Send a report with the outmost confidentiality.

WHISTLEBLOWING POLICY

  1. Background

The Legislature passed Legislative Decree 24/2023 (the so-called "Whistleblowing Law") which defined, inter alia:

● the aspects of protection of the person, as identified in Article 3 of the Whistleblowing Law, who makes a report;

● the obligations of Entities and Companies in terms of prohibition of retaliatory acts and non-discrimination of whistleblowers and protection of their confidentiality;

● the need for the presence of one or more channels (with computer modalities) that allow reporting parties to submit reports while ensuring the confidentiality of the identity of the reporter, the person involved and the person in any case mentioned in the report, as well as the content of the report and the related documentation;

● the need to hear from the representatives or labor organizations referred to in Article 51 of Legislative Decree No. 81 of 2015 before activating the aforementioned reporting channels;

● the conditions for making an external report;

● the prohibition of retaliatory or discriminatory acts against the reporter for reasons related to the report.

 

  1. Whistleblowing Introduction

Whistleblowing" is a report made by a person who, in the performance of his or her duties, becomes aware of an offence, risk or dangerous situation that may cause harm to the company/entity for which he or she works, as well as to customers, colleagues, citizens, and any other category of subjects.

The Company - sensitive to ethical issues and proper conduct of its business - has implemented internal systems of reporting violations to enable individuals identified by law to report violations of national or European Union regulatory provisions that harm the public interest or the integrity of the public administration or private entity, of which they have become aware in a public or private work context including violations of the Code of Ethics,

The Whistleblowing Law identifies:

● the individuals who can trigger a report;

● the acts or facts that can be reported, as well as the requirements that reports must include in order to be taken into consideration;

● the methods through which alleged violations can be reported and the parties responsible for receiving reports;

● the process of inquiry and possibly investigation at the time a report is made;

● the guarantee of confidentiality and protection of the personal data of the person making the report and any reported person and the data contained in the report;

● the prohibition of retaliation and the prohibition of discrimination against the reporting person.

Who can report?

Reports may be made by employees of the company, but also by those who have established other types of legal relations with the company other than employment in the strict sense. This refers, inter alia, to consultants, collaborators, volunteers, trainees, shareholders of the same public and private entities where they take corporate form, and to persons with functions of administration, management, control, supervision or representation. The rules also apply in the case of reports that occur in the context of an employment relationship that has subsequently ended, if the information was acquired during the course of that relationship, as well as if the relationship has not yet begun and the information on violations was acquired during the selection or other pre-contractual stages.

  1. Object

The purpose of this document is to represent the operational procedures for handling reports and any subsequent investigations, which have come to their attention by reason of their functions.

The following offenses may be reported:

N.

Type

Description

1

Corruption

Corruption is the crime consisting of the special agreement between a public official and a private party, by which the official accepts from the private party, for an act related to his or her duties, a fee that is not due to him or her.

2

Incitement to corruption

The criminal conduct of a person who attempts to bribe a Public Official without the latter accepting the proposal.

3

Abuse of power

Abuse of power occurs when a person misuses his or her authority to intimidate or reprimand others (example: bullying).

4

Theft

Theft of goods, inventory, company property, or even theft from colleagues and other similar instances of misappropriation of goods or property.

5

Workplace safety violation

Failure to comply with or enforce workplace health and safety regulations (e.g., failure to use personal protective equipment, lack of fire extinguishers, etc.)

6

Mobbing

Set of aggressive and persecutory behaviors put in place in the workplace in order to target and marginalize the person who is the victim.

7

Absenteeism

Absenting oneself from the workplace without good reason.

8

Violent or harassing behavior

Those undesirable behaviors, carried out for reasons including those related to sex and having the purpose or effect of violating the dignity of a female or male worker and creating an intimidating, hostile, degrading, humiliating or offensive climate.

9

Violation of Ethics Code.

Failure to comply with the ethical and moral values that the company has included in its code of ethics.

