PROCEDURE FOR HANDLING REPORTS OF UNLAWFUL CONDUCT IN ACCORDANCE WITH LEGISLATIVE DECREE NO. 24/2023 AND VIOLATIONS OF EUROCOLOR 2000’S ORGANIZATIONAL, MANAGEMENT AND CONTROL MODEL.
WHISTLEBLOWING
SUMMARY
Chapter I: Introduction and Scope of Application
Article 1: Introduction – Objectives 3
Article 2: Relevant Violations 4
Article 3: Protected Individuals 5
Chapter II: Reporting Procedures and Management of Reports
Article 4: Internal Reporting Channels 6
Article 5: Management of Reports 8
Article 6: External Reporting Channels 9
Article 7: Confidentiality of the Whistleblower and Other Individuals Involved in the Procedure 10
Article 8: Processing of Personal Data 11
Article 9: Retention of Documentation Related to Reports 11
Article 10: Public Disclosures
Chapter III: Protective Measures
Article 11: Conditions for the Protection of the Whistleblower 13
Article 12: Prohibition of Retaliation 14
PROCEDURE FOR THE MANAGEMENT OF REPORTS OF UNLAWFUL CONDUCT PURSUANT TO LEGISLATIVE DECREE NO. 24/2023 AND VIOLATION OF THE ORGANIZATIONAL, MANAGEMENT, AND CONTROL MODEL (WHISTLEBLOWING)
CHAPTER I.
INTRODUCTION AND SCOPE OF APPLICATION
Article 1: Introduction – Objectives
The purpose of this document is to regulate the management of reports made to the Reporting Manager pursuant to the whistleblowing regulations (Legislative Decree No. 24/23, “Implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law and laying down provisions concerning the protection of persons who report violations of national legislative provisions”) and to describe the protective measures for the individuals covered by this legislation.
Under the conditions provided in this Procedure, Eurocolor 2000 S.r.l. protects the Whistleblower and other individuals specified later, expressly prohibiting retaliatory, discriminatory, or otherwise unfair conduct against them for reasons directly or indirectly related to the report. The company also adopts specific disciplinary measures against those responsible for such conduct.
Reporting unlawful conduct to the Reporting Manager under Legislative Decree No. 24/23 is mandatory for the top management and employees of Eurocolor 2000 S.r.l. Failure to comply constitutes a disciplinary offense, punishable in accordance with the law, applicable collective agreements, and, where implemented, the company regulations.
Article 2: Relevant Violations
This Procedure governs the protection of individuals who report violations of regulatory and national or European Union provisions that harm the public interest or the integrity of Eurocolor 2000 S.r.l., which they have become aware of in the workplace context of the Entity.
The protections provided by this Procedure will not be granted in cases of reports concerning disputes, claims, or requests related to a personal interest of the Whistleblower or the person who has lodged a complaint with the judicial or accounting authority, which pertain solely to their individual employment relationships or their relationships with hierarchically superior figures. For such cases, recourse must be made to the procedures provided by law and the applicable collective agreements. The protections also do not apply to reports concerning violations known outside the workplace or based on rumors rather than facts directly observed by the Whistleblower.
Reports made with the intent to harm the Reported Party, made with willful misconduct or gross negligence, and found to be manifestly unfounded, are also not permitted and are subject to sanctions.
A report may concern behaviors, acts, or omissions that consist of:
a) administrative, accounting, civil, or criminal offenses;
b) unlawful conduct relevant under Legislative Decree No. 231/01;
c) other cases provided under Article 2, paragraph 1, letter a) of Legislative Decree No. 24/2023 concerning the following sectors: public procurement; financial services, products, and markets, and the prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; protection of privacy and personal data, and security of networks and information systems.
