WHISTLEBLOWING PROCEDURE

1. INTRODUCTION AND REFERENCES
The term “Whistleblowing” means the instrument through which a person belonging to the BARAUSSE S.R.L. organization, having become aware of illicit acts or facts during his/her work activity, decides to report said events of which he/she has witnessed, for through specific reporting channels created ad hoc by the Company.
This procedure implements Legislative Decree 10 March 2023, n. 24 entered into force on 30 March 2023 (the Decree) in implementation of EU Directive 2019/1937 commonly known as the Whistleblowing Directive (the Directive), which introduced the current regulations relating to the protection of persons who report violations of national or of the European Union which harm the public interest or the integrity of the public administration or private entity, of which they have become aware in a work context.
As a result of this legislation, the Report may come from anyone, as long as it concerns behavior (of any nature, even merely omission) attributable to the Staff of BARAUSSE S.r.l. and/or to Third Parties not compliant and/or in violation of laws and regulations, the system of rules and procedures in force in the Company.
The Legislative Decree 24/23 provides, in particular: i) the creation of one or more internal channels (possibly also of an IT type) for the submission of detailed reports, structured in such a way as to guarantee the confidentiality of the Reporter; ii) the prohibition of retaliatory or discriminatory acts, direct and indirect, against the Reporter for reasons directly or indirectly linked to the report; iii) disciplinary sanctions for those who violate the whistleblower’s protection measures and for those who intentionally or with gross negligence make reports that prove to be unfounded.

2. AIM
The purpose of this Procedure is to define the principles of conduct of the Company and the methods of management of the Reports referred to in the Legislative Decree. 24/2023.
In particular, this Procedure regulates the process of receiving, analyzing and managing Reports, sent or transmitted by anyone, even anonymously, in compliance with the security and protections linked to the confidentiality of the Reporter.
Management also includes the archiving and subsequent deletion of both the reports and all the documentation connected to them.
This Procedure also aims to disseminate within BARAUSSE S.r.l. the culture of legality and transparency.

3. FIELD OF APPLICATION
The Procedure applies to the Company Barausse S.r.l. which guarantees its correct and constant application, as well as maximum dissemination internally, in compliance with confidentiality obligations and the prerogatives of autonomy and independence.

4. DEFINITIONS
Work Context: Current or past work activities through which, regardless of the nature of those activities, a person acquires information about the reported violations, including:
(i) when the legal relationship between the Reporting Party and BARAUSSE S.r.l. has not yet started, if the information on the violations was acquired during the selection process or in other pre-contractual phases;
(ii) during the probationary period;
(iii) following the dissolution of the legal relationship if the information on the violations was acquired during the relationship itself and in which context they could risk suffering retaliation in the event of reporting.
Facilitator: a natural person who assists the reporting person in the reporting process in a Work Context.
Report File: means a summary document of the investigations conducted on the Report(s) which contains the summary of the investigation carried out on the facts covered by the Report, the outcome of the investigations carried out and any action plans identified.
GDPR: means Regulation (EU) 2016/679 relating to the protection of natural persons with regard to the processing of personal data, as well as the free movement of such data.
Reporting guide: means the document, published on the intranet and internet site of Barausse S.r.l., which provides a concise guide on the methods for making a Report as well as the list of channels for receiving the same.