10

Violation of tender procedure and other awards

Behavior that disrupts the proper conduct of the competition and is aimed at favoring the company.

11

Violation of personnel selection and recruitment procedure

Favoritism and/or lack of adoption of transparent procedures in selection and recruitment.

12

Conflict of interest

A real conflict of interest occurs when a secondary interest (financial or non-financial) of a person tends to interfere with the primary interest of the company.

13

Disclosure of Confidential Information / Breach of Duty of Confidentiality

Failure to respect the confidentiality of both personal and corporate information that is shared without authorization, causing harm to individuals or the company itself.

14

Unlawful processing of personal data

Unauthorized use of personal data of employees, customers, or suppliers for purposes beyond the scope of employment.

15

Fake documentation

Creating false signatures, changing documentation or to improve results or obtain compliance certifications.

16

Other

Other situations from which irregularities, abusive behavior and in violation of laws or company regulations are apparent.

 

In contrast, the scope of the procedure does not include those cases excluded by the Whistleblowing Law, including:

(a) disputes, claims or requests related to a personal interest of the reporting person or the person who has filed a complaint with the judicial or accounting authorities that pertain exclusively to his or her individual labor or public employment relationships, or inherent in his or her labor or public employment relationships with hierarchically subordinate figures;

(b) reports of violations where already mandatorily regulated by European Union or national acts or by national acts that constitute implementation of European Union acts;

(c) reports of violations relating to national security, as well as procurement relating to defense or national security aspects, unless such aspects are covered by relevant secondary legislation of the European Union.

 

  1. Targets

The purpose of this document, is to bring to light episodes of unlawfulness or irregularities within the Company, clarifying and facilitating the reporting by the reporter and removing any factors that may hinder or discourage recourse to the institution.

The objective of the procedure is therefore, on the one hand, to provide the whistleblower with clear operational indications about the subject, contents, recipients and method of transmission of reports and, on the other hand, to inform him or her about the forms of protection and confidentiality that are recognized and guaranteed.

 

  1. Departments and individuals involved

The departments and functions involved in the activities under this procedure are:

● External consultant appointed as Whistleblowing Procedure Manager.

● Management of the company.

 

  1. Procedures and other related documents.
  • Code of Ethics of the Company;
  • 231 Model.

 

  1. Description of the procedure

In order to facilitate reporting, the following channel has been defined:

● through the Legality Whistleblowing channel accessible from here https://ercongressi.segnalazioni.net/, as an alternative reporting channel suitable to ensure, by computer modalities, the confidentiality of the identity of the reporter, in deference to the legislation (hereinafter, the "Software") I would explain how the individual employee can have access to the Software;

● for those who want to proceed with a paper report, considering that this may have limitations on the guarantee of anonymity (e.g., dispatch office), the report can be sent to the Attention of Lawyer Sofia Piermattei, via Cairoli 9, 40121 Bologna.

  • The whistleblower may also request a face-to-face interview with the person in charge of the procedure, to be organized within 10 to 15 days.

The Company also takes into consideration anonymous reports, where they are adequately circumstantiated, and made with a wealth of details, that is, they are such as to bring out facts and situations by relating them to specific contexts (e.g.: documentary evidence, indication of particular names or qualifications, mention of specific offices, proceedings or particular events, etc.).

The report-even the non-anonymous one-must be circumstantiated and have as broad a degree of completeness and comprehensiveness as possible.

The whistleblower is required to provide all available and useful elements to enable the competent parties to carry out the due and appropriate checks and verifications to confirm the validity of the facts being reported, such as:

i. a clear and complete description of the facts that are the subject of the report;

ii. the circumstances of time and place in which the facts that are the subject of the report were committed;

iii. the personal details or other elements that enable the identification of the person(s) who has/have committed the reported facts (e.g., job title, place of employment where he/she carries out the activity);

iv. any documents supporting the report;

v. an indication of any other individuals who may report on the reported facts;

vi. any other information that may provide useful feedback about the existence of the reported facts.