Article 3: Protected Individuals
The provisions of this Procedure apply to the following individuals who report or disclose information to the judicial or accounting authority, or publicly disclose information about violations they became aware of in the context of Eurocolor 2000 S.r.l.’s workplace:
a) Employees of Eurocolor 2000 S.r.l., including those whose employment relationship is governed by Legislative Decree of 15 June 2015, No. 81, or by Article 54-bis of the Decree-Law of 24 April 2017, No. 50, converted, with amendments, by Law of 21 June 2017, No. 96;
b) Self-employed workers, including those mentioned in Chapter I of Law of 22 May 2017, No. 81, as well as those holding a collaboration relationship referred to in Article 409 of the Code of Civil Procedure and Article 2 of Legislative Decree No. 81 of 2015, who perform their work activities at Eurocolor 2000 S.r.l.;
c) Workers or collaborators who perform their work activities at entities that provide goods or services or carry out works in favor of Eurocolor 2000 S.r.l.;
d) Freelancers and consultants who perform their activities at Eurocolor 2000 S.r.l.;
e) Volunteers and interns, both paid and unpaid, who perform their activities at
Eurocolor 2000 S.r.l.;
f) Individuals with administrative, management, control, supervision, or representative functions at Eurocolor 2000 S.r.l., even if such functions are exercised on a de facto basis, such as Members of the Delegates Committee, the Board of Directors, the Board of Statutory Auditors, and the Supervisory Body, the General Manager and the Deputy General Manager, as well as the Internal Audit, the Reporting Manager, and the Data Protection Officer, where present in the Entity;
The protection of the Whistleblowers mentioned in the previous paragraph also applies in cases where the report, disclosure to the judicial or accounting authority, or public disclosure of information occurs in the following situations:
a) When the legal relationship mentioned in the previous paragraph has not yet started if the information on the violations was acquired during the selection process or in other pre-contractual phases;
b) During the probation period;
c) After the termination of the legal relationship if the information on the violations was acquired during the course of the relationship itself.
The protective measures provided by this Procedure also apply to:
a) Facilitators, meaning individuals who assist a Whistleblower in the reporting process, operating within the same workplace and whose assistance must be kept confidential;
b) Individuals in the same workplace as the Whistleblower, the person who has lodged a complaint with the judicial or accounting authority, or the person who has made a public disclosure, who are closely related to them by a stable affectionate or kinship bond up to the fourth degree;
c) Colleagues of the Whistleblower or the person who has lodged a complaint with the judicial or accounting authority or made a public disclosure, who work in the same workplace and have a regular and ongoing relationship with the said person;
d) Entities owned by the Whistleblower or the person who has lodged a complaint with the judicial or accounting authority or who has made a public disclosure, or for whom such persons work, as well as entities operating in the same workplace as the aforementioned individuals.
Chapter II.
Reporting Procedures and Management of Reports
Article 4: Internal Reporting Channels
The management of reports referred to in the previous articles is entrusted to the Reporting Manager, who is appointed by the Entity’s Administrative Body and may use collaborators selected by the Entity who are specifically trained on the matter.
Reports submitted to an individual other than the Reporting Manager are transmitted to the latter within seven days of receipt in compliance with the confidentiality obligations outlined in this procedure, with simultaneous notice of the transmission given to the Whistleblower.
Reports are made in writing or orally through the following information channels:
a) My Whistleblowing platform;
b) A link published on the official website of Eurocolor 2000 S.r.l., in the Eurocolor 2000 S.r.l. section, which redirects to a specific online form;
c) A dedicated phone number published on the official website of Eurocolor 2000 S.r.l., in the Eurocolor 2000 S.r.l. Transparency section, which is answered exclusively by the Reporting Manager, available during certain hours also published in the aforementioned Eurocolor 2000 S.r.l. section.
The phone numbers are: +39 0586 219091 and +39 0586 896865;
d) Direct meeting with the Reporting Manager, by appointment to be arranged through the phone number referred to in the previous letter c).
Reports must contain specific information and be based on precise factual elements, not subject to different interpretations, and consistent, meaning converging in the same direction.
Reports cannot concern mere suspicions or information merely relayed by third parties or without unequivocal supporting facts or documents.
In any case, it is not necessary for the Whistleblower to be certain of the actual occurrence of the reported facts or the identity of the perpetrator. It is sufficient that, based on their knowledge and in good faith or on a reasonable belief founded on specific and circumstantial factual elements, they consider it highly likely.