Reporting: means:
(i) the staff of BARAUSSE S.r.l., or all those who have an employment relationship with the Company regardless of the type and classification, including but not limited to: worker members, employed workers (fixed-term or permanent, part-time or full time), managers, employees, collaborators, volunteers and interns, paid and unpaid;
(ii) self-employed workers, freelancers and consultants, regardless of the type of contract signed or assignment conferred;
(iii) shareholders and those who hold administration, management, control, supervisory or representation functions within the Company, even if exercised on a purely de facto basis.
The Reporter must be a witness to an offense or irregularity referable to the Company learned in the Work Context.
Reported: means the person to whom the Report refers.
Report: means any communication received from BARAUSSE S.r.l. concerning conduct carried out in violation of laws, regulations, provisions of the Authorities, internal regulations, in any case capable of causing damage or prejudice, even if only to the image, of BARAUSSE S.r.l..
In particular, reports concerning:
(i) offenses that fall within the scope of application of the European Union or national acts indicated in the annex to Legislative Decree 24/2023 or of the national acts that constitute the implementation of the European Union acts indicated in the annex to the (EU) directive 2019/1937, linked to the following sectors: public procurement, services, products and financial markets and prevention of money laundering and terrorist financing, product safety and compliance, transport safety, environmental protection, radiation protection and nuclear safety, safety of food and feed and animal health and welfare, public health, consumer protection, privacy and personal data protection and security of networks and information systems;
(ii) harm to the financial interests of the Union referred to in Article 325 TFEU;
(iii) infringement of the internal market referred to in Article 26(2) TFEU including infringements relating to competition and State aid, as well as infringements affecting the internal market linked to acts infringing corporate tax rules or mechanisms the purpose of which is to obtain a tax advantage which defeats the object or purpose of the applicable corporate tax legislation.
Therefore, those other than the cases described above are not treated as Reports for the purposes of this Procedure and, in particular:
a) purely personal ones concerning exclusively one’s individual working relationships or one’s relationships with hierarchically superior figures (e.g. reports regarding labor disputes and pre-litigation phases, discrimination between colleagues, interpersonal conflicts with the Reported Person, etc.);
b) the reports already regulated on a mandatory basis by the European Union or national acts indicated in part II of the annex to the Decree, or by the national ones that constitute the implementation of the European Union acts indicated in part II of the annex to the Directive;
c) reports of violations relating to national security, as well as procurement relating to aspects of defense or national security, unless such aspects fall under relevant secondary law of the European Union.
Any reports concerning the facts referred to in the previous letters a), b) and c) will be transmitted to the functions competent to receive and process them on the basis of the relevant regulations.
Anonymous report: Report in which the personal details of the Reporter are not made explicit, nor are they univocally identifiable.
Detailed report: Report in which the assertions (for example reference period, place, value, causes and purposes, elements that allow identification of the person who carried out the reported facts, anomalies relating to the internal control system, supporting documentation , etc.) are characterized by a sufficient degree of detail, at least abstractly, to bring out precise and concordant facts and situations, relating them to specific contexts, as well as to allow the identification of useful elements for the purposes of verifying the validity of the Report itself.
Illegal report: Report made with willful misconduct or gross negligence on the part of the Reporter, which from the outcome of the investigation phase proves to be devoid of factual confirmation and made in full awareness of the non-existence of a violation or non-compliance or of the non-involvement of the person reported therein, or with gross negligence in the evaluation of the factual elements.
Third parties: any other third party not attributable to the definition of Reporter and/or Reported Party.

5. REPORTING MANAGER
The Manager is the external body that the Company “BARAUSSE S.r.l.”, in compliance with the provisions of the Decree, has identified as responsible for the internal reporting channel of the Reports, as well as responsible for managing the process of receiving, analyzing and evaluating the Reports.

6. GENERAL PRINCIPLES

6.1. Independence and professionalism of the person identified to manage the reports
The Manager carries out its activities ensuring the maintenance of the necessary conditions of independence and due professional objectivity, competence and diligence.
6.2. Prevention of Conflict of Interest
If the manager of the reports has a conflict of interest (because Reported or Reporting) he/she abstains from taking on the management of the Report and communicates it to the Administrative Body of Barausse S.r.l.
In this case, the report is managed by the Board of Directors. of Barausse S.r.l., within and in any case the terms established by the Legislative Decree. 24/2023.

6.3. Guarantee of confidentiality and anonymity
The Manager and, in general, all the people of BARAUSSE S.r.l. who receive a Report and/or who are involved, in any capacity, in the investigation and treatment of the same, are required to guarantee maximum confidentiality on the subjects and facts reported, using, for this purpose, criteria and methods of communication suitable to protect the identity and integrity of the people mentioned in the Reports (so-called “principle of confidentiality of the whistleblower”), avoiding in any case the communication of the data acquired to parties unrelated to the process of investigating and processing the Reports.
In the management of reports, the confidentiality of the content and identity of the Reporter is guaranteed, with the exception of the following cases:
or if criminal liability for crimes of slander or defamation or in any case for crimes committed with the Report is ascertained, even with a first degree sentence, or civil liability, for the same reason, in cases of willful misconduct or gross negligence;
or in response to requests from the Judicial Authority or other entitled parties.
The information on the identity of the Reporter and any other information from which such identity can be deduced, directly or indirectly, cannot be revealed without the express consent of the Reporter himself, to persons other than those competent to receive or follow up on the Reports, expressly authorized to process such data pursuant to Privacy legislation.

