WHISTLEBLOWING PROCEDURE

OPERATING PROTOCOL P_01 Rev: 1

Introduction
Recipients of the procedure
Object of the report
Content of reports
Recipient of reports
Report communication channels
Whistleblower protection
Personal data processing
Storage of documents relating to the report
Public disclosure
Prohibited reports
Prohibition of discriminatory and retaliatory behaviour

1. Introduction

Sapre Costruzioni S.r.l. (hereinafter also “SAPRE CONSTRUZIONI”) adopts the Whistleblowing procedure (hereinafter also “WB procedure”) pursuant to Italian Legislative Decree no. 24 of 10 March 2023.

2. Recipients of the procedure

The recipients of the procedure are: senior management, members of corporate bodies and of the supervisory body; employees, former employees and candidates for jobs; volunteers and trainees, paid or unpaid; shareholders, customers, as well as – but not limited to – partners, suppliers, consultants, collaborators in the performance of their work at SAPRE CONSTRUZIONI; self-employed workers and freelancers, who are in possession of information about breaches, as defined in this procedure. Recipients also include physical and legal entities not included in the previous categories, but to which the protection measures set out in this procedure apply. This document also applies to anonymous reports, provided that they are appropriately substantiated, as outlined below.

3. Object of the report

This procedure allows you to promptly report: administrative, accounting, civil or criminal offences; any relevant unlawful conduct pursuant to Legislative Decree no. 231/2001; any violation of the Organisation, Management and Control Model and the Code of Ethics adopted by the company; any other case governed by Article 2 (1) (a) of Legislative Decree no. 24/2023 (for example, offences relating to the safety and conformity of products), of which we become aware by reason of the functions performed (hereinafter also “Reports”).

4. Content of reports

Reports must be appropriately substantiated, contain all the elements useful to enable the collection of essential information for reconstruction of the fact and to ascertaining the merits of the reported actions. In particular, the report must contain the following elements: general information of the whistleblower, with indication of their position or role within the company; a description of the facts to be reported, including, if known, details of the time and place in which the reported facts were committed; if known, personal details or in any case other elements (function/role) enabling easy identification of the alleged perpetrator of the unlawful conduct; The whistleblower may also indicate the following elements: any other persons who may corroborate the facts; additional information/documentation to support the report. Reports may not concern mere suspicions or information reported by third parties or in any case lacking factual elements or unequivocal documentary support. It is not necessary that the whistleblower is certain of the actual occurrence of the reported facts and the identity of the alleged perpetrator, being sufficient that, on the basis of their knowledge and in good faith, or on the basis of a reasonable conviction based on factual and circumstantial elements, they consider it highly probable.

5. Recipient of reports

The Chair of the supervisory body is specifically appointed by the competent body as the dedicated recipient of reports.

