Conflict of Interest Management Policy 

Document History 

  • 2 September 2026: Policy and Possible Conflict of Interest Mapping matrix updated.
  • 19 November 2025: Migrated to the current repository.
  • 3 April 2025: Possible Conflict of Interest Mapping matrix updated.
  • October 2023: Policy adopted by the Board.

Goals of the TYPO3 Conflict of Interest Management Policy 

TYPO3's Conflict of Interest Policy aims to ensure that the collective interests of the TYPO3 community prevail over personal interests by exercising our responsibilities and making our decisions impartially, objectively and independently.

Definition of a Conflict of Interest 

The occurrence of a personal interest whose interference with the position held is such as to influence or appear to influence the loyal exercise of the position.

Sensitive Processes, Critical Positions and At-Risk Operations 

Only conflicts of interest within the perimeter of the sensitive processes, critical positions and at-risk operations are covered by this conflict of interest management policy.

Sensitive Processes 

Sensitive processes are processes whose conflict of interest would be harmful to the interests of the TYPO3 community. These processes are: Purchasing, sales, investments, accounting, and human resources management. This list is not exhaustive and will be updated regularly.

Critical Positions 

Critical positions include: TYPO3 Association Board and BCC members, TYPO3 Company Supervisory Board members, TYPO3 Company CEO, CTO and CFO, TYPO3 CMS product owner, project leader and co-leader. This list is not exhaustive and will be updated regularly.

At-Risk Operations 

Some operations inherent in the life of the TYPO3 project (prospecting, finding new markets, external growth, lobbying, lending or borrowing money, etc.) are more exposed to the corruption risk. Preventing conflicts of interest that may arise during these operations is likely to reduce the corruption risk.

Different Types of Conflict of Interest 

There are several types of conflict of interest:

  • A real conflict of interest is one in which an individual's current official duties and responsibilities directly conflict with his or her existing personal interests.
  • A potential conflict of interest exists when an individual has personal interests that could potentially conflict with his or her official responsibilities.
  • A perceived conflict of interest exists when the public may believe that an individual's personal interests could influence the performance of his or her official duties - whether or not this is actually the case.

Duties and Requirements 

Any individual falling within the scope of the sensitive processes, critical positions and at-risk operations defined above must :

  • Disclose any conflicts of interest by filling in a declaration of interests before taking up their position;
  • Declare any conflicts of interest of which they are aware. The nature of the conflict of interest must be recorded in the conflict of interest register.
  • Remove themselves from any Board discussion on topics involving a conflict of interest. They should do so either in the meeting or with other Board members before or after the Board meetings.
  • Refrain from attending the meeting during discussion, voting or deliberating on decisions related to the conflict of interest, unless expressly invited to do so by unanimous agreement by all other members present. The Board Member’s abstinence should be recorded in the meeting minutes.
  • Respect the confidentiality of all person(s) who declare an existing or potential conflict of interest.

Priority Matrix 

The priority matrix is used to weight the severity of a conflict of interest by its probability, and to determine whether action needs to be taken to reduce this priority.

Only conflicts of interest with a value greater than or equal to 4 should be dealt with using one of the strategies described below, with “Avoid or Resign” applying only to level 6.

Conflict of interest Type Low (1) High (3)
Perceived (1) 2 4
Potential (2) 3 5
Real (3) 4 6

Resolution Strategies 

  • Record/register: Recording the disclosure of a conflict of interest in a register is an important first step; however, this does not necessarily resolve the conflict. It may be necessary to assess the situation and determine whether one or more of the following strategies is also required.
  • Restrict: It may be appropriate to restrict involvement in the matter, for example, refrain from taking part in debate about a specific issue, abstain from voting on decisions, and/ or restrict access to information relating to the conflict of interest. If this situation occurs frequently, and an ongoing conflict of interest is likely, other options may need to be considered.
  • Recruit: If it is not practical to restrict your involvement, an independent third party may need to be engaged to participate in, oversee, or review the integrity of the decision-making process.
  • Remove: Removal from involvement in the matter altogether is the best option when ad hoc or recruitment strategies are not feasible, or appropriate.
  • Relinquish: Relinquishing the personal or private interests may be a valid strategy for ensuring there is no conflict with your public duty. This may be the relinquishment of shares, or membership of a club or association.
  • Avoid or resign: It may be an option if the conflict of interest cannot be resolved in any other way, particularly where conflicting private interests cannot be relinquished.