6.4. Prohibition of retaliatory or discriminatory acts against the Reporter
To all the staff of BARAUSSE S.r.l. it is absolutely forbidden to adopt retaliatory or discriminatory acts, direct or indirect, against the Reporter for reasons connected, directly or indirectly, to the Report.
The protection granted to the Reporter also extends to: (i) Facilitators; (ii) Third parties connected to the Reporting persons and who may risk retaliation in a work context, such as colleagues or relatives of the reporting persons; and (iii) legal entities that the Reporting Persons own, work for or are otherwise connected to in a Work Context.
The retaliatory or discriminatory dismissal of the Reporting party is null and void. The change of duties pursuant to Article 2103 of the Civil Code, as well as any other retaliatory or discriminatory measure adopted against the Whistleblower as indicated in the art., are also null and void. 17 of the Decree and reported below:
a) dismissal, suspension or equivalent measures;
b) demotion or failure to promote;
c) the change of functions, the change of place of work, the reduction of salary, the modification of working hours;
d) the suspension of training or any restriction of access to it;
e) negative merit notes or negative references;
f) the adoption of disciplinary measures or other sanctions, including pecuniary ones;
g) coercion, intimidation, harassment or ostracism;
h) discrimination or otherwise unfavorable treatment;
i) the failure to convert a fixed-term employment contract into a permanent employment contract, where the worker had a legitimate expectation of such conversion;
j) failure to renew or early termination of a fixed-term employment contract;
k) damage, including to the person’s reputation, in particular on social media, or economic or financial prejudice, including loss of economic opportunities and loss of income;
l) improper listing on the basis of a formal or informal sectoral or industry agreement, which may result in the person being unable to find employment in the sector or industry in the future;
m) the early termination or cancellation of the contract for the supply of goods or services;
n) the cancellation of a license or permit;
o) the request to undergo psychiatric or medical tests.
The adoption of discriminatory measures against Whistleblowers can be reported to the ANAC pursuant to art. 19 of the Decree, which will inform the National Labor Inspectorate for the relevant measures.
If an employee believes that he or she has suffered one of the aforementioned behaviors due to the submission of a Report, he or she may communicate this to the Human Resources Office. It will be the responsibility of the aforementioned Office to proceed with the possible initiation of disciplinary proceedings against the author of the discriminatory or retaliatory behavior.
For the consequences connected to the possible adoption of retaliatory and/or discriminatory acts, direct or indirect, carried out against the Reporter for reasons connected to the Report, and for the regulation of the sanctions that can be adopted against those who violate the protection measures of the Reporter or of those who make – with intent or gross negligence – reports that prove to be unfounded, please refer to the disciplinary measures established in the C.C.N.L. of reference.
6.5. Protection from Reports made with intent or gross negligence
To protect the image and reputation of those unjustly reported, in the event of Illegal Reports made with intent or gross negligence, BARAUSSE S.r.l. will ensure the adoption of disciplinary sanctions also against the Whistleblower.
It will also inform the subjects/companies subject to the illicit Report of the content of the Illicit Report and the identity of the Reporter, to allow such subjects/companies to evaluate possible actions to protect themselves.
6.6. Sanctions for violations of the protection of the Whistleblower
In the event of violations of the Whistleblower’s protection measures, the sanctions will be applied as provided for in the relevant CCNL.
furthermore the ANAC, pursuant to art. 21 of the Decree may impose a pecuniary administrative sanction on the Company from 10,000 to 50,000 Euros in the event that a violation of the provisions contained in the Decree and implemented in this Procedure is ascertained.
ANAC, always pursuant to art. 21 of the Decree, may impose a pecuniary administrative sanction of between 500 and 2,500 Euros on the Reporter when it ascertains, even with a first instance sentence, the civil liability of the Reporter for defamation or slander in cases of willful misconduct or gross negligence, unless the same has already been convicted, even in first instance, for the crimes of defamation or slander or in any case for the same crimes committed with the complaint to the judicial authority.