For a report to be substantiated, these requirements do not necessarily have to be met at the same time, since the reporter may not be in full possession of all the information requested.

Through the IT channel and thus through the Software, the reporter will be guided through each stage of the report and will be asked, in order to best circumstantiate the report, a series of fields that must be filled out compulsorily respecting the requirements.

It is essential that the elements indicated are known directly to the reporter and not reported or referred to by other parties.

In the case of use of the analogue channel, it is requested that the whistleblower expressly indicates that he/she wishes to benefit from the whistleblowing protections (e.g. by inserting the wording "reserved to the whistleblowing manager"), especially in order to correctly manage the possible sending, by mistake, of the report to a person other than the whistleblowing manager.

This does not affect, in any case, the possibility of reporting to the judicial and accounting authorities, in cases falling within their competence.

 

  1. Management of reports

Once the report is received according to the channels provided in this procedure, its handling is divided into four stages:

  1.  protocol and custody;
  2. investigation;
  3. investigation and communication of the outcome;
  4. filing.

 

a.           Protocoling and custody

In case the report is made through the Software, it will be the Software itself that will provide for full and confidential protocol in accordance with the relevant regulations.  Acknowledgement of receipt will be issued within 7 days. Finally, if the internal report is submitted to a person other than the one identified and authorised by the entity and it is clear that it is a whistleblowing report (e.g., the wording "whistleblowing" is explicitly stated on the envelope or in the subject or in the text of the communication), it should be forwarded, within seven days of its receipt and without retaining a copy, to the competent internal person, with simultaneous notification of the transmission to the reporting person.

b.           Preliminary Investigation

The purpose of the preliminary investigation is to verify the merits of the report received. To this end, the Manager performs an initial screening and:

● where it immediately detects that the same is clearly unfounded, it proceeds to immediate filing;

● where the report is not well substantiated it requests, where possible, further information from the reporter. Where it is not possible to gather sufficient information to substantiate the report and initiate the investigation it is dismissed;

● in case the report appears to be circumstantiated with precise and concordant factual elements it proceeds with the stages of the investigation.

Where it is necessary to avail oneself of the technical assistance of third party professionals, as well as of the specialist support of the staff of other corporate functions/departments, it is necessary - in order to guarantee the confidentiality obligations required by the legislation - to obscure any type of data that might allow the identification of the reporting person or of any other person involved. At the end of the investigations, when he finds that the report received is unfounded, the person in charge files the report and, where possible, informs the reporting person thereof.

c.            Preliminary investigation and communication of the outcome

Preliminary investigation is the set of activities aimed at verifying the content of the reports received and acquiring elements useful for the subsequent evaluation phase, guaranteeing maximum confidentiality on the identity of the reporter and the subject of the report.

The main purpose of the investigation is to verify the veracity of the information submitted for investigation, providing a precise description of the facts ascertained, through audit procedures and objective investigative techniques.

The person in charge of the investigation is the External Consultant Lawyer Sofia Piermattei (hereinafter "Responsible").

It is everyone's duty to cooperate with the person in charge of the investigation in the conduct of the investigation.

Of each investigation, the person in charge of the investigation shall prepare a final report containing at least:

● the facts established;

● the evidence gathered;

● the causes and deficiencies that allowed the occurrence of the reported situation.

At the outcome of the investigation, when it finds that the report received is unfounded, the Manager shall proceed to dismiss the report and, where possible, notify the reporter. 

If the report is found to be well-founded, the Manager activates the company managers (the management or possibly HR) to take the due and most appropriate mitigating and/or corrective actions.

He/she transmits the outcome of the investigation to the HR function for the possible initiation of disciplinary proceedings aimed at imposing, where appropriate, disciplinary sanctions in line with the provisions of the applicable regulations and the relevant collective labor agreements.

 

d.           Filing

In order to ensure the traceability, confidentiality, preservation and retrievability of data throughout the proceedings, documents are stored and archived both in digital format, through the Software, through password-protected network folders and in paper format, in a special cabinet secured and located in the Manager's office, accessible only to specially authorized and specially instructed persons.