For a report to be considered valid, it must contain the following essential elements:
Ø A precise description of the subject of the report, including the time and place where the acts were committed/omitted;
Ø Elements that allow, where possible, a clear identification of the Reported Party believed to be the presumed perpetrator of the unlawful conduct and/or the violation of the Model
The Whistleblower also provides their personal details and may indicate the following additional elements:
§ Any other individuals who can provide information on the reported facts and to whom the protections provided by this procedure should consequently be granted in case of retaliation;
§ Any documents that may confirm the validity of such facts;
§ Any other information that may facilitate the collection of evidence on what has been reported.
The report may include any documentation that helps further detail the reported facts.
As part of managing the internal reporting channel, the Reporting Manager performs the following activities:
a) Issues a notice of receipt of the report to the Whistleblower within seven days of receiving it;
b) Maintains communication with the Whistleblower and may request further information if necessary;
c) Diligently follows up on the received reports;
d) Provides feedback on the report within three months from the date of the acknowledgment of receipt or, in the absence of such notice, within three months from the expiration of the seven-day period from the submission of the report.
Anonymous reports are taken up only if they are adequately substantiated and based on precise and concordant factual elements, such that no investigative additions are necessary.
Article 5: External Reporting Channels
The Report Manager, upon receipt of a REPORT, regardless of the channel used, promptly completes the REPORT REGISTER, which includes:
a. The sequential identification number allowing unique identification; b. The date of receipt;
c. The channel used for receipt;
d. The CLASSIFICATION OF THE REPORT, based on the preliminary assessment of its content (Relevant, Inadequate, Not Relevant);
e. The findings and conclusions.
Reports are initially classified by the Report Manager into the following categories:
Ø Relevant: A REPORT that is sufficiently detailed and pertinent to warrant
the initiation of investigative measures.
Ø Inadequate: A REPORT with insufficient content to initiate investigative measures. The Report Manager must request additional information from the Whistleblower in order to initiate an investigation into the reported facts, reclassifying the Report as Relevant if the documentation is supplemented. The failure of the Whistleblower to provide the requested information does not result in the automatic dismissal of the report, as the Report Manager is required to assess any reasons for refusal, if stated, as well as to verify the possibility of obtaining the necessary information through other channels;
Ø Not Relevant: A REPORT that does not fall within the scope of the whistleblowing regulations because it refers to individuals not associated with Eurocolor 2000 S.r.l., or to facts, actions, or behaviors not concerning unlawful conduct as per the previous Article 2. In such cases, if the Report Manager deems the REPORT to be well-founded and detailed, it may be forwarded to the functions of the Entity deemed competent for appropriate verification.
In the case of REPORTS concerning members of the Administrative Body, the Report Manager immediately notifies the Auditor.
For REPORTS classified as RELEVANT, the Report Manager conducts the necessary internal investigations to verify the validity of the reported facts. If deemed necessary, the Report Manager may engage external consultants, who are bound by confidentiality regarding the facts they become aware of during their consultancy activities and the identities of the individuals involved. If the report is substantiated, the Report Manager must promptly and formally notify the reported violations to the Person Reported, who may, within thirty days of receiving the notice, request a hearing or submit written observations and documents.
At the conclusion of the investigation, the Report Manager prepares a specific report for the Administrative Body, outlining the context, the relevant regulatory and procedural framework, the verification activities carried out, the resulting findings, the documents and/or other evidence proving the unlawful conduct or violation committed, and any proposed sanctions.
In the case of PROHIBITED REPORTS, made with intent or gross negligence, that are found to be manifestly unfounded, the Report Manager informs the Administrative Body of Eurocolor 2000 S.r.l. and the General Manager to initiate disciplinary proceedings against the Whistleblower. In such cases, the Report Manager informs the Person Reported to allow them to exercise their rights of defense.
In all cases where sanctioning procedures are initiated, the provisions contained in the Disciplinary Code adopted by Eurocolor 2000 S.r.l. are applied.
ART. 6. EXTERNAL REPORTING CHANNELS
The whistleblower may make an external report through a specific channel activated by the ANAC if, at the time of submission, one of the following conditions is met:
a) The whistleblower has already made an internal report pursuant to Article 4 and no action has been taken;
b) The whistleblower has reasonable grounds to believe that, if they made an internal report, it would not be effectively addressed, or that making such a report might pose a risk of retaliation;
c) The whistleblower has reasonable grounds to believe that the violation may pose an imminent or clear danger to the public interest.
