Modern Slavery, Human Trafficking, Anti-Bribery & Anti-Corruption Policy

This Modern Slavery, Human Trafficking, Anti-Bribery & Anti-Corruption Policy describes the standards of conduct expected by Flowstates Inc, doing business as Flow2FA, located at 330 Madison Avenue, 27th Floor, New York, NY 10017, United States, SR: 20223077628, EIN: 88-3465626 ("Flow2FA," "we," "us," or "our").

Flow2FA owns and operates flow2fa.com and related software-as-a-service tools for one-time passcode (OTP) and two-factor authentication (2FA) delivery over WhatsApp, SMS, and email.

Flow2FA is committed to conducting business lawfully, ethically, transparently, and with respect for human rights. We do not tolerate modern slavery, forced labour, human trafficking, child labour, bribery, corruption, extortion, facilitation payments, kickbacks, or improper influence in any part of our business or supply chain.

This Policy is intended to support compliance with applicable modern slavery, anti-human trafficking, anti-bribery, anti-corruption, procurement, employment, sanctions, trade, and corporate compliance laws in the jurisdictions where we operate or do business.

This Policy applies to:

• Flow2FA directors, officers, employees, contractors, consultants, temporary workers, and interns;
• Flow2FA subsidiaries, affiliates, and controlled entities, where applicable;
• suppliers, vendors, subprocessors, service providers, contractors, consultants, agents, advisers, resellers, referral partners, channel partners, and other third parties acting for or on behalf of Flow2FA;
• any person or entity representing Flow2FA in dealings with customers, suppliers, public officials, regulators, carriers, telecommunications providers, or other third parties.

All covered persons and third parties must comply with this Policy, applicable law, contractual obligations, and Flow2FA's related policies and procedures.

Flow2FA is a business-to-business OTP and two-factor-authentication delivery platform. We accept authentication traffic from our customers via SMPP v3.4 and/or a documented REST API, and we deliver OTP and verification messages over WhatsApp, SMS, and email. Depending on the customer's configuration, delivery may use the customer's own vendors and SMPP binds, Flow2FA-supplied messaging routes, or a combination of both, together with routing, fallback, delivery monitoring, and verification services. Our direct business activities primarily involve software development, cloud-hosted services, messaging technology, customer support, vendor management, sales, marketing, billing, and business operations.

Our supply chain may include:

• cloud hosting and infrastructure providers;
• messaging aggregators, carriers, and WhatsApp Business Solution providers;
• software vendors, AI and model providers, analytics, security, support, and payment service providers;
• professional advisers, including legal, accounting, tax, and audit providers;
• outsourced development, technical, operational, customer support, or administrative services;
• marketing, sales, and business development providers;
• office, equipment, IT hardware, and facilities suppliers;
• recruitment, staffing, contractor, and consulting providers.

Although Flow2FA does not manufacture physical goods, we recognise that modern slavery and corruption risks can exist in technology supply chains, outsourced labour, contractor arrangements, messaging and telecommunications ecosystems, hardware procurement, data centre supply chains, recruitment practices, and third-party business development relationships.

Flow2FA has zero tolerance for:

• slavery, servitude, forced or compulsory labour;
• human trafficking;
• child labour or unlawful exploitation of minors;
• debt bondage, bonded labour, or coercive recruitment practices;
• unsafe or abusive working conditions;
• bribery, corruption, kickbacks, extortion, or improper payments;
• facilitation payments;
• improper gifts, hospitality, donations, sponsorships, or political contributions;
• falsification of books, records, invoices, expenses, approvals, or compliance documentation;
• retaliation against anyone who raises a concern in good faith.

We expect our people and business partners to act honestly, fairly, and transparently, and to avoid any conduct that could create the appearance of unethical behaviour or improper influence.

Flow2FA prohibits modern slavery and human trafficking in our business and supply chain.

Covered persons and third parties must not:

• use forced, bonded, indentured, trafficked, prison, or involuntary labour;
• charge workers recruitment fees or require deposits as a condition of employment;
• retain workers' passports, identity documents, immigration papers, or work permits except where legally required and with free worker access;
• restrict workers' freedom of movement unlawfully;
• use threats, coercion, intimidation, violence, harassment, or abuse;
• employ children in violation of applicable law;
• require excessive working hours or deny legally required rest periods;
• fail to pay legally required wages, overtime, or benefits;
• misrepresent employment terms, wages, location, role, or working conditions;
• use suppliers, recruiters, labour brokers, or contractors that engage in exploitative labour practices.

