Supply Chain Responsibility

  • Material topic: Supply chain responsibility

Supply chain responsibility is an important multiplier to ensure sustainable corporate value creation above and beyond individual divisional boundaries, and hence to contribute to the environment and society. Business relationships that are built around close partnerships are the basis for successful cooperation and a resilient supply chain, something that has become even more important in light of the new requirements set out in the German Supply Chain Due Diligence Act (Lieferkettensorgfaltspflichtengesetz – LkSG).

As a result, United Internet aims to ensure in-depth dialog with its suppliers. Our goal is to establish a systematic approach to taking sustainability aspects into account when selecting, assessing, developing, and inspecting/reviewing our suppliers in the first half of 2023, and hence to continuously minimize risks to people and the environment along the entire value chain.

Description of Our Supply and Value Chain

  • GRI 2-6

We are an access and applications provider that supplies private customers and organizations with internet-based applications – both as independent products in the Applications Division and in combination with fixed network and mobile access products in the Access Division. We see it as our role to examine our impact on the environment and society in all links in our value chain.

The following graphic shows a simplified overview of the United Internet Group’s supply and value chain:

Grafik 9

Upstream

  • GRI 308-2
  • GRI 414-2

United Internet sources network services, domains, licenses, and ICT products such as devices and servers from the upstream value chain. These wholesale services are in turn partly based on a multistage upstream value chain stretching all the way back to raw materials extraction.

The wholesale services provided for the Access Division – and especially network services (mobile and fixed network) – represent a significant component of total wholesale services. For example, the Access Division uses its right of access to Telefónica’s mobile network, sources land line services from wholesale service providers, and is in the process of constructing its own mobile network. Since these wholesale services entail the use of substantial amounts of energy and resources, they must also be examined with a view to their environmental impact.

Servers and devices such as smartphones and tablets, which we source from international manufacturers, have an environmental impact. Especially their electronic components can be relevant from the raw materials extraction phase onwards. A social perspective is becoming important here, since raw materials in particular are frequently mined in countries in which the standards for working conditions and environmental protection alike are lower than in Germany, for example. These human rights and environmental risks will be analyzed in future as part of the risk analyses performed in relation to suppliers, countries of origin, and product groups.

Our Value Added

The figure provides a more detailed breakdown of the red “Our value added” link in the value chain shown earlier. United Internet primarily adds value in the areas of product development and enhancement, marketing, sales, and customer care. In addition, the organization has its own logistics capabilities. Our products and services build on our data center and fiber-optic network operations.

We add most of the value we create in Germany or other EU or OECD countries. Impacts on the environment and society, such as the energy consumed by our data centers, the impact of transportation and logistics, or our responsibility as an employer, are examined in detail in the relevant chapters of this sustainability report. In addition, potential human rights and environmental risks will be assessed in future across all locations using dedicated risk analyses.

Downstream

United Internet also uses service providers in some parts of its sales and customer service operations. Downstream activities can be highly relevant, since in many cases the contracts underlying our fee-based subscriptions (more than 27 million) and ad-financed free accounts (more than 40 million) result in long-term customer relationships. This means that the use phase for our products (e.g., with respect to data privacy and information security) is a material part of our business – including from a sustainability perspective.

Equally, environmental topics are relevant. Deliveries and journeys by our service providers use fuel and emit greenhouse gases. In addition, disposing of or recycling retired devices and IT equipment in an environmentally friendly manner is a relevant environmental factor, which is why we work with specialized partners in this area.

Responsibility for Human Rights Due Diligence and Environmental Due Diligence

  • GRI 308-1
  • GRI 414-1

United Internet is aware of its responsibility for people and the environment and lives up to its social responsibility. This applies both to its own business activities and to its supply chain. We include our business partners when it comes to taking responsibility and make this the basis of our work together, so as to be able to build reliable, long-term relationships and assume responsibility together.

Our Activities to Date

Preventive and Corrective Measures

United Internet has already taken a number of measures in its own area of activity and in its supply chain. In its own area of activity these include the internal Code of Conduct and the related e-learning course. In its supply chain, the Code of Conduct for Business Partners, which was implemented in 2020, should be mentioned; the General Terms and Conditions of Business specify that compliance with this document is mandatory.

Complaints Process

United Internet has established confidential reporting channels to enable risks and adverse impacts to be identified at an early stage. The organization has created confidential points of contact outside the immediate working environments by appointing compliance managers and Vertrauenspersonen (designated persons of trust). These personal reporting channels are supplemented by an electronic whistleblowing system that enables whistleblowers to remain anonymous if desired. The goal of these grievance mechanisms is to become aware of any human rights complaints at an early stage and to get to the bottom of all complaints regarding human rights violations. The Management Board is informed at least once a year of all activities, e.g., via the annual compliance report.

Compliance received two reports of possible violations with potentially adverse human rights impacts in fiscal year 2022. These were both examined and the facts were established. No concrete, sufficiently precise indications of violations with potentially adverse human rights impacts were found in either case.