7. PROCESS

7.1. Sending Reports
The Reporter who becomes aware of any behavior among those described in the previous paragraphs is required to make a Report according to the methods indicated below.
BARAUSSE S.r.l. has set up the following communication channel:
WRITTEN channel via web platform: BARAUSSE S.r.l. has equipped itself with its own IT portal, accessible from the “Whistleblowing” footer on its website, in the manner set out in the “Operational Guide”, which can be consulted on the site.
The Platform allows you to transmit, even anonymously, both your own Report and a Report received from a third party, after having read the “Privacy Policy”.
This Procedure is published on the aforementioned page dedicated to Whistleblowing and information is available on the prerequisites for making a Report via an internal channel as well as information on the channels, procedures and prerequisites for making external Reports and public disclosures.
Monitoring of the functionality of the communication channel is guaranteed by the Manager, who must be contacted in the event of any malfunctions.
BARAUSSE S.r.l. personnel, other than the Manager, who receive a Report are obliged to send it to the Manager within 7 days of its receipt via the above channel, transmitting the original, complete with any supporting documentation and, at the same time, providing notice of the transmission to the reporting person. The recipient cannot retain a copy and must refrain from undertaking any independent analysis and/or in-depth initiative.

7.2. Registration and Classification
All reports, regardless of the method of receipt, are recorded by the Manager, who establishes the summary database of the essential data of the reports and their management and also ensures the archiving of all the attached documentation, as well as that produced or acquired during the course. of analysis activities.
To this end, the Manager forms and instructs the Reports File.
The registration and acceptance of the Report must take place within 7 days of its receipt. The acceptance of the Report must be communicated, where possible, to the Reporting Party within the same deadline, unless the Reporting person explicitly requests otherwise, or in the case in which it believes that the notice would jeopardize the protection of the confidentiality of the Reporting person’s identity.
After registration, the Manager analyzes and classifies the Report, to limit the processing only to reports falling within the scope of the Procedure.
For each Report, the Manager assigns a unique identification code which allows each Reporter to request the processing status.
In the event that a Report is not adequately detailed, the Manager may consider requesting further detailed information from the Reporter, according to the following methods:
or in the event that the Reporter has provided a contact (e-mail, telephone, etc.), through such contact;
or in the event of failure to indicate a contact, through the methods deemed most appropriate by the Manager as long as they respect the principle of confidentiality.

7.3. Preliminary analysis of the Report
The Manager carries out a preliminary analysis of the Reports, also through any documentary analysis, in order to verify the presence of the necessary conditions for starting the subsequent investigation phase, proceeding with the archiving of generic reports without information elements.
For each Report, the Manager also evaluates the opportunity to involve the competent Company Office/Body based on the subject of the Report, in order to carry out the appropriate checks.
Reports that are archived by the Manager:
I. generic and/or which do not constitute a “Detailed Report”;
II. clearly unfounded;
III. containing facts already subject to specific investigation activities in the past and already closed, where no new information emerges from the preliminary checks carried out such as to make further verification activities necessary.
Reports archived as clearly unfounded because transmitted for the sole purpose of damaging the reputation or damaging or in any case causing prejudice to the person and/or company reported are forwarded to the Human Resources Office, so that it can evaluate the appropriate initiative towards the Reporter.