Flow2FA expects suppliers and business partners to maintain fair labour practices, safe working conditions, lawful employment terms, and respect for internationally recognised human rights.

Flow2FA prohibits bribery and corruption in all forms.

Covered persons and third parties must not directly or indirectly:

• offer, promise, give, request, agree to receive, or accept a bribe;
• offer or give anything of value to improperly influence a decision;
• pay or receive kickbacks;
• make facilitation payments;
• use a third party to do something that Flow2FA could not lawfully or ethically do directly;
• falsify records to conceal a payment, benefit, discount, rebate, expense, commission, or incentive;
• make improper payments to public officials, political parties, candidates, state-owned enterprises, regulators, telecommunications authorities, carriers, procurement officials, or private-sector decision-makers;
• offer gifts, hospitality, donations, sponsorships, employment, internships, travel, entertainment, discounts, credits, or other benefits to obtain an improper business advantage.

"Anything of value" may include money, gifts, meals, entertainment, travel, accommodation, discounts, credits, rebates, commissions, charitable donations, political contributions, employment opportunities, internships, loans, services, confidential information, preferential treatment, or any other benefit.

Dealings with public officials, regulators, government agencies, state-owned enterprises, public telecommunications authorities, customs authorities, law enforcement, courts, political parties, political candidates, and public international organisations require special care.

For purposes of this Policy, a "public official" includes:

• any officer, employee, or representative of a government, government department, agency, ministry, regulator, court, or public authority;
• any officer or employee of a state-owned or state-controlled company;
• any political party, party official, or candidate for public office;
• any officer, employee, or representative of a public international organisation;
• any person acting in an official capacity for any of the above;
• close family members or intermediaries of public officials where the circumstances create corruption risk.

You must obtain prior written approval from the Legal Contact at legal@flowstates.net before offering anything of value to a public official or to a person connected with a public official.

Flow2FA prohibits facilitation payments.

A facilitation payment is a small unofficial payment or benefit made to speed up or secure routine government or administrative action, such as issuing permits, processing paperwork, clearing goods, connecting services, or obtaining routine approvals.

If you are asked to make a facilitation payment, you must refuse and report the request to legal@flowstates.net.

If you reasonably believe that refusing a payment would create an immediate threat to personal safety, you may make the payment necessary to protect yourself or others, but you must report the incident to Flow2FA as soon as possible.

Gifts, hospitality, travel, and entertainment must be reasonable, proportionate, transparent, lawful, and connected to a legitimate business purpose.

They must never be used to improperly influence a decision, obtain a business advantage, reward improper conduct, or create a conflict of interest.

Covered persons must not give or receive gifts, hospitality, travel, or entertainment that:

• is cash or a cash equivalent, including gift cards, vouchers, loans, or cryptocurrency;
• is lavish, excessive, frequent, or disproportionate;
• is offered during a tender, procurement, contract negotiation, audit, investigation, enforcement action, or regulatory process;
• is intended to influence a business or official decision;
• would embarrass Flow2FA if publicly disclosed;
• violates the recipient's policies or applicable law;
• involves a public official without prior written approval;
• is inaccurately recorded or concealed.

The following require prior written approval:

• any gift, hospitality, travel, or entertainment involving a public official;
• any gift or hospitality above an applicable threshold set by Flow2FA;
• any travel or accommodation paid for by Flow2FA for a third party;
• any repeated gifts or hospitality to or from the same person or organisation;
• any gift or hospitality involving a customer, supplier, or partner during contract negotiations.

All approved gifts, hospitality, travel, and entertainment must be recorded in the applicable register or expense system.

Flow2FA may make charitable donations, sponsorships, or community contributions where they are lawful, transparent, ethical, and aligned with our business values.

Charitable donations and sponsorships must not be used as a channel for bribery, improper influence, political contributions, or private benefit.

