WHISTLEBLOWING REGULATION

LEGISLATIVE DECREE No. 24 of 10 March 2023
Implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law and laying down provisions regarding the protection of persons who report breaches of national laws.

INTRODUCTION

In Italy, in compliance with international agreements and the recommendations of the Parliamentary Assembly of the Council of Europe, the adoption of a structure for the management of whistleblowing is envisaged to ensure the appropriate protection of whistleblowers in the workplace.

In particular, Law No. 190 of 6 November 2012, Article 1, Paragraph 51, introduced Article 54-bis into Legislative Decree 165/2001, which provides for a measure to facilitate the detection of unlawful conduct, known in English-speaking countries as whistleblowing.

The Regulation for the management of whistleblowing and for the implementation of the sanctioning power concerning the protection of whistleblowers who report wrongdoing or irregularities of which they become aware during an employment relationship pursuant to Article 54-bis of Legislative Decree 165/2001, was defined by ANAC with further operational provisions.

The European Union then promulgated European Directive 2019/1937 on the protection of whistleblowers against breaches of Union law, to establish a minimum level of protection of whistleblowers’ rights in all member states.

Italy implemented the European Directive with Legislative Decree no. 24 of 10 March 2023.

By approving these Regulations, NUOVA LOFRA SRL – in accordance with Article 2, para. 1, letter q) of Legislative Decree 24/2023 – has sought to align itself with the aforementioned legislative provisions, as well as with the directives provided by ANAC.

ARTICLE 1 OBJECT
These Regulations concern the protection of persons who, within their working environment, report violations of national or European Union regulations that damage the public interest or the integrity of Nuova Lofra s.r.l.

The purpose of these regulations is

– outline the guiding principles of the institute, highlighting the rules that Nuova Lofra s.r.l. must comply with;
– define the procedures for handling reports;
– clearly illustrate the methods adopted to protect the confidentiality of the identity of the reporter, the content of the report and the identity of possible persons involved.

The purpose of these regulations is both to inform Nuova Lofra srl’s staff on current regulations and provisions, providing clear operating instructions, and to facilitate reporting by those who become aware of an offence or irregularity in the workplace, during the performance of their duties, and decide to report it, eliminating those factors that may discourage or hinder it.

The whistleblowing management process ensures the confidentiality of the whistleblower’s identity from the moment of receipt and in any subsequent contact. Having specified that Nuova Lofra Srl will also manage anonymous whistleblowing in order to eliminate any wrongdoing and/or irregularities (ART. 6), it should be noted that only whistleblowers who report unlawful conduct by declaring their identity may benefit from the protection provided for by Legislative Decree No. 24 of 10 March 2023 Implementing Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law and on the provisions concerning the protection of persons who report breaches of national laws.

It should be made clear at the outset that the rules laid down in the Regulation do not apply, as they are outside the scope of the aforementioned legislation, to:

a. Disputes, claims or demands linked to a personal interest of the complainant or of the person lodging a complaint with the judicial or accounting authorities that relate exclusively to their individual employment relationships, or relating to their employment relationships with their superiors;

b. Complaints of violations already mandatorily regulated by the European Union or national acts indicated in Part II of the Annex to Legislative Decree No. 24 of 23 March 2023 or by national acts constituting the implementation of the European Union acts indicated in Part II of the Annex to Directive (EU) 2019/1937, even if not mentioned in Part II of the aforementioned Annex;

c. Allegations of violations relating to national security.

The provisions concerning the right of workers to consult their representatives or trade unions, protection against unlawful conduct or acts committed as a result of such consultations, the autonomy of the social partners and their right to enter into collective agreements, as well as the repression of anti-union conduct according to Article 28 of Law No. 300 of 20 May 1970 remain valid.

ARTICLE 2 DEFINITIONS
For a correct understanding of the Regulation and an easier implementation of it, the following definitions are clarified:

a. “Violations”: this term refers to conduct, whether active (actions) or passive (omissions), that damages the public interest or the integrity of Nuova Lofra srl. These “breaches” also include various relevant unlawful conduct, breaches of specific European Union or national regulations, actions or omissions detrimental to the Union’s financial interests, breaches concerning the internal market and conduct that contradicts the purpose or objective of Union provisions in the specified areas;

b. “Infringement information”: information, concerning facts and circumstances, including reasonable suspicions, relating to infringements committed or likely to be committed within Nuova Lofra srl, as well as elements concerning conduct aimed at concealing such infringements

c. “Reporting” or “flagging”: the actual communication of information about violations that have occurred, whether written or oral;

d. “Internal reporting”: communication of information about violations through the internal reporting channel specified in Article 4;

