Ethics line.

Who can use it and what to report

The line is open to employees, suppliers, partners, owners, residents, neighbours of a site and any member of the public. Nothing has to be proven: it is enough to have reason to believe the facts are true.

Reports may cover corruption, fraud, conflicts of interest, harassment, discrimination, occupational safety risks, environmental harm, misuse of data and irregular conduct by a supplier or partner.

This line does not handle commercial requests or service complaints: for those, use Contact. If there is an immediate risk to life in Brazil, call 190 (Police) or 193 (Fire brigade).

What fits each type of conduct

The list below gives generic examples, to help choose the type on the form. It is not a closed list: if the facts do not fit, choose “Other” and describe them. Choosing the wrong category does not harm the report.

• Corruption or bribery. Offering, promising, asking for or accepting an undue advantage (money, an unusual gift, a favour) in exchange for a decision, licence, contract or lenient inspection; payment to an intermediary with no clear justification.
• Fraud, misappropriation or false records. A measurement or invoice for a service that was not performed, an altered document, diversion of material or funds, a false attendance or incident record, collusion between bidders in a quotation.
• Conflict of interest. A decision to hire a company or person linked to a decision-maker without declaring the link; a benefit received from someone competing for a contract; outside activity that clashes with the duty owed to the development.
• Moral or sexual harassment. Repeated humiliation, threats, deliberate isolation, abusive demands, unwanted sexual insinuation or contact, blackmail in exchange for a favour or for keeping a job.
• Discrimination. Unfavourable treatment because of race, colour, origin, sex, age, disability, marital status or family situation, among other grounds, in recruitment, promotion, daily site life or the choice of a supplier.
• Occupational safety. Work at height or in an excavation without protection, missing protective equipment, pressure to ignore a stoppage for risk, an accident or near miss that was not recorded.
• Environmental harm or risk. Irregular waste disposal, work in a protected area with no visible licence, a spill, pollution of a watercourse, dust or noise beyond what is reasonable for the neighbourhood.
• Misuse of data or information. Access to a document or personal data without need, sharing outside the purpose, a leak, use of restricted information for personal gain.
• Supplier or partner conduct. Breach of the integrity clauses, subcontracting without authorisation, failure to disclose a conflict of interest, an offer of advantage to employees.

Safeguards

The safeguards below are the ones the line offers today. Each has a limit, described further down in the section on anonymity.

• Anonymity. Identification is optional and the line does not store the reporter’s IP address.
• Confidentiality. The content sits in a restricted-access record, read only by those who investigate. The new-report notice carries only the protocol number and the date; the text never travels by e-mail or WhatsApp.
• No retaliation. No one is punished for reporting in good faith, even if the investigation does not confirm the facts.
• Follow-up. On submitting, you receive a protocol number and a secret code to check progress.

How it works

1. ReportChoose the type of conduct and describe what happened, when, where and who was involved. Do not attach files: say where the evidence is.
2. Optional identificationBy default the report is anonymous. Those who prefer may give a name, e-mail and phone, which stay only in the restricted record.
3. Protocol and codeThey appear only once, on screen. Write both down: the code cannot be recovered.
4. Restricted recordThe report is saved in a restricted-access record. The new-report notice carries only the protocol number and the date; the text never travels by e-mail or WhatsApp.
5. InvestigationWhoever investigates cannot be involved in the facts. The first progress update is given within 10 business days.
6. Follow-upWith the protocol and code, check progress below: received, under investigation, concluded or closed, with the date of the update and, when there is one, a reply.
7. ClosureThe state of the report, including concluded or closed, appears in the same follow-up.

How to write a report that can be investigated

A report that can be investigated answers simple questions, in the order the facts occurred. The more concrete it is, the better the chance that the investigator can verify it. The field accepts up to 8,000 characters and requires at least 30; “when”, “where” and “who was involved” are optional, but help a great deal.

