Whistleblowing

Regulations for Managing Reports and Protecting Whistleblowers Pursuant to Italian Legislative Decree No. 24 of March 10, 2023

1. Introduction and regulatory framework

These regulations are adopted by Paiardini Tino S.r.l. to align its internal organization with the provisions introduced by Italian Legislative Decree No. 24 of March 10, 2023. This decree transposes EU Directive 2019/1937 (on the protection of persons who report breaches of Union law) for private entities that, in the last year, have employed an average of at least 50 subordinate workers.

Specifically, Paiardini Tino S.r.l.’s intent is to define a system designed to allow the reporting of unlawful acts and conduct that harm the Company’s integrity.

These regulations take into account the relevant guidelines developed and published by the National Anti-Corruption Authority (ANAC) via Resolution No. 311 of July 12, 2023.

The regulations specify:

• The individuals who can submit reports
• The types of illicit activities that can be reported
• The recipient of the report (hereinafter also referred to as the “Report Manager”), the methods for submitting the report, and its content
• The activities following the submission of a report
• The protections for the whistleblower
• The protection of personal data

2. Individuals who can submit reports

Reports of illicit activities can be made by:

• Employees of Paiardini Tino S.r.l. under any type of contract, even after the termination of their employment, provided the report pertains to facts they became aware of during their employment.
• Individuals currently engaged with Paiardini Tino S.r.l. under an autonomous work contract, a coordinated and continuous collaboration agreement, or a curricular or extracurricular internship.
• Owners, partners, or employees of companies that have an ongoing supply, contract, or administration agreement with Paiardini Tino S.r.l.
• Candidates for employment at Paiardini Tino S.r.l., if the information regarding the reported violations was acquired during the selection or pre-contractual phase.
• Individuals at Paiardini Tino S.r.l. who hold administrative, managerial, control, supervisory, or representative functions.

These regulations, based on the provisions of Legislative Decree 24/2023, refer to reports of violations of European Union legislative provisions and their corresponding national implementing legislation, which are likely to harm the integrity of Paiardini Tino S.r.l.

Specifically, reports, which must be based on the whistleblower’s good faith, may concern: violations that the whistleblower has direct knowledge of or a well-founded suspicion about, violations for which there is a well-founded suspicion of future commission, and conduct aimed at concealing such violations.

Reports may concern violations of European legislation as per Article 2, paragraph 1, letters a) numbers 3), 4), 5) and 6) of Legislative Decree No. 24 of March 10, 2023.

More specifically, these include violations of European legislation and its related national implementing legislation concerning:

• Transport safety
• Public procurement
• Financial services, products, and markets; prevention of money laundering and terrorist financing
• Environmental protection
• Radiation protection and nuclear safety
• Food and feed safety, and animal health and welfare
• Public health
• Consumer protection
• Protection of privacy and personal data
• Security of network and information systems
• Competition and state aid regulations

3. Types of reportable illicit activities

Reports related to disputes, claims, or requests concerning personal interests, the whistleblower’s employment contract, or their relationship with colleagues and superiors do not fall within the scope of these regulations and will not be considered.

4. Recipient of reports and reporting procedures

Internal Channel

Paiardini Tino S.r.l., having consulted with the company’s RSU (Company Trade Union Representation) on December 12, 2023, and having received no observations or reports from them, has activated an internal reporting channel. Mr. Gaetano Catani (Main Manager) and Mr. Christian Serrangeli (Alternate) have been appointed to manage this channel.

Please note that Mr. Christian Serrangeli will assume the functions of report manager only in the event of a prolonged absence of the Main Manager or should a report identify the Main Manager as the subject of the report.

The report manager is obligated to autonomously handle received reports with full respect for the whistleblower’s confidentiality, applying the principles and measures outlined in EU Regulation 2016/679 concerning personal data confidentiality. This includes, in particular, providing the whistleblower with the information notice pursuant to Articles 13 and 14 of the Regulation.

Reports can be submitted via the dedicated “Teamsystem Whistleblowing” IT platform, available at the link https://paiardini.smartleaks.cloud. Through this platform, the whistleblower can submit reports in written form or verbally by attaching a voice recording file.

The “Teamsystem Whistleblowing” IT platform guarantees the confidentiality of the whistleblower, whose personal details are encrypted and can only be known by the report manager for the purpose of providing feedback on the outcome of the report, requesting any further necessary information, and ensuring the whistleblower’s protection as stipulated by Italian Legislative Decree 24/2023.

