Whistle-blowing

Information – including well-founded suspicions – concerning violations committed or which, on the basis of concrete elements, could be committed in the company, as well as elements concerning conduct aimed at concealing such violations, shall be reported.
The report should be as detailed as possible and the following should be clearly indicated:

• time and place where the reported event occurred
• description of the event
• personal information or other elements making it possible to identify the person to whom the facts reported can be attributed

It is also useful to attach documents that may provide evidence of what has been reported, as well as an indication of other persons potentially aware of the facts.

1.1 The report recipient

The internal report, forwarded through the web platform (see section 3.1), will automatically be sent to the President of the Supervisory Board, who is the only subjectauthorised to receive and handle the report..

The processing of data (see section 2.1) by the President of the Supervisory Board will be characterised by the utmost caution, starting with the obscuring of data if, for investigative reasons, other parties (internal or external) need to be informed of it. In this hypothesis, the President of the Supervisory Board does not pass on the report to such persons, but only the results of any checks carried out, and takes the utmost care to ensure that the information and facts described do not reveal the identity of the reporter.

1.2 What cannot be reported

In general, reporting cannot concern unsubstantiated news, so-called ‘hearsay’ and information that is already fully in the public domain.

Whistle-blowing does not concern complaints, claims or requests pertaining exclusively to one’s individual employment relations, or inherent to one’s employment relations with hierarchically superior figures, for which one must always refer to the regulations and procedures falling within the competence of the Human Resources Department, unless they are connected or linkable to the violation of internal procedural rules of the company and are indicative of a malfunctioning of the same.

Whistle-blowing does not concern complaints, claims or requests linked to a personal interest, since such toolaims to protecting the integrity of the company with reference to the scope of application of the acts of the European Union, as subsequently indicated in section 1.3.2, and with reference also to Legislative Decree No. 231/2001 and the relevant model.

1.3 What can be reported

Behaviour, acts or omissions detrimental to the integrity of the company may be reported.

1.3.1 Exclusively via internal channel

Reports may concern unlawful conduct or violations of the 231 Organisational Model and may only be made through internal channels.

1.3.2 Via internal and external channels

• Offences falling within the scope of European Union acts in the following areas:
  • services, products and financial markets and the prevention of money laundering
  • safety and conformity of products
  • transport security
  • environmental protection
  • food and feed safety and animal health and welfare
  • public health
  • consumer protection
  • privacy and data protection as well as security of networks and information systems
• acts or omissions affecting the financial interests of the European Union against fraud
• • acts or omissions affecting the internal market (including violations of EU competition and State aid rules, as well as violations affecting the internal market related to acts in breach of corporate tax rules or mechanisms whose purpose is to obtain a tax advantage that undermines the object or purpose of the applicable corporate tax law)
• • acts or conduct that undermine the object or purpose of the provisions of the acts of the European Union

1.4 Inadmissibility of an internal report

Reports will not be taken into account if they are:

1. not properly detailed and specific
2. instrumental and emulative, defamatory or libellous
3. based on mere suspicions or rumours or containing information that the reporter knows to be false
4. disregarding the integrity of the company
5. lacking competence in the matters reported
6. unfounded due to the absence of factual elements capable of justifying investigations
7. generic and not allowing comprehension of the facts, or accompanied by inappropriate or irrelevant documentation
8. not reporting unlawful or irregular conduct and only producing documentation
9. lacking the data that constitute essential elements of the report

Upon receiving a report that is not adequately detailed, the President of the Supervisory Board (hereinafter SB) may ask the reporting party to complete it, again through the web platform (see section 3.1).
In the event of inadmissibility, the SB President communicates the assessment result to the reporting party and the report is considered ‘closed’.

Reports may be made by anyone working for the company in the capacity of:

• subordinate (employee) worker, including temporary workers
• self-employed worker or person in a collaborative relationship
• worker or collaborator working for entities that provide goods or services or perform works for third parties
• freelancer or consultant
• volunteer and intern (paid and unpaid)

Shareholders and persons with administrative, management, control, supervisory or representative functions are also entitled to report, even if these functions are exercised in a representative capacity.