Code of Conduct for Business Partners

  • GRI 308
  • GRI 414

Our Code of Conduct for Business Partners (German only) builds on our Corporate Values to define minimum social and environmental standards in the areas of business integrity and compliance, human rights and labor rights, health and safety, and the environment. The Code specifies how the requirements are to be met and presents suitable channels for reporting any indications of problems. For example, United Internet provides employees at our business partners who want to notify it of potential violations of the law or of the Code of Conduct for Business Partners with a confidential reporting channel. At the same time, its business partners must ensure that employees are aware of this confidential reporting channel and that they can use it without any fear of reprisals.

Business Integrity and Compliance

The Code of Conduct for Business Partners requires business partners to take appropriate measures to comply with all applicable laws, regulations, and requirements (compliance). No undue benefits may be requested or offered; anti-corruption laws and regulations, and competition law and antitrust regulations must be observed; and sanctions and embargoes that have been imposed must be complied with (fair competition). In addition, suitable technical and organizational measures must be taken to protect the confidentiality, availability, and integrity of all information transmitted by United Internet, and in particular of sensitive corporate data and personal data (information security and data privacy).

  • Human Rights and Labor Rights
  • GRI 408-1
  • GRI 409-1
  • GRI 414-2

With respect to human rights, the Code of Conduct for Business Partners is based on the UN Guiding Principles on Business and Human Rights. The Code stipulates that appropriate measures must be taken to prevent, mitigate and, if necessary, redress adverse human rights impacts, and that it also expects business partners to do this.

In concrete terms, the Code of Conduct for Business Partners contains requirements regarding compliance with the rules governing working times, wages, and social security benefits (wages and working times). In addition, business partners may not use any form of forced, prison, slave, or compulsory labor, and the use of conflict minerals must be examined and prevented, especially during the procurement and manufacture of goods (voluntary labor). Business partners may not employ children under the minimum age specified by the International Labour Organization (ILO) or national legislation (no child labor). Above and beyond this, business partners must ensure that working environments are free from psychological, physical, sexual, or verbal abuse, intimidation, threats, or harassment, and must undertake to ensure equal opportunities in their human resources decisions. Discrimination on the basis of nationality and national origin, ethnicity, political affiliation, gender, religion or belief, disability, age, or sexual identity is prohibited (prohibition on discrimination).

Health and Safety

Business partners must ensure safe, healthy working environments in order to prevent accidents and sickness. Among other things, this includes holding regular training courses and providing suitable protective clothing.

Environment

  • GRI 308-1
  • GRI 414-1

Business partners undertake to comply with all applicable environmental legislation and to ensure the conservation of natural resources. Business partners whose activities have significant impacts on the environment should have effective environmental management policies in place to reduce the adverse impacts of their products and services on the environment.

Implementation

The Code of Conduct for Business Partners has been incorporated into the contracts entered into with business partners by including it in our General Terms and Conditions for Procurement (German only).

Our Next Steps

  • GRI 414
  • GRI 414-2

In 2023, we will continue the work that we started in 2022 on the processes for establishing a due diligence risk management system by defining workflows and responsibilities for all affected business processes. This will enable us to discharge our responsibilities in the supply chain and comply with the requirements of the LkSG. The work covers the following aspects in particular.

Due Diligence Risk Management and Internal Responsibilities

United Internet will continue embedding workflows and responsibilities in the business processes affected in the course of 2023. This includes defining new roles for monitoring due diligence risk management and reporting to senior management, and appointing human rights coordinators in relevant functions such as Procurement and Human Resources.

Risk Analyses

United Internet has developed dedicated policies for analyzing human rights and environmental risks in its own activities and in its supply chain. These risk analysis policies will be used by the functions and organizational units affected in the first half of 2023 to analyze potential risks at their own locations and within the supply chain. These risk analyses will be integrated in our organization and, to a certain extent, in the systems used and will be performed annually and ad hoc going forward.

  • A questionnaire and a related assessment policy is being developed for use in risk analyses of our own activities and will be used to determine, weight, and prioritize risks. The individual risk categories will be assessed for each location or location cluster by the contacts in the functions, in line with their probability of occurrence, as determined, and their expected severity (impact, scope, irreversibility).
  • Going forward, a software solution will be used to perform risk analyses in the supply chain; this will initially be used to assess the country and sector risks with respect to human rights, environmental, and ethical risks. Additional product group-specific risk analyses will then be performed that build on this initial risk analysis. A policy and a template to be used in assessing product group risks have been developed; these take into account both external sources, such as studies and relevant databases, and a questionnaire that is used to characterize the various supplier markets when determining the risks involved. Specific risks are assessed in terms of both their probability of occurrence and their expected severity (impact, scope, irreversibility). The next step examines supplier-specific contributions to their causes and the opportunities for influencing them.

Policy Statement

The Company has committed itself to observing the United Nations’ Universal Declaration on Human Rights and bases its activities on the UN Guiding Principles on Business and Human Rights. United Internet has included principles designed to ensure respect for human rights in its Corporate Values and Code of Conduct. This applies both to its internal Code of Conduct for employees and to its Code of Conduct for Business Partners.

Following the entry into force of the LkSG on January 1, 2023, United Internet is now updating its Policy Statement so as to set out its human rights strategy, its risk analysis process, potential risks, and related measures in more detail. In addition, the internal and external Codes of Conduct will be updated and communicated as appropriate.