The report must contain the following elements:

• Identity of the whistleblower
• Clear and complete description of the reported event
• If known, place and time circumstances in which the event occurred
• If known, identity of the individual(s) who committed the reported act
• If known, identity of other individuals who may be aware of the facts
• Any documents in the whistleblower’s possession useful for evaluating the reported event or an indication of where such documents are stored

The whistleblower’s identity will be known exclusively by the report manager, who is obligated to ensure maximum confidentiality in this regard.

Any anonymous reports cannot be considered or reviewed, as it is not possible to verify if the whistleblower falls within the categories of individuals authorized to submit reports by Legislative Decree 24/2023. Such reports will still be recorded, and any documentation will be stored in accordance with the aforementioned decree.

In any case, it will not be possible to ensure full protection for the whistleblower against potential retaliatory actions, as provided by Legislative Decree 24/2023, as long as their identity remains unknown.

Should an anonymous whistleblower subsequently reveal their identity, the report can be managed in accordance with these procedures.

If the report is found to be substantiated and, based on it, the Company needs to initiate disciplinary proceedings against the reported individual, the whistleblower’s consent to reveal their identity will be requested only if knowledge of their identity is indispensable for the defense of the accused party. If the whistleblower does not consent to the disclosure of their identity, the report cannot be used for disciplinary purposes.

If the disciplinary proceeding originates from further and distinct investigations unrelated to the report (even if consequent to it), the whistleblower’s identity cannot be revealed.

Consent will not be required if, following the report, a proceeding involving the Judicial Authority is initiated and the Authority requests the whistleblower’s identity.

External channel – Reporting via ANAC

The whistleblower can submit a report through the reporting channel activated by the National Anti-Corruption Authority (ANAC), via their website https://www.anticorruzione.it/-/whistleblowing, in the following cases:

• If the report made through the company’s internal channel, as described above, did not receive follow-up (i.e., the whistleblower did not receive confirmation of receipt or the outcome of the report within the terms specified in these regulations).
• If there are well-founded reasons to believe that submitting a report through the company’s internal channel would not be effectively followed up on or would lead to retaliatory conduct.
• If there is a well-founded reason to believe that the reported violation may pose an imminent or obvious danger to the public interest.

Public disclosure

The whistleblower may make a public disclosure if one of the following conditions is met:

• They have submitted a report through the company’s internal channel and a report through ANAC (or directly submitted a report through the ANAC channel) and no feedback has been provided within the stipulated deadlines.
• They have a well-founded reason to believe that the reported violation may constitute an imminent or obvious danger to the public interest.
• They have a well-founded reason to believe that reporting through the ANAC channel may involve a risk of retaliation or may not be followed up on.

Public disclosure involves making information about the violation publicly available, disseminating it through mass media, electronic means, or any other tools capable of reaching a large number of people.

It should be noted that public disclosure is an absolutely residual reporting method, both due to the stringent prerequisites on which it is based and the delicate consequences that can arise for the reported individual and the company, especially if the report itself is unfounded.

It is also specified that in this case, the whistleblower’s protection only applies if the conditions required for making a public report have been met.

5. Post-report procedure

Within 7 days of receiving a report, the report manager will provide written confirmation of its receipt to the whistleblower. This confirmation will be sent automatically through the platform.

Subsequently, the whistleblower may be contacted by the report manager if further information or clarification regarding the reported matter is needed.

Reports received through the “Teamsystem Whistleblowing” platform will be automatically managed through the same platform, which will automatically assign an identification number to each report and record any related events or progress (e.g., feedback to the whistleblower, requests for clarification, document uploads, etc.).

The report manager will proceed with reviewing the received report, adhering to the principles of impartiality and confidentiality, carrying out all necessary activities such as:

• Verifying that the report was submitted by an authorized individual and that its subject matter complies with the provisions of Legislative Decree 24/2023.
• Interviewing the whistleblower and, while ensuring the whistleblower’s confidentiality, other internal or external parties who can provide information and feedback.
• Interviewing the reported individual, ensuring their confidentiality and provided that the interview does not prejudice the effectiveness of the investigative activity.
• Consulting company documents, in electronic or paper format, while respecting the confidentiality and secrecy constraints determined by the nature and content of the documents themselves.
• Requesting support from external consultants who can provide technical assistance in evaluating the merits of the received report, while maintaining the confidentiality of the whistleblower’s identity.

The investigative activity must be completed within 90 days of receiving the report, unless a deferral of the deadline is necessary, which must be justified by the report manager.