ART. 7. CONFIDENTIALITY OF THE WHISTLEBLOWER AND OTHER INDIVIDUALS INVOLVED IN THE PROCEDURE
Internal reporting channels, as well as all personnel of Eurocolor 2000 S.r.l., particularly those involved in the management and investigation of reported facts, guarantee the confidentiality of the REPORT, as well as the identity of the Whistleblower, the REPORTED PERSON, and individuals mentioned in the report as facilitators or persons informed about the facts, until the conclusion of the procedures initiated due to the report, in compliance with the same guarantees provided for the whistleblower. For this purpose, all personnel of Eurocolor 2000 S.r.l. are specifically trained on the confidentiality obligations required by whistleblowing regulations.
Reports may not be used beyond what is necessary to adequately address them.
The identity of the whistleblower and any other information from which this identity can be directly or indirectly inferred cannot be disclosed without the express consent of the whistleblower to persons other than those authorized to receive or address the reports, explicitly authorized to process such data under Articles 29 and 32, paragraph 4, of Regulation (EU) 2016/679, and Article 2-quaterdecies of the Code on the protection of personal data.
Within the disciplinary procedure, the identity of the whistleblower cannot be disclosed if the disciplinary charge is based on findings distinct and separate from the report, even if resulting from it. If the charge is based, in whole or in part, on the report and knowing the identity of the whistleblower is indispensable for the defense of the accused, the report will only be used for disciplinary proceedings if the whistleblower has given express consent for the disclosure of their identity.
Confidentiality of the Whistleblower may also not be maintained in cases where:
§ The Whistleblower gives express consent to disclose their identity;
§ The Whistleblower’s criminal liability for defamation or false accusation, or any crime committed with the REPORT, is confirmed by a first-instance judgment, or their civil liability for the same reason in cases of intent or gross negligence;
§ Anonymity is not enforceable by law and the Whistleblower’s identity is requested by the Judicial Authority.
The report is exempt from the access provided for by Articles 22 and following of the law of August 7, 1990, no. 241, as well as by Articles 5 and following of Legislative Decree March 14, 2013, no. 33.
ART. 8. PROCESSING OF PERSONAL DATA
Any processing of personal data, including communication between the competent authorities, as provided for in this Procedure, must be carried out in accordance with Regulation (EU) 2016/679, Legislative Decree June 30, 2003, no. 196, and Legislative Decree May 18, 2018, no. 51.
Personal data collected regarding the handling of the report are kept until the conclusion of the activity and then deleted. Personal data that are clearly not useful for examining the report are not collected, or, if accidentally collected, are immediately deleted. For this purpose, the whistleblower is required to communicate only the data they consider relevant to the report, taking into account also the possibility for the Report Manager to interact to request further information.
Eurocolor 2000 S.r.l. defines its model for receiving and managing internal reports, identifying technical and organizational measures suitable for ensuring a level of security appropriate to the specific risks arising from the processing carried out, based on an impact assessment on data protection, and regulating the relationship with any external providers processing personal data on their behalf pursuant to Article 28 of Regulation (EU) 2016/679 or Article 18 of Legislative Decree no. 51 of 2018.
ART. 9. RETENTION OF DOCUMENTATION RELATED TO REPORTS
Internal and external reports and related documentation are retained for the time necessary to process the report and, in any case, no longer than five years from the date of the final communication of the outcome of the reporting procedure, in compliance with the confidentiality obligations set out in the previous Articles 7 and 8.
Reports submitted using the telephone line, with the consent of the whistleblower, are recorded and stored on electronic media suitable for ensuring confidentiality.
Telephone reports for which consent to recording has not been given are documented in writing by a detailed account of the conversation by the assigned staff. The whistleblower may verify, correct, and confirm the content of the transcription.
When the report is made orally during a meeting with the assigned staff, it is, with the whistleblower’s consent, documented by recording on a device suitable for preservation and listening, or by a report. In the case of a report, the whistleblower may verify, correct, and confirm the meeting’s minutes.
Subject to the provisions of the previous article, documentation is retained by implementing appropriate technical and organizational measures to prevent their loss, destruction, or accidental damage, in compliance with the principles of integrity and confidentiality as per Article 5 of Regulation (EU) 2016/679.