Possible Conflict of Interest Mapping 

Type + Severity BCC member Board member Person(1) sharing a financial interest(2) with a BCC member or having financial or hierarchical leverage over them Person(1) sharing a financial interest(2) with a Board member or having financial or hierarchical leverage over them Person(1) sharing a financial interest(2) with a Unit lead role or having financial or hierarchical leverage over them Person(1) with a financial interest(2) in any TYPO3 agency or TYPO3 freelance business
BCC member na forbidden by by-laws 6 5 6 3
Board member forbidden by by-laws na 5 6 6 4
GmbH employee CEO, CTO, CFO, any critical role(3) forbidden by by-laws forbidden by by-laws 5 5 5 5
Association Officers(4) forbidden by by-laws forbidden by by-laws 5 5 5 3
Unit coordinators, deputies and panel members 6 6 6 6 6 3
Team / Committee leads and co-leads 5 5 5 5 5 3
External contractors and service providers(5) forbidden by by-laws forbidden by by-laws 6 6 6 3
  1. References to a person's interests include interests held by their close relatives and persons with whom they have a close personal relationship where those interests could reasonably be perceived as influencing the person's judgment.
  2. Financial interest refers to an ownership, equity or comparable economic interest in the agency, and does not include ordinary commercial customer or supplier relationships.
  3. GmbH employee with critical role: Any role or position related to sensitive processes listed in the Conflict of Interest Policy.
  4. Association officers: Data Privacy Officer, Compliance Officer, Trademark Officer, Ambassadors, etc.
  5. For external contractors and service providers, the default impact severity is High. Where the total annual value of the services provided to the TYPO3 Association is below €50,000, the impact may be assessed as Low depending on the nature and significance of the contractual relationship.

Reporting a Conflict of Interest 

Any TYPO3 Association member, TYPO3 GmbH employee, or provider working for the TYPO3 Association or TYPO3 GmbH who becomes aware of a potential conflict of interest may report it to the TYPO3 Association Compliance Officer using compliance@typo3.org. The report may concern the reporting person's own situation or a situation involving another person.

The Compliance Officer will acknowledge the report within one working week, record it, assess the available information, and prepare a recommendation for the TYPO3 Association Compliance review panel. The Compliance review panel decides whether a conflict of interest exists and, where applicable, determines the appropriate measures in accordance with this policy.

The person who submitted the report will be informed of the decision. Confirmed conflicts of interest and their management are recorded and periodically reviewed in accordance with the Conflict of Interest Resolution Process.

Detailed Process 

This chapter describes how Conflicts of Interest are managed, from declaration to resolution by the TYPO3 Association.

Review (1 month after each GA) 

  • The Compliance Officer sends an email to all persons listed in the Conflict of Interest register to ask them either to validate the declared situation, or to inform about any new situation.

  • The recipient has 2 weeks to answer about their situation

    • If the situation hasn’t changed, the Board member responsible for the conflicts of interest documentation adds the last update date of the conflict.
    • If the situation has changed, the conflict goes through the next steps like a new conflict.

Compliance Review Panel members pool (1 month after each GA) 

  • The Compliance Officer updates the Compliance Review Panel members pool based on the elected Board and BCC members.
  • A public rotation list includes all current Board and BCC members and is initially ordered alphabetically by last name. For each case, the first three eligible persons are selected. Anyone who has a conflict of interest is skipped for that case without losing their place. After serving, Panel members move to the end of the list.

Take over (A conflict of Interest is declared) 

  • Any TYPO3 association member, TYPO3 company employee, or TYPO3 Association or Company's provider aware of a conflict of interest can declare it by emailing the TYPO3 Association Compliance Officer at compliance@typo3.org.
  • The declaration is received in the OTOBO ticketing system, it is automatically assigned to the Compliance Officer
  • The Compliance Officer has 1 working week to add the topic in the next board meeting and answer the member that their declaration is taken over
  • The Compliance Officer creates a Reported disclosure record in the register and closes the OTOBO ticket.
  • If the Compliance Officer is involved or conflicted, an alternate Case Officer is selected through the same predefined rotation used for the Compliance Review Panel.

Identify (The next board meeting after the declaration) 

  • The Case Officer prepares a conflict of interest decision paper with the information needed:

    • The needed information for the decision paper
    • The selected members of the Compliance review panel
    • The Case Officer recommendations
  • The Compliance review panel must identify the conflict of interest with the help of the Conflict of Interest Mapping and the Conflict of Interest priority matrix

  • The Compliance review panel votes (simple majority, no possible abstention) a decision on :

    • Is it a conflict of interest?
    • If so, what is its type and impact severity?
  • The Compliance review panel must record the decision in the meeting protocol

Disclose (Four weeks after the identification of a conflict of interest) 

  • The Case Officer must update the Conflict of Interest register and if necessary the Conflict of Interest Mapping
  • The Case Officer reports about the decision in the next board meeting
  • The Case Officer sends an email to the person who reported the conflict of interest to inform them about the decision

Manage (The next board meeting after the disclosure of a priority Conflict of Interest) 

  • If the Compliance review panel identified a conflict of interest of any type, the board must decide on actions to avoid the Conflict of Interest, or reduce the Conflict of Interest probability or severity impact
  • The possible type of actions are listed in the Conflict of Interest Policy’s Resolution strategies chapter
  • The Compliance Officer prepares a decision paper according to the actions
  • The Board votes (quorum) the strategies they want to apply
  • The Board must record the decision in the meeting protocol

Monitor (One year after the strategies implementation) 

  • The Board must validate during a QSA during the conflict of interests policy review that the change is significant and that the strategies were successful.
  • The Board must record the validation in the QSA protocol