1. What happened. Describe the fact, not the conclusion. “I saw material leave the site with no record” says more than “there is diversion”.
2. When. Date, period or frequency (once, every week, since a given month).
3. Where. Development, work front, department, or the medium used (meeting, message, e-mail).
4. Who. Roles or names of those involved, if you know them. Distinguish who did it, who saw it and who learned of it afterwards.
5. How you know. Did you witness it, hear it from someone, see it in a document? Say which, without assuming more than you know.
6. Evidence and where it is. The line does not accept attachments. Say what document, message or record exists and who holds it, without copying its content.
7. Effect. Who was harmed, what the risk is, whether it is still happening.
8. What has been done. Whether you already told someone and what the reply was.

What not to write

• Third-party data beyond what is needed. The name, role and conduct of those involved are enough. Tax ID numbers, home addresses, personal phone numbers and other people’s health data are rarely needed to investigate.
• Documents and files. Do not paste whole contracts, forms, spreadsheets or conversations. Describe them and say where they are.
• Passwords, keys and access credentials. Never, under any circumstances.
• Assumption presented as fact. Separate what you saw from what you imagine. A good-faith report does not require certainty, but accusing without a basis harms the person named and weakens the report.
• Details that point to you, if you want to stay anonymous. A position only one person holds, a time when only you were present, a conversation in which only the two of you spoke. The investigator may infer authorship from such signs.

Anonymity and confidentiality: what they mean and where they end

The two words do not mean the same thing. Anonymity means nobody knows who reported. Confidentiality means it is known, but the information reaches only a limited set of people. The line allows the first and, when you choose to identify yourself, keeps your details in a restricted record.

• Anonymous report. The form does not ask for a name, e-mail or phone number, and the line does not store the IP address. Even so, the content of the report may reveal authorship, as seen in the previous section.
• Identified report. Name, e-mail and phone are optional and sit only in the restricted record, so the investigator can reach you. Identifying yourself does not make the report public.
• Limit of anonymity. An anonymous report with little information limits what can be investigated. The reply, when there is one, appears in the follow-up with protocol and code.
• Limit of confidentiality. If a fact requires communication to a public authority or a court order, the legal rules apply on top of the line’s rules.

The same care applies on your side: using a device used only by you and avoiding shared networks reduces the risk that someone links the access to the report.

Protocol and secret code

When you send the report, the screen shows a protocol number (format ET-XXXXXXXX) and a secret code (format XXXX-XXXX-XXXX). Both appear only once and cannot be recovered. A button copies both.

• What they are for. With both, anyone can check the report’s progress in the “Check progress” section. With both, no one can see the content of the report.
• Where to keep them. Somewhere only you can reach, such as a password manager. Avoid a shared device, work e-mail and group chats.
• If you lose the code. There is no recovery: the code appears only once, on screen, and the follow-up requires both protocol and code.
• If you mistype the protocol or the code when checking. The page answers that they do not match, without saying which of the two is wrong.

Personal data in the report

Every report tends to contain personal data: that of the reporter, if identified, and that of the people named. Under Brazil’s General Data Protection Law (Law 13,709/2018, art. 5), personal data is information relating to an identified or identifiable natural person; sensitive personal data is, among other things, data revealing racial or ethnic origin, religious belief, political opinion, health or sex life. Reports of discrimination and harassment may touch on these matters.

Three principles in art. 6 guide the way to write a report: purpose (process data for a legitimate, stated purpose), necessity (only the minimum relevant to the purpose) and security (technical and administrative measures against unauthorised access). It is consistent with this that the form requires only the type of conduct and the description, accepts no attachments and keeps the content in a restricted record.

A reporter who identifies themselves, and anyone named in a report, has the rights in art. 18 of the LGPD, among them confirming processing and accessing and correcting data. The full policy and the data protection officer are under Privacy.