Prior written approval is required for:

• any charitable donation or sponsorship made on behalf of Flow2FA;
• any donation or sponsorship requested by a customer, supplier, partner, public official, regulator, or politically exposed person;
• any donation or sponsorship connected to a tender, procurement, licensing, regulatory, or contract decision;
• any donation or sponsorship above an applicable threshold set by Flow2FA.

Flow2FA may require due diligence on the recipient before approving donations or sponsorships.

Flow2FA does not make political contributions unless expressly approved by senior management and permitted by applicable law.

Flow2FA funds, assets, facilities, services, or resources must not be used to support political parties, candidates, campaigns, political committees, or political causes without prior written approval.

Lobbying, public policy engagement, and government relations activities must be lawful, transparent, properly recorded, and conducted only by authorised persons.

All Flow2FA personnel must avoid actual, potential, or perceived conflicts of interest.

A conflict of interest may arise where personal, financial, family, political, or outside business interests could influence, or appear to influence, a person's decisions on behalf of Flow2FA.

Examples include:

• selecting a supplier owned by a family member or close friend;
• receiving personal benefits from a vendor, customer, or partner;
• outside employment with a competitor, supplier, or customer;
• personal financial interests in a company doing business with Flow2FA;
• hiring, supervising, or influencing employment decisions involving relatives or close personal relationships.

Conflicts must be disclosed promptly to legal@flowstates.net.

Flow2FA may conduct risk-based due diligence on suppliers, vendors, contractors, subprocessors, agents, resellers, referral partners, consultants, and other third parties.

Due diligence may include review of:

• ownership and control;
• sanctions, watchlist, and adverse media screening;
• anti-bribery and modern slavery policies;
• labour practices and recruitment standards;
• geographic and sector risk;
• use of subcontractors or labour brokers;
• public-sector touchpoints;
• compensation structure, commissions, referral fees, or success fees;
• history of regulatory, corruption, labour, human rights, or enforcement issues;
• ability to comply with Flow2FA's Supplier Code of Conduct and contractual requirements.

Third parties may be rejected, suspended, terminated, or subject to enhanced monitoring where risks cannot be appropriately mitigated.

Flow2FA expects suppliers and business partners to:

• comply with all applicable modern slavery, labour, employment, anti-bribery, anti-corruption, sanctions, trade, privacy, and human rights laws;
• prohibit forced labour, human trafficking, child labour, and exploitative working conditions;
• prohibit bribery, corruption, kickbacks, facilitation payments, and improper influence;
• maintain accurate books and records;
• implement reasonable compliance controls appropriate to their size, risk, and services;
• conduct due diligence on their own suppliers and subcontractors where appropriate;
• promptly report actual or suspected violations affecting Flow2FA;
• cooperate with Flow2FA audits, inquiries, and remediation efforts;
• flow down equivalent obligations to relevant subcontractors;
• avoid retaliation against workers or others who raise concerns in good faith.

Flow2FA may include modern slavery, anti-bribery, audit, termination, cooperation, and remediation clauses in supplier and partner contracts.

You must escalate any red flags relating to modern slavery, human trafficking, bribery, or corruption.

Flow2FA requires accurate books, records, invoices, expense reports, approvals, and supporting documentation.

Covered persons must not:

• create false, misleading, incomplete, or inaccurate records;
• conceal payments, gifts, hospitality, commissions, rebates, discounts, donations, or benefits;
• misclassify expenses;
• approve invoices without legitimate services or adequate documentation;
• create side agreements or undocumented arrangements;
• bypass approval limits or procurement controls;
• use personal funds to make payments prohibited by this Policy.

All transactions must be recorded honestly, accurately, and in reasonable detail.

Flow2FA is committed to fair and lawful employment practices.

We aim to:

• verify employees' right to work where legally required;
• avoid charging employees recruitment fees;
• provide clear employment or contractor terms;
• comply with applicable wage, working time, leave, and benefits laws;
• promote safe and respectful working conditions;
• prohibit harassment, coercion, discrimination, and abuse;
• require staffing agencies and recruiters to follow lawful and ethical recruitment practices.

Flow2FA will communicate this Policy to relevant personnel and, where appropriate, suppliers and business partners.