6. Report communication channels

Internal communication channels SAPRE COSTRUZIONI operates and maintains the following internal communication channels (hereinafter also “reception channels”) to the recipient of reports: in written form. The report must be placed in two closed envelopes: the first with the whistleblower’s identification data and a photocopy of their ID; the second containing the report itself, in order to separate the whistleblower’s identity from the report. Both envelopes must then be placed in a third sealed envelope bearing the word “confidential” for the recipient of reports (“confidential for the SB chair”). The envelope must be sent by registered post to the address made available to the recipients of this procedure. The report will be subject to confidential registration, on an autonomous basis, by the recipient; orally, in other words, at the request of the whistleblower, emailed to the address made available to the recipients of this procedure and only accessible by the Chair of the supervisory body, or in the manner outlined in the previous point, through a direct meeting with the recipient of the report, held within a reasonable time. In this case, with the whistleblower’s consent, the interview is documented by recording on a device suitable for storage and listening or by written minutes, which the whistleblower may check and/or rectify and which must be confirmed by signing. It is understood that anyone who receives a report, in any form (oral or written), must transmit it without delay, and in any case within 3 days of receipt, to the recipient of the report through the internal reporting channels described above, giving contextual notice to the whistleblower (where known). It is also required to transmit the original report, including any supporting documentation, as well as evidence of the communication to the whistleblower of the forwarding of the report. Anyone receiving a report may not retain a copy of the original and must delete any digital copies, refraining from undertaking any independent and/or in-depth analysis. Failure to communicate a report received within the aforementioned terms constitutes a violation of the procedure and may result in the adoption of disciplinary measures. Handling reports The recipient of the report carries out the following procedure: issues notice of receipt of the report to the whistleblower within 7 days from the date of receipt; maintains discussions with the whistleblower and may request additions from the latter, if necessary; diligently follows up on reports received; provides feedback on the report within 3 months from the date of the notice of receipt or, in the absence of such notice, within 3 months from the expiry of the term of seven days from submission of the report. Anonymous reports are taken into account only if adequately substantiated and based on precise and concordant facts, so that no additional investigations are necessary. Tasks of the person receiving the report The recipient who receives the Report must promptly complete a “Report Register” in which the following are stated: the serial number that allows its unequivocal identification; the date of receipt; the reception channel used; the classification of the report, based on a preliminary evaluation of its content; findings and conclusions emerging. The recipient of the report carries out an initial eligibility screening, since it is important to distinguish a report adhering to certain criteria, both subjective (coming from a whistleblowing recipient) and objective criteria (as outlined in paragraph 3), from a mere complaint. The recipient of the report will assess: whether the subject of the report has previously been investigated by the organisation, or by a competent authority; whether the report contains sufficient elements to be verified or, on the contrary, is too general and lacks enough information for subsequent investigation. If the recipient assesses the report as a mere complaint, or discovers that the subject of the report has previously been investigated by the company or the competent authority, they will proceed to file the report, informing the whistleblower. The recipient will acknowledge it in a special report, transcribed in the register and will forward the report to the company department responsible for its processing. If the recipient considers the report to be excessively generic (“poor”) and needs additional information for the investigation, the reporter must be contacted, in order to protect their identity. Where deemed useful for in-depth investigations, the recipient may acquire information from the persons involved in the report, who also have the right to be heard or to produce written observations or documents. In such cases, also in order to guarantee the right of defence, the person involved is given notice of the existence of the report, while guaranteeing confidentiality about the identity of the whistleblower and other persons involved and/or mentioned in the report. If insufficient or no further information is provided for investigation, the recipient will evaluate any underlying reasons, if given, as well as verify the possibility of obtaining the necessary information through other channels. For “relevant” reports, i.e. sufficiently detailed to allow the initiation of investigations, the recipient of the report carries out the appropriate internal investigations to substantiate the reported facts. If deemed necessary, they may make use of external consultants, bound by the obligation of confidentiality regarding their activity and the identity of the persons involved. If the report is “well-founded”, the recipient is required to promptly and formally communicate the alleged violations to the reported person, who may, within 30 days of receipt of the dispute, request to be heard or submit written observations and documents. At the end of the investigations, the recipient of reports prepares a specific report for the Board of Directors in which the context, the regulatory and procedural framework of reference, the verification activities carried out, the results emerged, documents and/or other elements proving unlawful conduct or the violation committed, and any proposed sanction, are formalised. If, on the other hand, the investigation shows that the report, if not anonymous, is unfounded and reasonably carried out with wilful misconduct or gross negligence by the whistleblower, the recipient of the report activates the company departments responsible for initiating a disciplinary procedure against the whistleblower. In this case, the recipient gives notice to the reported party, to allow them to exercise their right to defence. Also in these cases any activity carried out must be reported. In the event of reports concerning members of the Board of Directors, the recipient of reports shall immediately notify the supervisory body. If the report concerns conduct pursuant to Legislative Decree 231/01 or highlight one or more violations of the Organisational Model, the Chair of the supervisory body must immediately notify the body itself, which may submit observations on the line of investigation to be followed. External reporting channel The whistleblower may make an external report through a specific channel activated by the ANAC, if, at the time of submission, one of the following conditions is met: the whistleblower has already made an internal whistleblower report as per the preceding paragraph, and it has not been followed up; the whistleblower has reasonable grounds to believe that if they made an internal report, it would not be effectively followed up or may result in the risk of retaliation; the whistleblower has reasons to believe that the contravention may constitute an imminent or obvious danger to the public interest.

7. Whistleblower protection

The internal reporting channels guarantee confidentiality regarding the identity of the whistleblower in the management of reports (from receipt of the report, and at all stages of the process). Anyone receiving a report is bound to protect the identity of the whistleblower, the persons involved and/or otherwise mentioned in the report, the content of the report and the related documentation. Protection of the whistleblower is also extended to the following cases: when the legal relationship has not yet begun, if information on violations was acquired during the selection process or at other pre-contractual stages; during the probationary period; after the dissolution of the contractual relationship, if the information on violations was acquired during the course of the relationship, The protection measures also apply to the following subjects: facilitators, persons in the same working area as the whistleblower, who are linked to them by a stable emotional bond or kinship within the fourth degree; the whistleblower’s colleagues who work in the same professional area and who have a habitual and ongoing relationship with them; entities owned by the whistleblower or for which they work, as well as entities operating in the same area as the whistleblower. Without prejudice to any legal obligations relating to communications to the authorities. Reports may not be used beyond what is necessary for proper follow-up. The identity of the whistleblower, and any other information from which their identity may be directly or indirectly derived, may not be disclosed without the express consent of the whistleblower to persons other than those authorised to receive or follow up reports, or expressly authorised to process such data pursuant to Regulation (EU) 2016/679. Regarding the disciplinary procedure, the identity of the whistleblower may not be revealed if the dispute of the disciplinary charge is based on separate and additional assessments of the Report, even if relating to the same. If the complaint is based in whole or in part on the report and knowledge of the whistleblower’s identity is essential for the defence of the accused, the report may be used for the purposes of the disciplinary procedure only upon the whistleblower’s express consent to the disclosure of their identity. Furthermore, the confidentiality of the whistleblower may not be respected in cases where: the whistleblower gives express consent to the disclosure of their identity; the criminal liability of the whistleblower for slander or defamation, or in any case for crimes committed by the whistleblower is ascertained with a judgment of first instance, or its civil liability for the same title in cases of wilful misconduct or gross negligence; anonymity is not enforceable by law and the identity of the whistleblower is required by the judicial authority. Violation of the obligation of confidentiality is a cause for disciplinary responsibility, without prejudice to further forms of responsibility provided for by the protocol. The whistleblower is exempt from direct or indirect discriminatory or retaliatory acts for reasons directly or indirectly connected to the whistleblowing. In this regard, please refer to paragraph 12.