The following can be reported:

1. when the legal relationship between the reporting party and the company is ongoing
2. when the legal relationship has not yet begun, if information on violations was acquired during the selection process or in other pre-contractual stages
3. during the trial period
4. after the termination of the legal relationship, if the information on violations was acquired in the course of that relationship

2.1 Protection of confidentiality

The identity of the reporting person and any other information/element of the report – including the documentation attached thereto – from which such identity may be inferred, directly or indirectly, may not be disclosed without the express consent of the reporting person himself/herself to persons other than those competent to receive or follow up the reports, expressly authorised to process such data pursuant to Articles 29 and 32(4) of Regulation (EU) 2016/679 and Article 2-quaterdecies of the Personal Data Protection Code pursuant to Legislative Decree No. 196/2003.

2.2 PROHIBITION OF RETALIATION

The protection of the whistle-blower and of all those who are protected by Legislative Decree no. 24 of 10.03.2023 is also guaranteed by the so-called prohibition of retaliation.

Retaliation includes but is not limited to:

1. dismissal, suspension or equivalent measures
2. downgrading, not promoting, unfairly negative performance assessments
3. demanding results that are impossible to achieve in the specified manner and timeframe
4. change of duties, change of workplace, reduction of salary, change of working hours
5. unjustified refusal to assign tasks with simultaneous assignment to another person
6. suspension of training or any restriction of access to it
7. demerits or negative references
8. repeated rejection of requests (e.g. holidays, leave)
9. unjustified cancellation of assignments
10. unjustified suspension of patents and licences
11. adoption of disciplinary measures or other sanctions, including fines
12. coercion, intimidation, harassment or ostracism
13. discrimination or otherwise unfavourable treatment
14. failure to convert a fixed-term employment contract into an employment contract of indefinite duration, where the employee had a legitimate expectation of such conversion
15. non-renewal or early termination of a fixed-term employment contract
16. damage, including to a person’s reputation, particularly on social media, or economic or financial harm, including loss of economic opportunities and loss of income
17. inclusion in improper lists on the basis of a formal or informal sectoral or industry agreement, which may result in the person being unable to find employment in the sector or industry in the future
18. early termination or cancellation of a contract for the supply of goods or services
19. cancellation of a licence or permit
20. request for psychiatric or medical examinations

In order to enjoy the protection provided by the Decree on Whistle-blowing with regard to the prohibition of retaliatory measurese:

• The whistle-blowers and all those who are protected by Legislative Decree No. 24 of 10.03.2023 must reasonably believe, also in the light of the circumstances of the specific case and the data available at the time of the Report, Public Disclosure or whistle-blowing, that the information on the violations reported, disclosed or denounced is true and relevant. On the other hand, the fact that the person has reported, made public disclosures or denunciations despite not being certain of the actual occurrence of the facts reported or denounced and/or of the identity of the author thereof or even reporting inaccurate facts due to a genuine mistake is not relevant for the purposes of the protections;
• there must be a close connection between the report, whistle-blowing, disclosure and the adverse conduct, measure, act, omission suffered, directly or indirectly, by the reporting person, whistle-blower or discloser

The protection envisaged in the event of retaliation is not guaranteed when the criminal liability of the reporting person, whistle-blower or discloser is established, even by a judgment of first instance, for the offences of defamation or slander or, in any case, for the same offences committed when reporting to the Authority, or when their civil liability is established, in cases of wilful misconduct or gross negligence. In cases where the aforementioned responsibilities are proven, a disciplinary sanction will also be imposed on the reporting and whistle-blowing person.
The protection of the whistle-blower and of all those who are protected by Legislative Decree no. 24 of 10.03.2023 against the retaliation suffered is applicable, albeit belatedly, if the first instance judgement, unfavourable to the whistle-blower, is not confirmed in the subsequent levels of judgement.
Similarly, the initiation of a criminal trial for offences of defamation or slander, following the Report, Public Disclosure or Complaint, which is then concluded with a dismissal, does not exclude the application of the protection in favour of the reporter or whistle-blower.

The choice of the reporting channel is not discretionary: the internal channel is prioritised and, only if one of the conditions set out in Article 6 of Legislative Decree No. 24/2023 is met, is it possible to make an external report or, if one of the conditions set out in Article 15 of Legislative Decree No. 24/2023 is met, a public disclosure.