Training may be provided based on role and risk, including for personnel involved in:

• sales and business development;
• procurement and vendor management;
• finance and payments;
• customer success and support;
• telecommunications and carrier relationships;
• public-sector or regulated-industry customers;
• international business;
• supplier onboarding;
• compliance, legal, HR, and operations.

Training may cover modern slavery risks, anti-bribery rules, red flags, gifts and hospitality, public officials, reporting channels, due diligence, and recordkeeping.

Flow2FA encourages prompt reporting of any actual or suspected violation of this Policy.

You should report concerns if you know or suspect that:

• modern slavery, human trafficking, forced labour, child labour, or worker exploitation is occurring;
• a bribe, kickback, facilitation payment, or improper benefit has been offered, requested, paid, or received;
• books or records have been falsified;
• a supplier or partner has breached this Policy;
• a third party has asked Flow2FA to bypass legal, compliance, procurement, or approval controls;
• retaliation has occurred against someone who raised a concern.

Reports may be made to:

Legal Contact: legal@flowstates.net

If a matter involves immediate danger, criminal activity, or urgent risk to safety, you should also contact appropriate emergency services or law enforcement where necessary.

Flow2FA prohibits retaliation against anyone who raises a concern, asks a question, refuses to participate in misconduct, or cooperates with an investigation in good faith.

Retaliation may include dismissal, demotion, threats, harassment, discrimination, reduced hours, adverse work assignments, intimidation, blacklisting, or other negative treatment.

Anyone who engages in retaliation may be subject to disciplinary action, including termination of employment or business relationship.

Flow2FA will review and, where appropriate, investigate reported concerns.

Investigations may involve:

• document review;
• interviews;
• supplier or third-party inquiries;
• audits or inspections;
• suspension of payments or activities;
• engagement with legal, compliance, HR, finance, procurement, or external advisers;
• reporting to regulators or law enforcement where required or appropriate.

Where misconduct is found, Flow2FA may take corrective action, including:

• employee discipline or termination;
• supplier suspension or termination;
• contract termination;
• remediation plans;
• enhanced due diligence;
• repayment or recovery of improper payments;
• training or control improvements;
• notification to affected parties;
• reporting to authorities where required or appropriate.

Breach of this Policy may result in disciplinary action, up to and including termination of employment.

For suppliers, vendors, contractors, agents, partners, or other third parties, breach may result in contract termination, suspension, withholding of payment, audit, remediation requirements, reporting to authorities, or legal action.

Violations of modern slavery, human trafficking, bribery, or corruption laws may also expose individuals and companies to civil penalties, criminal prosecution, fines, imprisonment, debarment, contract loss, reputational harm, and other serious consequences.

Flow2FA will review this Policy periodically and update it as needed.

Review may consider:

• changes in law or regulatory expectations;
• business expansion into new countries or sectors;
• new products, services, or supply chains;
• customer, supplier, or partner risk;
• audit or investigation findings;
• reported concerns or incidents;
• effectiveness of training and controls;
• changes in modern slavery, bribery, corruption, sanctions, or labour-risk indicators.

The Policy Owner is responsible for coordinating review and recommending updates.

Senior management is responsible for promoting an ethical culture and supporting implementation of this Policy.

The Policy Owner is responsible for oversight of this Policy, including communication, review, escalation, and coordination with relevant functions.

Managers are responsible for ensuring that their teams understand and follow this Policy.

All covered persons are responsible for reading, understanding, and complying with this Policy.

This Policy should be read together with:

• Website Terms of Use;
• Acceptable Use Policy;
• Supplier Code of Conduct;
• Privacy Policy;
• Data Processing Agreement;
• Messaging Compliance Policy;
• Employee Handbook;
• Procurement Policy;
• Gifts and Hospitality Register;
• Conflicts of Interest Policy;
• Whistleblowing or Speak-Up Policy;
• Sanctions and Export Controls Policy;
• Information Security Policy;
• Cookie Policy.

Questions about this Policy should be directed to:

Flowstates Inc, doing business as Flow2FA
330 Madison Avenue, 27th Floor
New York, NY 10017
United States

Legal Contact: legal@flowstates.net

Privacy Contact / Data Protection Officer: dataprotectionofficer@flowstates.net

Website: flow2fa.com