Once the investigative phase is complete, the report manager will assess the merits of the received report and:

• If the report is deemed unfounded, they will order its archiving with adequate justification.
• If the report is deemed founded, they will draft a report on the matter and submit it to the Chairman of the Board of Directors, keeping the whistleblower’s identity confidential.
• In the case of reports concerning the Chairman of the Board of Directors or one or more Board Members, the report manager will immediately notify the other members of the Board of Directors and the Auditor to coordinate and define the subsequent investigation process.

In both cases, written feedback will be provided to the whistleblower. Feedback on the submitted report must in any case be provided to the whistleblower within three months of receiving the report, even if the investigative activity has not been completed due to a deferral of the 60-day deadline.

If the report is found to be substantiated, the Chief Executive Officer, upon receiving the report from the report manager, and assisted by relevant company figures, may proceed to:

• File a complaint with the Judicial Authority if the report reveals profiles of criminal liability on the part of individuals internal or external to the Company.
• Request clarification from the head of the company area affected by the reported event.
• Request that competent company personnel create or improve internal procedures suitable for preventing the reported event from occurring or limiting its consequences.
• Initiate disciplinary proceedings against the reported individual in compliance with Article 7 of Law 300/1970.
• Arrange appropriate measures against third parties who are the subject of the report and have contractual relationships with the Company.
• Communicate the report to the Auditor.

The reported individual, while maintaining their confidentiality, may be heard by company management during the investigation and may submit written observations and documents.

6. Whistleblower protection measures

Italian Legislative Decree 24/2023 stipulates that whistleblowers must receive specific protection to prevent any form of retaliation following their report.

For this protection to be guaranteed, the following conditions must be met:

• The report must have been made in good faith. This means that at the time of reporting, the whistleblower must have had well-founded reasons to believe that the information about the reported violation was true and fell within the scope indicated by Legislative Decree 24/2023.
• The whistleblower’s criminal liability for defamation or slander, or civil liability for the same reason in cases of willful misconduct or gross negligence, must not have been ascertained by a first-instance judgment.
• The report must have been made in compliance with the procedures outlined in these regulations.

In cases a) and b) above, the whistleblower may be subject to disciplinary action. If the report has caused reputational damage to Paiardini Tino S.r.l., the whistleblower may be held liable for the damage caused.

The whistleblower (subject to the above clarifications) cannot be subjected to retaliatory acts such as, by way of example, dismissal, demotion, transfer, or any other action that results in negative effects on their employment contract, which will therefore be considered null and void. This protection extends to the whistleblower even if the report is deemed unfounded after the investigation, provided it was made in good faith.

The aforementioned protection extends to:

• “Facilitators”: individuals who assist the whistleblower in the reporting process and who have been explicitly named by the whistleblower in the report.
• Colleagues who work in the same environment as the whistleblower and have regular and ongoing relationships with them.
• Individuals in the same work environment who are related to the whistleblower by stable emotional ties or kinship up to the fourth degree.
• Entities owned by the whistleblower or in which they work.

In the event of disclosure/dissemination of:

• Information covered by secrecy.
• Information related to the protection of copyright or personal data.
• Information related to confirmed violations that offend the reputation of the person involved or reported.

The whistleblower’s non-punishability is excluded only if both of the following conditions are met:

• At the time of disclosure or dissemination, there were well-founded reasons to believe that the disclosure or dissemination of such information was necessary to reveal the violation and the report.
• The public disclosure or report to the judicial or accounting authority was made in the required manner.

7. Protection of personal data confidentiality

Paiardini Tino S.r.l. is the data controller for all personal data related to reports, concerning the whistleblower, the reported individual, and any other parties involved. Consequently, it has updated its Register of Processing Activities as per Article 30 of EU Regulation 2016/679.

Data is processed using appropriate measures aimed at protecting its confidentiality, integrity, and availability, based on a prior impact assessment under Article 35 of EU Regulation 2016/679. Data will be stored for the period necessary to carry out activities consequent to the report, and in any case for a maximum period of five years from the date of feedback on the report. Data not strictly necessary for managing the report will be deleted immediately after receipt.

The report managers have been authorized to process data and consequently instructed on the appropriate measures for the confidentiality of personal data processed in the exercise of their function.

These regulations are brought to the attention of all interested parties through posting on the company bulletin board and publication in a dedicated section of the website www.paiardini.it.

The regulations will be promptly updated in the event of relevant legislative changes, organizational changes within the Company that impact the application of these regulations, or the introduction of new tools, including technological ones, that modify the operational procedures described.

Urbania, 15/12/2023