ART. 10. PUBLIC DISCLOSURES
For the purposes of this Procedure, public disclosure means making information on violations publicly available through the press or electronic means or otherwise through means capable of reaching a large number of people.
The whistleblower who makes a public disclosure benefits from the protection provided for in this Procedure if, at the time of the public disclosure, one of the following conditions is met:
a) The whistleblower has previously made an internal and external report or has made an external report directly, under the conditions and procedures provided for in this Procedure, and no response has been given within the established time regarding the measures planned or taken to address the reports;
b) The whistleblower has reasonable grounds to believe that the violation may pose an imminent or clear danger to the public interest;
c) The whistleblower has reasonable grounds to believe that the external report may entail the risk of retaliation or may not be effectively addressed due to the specific circumstances of the case, such as where evidence may be concealed or destroyed, or where there is a well-founded fear that the recipient of the report may be colluding with the violator or involved in the violation.
CHAPTER III.
PROTECTIVE MEASURES
Art. 11. CONDITIONS FOR THE PROTECTION OF THE WHISTLEBLOWER
The protective measures provided in this Chapter apply to the individuals referred to in the previous Article 3 when the following conditions are met:
a) At the time of making the report or complaint to the judicial or accounting authorities or of public disclosure, the whistleblower had reasonable grounds to believe that the information about the reported violations, publicly disclosed or reported, was true and fell within the scope of the previous Article 2;
b) The report or public disclosure was made in accordance with the provisions of the previous Chapter II.
The reasons that led the person to report or disclose publicly are irrelevant to their protection.
Subject to the limitations of liability provided by current legislation, when the criminal responsibility of the whistleblower for offenses such as defamation or slander or for similar offenses committed with the report to the judicial or accounting authorities is confirmed, even by a first-instance judgment, or their civil liability for the same reasons in cases of intent or gross negligence, the protections provided in this Chapter are not guaranteed, and the whistleblower is subject to a disciplinary sanction.
The provisions of this Article also apply in cases of anonymous reports or complaints to the judicial or accounting authorities or public disclosures, if the whistleblower has been subsequently identified and has faced retaliation, as well as in cases of reports submitted to institutions, bodies, and competent agencies of the European Union, in accordance with the conditions set out in the previous Article 6.
Art. 12. PROHIBITION OF RETALIATION
Individuals referred to in the previous Article 3 may not suffer any retaliation from Eurocolor 2000 S.r.l., which is to be understood as any behavior, act, or omission, even if attempted or threatened, carried out because of the report, complaint to the judicial or accounting authorities, or public disclosure, that causes or may cause unjust harm to the whistleblower or the person who made the complaint, either directly or indirectly.
The following are examples of actions that, if they fall under the previous paragraph, constitute retaliation:
a) Dismissal, suspension, or equivalent measures;
b) Demotion or failure to promote;
c) Change in duties, change of work location, reduction in salary, or alteration of work hours;
d) Suspension of training or any restriction on access to training;
e) Negative performance reviews or negative references;
f) Disciplinary measures or other sanctions, including financial penalties;
g) Coercion, intimidation, harassment, or ostracism;
h) Discrimination or otherwise unfavorable treatment;
i) Failure to convert a fixed-term contract to a permanent contract, where the employee had a legitimate expectation of such conversion; l) Failure to renew or early termination of a fixed-term contract;
m) Damage, including to the individual’s reputation, particularly on social media, or economic or financial prejudice, including loss of economic opportunities and income;
n) Inclusion in improper lists based on a formal or informal sectoral or industrial agreement, which may hinder the individual’s ability to find future employment in the sector or industry;
o) Early termination or cancellation of a supply contract for goods or services;
p) Revocation of a license or permit;
q) Request for psychiatric or medical examinations.
Actions taken in violation of this Article are null and void. Individuals referred to in the previous Article 3 who have been dismissed due to the report, public disclosure, or complaint to the judicial or accounting authorities have the right to be reinstated in their position, according to current legislation, in accordance with the specific regulations applicable to employees.
Individuals referred to in the previous Article 3 may report any retaliation they believe they have suffered to ANAC (National Anti-Corruption Authority), which will take the measures within its competence according to current legislation.
