The HSchG defines a personal scope of application.

The HSchG only applies to persons who, due to their professional activity in their capacity as an employee, staff member, management/administrative/supervisory body, applicant for a vacant position, intern, volunteer, self-employed person, employee of a subcontractor/supplier, have obtained information about violations of the law and report this information internally or externally or publicly disclose (make publicly available) this information, in accordance with § 14 HSchG.

Please note that the protection of the HSchG only applies (§ 6 HSchG) if

• the whistleblower may assume that the report is true, and

• the reporting person (whistleblower) falls within the personal scope of the HSchG (see above) and

• the notification falls within the material scope of the HSchG

You can submit a report in just a few steps via the online WU whistleblowing system.

The WU whistleblowing system is optimized for both desktop operating systems (Windows, etc.) and mobile devices (Android, iOS, etc.) and is accessible via the web browser.

• Click https://wu-whistleblowing.vco.ey.com and

• then click on the "Report illegal activity" button.

• Select your preferred language (German or English) to access the questionnaire.

• Answer the questions about the incident in as much detail as possible.

• After you have read and confirmed the data protection statement, you can submit the notification.

• You will then see an individual token code consisting of numbers and letters.

Important: Write down the token code and keep it in a safe place. If you lose the token code, you will no longer have access to your message.

• You can use this code to anonymously log into the WU Whistleblowing system again via wu-whistleblowing.vco.ey.com by clicking on the "View updates to your report" button, this will allow you to:

  • view the processing status of your message

  • upload files to your message

  • anonymously contacting the reporting officers via a chat function

• Do I have to have proof of the incident I want to report?
  NO, it is sufficient that you can assume on the basis of your perception that there is a violation of the law within the meaning and scope of the HSchG. Do not attempt to obtain evidence (e.g. documents) yourself under any circumstances. This may violate rights and affect the clarification.

All reports are processed by a team - the report processors. Communication in the system usually takes place via the chat function integrated in the system. This is an additional protection aspect.

The following steps are taken:

• Step 1 - Acknowledgement of receipt: You will receive an acknowledgement of receipt of your report within seven days. This is always done in the WU whistleblowing system via the chat function.

• Step 2 - Initial assessment/plausibility check: The report processors assess whether your report is plausible and contains sufficient information for further processing. If further information is needed, the message processing team will contact you via chat function. Log in regularly with your token code to assist the processing team. If there is enough evidence to follow up on an incident and it appears plausible, further action will be taken. If this is not the case, you will be informed of this decision.

• Step 3 - Follow-up measures: Follow-up measures to deal with the incident may include, for example, an internal investigation, possibly with the support of external service providers. Within three months of receiving confirmation of receipt, you will be informed of these follow-up measures or of an interim status.

Important: Regularly check the current status of your report using the token code you have received. In this way, the processors and the reporters can ensure a timely exchange of information.

Yes, your report will be kept strictly confidential.

Information about your report will only be transmitted to those persons who absolutely need to be informed in order to clarify the incident and only to an extent that is absolutely necessary for clarifying the facts (need-to-know principle).

• You are not on the corporate network (intranet / VPN).

• You are not using a device (smartphone, computer, etc.) provided to you by WU.

• You have deleted metadata from submitted documents (e.g. author of the document).

• You do not provide any contact details or information that allows conclusions to be drawn about your person.

• They use an anonymization service to protect your IP address.

This is done by a three-person team, the report processors. This team includes the heads of the Legal Affairs Office, the Rector's Office and Internal Auditing. The WU POL for processing reports (see regulations database Regulations and Forms (wu.ac.at)) contains the principles of processing. These include objectivity and impartiality, independence, confidentiality and adherence to a principle of multiple eyes.

If necessary, other persons within the company are involved. If necessary, external specialists such as auditors, forensic experts and lawyers can also be called in for clarification and follow-up measures. These are subject to strict confidentiality obligations.

According to § 14 (1) HSchG (Austrian Whistleblower Protection Act), whistleblowers should consider whether they can first pass on a report to an internal office. Information should be given to an external reporting office, if the treatment of the information in the internal whistleblower system in accordance with the provisions of the HSchG is not possible, appropriate or reasonable or if it has proved unsuccessful or futile.

For such cases, you can reach the external reporting office at the Federal Office for the Prevention of and Fight against Corruption (BAK) with this link: reporting offices (bak.gv.at) /

Please also refer to the FAQ of the BAK: FAQ (bak.gv.at) FAQ (bak.gv.at