Business Conduct and Ethics
Kotn is a company that values ethical business practices. We’ve put together these policies, which apply to everyone at Kotn to ensure that we’re all operating with fairness and integrity.
CONFLICTS OF INTEREST
When you are in a situation in which competing loyalties could cause you to pursue a personal benefit for you, your friends or your family at the expense of Kotn, you may be faced with a conflict of interest.
Areas where conflicts of interest often arise:
Personal investments
Outside employment, advisory roles, board seats, and starting your own business
Business opportunities found through work
Inventions
Friends and relatives; co-worker relationships
Accepting gifts, entertainment and other business courtesies
Conflicts of interest are not always clear cut. To help determine whether you are faced with a potential conflict of interest, you must consult your supervisor and/or ask yourself:
Could this activity create an incentive for me, or be perceived by others to create an incentive for me, to benefit myself, my friends or my family, or an associated business at the expense of Kotn?
Could this activity negatively impact my ability to do my job at Kotn, or potentially harm Kotn or its reputation?
Could this activity negatively impact Kotn if it showed up on the front page of a newspaper or a blog?
If the answer to any of these questions is “yes,” the relationship or situation is likely to create a conflict of interest, and you must avoid it.
In each of these situations, the rule is the same. If you are considering entering into a situation that creates a conflict of interest, don’t. If you are in a situation that may create a conflict of interest, or the appearance of a conflict of interest, review the situation with management immediately. Finally, it’s important to understand that as circumstances change, a situation that previously didn’t present a conflict of interest may in time present one.
GRATUITY AND ENTERTAINMENT
Offering or receiving any gratuity or entertainment that might be perceived to unfairly influence a business relationship should be avoided.
PHISHING AND EMAIL SECURITY POLICY
Phishing attacks are fraudulent attempts to obtain sensitive information by impersonating trusted sources and are one of the most common ways organizations are compromised. This policy exists to protect our people, our partners, our customers, and our communities.
This policy applies to everyone who accesses KOTN systems, email, or data — including:
Full-time and part-time employees (HQ and retail)
Contractors, freelancers, and agency partners
Anyone using KOTN-issued or personal devices for work purposes
Phishing is a form of social engineering where attackers impersonate legitimate individuals or organizations to trick recipients into clicking malicious links, downloading harmful files, or sharing confidential information.
Common forms include:
Email phishing: fraudulent emails impersonating colleagues, vendors, or banks
Spear phishing: targeted attacks using your name, role, or recent activity
Smishing: phishing via SMS or messaging apps
Vishing: phishing via phone calls
Business Email Compromise (BEC): fake requests from apparent executives or finance partners
Red flags in emails or messages:
• Urgency or pressure to act immediately (“Transfer now”, “Account suspended”)
• Requests for passwords, financial information, or personal data
• Mismatched sender addresses (e.g. “kotn-support@gmaiI.com”)
• Unexpected attachments, especially .zip, .exe, or Office files with macros
• Links that don’t match the stated destination (hover to verify)
• Poor grammar, unusual formatting, or off-brand tone
• Requests that bypass normal approval processes
Employee Responsibilities
All employees must:
• Never click links or download attachments from unverified senders
• Never share passwords, PINs, or codes even with IT or a manager
• Report any suspicious message immediately
• Keep devices and software up to date
• Use strong, unique passwords and enable multi-factor authentication (MFA) on all work accounts
If you’re unsure whether a message is legitimate: pause, verify, then act. When in doubt, reach out.
We encourage a culture where raising concerns is seen as courageous, not inconvenient. If you receive or accidentally interact with a suspicious message:
Do not forward the email to colleagues
If you clicked a link or entered credentials, notify the team immediately no judgment, just action
Preserve the message, do not delete it until instructed
Prompt reporting protects the whole team. There is no penalty for good-faith reporting, including if you made a mistake.