Supply Chain Responsibility

  • Material topic: Supply chain responsibility

Supply chain responsibility is an important way of ensuring sustainable Group value creation above and beyond its own operations, and hence making a further contribution to the environment and society. Business relationships that are built around close partnerships are the basis for successful cooperation, and for a resilient and sustainable supply chain. This topic has become even more important given the requirements of the German Supply Chain Due Diligence Act (Lieferkettensorgfaltspflichtengesetz – LkSG).

United   Internet described the approach and the processes it has put in place to implement the LkSG in a Policy Statement during the reporting period. A dedicated report is used to report on compliance with the due diligence requirements set out in the LkSG.

See United Internet's Policy Statement.

Description of the Supply and Value Chain

  • GRI 2-6

United Internet is an access and applications provider that supplies consumers and businesses with internet-based applications – both as independent products in the Applications Division and in combination with fixed network and mobile access products in the Access Division. The United Internet Group sees its role as being to examine and positively influence its impact on the environment and society in all links in its value chain.

The following graphic shows a simplified overview of the United Internet Group’s supply and value chain:

Grafik 202

Upstream

  • GRI 308-2
  • GRI 414-2

United Internet sources network services, domains, licenses, and ICT products such as devices and servers from the upstream value chain. In turn, these wholesale services are based in some cases on a multistage upstream value chain stretching all the way back to raw materials extraction.

The wholesale services provided for the Access Division – and especially network services (mobile and fixed network) – represent a significant component of total wholesale services. Until 1&1 started providing mobile services via its own network, it had access to Telefónica’s mobile network in Germany in the reporting period and also used capacity provided by other wholesale service providers such as Vodafone’s mobile network. 1&1 started successively migrating existing customers using these networks to the 1&1 mobile network since the end of 2023.

Servers and devices such as smartphones and tablets, which are sourced from international manufacturers, have an environmental impact. In particular, their electronic components can be relevant from the raw materials extraction phase onwards.

The social and environmental perspective is especially relevant here, since raw materials in particular are frequently mined in countries in which the standards for working conditions and environmental protection alike are lower than in Germany, for example. United Internet analyzes these human rights and environmental risks continuously as part of the risk analyses it performs for suppliers, countries of origin, and product groups.

United Internet’s Value Added

The figure provides a more detailed breakdown of the red link entitled “United Internet’s value added” in the value chain shown earlier. United Internet primarily adds value in the areas of product development and enhancement, marketing, sales, and customer care. In addition, the Group has its own logistics capabilities. Its products and services are based around the operation of its own data centers and fiber-optic networks.

United Internet adds most of the value it creates in Germany or in other EU or OECD countries. Impacts on the environment and society, such as the energy consumed by data centers, the impact of transportation and logistics, or United Internet’s responsibility as an employer, are examined in detail in the relevant chapters of this sustainability report. In addition, potential human rights and environmental risks are assessed across all locations using dedicated risk analyses.

Downstream

United Internet also uses service providers to perform some parts of its sales and customer service operations. Downstream activities can be highly relevant, since in many cases the contracts underlying the fee-based subscriptions (more than 28 million) and ad-financed free accounts (roughly 40 million) result in long-term customer relationships. This means that the use phase for products (e.g., with respect to data privacy and information security) is a material part of the business – including from a sustainability perspective.

Equally, environmental topics are relevant. Deliveries and journeys by service providers use fuel and emit greenhouse gases. In addition, disposing of or recycling retired devices and IT equipment in an environmentally friendly manner is a relevant environmental factor, which is why United Internet works with specialized business partners in this area.

Responsibility for Human Rights Due Diligence and Environmental Due Diligence

  • GRI 308-1
  • GRI 414-1
  • GRI 414-2

United Internet is aware of its responsibility for people and the environment, and lives up to its social responsibility. This applies both to its own operations and to its supply chain. United Internet shares responsibility for compliance with human rights and environmental due diligence requirements with its business partners and makes this the basis of cooperation, so as to build reliable, long-term relationships and assume responsibility together.

Risk Management – Structures and Responsibilities

United   Internet ensures compliance with human rights and environmental due diligence requirements, both in its own operations and in its supply chain, by embedding workflows and responsibilities in its core business processes. Among other things, this includes appointing a central Human Rights Officer to monitor risk management, plus human rights coordinators in relevant functions such as Procurement, Human Resources, and Sustainability. These are responsible for coordinating implementation of the due diligence requirements in the relevant business processes at the level of the individual functions.

Risk Analysis

United Internet has developed policies for analyzing human rights and environmental risks in its own operations and in its supply chain. These risk analysis policies were used by the functions and organizational units affected in the 2023 reporting period as the basis for analyzing potential risks at their own locations and within the supply chain. These risk analyses will be integrated in the organization and, to a certain extent, in the systems used and will be performed annually and ad hoc going forward.