8. Processing of personal data

Personal data collected in connection with the processing of the report is kept until the end of the activity and subsequently deleted. Personal data that is manifestly not useful for examining the report is not collected or, if collected accidentally, deleted promptly. To this end, the whistleblower is required to communicate only data that they consider relevant for the purposes of the report, also taking into account the possibility for the recipient of the report to request further information. Original reports received in paper form are kept in a special protected environment. SAPRE CONSTRUZIONI implements technical and organisational measures to ensure a level of security appropriate to the specific risks deriving from the processing carried out, on the basis of a data protection impact assessment (DPIA), and governing the relationship with any external suppliers that process personal data on their behalf in accordance with Article 28 of Regulation (EU) 2016/679. In particular, SAPRE Construzioni implements measures to prevent third parties from accessing information and documents.

9. Storage of documents relating to the report

Reports and their relative documentation are kept for the time necessary for processing the report, and in any case no more than five years from the date of communication of the final outcome of the reporting procedure, in compliance with the confidentiality obligations referred to in the preceding point. Notwithstanding paragraph 8, the documentation is stored with appropriate technical and organisational measures in order to prevent its loss, destruction or accidental damage in compliance with the principles of integrity and confidentiality referred to in Article 5 of Regulation (EU) 2016/679.

10. Public disclosure

“Public disclosure” means making information about violations public via the press or digital means, or in any case by dissemination capable of reaching a large number of people. A whistleblower who makes a public disclosure benefits from the protection provided by this procedure only if, at the time of public disclosure, one of the following conditions is met: the whistleblower has previously made an internal and external report or a direct external Report, under the conditions and in the manner provided for in this procedure, and no response has been received within the established deadlines regarding the measures envisaged or adopted to follow up on reports; the whistleblower has reasons to believe that the contravention may constitute an imminent or clear threat to the public interest; the whistleblower has reasonable grounds to believe that the external report may carry the risk of retaliation, or may not have been followed up properly due to the specific circumstances of the particular case, such as when evidence may have been concealed or destroyed, or when there is a well-founded fear that the person who received the report may be colluding with the perpetrator or involved in the violation itself.

11. Prohibited reports

SABRE CONSTRUZIONI does not accept that this procedure for reporting offences and violations constitutes a tool to vent disagreements or disputes between company personnel. In particular, the following are prohibited: – The submission of reports for purely defamatory or slanderous purposes; – The use of insulting expressions; – The submission of reports that relate exclusively to aspects of private life, without any direct or indirect connection with the company’s business

12. Prohibition of discriminatory and retaliatory behaviour

No form of retaliation or discriminatory action, direct or indirect, affecting the working conditions of the whistleblower for reasons directly or indirectly connected to the whistleblowing is permitted or tolerated. Protection is also guaranteed to anonymous whistleblowers who believe they have suffered retaliation and have been subsequently identified. The protection measures apply within the limits and conditions set out in Chapter 3 of Legislative Decree no. 24/2023, and also extend to: facilitators, persons in the same working area as the whistleblower, who are linked to them by a stable emotional bond or kinship within the fourth degree; the whistleblower’s colleagues who work in the same professional area and who have a habitual and ongoing relationship with them; entities owned by the whistleblower or for which they work, as well as entities operating in the same area as the whistleblower. The following are some cases that, if attributable to the first paragraph of this article, constitute retaliation: dismissal, suspension or equivalent measures; demotion or non-promotion; change of functions, change of workplace, reduction of salary, change in working hours; suspension of training or restriction of access to it; negative notes of merit or negative references; adoption of disciplinary measures or other sanctions, including financial penalties; coercion, intimidation, harassment or ostracism; discrimination or otherwise unfavourable treatment; failure to convert a fixed-term employment contract into a permanent employment contract, where the worker had a legitimate expectation of such conversion; non-renewal or early termination of a fixed-term employment contract; damage, including to the person’s reputation, in particular on social media, or economic or financial prejudice, including loss of economic opportunities and loss of income; improper listing on the basis of a formal or informal sectoral or industrial agreement, which may make it impossible for the person to find employment in the sector or industry in the future; early conclusion or cancellation of the contract for the supply of goods or services; cancellation of a license or permit; the request to submit to psychiatric or medical investigation. Acts adopted in violation of this article are null and void. Protected subjects who have been dismissed due to the report, public disclosure or complaint to the judicial or accounting authority have the right to be reinstated in the workplace, in accordance with current legislation, by reason of the specific discipline applicable to the worker. Violation of the aforementioned prohibition is a disciplinary matter, in accordance with the corporate disciplinary system adopted by the company as part of the Organisation, Management and Control Model.

CONTACT AND ENQUIRIES