3.1 Internal reports

3.1.1 Channels in written form

To submit an internal report, you need to access the web platform via the following link:

https://polycart.trusty.report

The platform, by means of advanced encoding tools and hosting in a high-security, ISO-certified data centre in Germany, guarantees the security of the reported data for all documentary evidence provided during reporting as well as anonymity, thus fulfilling the requirements of Legislative Decree 24/2023.

The report, forwarded through the web platform, will automatically be sent to the President of the Supervisory Board, who is the only subject that can receive and handle the report.

At the end of the guided process, the platform assigns a user code and password that must be kept by the reporter. These codes allow the reporter to:

• access the report to view its status
• talk to the SB President
• Inserting further information relevant to what has been reported also following specific requests by the SB President

If the user code and password are lost, they cannot be recovered in any way, so the whistle-blower will have to submit a new report.

It is the whistle-blower’s responsibility to consult the report periodically, directly on the web platform, in order to monitor its progress and provide the SB President with any further information.

Alternatively, a report can be submitted by ordinary mail. In this case, the report must be placed in two sealed envelopes.The first must contain the identification data of the reporter together with an identity document, whereas the second must contain the subject of the report. Both envelopes should then be placed in a third envelope with the words ‘confidential letter to the reporting manager’ on the outside.

3.1.2 Channels in oral form

Using the platform mentioned in section 3.1.1, it is possible to attach a voice message or request a direct meeting with the SB President.In the latter case, the meeting will be held on premises other than company premises and the consent of the reporter will be requested for the recording of the meeting.

3.1.3 Handling of internal reports

Handling of internal reports

The President of the Supervisory Board performs the activities described below.

1. They notify the whistle-blower of receipt of the report within seven days from the date of receipt.
2. They assess the report in order to verify its admissibility as a whistle-blowing case (see section 1.3).
3. They follow up the reports received, taking action to assess the existence of the reported facts, the outcome of the investigations and any measures taken.
4. If useful for the management of the report, they initiate a dialogue with the reporter, asking him/her for clarifications, documents and further information, via the same web platform.
5. They acknowledge the report by informing the reporter (within three months from the notice of receipt or, in the absence of such notice, within three months from the expiry of the seven-day period from the submission of the report) about the follow-up given or intended to be given to the report.

1. 1. If, following the activity carried out, the SB President finds elements of manifest unfoundedness in the report, they order it to be filed with adequate justification.

   2. If, on the other hand, they find that the report is well-founded, they should immediately refer the matter to the relevant internal bodies or external bodies/institutionsaccording to their competences, forwarding a report on the investigative findings and the activities carried out, and always taking care to protect the confidentiality of the identity of the reporter.

3.1.4 Conflict of interest

If the reporting party or the reported person coincides with the SB President (ordinary manager of internal reports), or with the company managing the IT platform, the report must be forwarded to the President of the Board of Auditors by ordinary mail.

3.2 External reports

An external report can only be issued if one of the following conditions is met:

1. An internal report has already been made and this has not been followed up
2. There are well-founded reasons to believe that, by making an internal report, it would not be effectively followed up or that the same report could lead to the risk of retaliation
3. There are reasonable grounds to believe that the breach may constitute an imminent or obvious danger to the public interest

External reporting is addressed to the National Anti-Corruption Authority (ANAC) through the channels activated by it. An external report submitted to a party other than the ANAC is transmitted to the latter within seven days from the date of its receipt, with simultaneous notification of the transmission to the reporting person.

For more details on the submission and management of a report, see ANAC’s website (in Italian): https://www.anticorruzione.it/-/whistleblowing

3.3 Public disclosure

Public disclosure means placing information about violations in the public domain through print or electronic media or otherwise through means of dissemination capable of reaching a large number of people.

A person who makes a public disclosure benefits from the protection provided for in Legislative Decree No. 24/2023 if, at the time of the public disclosure, one of the following conditions is met:

1. they have previously made an internal and external report or have made an external report directly and have not received a reply within the prescribed time limits on the measures envisaged or taken to follow up the reports
2. they have reasonable grounds to believe that the breach may constitute an imminent or obvious danger to the public interest
3. they have a well-founded reason to believe that the external report may entail a risk of retaliation or may not be effectively followed up due to the specific circumstances of the case, such as those where evidence may be concealed or destroyed or where there is a well-founded fear that the recipient of the report may be in collusion with or involved in the violation

In public disclosure, if the person voluntarily reveals their identity, the protection of confidentiality does not apply, without prejudice to all the other forms of protection provided for by Legislative Decree No. 24/2023.