All documentation will be kept, subject to further legal deadlines in the cases expressly provided for and any pending judgments, for 5 years from the date of closure of the activities.

Pursuant to current law and the company's privacy procedures, the processing of personal data of persons involved and/or mentioned in the reports is protected.

Therefore, at the expiry of the three months, the reporting manager may inform the reporter of

● the fact that the report has been dismissed, stating the reasons;

● the fact that the report has been substantiated and forwarded to the competent internal

competent internal bodies;

● the activity performed to date and/or the activity he intends to perform.

In the latter case, it is advisable to also inform the reporting person of the subsequent final outcome of the investigation of the report (whether the report has been dismissed or found to be well-founded and forwarded to the competent bodies).

9.           Protection of the reporter

The entire process must still ensure the confidentiality of the reporter's identity from the time the report is received and at every stage thereafter.To this end, in accordance with current regulations, the Company has established a series of mechanisms aimed at protecting the non-anonymous whistleblower, providing for:

a. the protection of the confidentiality of the whistleblower;

b. the prohibition of discrimination against the whistleblower.

c. the limitation of its liability for the collection or dissemination of certain types of

protected information.

These protection measures, with some exceptions (apply not only to the reporting person but also to other persons who might be the recipients of retaliation, by reason of their role or particular proximity or relationship with the reporting person. In particular, these are the following subjects:

- facilitator, i.e. the natural person who assists the reporter in the reporting process, operating within the same work context and whose assistance must be kept confidential. In this regard, the Anac Guidelines provide that 'the term "assistance" refers to a person who provides advice or support to the reporter and who operates in the same work context as the reporter. By way of example, the facilitator could be a colleague in the reporter's office or in another office who confidentially assists the reporter in the reporting process. The facilitator could be a colleague who also holds the title of trade unionist if he/she assists the whistleblower on his/her behalf, without displaying the trade union code. It should be noted that if, on the other hand, he assists the whistleblower by using the trade union acronym, he does not play the role of facilitator. In such a case, the provisions on consultation of trade union representatives and repression of anti-union conduct';

- -persons in the same employment context as the reporter, whistleblower or person making a public disclosure and who are linked to them by a stable affective or kinship link up to the fourth degree. On the notion of "stable affective link", the Anac Guidelines provide that "such expression could refer, first of all, to those who have a cohabiting relationship with the reporter. In line with the ratio of extending as far as possible the protection against retaliation, it is considered that the notion of a stable affective bond can be understood, however, not only as cohabitation in the strict sense, but also as a relationship of an affective nature characterized by a certain stability both in terms of time and in terms of sharing of life. An affective bond therefore involving a specific person';

- work colleagues of the reporting person, whistleblower or person making a public disclosure, who work in the same work environment as the reporting person and who have a habitual and current relationship with that person. In this regard, the ANAC Guidelines provide that 'In the case of work colleagues, the legislator has provided that they are those who, at the time of the report, work with the whistleblower (thus excluding former colleagues) and who have a usual and current relationship with the latter. The provision refers, therefore, to relationships that are not merely sporadic, occasional, episodic and exceptional, but current, protracted over time, characterized by a certain continuity such as to determine a relationship of "commonality", of friendship."

- entities owned - either exclusively or in majority by third parties - by the whistleblower,

whistleblower or the person making a public disclosure;

- entities where the reporter, whistleblower or person making a public disclosure works

 

a.           The protection of the confidentiality of the reporter

The use of the Software guarantees the complete confidentiality of the reporter, as only the Manager can access the report.

In the case of reports made through any other modality, the recipients, once the report is received and logged, assign a specific anonymous ID to the reporting person. To protect the confidentiality of the reporter, the ID will be used in all official documents and communications during the investigative activity.