  • A questionnaire and a related assessment policy were developed for use in risk analyses of United   Internet’s own operations, allowing it to determine, weight, and prioritize human rights and environmental risks. The individual risk categories are assessed for each location or location cluster by the contacts in the functions concerned, based on the probability of occurrence determined for them and their expected severity (impact, scope, irreversibility). A variety of assessment categories are taken into account, such as the existence of a certified management system, clear roles and responsibilities, procedural instructions, established processes and practices, and KPIs and reporting structures. The results of the risk analysis are fed into United   Internet’s corporate decision-making processes on an ongoing basis and serve as the basis for identifying appropriate goals and targets, and preventive and corrective measures.

  • A proven software solution is used to perform risk analyses in the supply chain; this is initially being used to assess the country and sector risks with respect to human rights, environmental, and ethical risks. This abstract (gross) risk analysis is then used to determine and prioritize potential high-risk suppliers. These “gross risk suppliers” are then discussed by the human rights coordinators in the Procurement department and the purchasing agents responsible for the suppliers concerned. The dialog covers both the gross risk identified and the existing and future preventive measures taken or to be taken in response to them.

A net risk assessment of the suppliers is then performed, taking established preventive measures into account, after which additional preventive measures are determined. In addition, insights gained in the course of the grievance procedure are included in the risk analysis.

Preventive and Corrective Measures

A large number of measures have been systematically incorporated into the workflows in United Internet’s own operations. Among other things, this applies to the Human Resources function’s processes, procedural instructions, and responsibilities. These cover human rights due diligence requirements such as the prohibition on child labor and forced labor, ensuring appropriate remuneration and working conditions, and nondiscrimination of employees. Measures include appropriate contracts of employment, audits of temporary employment agencies, regular salary reviews and minimum wage audits, internal remuneration guidelines, internal audits, and regular training on diversity and equal opportunities. For example, occupational health and safety issues are addressed using annual safety inspections and regular classroom training and safety courses.

  • Internal Code of Conduct

United   Internet AG’s Code of Conduct sets out rules for how the Group and its employees should behave, and covers human rights and environmental due diligence requirements in its own operations. The Code of Conduct has been implemented at all United   Internet AG companies and is binding on all employees. An e-learning course on the Code of Conduct is used to familiarize employees with its content in an interactive, easily understandable way, and is an integral part of the onboarding process.

  • Code of Conduct for Business Partners
    • GRI 308-1
    • GRI 408-1
    • GRI-409-1
    • GRI 414-1
    • GRI 414-2

    The Code of Conduct for United Internet AG’s Business Partners (or the “Code of Conduct for Business Partners” for short) sets out the minimum requirements that must be observed by United   Internet’s suppliers. United   Internet expects that business partners will also pass on the standards set out in the Code of Conduct for Business Partners to their own suppliers. The Code specifies how the requirements are to be met and draws attention to the established grievance procedure for reporting any potential violations. For example, United Internet provides employees at its business partners who want to notify it of potential violations (especially in the areas of human rights and the environment) with a confidential reporting channel.

    • Supplier management

    United   Internet is systematically expanding its supplier management. A dedicated software solution is used to assess suppliers for potential sustainability risks, and sustainability impact assessments are then performed on a risk- and event-driven basis. In future, the supplier management process will specifically address human rights and environmental risks in the supply chain. This will cover supplier selection on the basis of defined requirements and qualification criteria, supplier assessment and control, and supplier development.

    Grievance Process

    United Internet has established confidential reporting channels to enable risks and adverse impacts to be identified at an early stage. By appointing compliance managers and designated persons of trust, the Group has created confidential points of contact outside of the immediate working environment. These personal reporting channels are supplemented by an electronic whistleblowing system that enables whistleblowers to remain anonymous if desired.

    The goal of these grievance mechanisms is to become aware of any human rights complaints at an early stage and to get to the bottom of all complaints regarding human rights violations. The Management Board is informed every quarter of human right complaints, incidents, and material adverse impacts as part of compliance reporting.

    Group Compliance received eight reports of possible violations with potentially adverse human rights impacts in fiscal year 2023. All of these underwent a plausibility check.

    Violations were found to have occurred in two cases, and corrective actions were launched and implemented in both of these. No violations were found to have occurred in six cases, and no further measures were required with respect to these.

    Policy Statement

    United Internet is committed to observing the United Nations’ Universal Declaration on Human Rights and bases its activities on the UN Guiding Principles on Business and Human Rights. United Internet has included principles designed to ensure respect for human rights in its Corporate Values and Code of Conduct. This applies both to its internal Code of Conduct for employees and to its Code of Conduct for Business Partners.

    United   Internet AG’s senior management published a Policy Statement in the reporting period. This describes the Group’s approach to implementing the human rights and environmental due diligence requirements set out in the German Supply Chain Due Diligence Act (Lieferkettensorgfaltspflichtengesetz – LkSG), and covers its human rights strategy and what it expects from employees and business partners.

    See United Internet AG's Policy Statement.