e. “External reporting”: communication of information about violations through the external reporting channel specified in Article 13;

f. “Public disclosure” or “public dissemination”: dissemination of information about violations to the public through print, electronic, or other means capable of reaching a large number of people;

g. “Reporting person” (or “whistleblower”): the person who makes a report or public disclosure of information about violations obtained in the work context;

h. “Facilitator”: one who supports the reporting person during the reporting process, operating in the same work context and whose help must remain confidential;

i. “Work context”: current or past work or professional activities where an individual acquires information about violations and which could lead to retaliation if reported or publicly disclosed;

j. “Person Involved”: an individual or entity mentioned in the internal or external reporting or public disclosure as a person associated with the violation or as a person in some way implicated in the reported or publicly disclosed violation;

k. “Retaliation” or “Retaliation”: any conduct, act or omission, even if only attempted or threatened, that results from the report, report to the judicial or accounting authority, or public disclosure and that causes or could cause unfair harm to the reporting person or the person who made the report;

l. “Follow-up”: the action taken by the person in charge of the reporting channel to assess the accuracy of the reported facts, the results of the investigation and any measures taken;

m. “Acknowledgement”: communication to the reporting person with information regarding the actions being taken or intended to be taken as a result of the report.

ARTICLE 3 PROTECTED SUBJECTS
In the context of disclosures, notifications to judicial or accounting authorities, and public disclosures of violations identified in the normal course of work, the provisions of these Regulations apply in particular to:

(a) Employees of NUOVA LOFRA SRL;
b) Collaborators in compliance with Article 2 of Legislative Decree No. 81 of 2015 who perform their duties at the company;
c) Workers or collaborators engaged in entities that provide goods, services or carry out works on behalf of the company;
d) Independent professionals and consultants working within the company;
e) Volunteers and interns, paid or unpaid, who carry out their activities at Nuova Lofra srl;
f) Shareholders and individuals with management, supervisory, control, or representative responsibilities, even if such functions are exercised de facto.

Protection for whistleblowers is also provided:

(a) when the previously mentioned contractual relationship has not yet begun, if information about the violation was obtained during the selection process or other pre-contractual stages;
(b) during the probationary period;
(c) after the termination of the contractual relationship if the information about the breach was obtained during its performance.

Except as provided in Article 17(2) and (3) of Legislative Decree 24/2023, the protective measures outlined in Chapter III also apply to:

(a) facilitators;
(b) persons in the same work environment as the whistleblower, the person who has notified an irregularity to the judicial or accounting authority, or publicly disclosed, and who are related to them by a strong emotional or kinship relationship within the fourth degree;
(c) colleagues of the whistleblower or the person who notified the judicial or accounting authority, or made a public disclosure, and who work in the same environment and with whom they maintain a regular relationship;
(d) entities owned by the reporter or the person who notified the judicial or accounting authority, or made a public disclosure, or for whom these persons work, as well as entities working in the same work environment as the persons already mentioned.

ARTICLE 4 INTERNAL REPORTING
In compliance with current regulations NUOVA LOFRA srl has created a reporting system that ensures the protection of the identity of the reporter, the individual involved and anyone else mentioned in the report, as well as the content of the report itself and the attached documentation.

In line with Article 4, of Legislative Decree 24/2023, the management of the reporting system has been entrusted by Lofra Ltd. to an internal person specifically trained to manage the reporting channel and an external collaborator who supervises the activity for greater protection of the reporter. Only the Reporting Officers assigned by Nuova Lofra srl will be aware of the report.

For this purpose, reports can be submitted via specific form available on the company website, through an encrypted channel, with Trusty AG system a provider of secure and anonymous web-based internal reporting systems at https://www.lofra.it/whistleblowing/

The reporting information is separated from the reporting party’s identifying information and automatically forwarded to the appointee to promptly initiate the investigation. The appointee receives a notification of the submission, along with the report identification code (without further details).

The reporter’s identification data are stored in encrypted form and are accessible only to the appointee.

The appointee can access his or her restricted space and the details of the various reports received.

Alternatively,

– By regular mail (in a sealed envelope marked “DO NOT OPEN – Personal Confidential”) to the address: Nuova Lofra srl via Montegrotto 125, 35038 Torreglia (PD);
– By internal mail (in a sealed envelope marked “DO NOT OPEN – Personal Confidential”);
– Regular email to the following address: privacy@lofra.it;
– Pec to the following address: nuovalofra@legalmail.it;
If the report is sent using one of the above methods, the identity of the reporter will be known only to the Reporting Officers who will ensure its confidentiality.