7.4. Investigation Phase
Objectives and characteristics of the investigation
The objective of the investigation activities on the Reports is to proceed, within the limits of the tools available to the Manager, with specific investigations, analyzes and assessments regarding the reasonable basis of the factual circumstances reported, as well as to provide any indications regarding possible corrective actions.
Execution of the investigation
The Manager carries out the investigation also by acquiring information from the other structures involved, and making use, if deemed appropriate, of experts or experts external to the Company. The disciplinary powers of the Human Resources Office remain unaffected.
The preliminary investigation activities are carried out using, by way of example,:
or company data/documents useful for the purposes of the investigation;
or external databases (e.g. info provider/databases on company information);
or open sources;
or documentary evidence acquired at the company’s facilities;
or where appropriate, statements made by interested parties or acquired during interviews, recorded and signed.
In order to acquire information, the Manager has the right to carry out in-depth investigations directly, for example, through formal summons and hearings of the Reporter, the person reported and/or other subjects mentioned in the Report as having been informed of the facts, as well as requesting the aforementioned subjects the production of information reports and/or documents.
At the conclusion of the investigation, the Manager decides to close the case and prepares a Report which reports:
or the activities carried out, the related outcomes, as well as the outcomes of any previous investigations carried out on the same facts or on facts similar to those covered by the Report;
or a judgment of reasonable validity or otherwise of the facts reported with any indications regarding the opportunity, by the competent Administrative Body, of adopting corrective actions on the areas affected by the Report.
The preliminary investigation activity must not last more than 3 (three) months from the date of taking charge, unless there are justified and motivated reasons, for which the deadline may be extended by a further 3 (three) months.

7.5. Communication of results
The Report prepared by the Manager is sent to the Board of Directors. of BARAUSSE S.r.l. to take on any relevant initiatives;
At the end of the preliminary investigation, the Manager must provide feedback to the Reporting person.

1.1. Information to the Reporter
The Reporter will be informed by the Manager that the Report has been taken into account and will receive feedback on the outcome of the activity carried out by the Manager within the terms established by the Decree.
If the Reporting party transmits the Report via the portal, he will receive the Report identification code and the encrypted link to a personal page where he can interact with the Manager via chat and through the possibility of sharing files and documents.
The possibility given to the Reporter to be able to communicate with the Manager and monitor the progress of the Report is guaranteed even if the Report is anonymous.

1.2. Record keeping
The information and any other personal data acquired are processed in compliance with Regulation 2016/679/EU (General Data Protection Regulation – hereinafter GDPR).
In order to guarantee the management and traceability of reports and consequent activities, the Manager takes care of the preparation and updating of all information regarding reports and ensures the archiving of all related supporting documentation.
The Reports and the related documentation are kept for the time necessary to process the Report and in any case no later than 5 (five) years from the date of communication of the final outcome of the reporting procedure, except for further needs arising from any proceedings (disciplinary, criminal, accounting) against the Reported Party or the Reporter (bad faith, false or defamatory statements) or by further regulatory obligations.

INFORMATION ON THE PROCESSING OF PERSONAL DATA OF REPORTING PERSONS WITHIN THE SCOPE OF THE “WHISTLEBLOWING” REPORT MANAGEMENT PROCEDURE PURSUANT TO LEGISLATIVE DECREE. 24/2023

With this information, BARAUSSE S.R.L. intends to provide the indications provided for by the art. 13 of EU Regulation 2016/679 (hereinafter the “Regulation”) regarding the processing of personal data carried out by the company itself as part of its whistleblowing reporting management procedure (hereinafter the “Whistleblowing Procedure”), adopted in accordance with the Legislative Decree 10 March 2023 n. 24 and, in particular, of all the activities and obligations connected to the functioning of the company system for the management of the same reports.

DATA CONTROLLER
The data controller is BARAUSSE S.R.L. with registered office in via Parmesana n.27, Monticello Conte Otto (VI), contactable at the e-mail address: info@barausse.com

TYPES OF DATA PROCESSED
The management of the report involves, unless it is carried out anonymously, the processing of common personal data of the reporter, including personal data, contact data and data relating to professional qualifications and any particular data referred to in the art. 9 of the Regulation and any information communicated by the same, included in the documentation attached by the same.
Personal data that is clearly not useful for the processing of a specific report are not collected or, if collected accidentally, are promptly deleted (art. 13 Legislative Decree 24/2023); therefore, reporting subjects are invited to refrain from communicating personal data of a “particular” and “judicial” nature unless deemed necessary and essential for the purposes of reporting in compliance with the art. 5 of the Regulation.