Legal basis and good-practice references

A reporting line is not a favour: Brazilian law treats it as part of an integrity programme, the set of rules and controls with which a company prevents, detects and corrects wrongdoing. What each norm consulted says, and what it does not say:

• Law 12,846/2013 (Anti-Corruption Law). Holds a company strictly liable for acts harmful to the public administration, such as promising or giving an undue advantage to a public official and rigging a public tender (arts. 2 and 5). When sanctions are applied, the existence of integrity mechanisms and of incentives to report irregularities is taken into account (art. 7, VIII).
• Decree 11,129/2022. Regulates the law. Among the parameters used to assess an integrity programme are reporting channels open to and widely publicised among employees and third parties, with mechanisms to handle reports and protect good-faith reporters (art. 57, X), disciplinary measures (XI) and prompt interruption of irregularities (XII). The decree requires the company’s size and specifics to be considered (art. 57, § 1).
• Law 14,457/2022, art. 23. For companies with an Internal Committee for the Prevention of Accidents and Harassment (Cipa), it requires rules of conduct against sexual harassment and other forms of violence, procedures to receive and investigate reports with anonymity guaranteed to the reporter, and training at least every 12 months. Receiving reports does not replace criminal proceedings (art. 23, § 1).
• Law 9,029/1995, art. 1. Prohibits discriminatory practice in access to or continuation of an employment relationship on grounds of sex, origin, race, colour, marital status, family situation, disability, professional rehabilitation, age, among others.
• Law 13,709/2018 (LGPD). Sets the principles of purpose, necessity and security in the processing of personal data (art. 6), seen in the previous section.
• Law 13,608/2018, arts. 4-A to 4-C. Guarantees the informant protection against retaliation and preservation of identity, which is revealed only in case of relevant public interest or concrete interest in the investigation, with prior notice and formal consent. These articles apply to the ombudsman and internal-affairs units of the public administration; for private companies they stand as a reference of conduct, not as a direct obligation.
• Directive (EU) 2019/1937. European rules on protecting those who report breaches of Union law, not applicable in Brazil. It serves as a comparative benchmark: acknowledgement of receipt within 7 days, a reply within a reasonable time not exceeding 3 months, confidentiality of identity and a ban on retaliation (arts. 9, 16 and 19).

The InnovaSphere Ethics line does not claim certification or full conformity with any standard; the norms above are references. This page is informative and is not legal advice.

What the line does not do

• It does not handle emergencies: an immediate risk to life requires 190 or 193.
• It does not replace the police, the Public Prosecutor’s Office or the courts. Facts that amount to a crime may also be reported by the reporter to the competent authority.
• It does not promise a result or a specific punishment.
• It does not guarantee absolute anonymity: it guarantees that the line does not ask for identification or store the IP, and it does not control what the content of the report reveals.
• It does not accept attachments or send the report text by e-mail or WhatsApp.
• It does not handle commercial requests, quotations, billing or service complaints: for those there is Contact.

Frequently asked questions

Do I need proof to report?
No. Good faith is enough: reason to believe the facts are true. The line asks you to say where the evidence is, if it exists, so the investigator can look for it.

What if the investigation does not confirm the facts?
Someone who reported in good faith is not punished for it. The protection does not cover reporting facts known to be false: good faith is the test.

Can I report something that happened long ago?
Yes. Give the period and where a record exists. Time may make investigation harder, but it does not bar a report.

Will anyone know it was me?
In an anonymous report, the line has neither your name nor your IP. The risk lies in the content itself: details only you know may point to you. In an identified report, your details sit in the restricted record, read only by the investigator.

Can I follow progress without identifying myself?
Yes. The follow-up uses only the protocol and the secret code, and shows the state of the report (received, under investigation, concluded or closed), the date of the update and, when there is one, a reply.

How long does it take?
The first progress update is given within 10 business days.

I lost the code. What now?
The code appears only once, on screen, and cannot be recovered. Without it, the follow-up is not possible.

I suffered retaliation for reporting. What do I do?
Law 13,608/2018 describes, as a reference, protection against retaliation for those who report (see the legal basis section). On the form, choose the closest type or “Other” and describe what happened and when.

Can I also report to a public authority?
Yes, at any time. The line neither prevents nor replaces that route.

Official sources

• Law 12,846/2013 (Anti-Corruption Law), Planalto (Portuguese).
• Decree 11,129/2022, Planalto (Portuguese).
• Law 14,457/2022, Planalto (Portuguese).
• Law 9,029/1995, Planalto (Portuguese).
• Law 13,709/2018 (LGPD), Planalto (Portuguese).
• Law 13,608/2018, Planalto (Portuguese).
• Directive (EU) 2019/1937, EUR-Lex.

Texts consulted on 4 October 2026.