It should be noted that a report for proper handling should include:
– the identity of the reporter;
– a clear and detailed description of the events reported;
– the circumstances of time and place in which the events occurred;
– general information or other data identifying the person(s) involved;
– indication of possible other individuals who can provide information about the reported events;
– reference to any documents that may support the validity of the reported events;
– any other information that may be useful in verifying the accuracy of the reported events.

The whistleblower should provide all necessary data to enable verification and investigation to confirm the validity of the reported events.

Reports can be submitted in writing, including digitally, or even orally. Oral reports can be made through telephone lines, voice messaging systems, or, at the request of the reporter, through a face-to-face meeting scheduled within a reasonable time frame.

If a recorded telephone line or other recorded voice messaging system is used, the report, with the consent of the reporter, is documented by designated personnel by recording or complete transcript. In the case of a transcript, the reporter may verify, correct or confirm the contents of the transcript by signing it.

If an unrecorded telephone line or other unrecorded voice messaging system is used, the report is documented by a detailed account of the conversation written by designated personnel. The reporter may verify, correct and confirm the contents of the transcript by signing it.

If, at the request of the whistleblower, the report is made orally during a meeting with designated personnel, and with the consent of the whistleblower, it is documented by recording or minutes prepared by the designated personnel. In the case of minutes, the reporter may verify, correct and confirm the contents by signing them.

ARTICLE 5 INTERNAL MANAGEMENT
The Reporting Officers begin handling the report with a preliminary investigation. If necessary, they request additional information from the reporter and/or other individuals involved, concluding the investigation in accordance with legal regulations.

All reports received, investigation records and related documentation are stored and catalogued in an appropriate, separate, well-maintained and locked file.

As part of the management of the internal reporting channel, appointees:
a. provide the reporter with notification of receipt of the report within seven days of the date of receipt;
b. maintain dialogue with the reporter and may request additional information if necessary;
c. diligently follow up on reports received;
d. provide feedback on the report within three months from the date of notification of receipt or, in the absence of such notification, within three months after the seven-day period from the submission of the report.

In case the report is clearly unfounded or inadmissible by falling outside the regulated discipline, the appointees based on an analysis of the reported events, may decide to dismiss the request. In such a scenario, it will inform the reporter.

The handling and verification of the merits of the circumstances represented in the report are entrusted to the appointees, who do so in accordance with the principles of impartiality and confidentiality, carrying out any activity deemed appropriate, including the personal hearing of the reporter and any other persons who may report on the reported facts, with the adoption of the necessary precautions.

The activity of the appointees is not of actual fact-finding, but takes the form of making an initial impartial assessment of the existence of what was reported.
In carrying out the investigative activity, the appointees may request additional information from the Whistleblower, may acquire acts and documents from other offices of the administration, may use the support of other offices, always taking care that the protection of the confidentiality of the Whistleblower and the Reported is not compromised.

For the definition of the investigation, the time limit is 30 days, which run from the date of its initiation, it being understood that, where necessary, Nuova Lofra srl unipersonale in the person of the sole director may authorize those in charge to extend the aforementioned time limits by providing adequate reasons.
If the Report proves to be unfounded, the appointees shall proceed with the filing, adequately justifying their choice to the Reporting Party.
If the Report proves to be well-founded, the appointees shall transmit a report of investigative findings to the internal supervisory bodies or external authorities in relation to the profiles of unlawfulness found, making sure that such documentation does not contain references to the identity of the Reporting Person and the Reported Person, nor other implicit references that could lead, without a shadow of doubt, to the Reporting Person.
It remains implicit that the same obligation of confidentiality that exists for the Reporting Officers applies to the internal supervisors who are reserved the task of verifying the effectiveness of the Reporting.
For the internal in charge bodies, the deadline for the definition of this phase is 90 days, which run from the date of receipt of the documentation by the person in charge without prejudice to the fact that, where necessary, the legal representative and sole director may authorize the in charge body to extend the aforementioned deadlines by providing adequate reasons.

The regulation is brought to the attention of employees in the most appropriate manners and to ensure adequate visibility in the workplace and accessibility to those who, while not frequenting such places, have a legal relationship with Nuova Lofra srl the regulation is also published in the “Whisteblowing” section of the company’s website.

ARTICLE 6 ANONYMOUS REPORTS.
Guaranteeing anonymity is not the same as accepting anonymous reports, since the protection of the reporter applies to reports from identifiable and recognisable persons.

Notwithstanding the above, Nuova Lofra srl reserves the right to assess anonymous reports, if they are adequately detailed and specific, i.e. if they contain facts of extreme seriousness and contain sufficiently detailed, specific information linked to well-defined contexts (e.g. mention of particular names or titles, reference to specific offices, procedures or events, etc.).