As part of any disciplinary proceedings instituted against the whistleblower:

● if the facts charged were based on investigations separate and additional to the report, even if consequent to the report, the identity of the reporting person may not be disclosed;

● if the facts charged were based in whole or in part on the report, the identity of the reporter may be disclosed to the person(s) involved by the report if two requirements are met simultaneously:

○ the consent of the reporting person;

○ the proven need on the part of the reporting person to know the name of the reporting person for the purpose of the full exercise of the right of defense.

 

b.           The prohibition of discrimination against the reporting person

The reporting person shall not be sanctioned, dismissed, or subjected to any discriminatory measures, whether direct or indirect, affecting working conditions for reasons directly or indirectly related to the reporting.

Discriminatory measures are defined as unjustified disciplinary actions, harassment in the workplace, any changes in job duties or work location, and any other pejorative change in working conditions that is posed as a form of retaliation against the whistleblower. A reporting person who believes that he or she has suffered discrimination because of making a report must give detailed notice to the Manager.

The reporting person who believes that he or she has suffered discrimination may take legal action against the perpetrator of the discrimination and also against the Company-if the Company actively participated in the discrimination. It should be borne in mind that, in such a case, the law provides for an inversion of the burden of proof, and it will, therefore, be the Company that will have to prove that the change in the reporter's working conditions did not originate from the report.

The rule provides a list of possible retaliatory cases, albeit not exhaustive and not exhaustive:

(a) dismissal, suspension or equivalent measures;

(b) downgrading or non-promotion;

(c) change of duties, change of place of work, reduction of salary, change of working hours; (d) change of job.

change of working hours;

(d) suspension of training or any restriction on access to it;

(e) negative merit notes or references;

f) the adoption of disciplinary measures or any other sanction, including a fine;

(g) coercion, intimidation, harassment or ostracism;

(h) discrimination or otherwise unfavourable treatment;

(i) failure to convert a fixed-term employment contract into an employment contract of indefinite duration, where the

indefinite duration, where the employee had a legitimate expectation of such conversion;

(j) the non-renewal or early termination of a fixed-term employment contract;

(m) damage, including to the person's reputation, in particular on social media, or prejudice

economic or financial loss, including loss of economic opportunities and loss of income;

n) improper listing on the basis of a formal or

informal, which may result in the person being unable to find employment in the sector

or industry in the future;

(o) the early termination or cancellation of a contract for the supply of goods or services;

(p) the cancellation of a licence or permit;

(q) a request to undergo psychiatric or medical examinations.

Therefore, any person who believes that he/she has suffered retaliation, even attempted or threatened retaliation, as a result of a report/disclosure/whistleblowing shall notify the ANAC, which shall ascertain the causal link between the retaliation and the report and, therefore, take the consequent measures.

c.            Limitations of liability

A further protection afforded by the Decree to whistleblowers is the limitation of their liability with respect to the disclosure and dissemination of certain categories of information, which would otherwise expose them to criminal, civil and administrative liability.

In particular, the whistleblower will not be held liable either criminally, or in civil and

administrative proceedings:

- of disclosure and use of official secrecy (Article 326 of the Criminal Code)

- of disclosure of professional secrecy (Article 622 of the Criminal Code);

- of disclosure of scientific and industrial secrets (Article 623 of the Criminal Code);

- breach of the duty of loyalty and faithfulness (Article 2105 of the Civil Code);

- violation of the provisions on the protection of copyright;

- of violation of the provisions on the protection of personal data;

- of disclosure or dissemination of information on violations that offend the reputation of the

person involved.

However, the Decree lays down two conditions for the operation of the aforementioned limitations of liability:

  1. at the time of disclosure or dissemination, there are reasonable grounds for believing that the information is necessary to disclose the reported violation;
  2.  the report is made in compliance with the conditions laid down in the Decree to benefit from protection against retaliation (reasonable grounds for believing the facts reported to be true, the breach is among those reportable and the terms and conditions for access to the report are complied with).

 

  1. Infringement of the procedure

Failure to comply with this procedure will result in the Company's employees being subject to the Company's Disciplinary System, in line with the provisions of the applicable regulations and the relevant collective bargaining agreements.