PURPOSE AND LEGAL BASIS OF THE PROCESSING
The purpose is the management, processing and analysis of whistleblowing reports received through dedicated internal channels (IT written channel) as well as the consequent feedback.
The processing is aimed at: i) managing the report made including the verification of the facts covered by the report, its resolution, the preparation of feedback, the adoption of any compensation or support measures for the reporting subjects and the possible establishment of proceedings, including disciplinary ones, and any other related obligations; ii) effectively prevent and combat fraudulent behavior and illicit or irregular conduct; iii) support the effective application and operation of the Organization, Management and Control Model pursuant to Legislative Decree. Legislative Decree 231/2001 and the Code of Ethics.
The legal basis of the processing is represented by: a) fulfilling legal obligations including those set by Legislative Decree 24/2023; b) the legitimate interest of the Data Controller in ascertaining and defending a right before a judicial or supervisory authority; c) in the cases contemplated by the same regulations, specific and free consent may be requested from the reporting party − pursuant to art. 6, par. 1, letter. a) of the Regulation – and, in particular, where there is a need to reveal the identity, or where the registration of reports collected in oral form is envisaged.

NATURE OF THE PROVISION OF PERSONAL DATA
The provision of personal data is optional, pending the possibility of forwarding anonymous reports to the Company, where they present precise, consistent and adequately detailed information, without prejudice to the provisions of the legislation, regarding this case, regarding protection measures to protect the reporting subject. If provided, the personal data will be processed to manage the report according to the limits and with the guarantees of confidentiality imposed by the relevant legislation.

PROCESSING METHODS AND CATEGORIES OF DATA RECIPIENTS
Data processing is carried out in accordance with the provisions of the law and the Whistleblowing Procedure adopted by the Company in compliance with the confidentiality of the identity of the reporting person, without prejudice to the provisions of art. 12 of Legislative Decree 24/2023, of the reported person or of third parties involved in various capacities in the report, also through the adoption of adequate security measures.
The reports and related data may be processed on paper and/or through IT tools (among other things, if necessary, via voice recording) by the Manager of the reporting channel identified in the Company’s Supervisory Body, in its capacity as Data controller pursuant to art. 28 of the Regulation.
Where certain information relating to the report becomes necessary due to needs related to investigative activities, it may be processed by company functions who have been provided with specific written instructions and who operate as authorized to process it.
The personal data collected may also be communicated, as long as it is necessary to pursue the purposes of the processing and on the basis of the same lawfulness assumptions indicated, to third parties such as public administrations and in particular police forces, competent authorities (e.g. ANAC, judicial authorities or accountants), as well as to the Supervisory Body.

DATA RETENTION PERIOD
The data will be stored according to the terms set out in the art. 14 of Legislative Decree 24/2023, i.e. for the time necessary to process the report and in any case no later than five years from the date of communication of the final outcome of the same, without prejudice to different legal obligations to which the Data Controller or specific indications coming from the National Anti-Corruption Authority – ANAC.
Personal data that is clearly not useful for processing a specific report are not collected or, if collected accidentally, are promptly deleted.

DATA TRANSFER TO THIRD COUNTRIES
The data will not be transferred to third countries and, where they are transferred, the conditions and guarantees provided for by the articles will be respected. 44 and following of the Regulation.
Under no circumstances will personal data be disclosed.

RIGHTS OF INTERESTED PARTIES
Each interested party has the right to exercise the rights referred to in articles 15 and following of the Regulation, in order to obtain from the Data Controller, for example, access to their personal data, the rectification or cancellation of the same or the limitation of the processing that concerns him, without prejudice to the possibility, in the absence of adequate feedback, to lodge a complaint with the Guarantor Authority for the protection of personal data. These rights can be exercised by contacting the Owner at the addresses indicated.
In this regard, we inform you that the aforementioned rights of those interested in the processing of personal data may be limited pursuant to and for the purposes of the art. 2-undecies of the Legislative Decree. 30 June 2003, n. 196 (“Privacy Code”, as amended by Legislative Decree no. 101/2018), for the time and within the limits in which this constitutes a necessary and proportionate measure, if their exercise could result in a concrete and effective prejudice to confidentiality of the identity of the reporting subjects.
In such cases, interested parties will still have the right to contact the Guarantor Authority so that the latter can assess whether the conditions for acting in the manner provided for in Article 160 of the Legislative Decree are met. n. 196/2003.

The Data Controller
BARAUSSE S.R.L.

Formulario de denuncia de irregularidades