Signature
Signed by every new hire before their start date
Trust Centre
Code of Conduct & Business Ethics
Every Upstream BPO new hire signs the Code of Conduct before their start date, and all staff re-acknowledge it annually. Violations are handled through a documented disciplinary process that includes termination for material breaches.
Key information
At-a-glance governance context
These points summarise the public scope of this page and the main contact or review context around it.
Re-acknowledgement
All staff re-acknowledge annually
Training
Annual mandatory Code of Conduct training for all staff
Report a violation
dpo@upstreambpo.com
Section 1
Signature and annual re-acknowledgement
Every Upstream BPO new hire signs the Code of Conduct before their start date. Signature is a condition of employment rather than an onboarding task completed at some point after joining.
All staff re-acknowledge the Code annually. Re-acknowledgement covers the current version of the Code, so that staff confirm against what the document says now rather than the version in force when they joined.
Section 2
What the Code covers
The Code sets behavioural standards across the following areas. The Code itself is the authoritative document and carries the full clause set; we provide it to reviewers under NDA.
- Honest dealings in commercial, customer and supplier relationships.
- Prohibition of bribery and corruption.
- Prohibition of harassment and discrimination.
- Confidentiality of customer information.
- Disclosure of conflicts of interest.
- Protection of company assets.
Section 3
Training
Code of Conduct training is mandatory and runs annually for all staff. It sits alongside the annual mandatory security awareness training described on our information security page, and both are tracked as completion requirements rather than optional development.
Section 4
Enforcement
Violations are handled through a documented disciplinary process. The process covers investigation, findings and outcome, and it applies consistently rather than case by case.
Material violations result in termination. We state that directly because a code with no stated consequence attached to it does not function as a control.
Section 5
Reporting a violation
Report a suspected violation to dpo@upstreambpo.com, or through the whistleblowing channel. Our data protection officer, Cillian Conor, owns the trust inbox and routes reports to the appropriate review path.
We treat reports confidentially. Reports from outside the organisation, including from customers and suppliers, use the same route.
Reviewer questions
Questions we are asked in security review
Answers are stated in full here so they are quotable directly into a security questionnaire.
Do all employees sign the Code of Conduct?
Yes. Every new hire signs the Code of Conduct before their start date, as a condition of employment, and all staff re-acknowledge it annually.
Is Code of Conduct training mandatory?
Yes. Code of Conduct training is mandatory and runs annually for all staff.
What happens when someone violates the Code?
Violations are handled through a documented disciplinary process covering investigation, findings and outcome. Material violations result in termination.
How do we report a suspected violation?
Report it to dpo@upstreambpo.com or through the whistleblowing channel. Reports from customers and suppliers use the same route and are treated confidentially.
Can we review the Code of Conduct itself?
Yes. The Code is the authoritative document and is available to reviewers under NDA. Request it from dpo@upstreambpo.com.
Related resources
Related governance and service pages
Use the connected pages below for deeper privacy, governance, service or contact context.
Contact & Escalation
Report a suspected Code of Conduct violation to dpo@upstreambpo.com or through the whistleblowing channel. Request the Code itself under NDA from the same address.
Next Step
Need a deeper governance review?
Send certificate requests, subprocessor list requests, incident reports and vulnerability disclosures to dpo@upstreambpo.com. We acknowledge security and trust enquiries within 3 business days.