ARTICLE 7 OBLIGATION OF CONFIDENTIALITY
Reports must not be used beyond what is strictly necessary for adequate follow-up. The identity of the whistleblower, as well as any other information that may reveal it, whether directly or indirectly, may not be disclosed without the whistleblower’s explicit consent, except to persons authorised to receive or handle reports.

In the context of disciplinary proceedings, the identity of the whistleblower may not be disclosed if the allegation is based on verifications that are separate and additional to the whistleblowing, even if arising from the whistleblowing. If the allegation is based, in whole or in part, on the report and knowledge of the identity of the reporter is essential for the defence of the accused, the report may only be used in disciplinary proceedings with the explicit consent of the reporter to the disclosure of his or her identity. The whistleblower will be notified in writing of the reasons for the disclosure of confidential data, if it is indispensable to reveal the identity of the whistleblower and related information also for the defence of the person concerned.

In accordance with Article 12 of Legislative Decree 24/2023, in proceedings initiated as a result of a whistleblowing, the individual concerned may be heard, or, at his or her request, shall be heard, including through a documentary procedure, by collecting written comments and documents.

ARTICLE 8 PERSONAL DATA MANAGEMENT
Any processing of personal data must be conducted in accordance with Regulation (EU) 2016/679, Legislative Decree of 30 June 2003, No 196 and Legislative Decree of 18 May 2018, No 51.
Personal data that is not clearly useful for the processing of a specific report shall not be collected or, if collected in error, shall be deleted immediately.
The rights outlined in Articles 15 to 22 of Regulation (EU) 2016/679 may be exercised within the limits of the provisions of Article 2-undecies of Legislative Decree of 30 June 2003, no.196.
Nuova Lofra srl handles the processing of personal data relating to the receipt and management of reports, in accordance with the principles outlined in Articles 5 and 25 of Regulation (EU) 2016/679 or Articles 3 and 16 of Legislative Decree No. 51 of 2018, providing adequate information to the reporting parties and the data subjects, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 or Article 11 of the aforementioned Legislative Decree No. 51 of 2018, and taking appropriate measures to protect the rights and freedoms of the data subjects.

ARTICLE 9 ARCHIVING OF DOCUMENTS RELATING TO REPORTS
Reports and related documents shall be retained for the period necessary for the processing of the report and, in any event, no longer than five years from the date of the communication of the final result of the reporting procedure, in compliance with the confidentiality obligations of Article 7 of this Regulation and the principle of Article 5(1)(e) of the GDPR and Article 3(1)(e) of Legislative Decree No. 51 of 2018.

ARTICLE 10 SAFEGUARDS FOR WHISTLEBLOWERS
The safeguards outlined in Chapter III of Legislative Decree No. 24/2023 are applied to individuals specified in Article 3 when the following circumstances are present:

a. At the time of the report, whistleblowing or public disclosure, the person making the report or disclosure had good reason to believe that the information about the violations reported or made public was true and fell within the scope of Article 1 of this Regulation;
b. The reporting or public disclosure was made in accordance with the provisions of Articles 7 and 11 of this Regulation and, in general, Chapter II of Legislative Decree No. 24/2023.

The reasons that led the individual to report, denounce or publicly disclose do not affect his or her protection.
However, the whistleblower may be criminally and disciplinarily liable in the case of defamatory or slanderous reports, as set out in Articles 368 and 595 of the Criminal Code and Article 2043 of the Civil Code.
Unless otherwise provided for in Article 14, if the criminal liability of the whistleblower for defamation or slander, or for the same type of offence committed by reporting to the judicial or accounting authorities, or his civil liability, in cases of wilful misconduct or gross negligence, is established, even by a first instance judgement, the protections established in Chapter III of Legislative Decree No. 24/2013 are not guaranteed and the whistleblower or reporter is also subject to disciplinary sanctions.

ARTICLE 11 PROHIBITION OF REPRISALS
The organisations and individuals listed in Article 3 shall not be subject to reprisals. In the event of judicial, administrative or extrajudicial litigation concerning the verification of conduct, acts or omissions prohibited by this Article against the persons listed in Article 3, it shall be presumed that they were carried out as a result of the reporting, public disclosure or complaint. Any person engaging in such conduct or acts shall be obliged to prove that they are motivated by reasons unrelated to the reporting, public disclosure or complaint.