3.4 Complaint to the Authority

Any person who, in the course of their work/professional activity, has become aware of any offence (alleged or actual) falling within the scope of Legislative Decree No. 24/2023 may also consider addressing the competent national judicial and accounting authorities.

If the whistle-blower has the status of public official or person in charge of a public service, even where the whistle-blower has made a report through the internal or external channels provided for by Legislative Decree no. 24/2023, they are not exempt from the obligation to report to the competent judicial or accounting authority any facts that are criminally relevant and any hypotheses of financial loss.

It remains understood that, where the whistle-blower reports an offence to the judicial authorities pursuant to Articles 361 or 362 of the Criminal Code and is then discriminated against as a result of the report, they may benefit from the protections provided for by Legislative Decree No. 24/2023 for the retaliation suffered.

The offices of the judicial authorities to which the complaint is made are also required to comply with the rules on the protection of confidentiality and the content of reports pursuant to Legislative Decree No. 24/2023.

3.5 Anonymous reporting

The SB President considers anonymous reports in the same way as ordinary reports. Anonymous reports, if well-founded, are also treated by ANAC as ordinary reports and in that case considered in its ‘ordinary’ supervisory procedures.

Internal and external reports and related documentation shall be filed for as long as necessary for their processing and, in any case, no longer than five years from the date of the communication of the reporting procedure’s final outcome, in compliance with the confidentiality obligations set out in Article 12 of Legislative Decree No. 24/2023 and the principle set out in Article 5(1)(e) of Regulation (EU) 2016/679 and Article 3(1)(e) of Legislative Decree No. 51/2018.

4.1 Personal information

Personal data that are clearly not useful for processing a specific report are not collected or, if accidentally collected, are deleted immediately.

The rights referred to in Articles 15 to 22 of Regulation (EU) 2016/679 may be exercised within the limits of Article 2-undecies of Legislative Decree No. 196/2003.

The notice can be found in the privacy section.

Any abuse of this Procedure, such as reports that prove to be unfounded, made with malice or serious misconduct, or those that are manifestly opportunistic and/or made for the sole purpose of harming the whistle-blower or other persons, as well as any other case of improper use or intentional exploitation of this Procedure, shall be considered a source of liability in disciplinary and other competent fora.

Pursuant to Article 17 of Legislative Decree no. 24/2023, all ascertained breaches of the measures put in place to protect the whistle-blower, including all discriminatory acts adopted by the company against the whistle-blower him/herself (ref. Article 17(4) of Legislative Decree no. 24/2023) or pressure or discrimination aimed at influencing the investigation, are also sanctioned.

Disciplinary sanctions will be proportionate to the extent and seriousness of the unlawful conduct ascertained and may also lead to the termination of the employment or consultancy relationship, in compliance with the applicable legal provisions as well as with the regulations of the national collective labour contract of the relevant sector.

In particular, it should be noted that, in order to ensure the protection of the whistle-blower, the Disciplinary System of Model 231 provides that acts of retaliation or discrimination against anyone who has reported an unlawful conduct, relevant for the purposes of Legislative Decree 231/2001, or a breach of the Model or of the Code of Conduct, as well as any breaches of confidentiality obligations concerning the identity of the whistle-blower, shall be sanctioned.

For sanctions, please refer to the Disciplinary System of Model 231.

The retaliatory or discriminatory dismissal of the reporting person is null and void, just like the change of job and any other retaliatory or discriminatory measure taken as a consequence of the reporting, as already mentioned in section 2.2.

In the event of disputes on the imposition of sanctions or on demotions, dismissals, transfers, organisational measures with direct or indirect negative effects on working conditions, subsequent to the report, or in the event of a claim for damages submitted to the judicial authorities by the authors of a report, Polycarts.p.a. shall be responsible for proving, on the one hand, the legitimacy of the measures adopted and, on the other hand, that the damage is not a consequence of the report made.

If the whistle-blower is an employee of the company who believes that they have been retaliated against for having submitted a report, they may notify the relevant trade unions, the National Labour Inspectorate, or directly the National Anti-Corruption Authority (ANAC) through the whistle-blowing procedure on the company’s institutional website.