Whistleblowing

Legislative Decree 24/2023 (the “Whistleblowing Decree”) in force since 30 March 2023, implementing the EU Directive 2019/1937, regulates the protection of individuals who report violations of national or European Union regulatory provisions that harm the public interest or the integrity of the public administration or private entity, of which they have become aware in a public or private employment context.

For the purposes of the Whistleblowing Decree, “violations” are defined as:

1.  administrative, accounting, civil or criminal offences that do not fall under numbers 3), 4), 5) and 6) below;
2. unlawful conduct relevant to Legislative Decree No. 231 of 8 June 2001, or violations of the organization and management models provided for therein that do not fall under numbers 3), 4), 5) and 6);
3. offences falling within the scope of application of European Union acts relating to the following areas: public procurement; services, products and financial markets and prevention of money laundering and terrorism financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; privacy and protection of personal data and security of networks and information systems;
4. acts or omissions affecting the financial interests of the European Union;
5. acts or omissions affecting the internal market, including violations of the Union’s competition and State aid rules, as well as corporate taxes;
6. acts or conduct that frustrate the object or purpose of the provisions of Union acts in the areas indicated in (3), (4) and (5).

The “reporting person” or “Whistleblower” is the individual who reports information on violations of which he/she has become aware in the context of his/her work environment. Such person may be either:

• employees and other subjects on the basis of relationships that de facto determine their inclusion in the company organization, also in a form other than an employment relationship;
• self-employed personnel as well as those having a collaboration relationship who perform their work activity at the Company;
• employees or collaborators, who perform their work activity at the Company by supplying goods or services or carrying out specific activities;
• self-employed professionals and consultants who perform their activity at the Company;
• volunteers and trainees, whether remunerated or not, who work for the Company;
• shareholders and persons with administrative, management, control, supervisory or representative functions;
• persons who have terminated their employment relationship with the Company if information on violations was acquired during the course of that relationship;
• persons whose employment relationship has not yet commenced (so-called ‘candidates’) in cases where information concerning a breach has been acquired during the selection process or other stages of pre-contractual negotiations.

Kairos ensures the confidentiality of the reporting person’s identity in accordance with the relevant regulations in force and the self-regulatory rules governing forms of protection against retaliation and/or discriminatory conduct.

A reporting person who suspects that a violation has occurred or may occur may send a report to the attention of the Head of Internal Reporting Systems (RSIS), according to the procedures set out below:

INTERNAL REPORTING CHANNEL

 For employees only, through two alternative channels:

• electronic communication by accessing the online platform available at the link indicated in the Company’s Whistleblowing Policy (so-called “electronic channel”);
• letter, by registered letter, to the address: Unione Fiduciaria – Via Amedei, 4 – 20123 Milan, to the attention of the Whistleblowing Office – KAIROS (so-called “paper channel”).

For all other Whistleblowers, who do not have access to the Company systems, via the “paper channel” to the address Unione Fiduciaria – Via Amedei, 4 – 20123 Milan, to the attention of the Whistleblowing Office – KAIROS.

The Company has identified and regulated a process for the management and analysis of the reports received characterized by the presence of a specifically identified Officer (RSIS), who preliminarily examines the report by assessing the existence of the prerequisites of foundation and reliability necessary to initiate further investigation, excluding generic reports.

If the report is deemed to be a mere personal complaint or relates to events already reported and/or known to the Company or does not fall within the scope of the rules governing whistleblowing, the RSIS will close the file by notifying the Whistleblower.

The provision of the Whistleblower’s identification data is optional. Anonymous reports, i.e. reports that contain no element that can identify the Whistleblower, are allowed. However, reports must be adequately circumstantiated and based on accurate and consistent elements, so that the facts or situations described in the report can be related to specific contexts and the necessary investigations and assessments can be carried out to evaluate their merits.

The RSIS updates the reporting person on the progress of the case through the same channel originally used by the reporting person and, specifically, the following communications are provided for by the RSIS:

• within 7 days from the date of receipt of the report, an acknowledgement of receipt of the report is provided to the reporting person;
• within 3 months from the date of the acknowledgement of receipt, feedback on the report is provided.

EXTERNAL REPORTING CHANNEL WITH ANAC

The Whistleblower may file an external report through the channel activated by the ANAC (National Anti-Corruption Authority) by accessing the relevant website: www.anticorruzione.it/-/whistleblowing, if one of the following conditions occurs:

• the mandatory activation of the internal reporting channel is not envisaged within his work context, or this channel, even if mandatory, is not active or, even if activated, does not comply with the regulation; or
• the reporting person has already made an internal report and it was not followed up;
• the reporting person has reasonable grounds to believe that, if he/she were to make an internal report, it would not be effectively followed up or that the report might give rise to the risk of retaliation;
• the reporting person has reasonable grounds to believe that the violation may constitute an imminent or manifest danger to the public interest.

PUBLIC DISCLOSURE

Public disclosure means releasing information about violations into the public domain through the press or electronic media or otherwise through means of dissemination capable of reaching a wide number of people.

The Whistleblower benefits from the protection measures provided for by the legislation if, at the time of public disclosure, one of the following conditions is met:

• the reporting person has previously made an internal and an external report, or has made an external report directly and no reply has been received within the deadline set on the measures envisaged or adopted to follow up the report;
• the reporting person has reasonable grounds to believe, based on concrete circumstances, that the violation may constitute an imminent or manifest danger to the public interest;
• the reporting person has reasonable grounds to believe that the external report may entail a risk of retaliation or may not be effectively followed up by reason of the specific circumstances of the case, such as where evidence may be concealed or destroyed or where there is a well-founded concern that the recipient of the report may be colluding with or involved in the author of the violation.

Please note that a report of a violation is not a complaint. For information on how to file a complaint, please refer to the ‘Complaints’ section on the website.

The information pursuant to Articles 13 and 14 of Regulation EU/679/2016 (GDPR) is hereby made available.

Information on the protection of personal data