Whistleblowing procedure compliant with Italian Legislative Decree 24/2023

What can be reported?

Violations that harm the public interest or the integrity of the organization, including but not limited to: administrative, accounting, civil, or criminal offenses; unlawful conduct pursuant to Italian Legislative Decree no. 231 of June 8, 2001; offenses in sectors such as public procurement, financial services, product safety, environmental protection, consumer protection, etc.; acts or omissions that undermine the interests of the European Union or regulations on competition, state aid, or corporate taxation.

What should a report include?

Detailed information about the issue, including information about the reporting person, a complete description of the incident, when and where it occurred, who is involved, and any other information or documentation that may help prove the truthfulness of the report.

How to submit a report?

The report may be submitted through the dedicated internal channel, in written or oral form. The report must be submitted to the employer by hand-delivered sealed envelope, by email, or through an interview.

What happens after a report?

After submitting a report, the reporting person will receive an acknowledgment of receipt within seven days from the date of receipt. This will confirm that the report has been received and that the process has started. The employer will review the report impartially and confidentially, maintaining communication with the reporting person and requesting any additions if necessary. If the report is valid, the employer may report the matter to the authorities, take disciplinary measures, or take other steps. In any case, feedback will be provided within three months from the date of the acknowledgment of receipt, maintaining transparency with the reporting person. If it becomes necessary to disclose confidential data during the investigation, the reporting person will be informed of the reasons for such disclosure. In this way, the process ensures complete and fair management of any report, protecting the interests of all parties involved.

Protection of the reporting person

The identity of the reporting person and any other information will be kept confidential, with specific limitations in criminal proceedings, proceedings before the Court of Auditors, or disciplinary proceedings. Information may be disclosed only with the express consent of the reporting person when indispensable for the defense of the person concerned.

Responsibility of the reporting person

If the reporting person submits a report that proves to be false or defamatory, they may be subject to criminal or disciplinary sanctions.

Confidentiality obligation

Reports may not be used beyond what is necessary, and confidential data must be processed with the utmost confidentiality, in accordance with the relevant articles of Regulation (EU) 2016/679 and Legislative Decree no. 196 of June 30, 2003.