ARTICLE 12 LIMITATIONS OF LIABILITY
The entity or person indicated in Section 3 shall not be punishable if it discloses or disseminates information on infringements covered by the duty of confidentiality or relating to the protection of copyright or the protection of personal data, or if it discloses or disseminates information on infringements that damage the reputation of the person involved or reported.
This applies when, at the time of the disclosure or dissemination, there were reasonable grounds to believe that the disclosure or dissemination of the same information was necessary to disclose the breach and that the report, public disclosure or denunciation to the judicial or accounting authority was made in accordance with Art. 12.

In such circumstances, any further liability, including civil or administrative liability, is excluded.
Unless a criminal offence is involved, the body or person referred to in Art. 3 does not incur any liability, including civil or administrative liability, for acquiring or accessing information on violations.
Exemption from criminal liability or any other liability, including civil or administrative liability, does not apply for actions, conduct or omissions that are not directly related to reporting, reporting to judicial or accounting authorities or public disclosure, or that are not strictly necessary to expose the breach.

ARTICLE 13 EXTERNAL REPORTING
An external report may be submitted if, at the time of its submission, one of the following conditions is met

a. The internal reporting channel, as referred to in Article 5 above, is not active;
b. The reporter has already submitted an internal report, which has not been followed up;
c. The whistleblower has good reason to believe that, if he or she were to file an internal report, it would not be adequately followed up or could involve a risk of retaliation;
d. The reporter has good reason to believe that the breach may pose an imminent or obvious danger to the public interest.

The external reporting channel, as provided for in Article 7 of Legislative Decree 24/2023, is established at the National Anti-Corruption Authority (https://www.anticorruzione.it/-/whistleblowing).

External reports are submitted in writing through the IT platform or orally through telephone lines or voice messaging systems, or, at the request of the reporter, through a direct meeting scheduled within a reasonable period.

Any external report sent to an entity other than the ANAC is transmitted to the latter, within seven days of its receipt, informing the reporter of the transmission.

In managing the external reporting channel, ANAC performs the following activities:

(a) It provides information on the use of the internal and external reporting channels, and on the protection measures provided for in Chapter III of Legislative Decree 24/2023, to anyone who is interested;
b) Acknowledges receipt of the external report to the whistleblower within seven days from the date of receipt, unless the whistleblower explicitly requests otherwise or ANAC considers that the notification may compromise the confidentiality of the whistleblower’s identity
c) Maintains a dialogue with the reporter and, if necessary, requests further information;
d) Follows up diligently the reports received;
e) Conducts the investigation necessary to respond to the report, including through hearings and acquisition of documents;
f) Provides feedback to the whistleblower within three months, or, in the presence of justified and substantiated reasons, six months from the date of notification of receipt of the external report, or, in the absence of such notification, at the end of seven days from the date of receipt;
g) Notify the reporter of the final outcome.

ANAC may decide not to follow up reports concerning minor breaches and proceed to file them.

ARTICLE 14 PUBLIC DISCLOSURE
A whistleblower who makes a public disclosure enjoys the protection provided for in the Decree if, at the time of the disclosure, one of the following conditions is met
a. The whistleblower has previously made an internal and external report, or has directly made an external report, in accordance with the terms and conditions set out in Articles 4 and 7, and has not received a timely response regarding the measures planned or taken to follow up the reports;
b. The reporter has a valid reason to believe that the violation may constitute an imminent or obvious danger to the public interest;
c. The whistleblower has a valid reason to believe that the external report could entail a risk of retaliation or could not be effectively followed up due to the specific circumstances of the case, such as those where evidence could be concealed or destroyed or where there is a well-founded fear that the recipient of the report may be in connivance with or involved in the perpetrator of the breach.
The rules on professional secrecy for journalists, in relation to the source of the news, remain unchanged.

ARTICLE 15 SUPPLEMENTARY RULES
Retaliation, obstruction or attempts to obstruct a report, breach of the obligation of confidentiality as set out in Article 7, failure to check and analyse reports received, and reports manifestly made with the intention of defaming and/or slandering the whistleblower or other individuals shall be subject to disciplinary sanctions.
Any waiver or agreement, in whole or in part, concerning the rights and protections provided for by these Rules and Regulations and, in general, by Legislative Decree 24/2023, shall be invalid, unless it is entered into in the form and manner provided for by Article 2113, para. 4, of the Civil Code.
Pursuant to Article 18 of Legislative Decree 24/2023, a list of Third Sector entities offering support to whistleblowers is established at ANAC.
The appointees report annually on the number of reports received and on their progress, guaranteeing the confidentiality of the whistleblowers.

For anything not expressly mentioned, reference is made to Legislative Decree 24/2023.

ARTICLE 16 ENTRY INTO FORCE
These Rules and Regulations were ratified by Nuova Lofra srl on 10 December 2023, replacing, where present, any previous rules and regulations on the subject.