies.

September 2026