SHORT INFORMATION ON THE PROCEDURE FOR RECEIVING AND MANAGING REPORTS ADOPTED BY PASQUALE BRUNI SPA AND PASQUALE BRUNI BOUTIQUE SRL

pursuant to Legislative Decree 10 March 2023 n. 24

 

Summary

- Background

- Who can report - Protected subjects

- How to report

 -What to report

- How reports are managed

- Guarantee of confidentiality and protections

- ANNEX A – Privacy notice

Background

Since their establishment, the companies Pasquale Bruni S.p.a. and Pasquale Bruni Boutique S.r.l. (hereinafter jointly referred to as the "Companies") have been committed to creating and maintaining the necessary conditions so that relationships established with all their Employees, Collaborators, Consultants, as well as Shareholders, Suppliers, and Partners always take place within a corporate context of transparency, integrity, and responsibility.

This is how the Companies have always conducted their business.

With a view to continuous improvement and in line with current developments in applicable regulations, the Companies have decided to send a strong signal of respect for the aforementioned principles, strengthening their organizational structures and formalizing a corporate procedure for receiving and managing internal reports, also through the adoption of a new Procedure for receiving and managing internal reports (“Whistleblowing Protocol”), in compliance with Legislative Decree 10 March 2023 n. 24 (hereinafter “Whistleblowing Decree”).

Who can report - Protected subjects

Anyone can use the internal reporting channels to communicate possible violations of the law or alleged unlawful conduct of which they became aware by reason of their relationship with the Companies. The subjects protected by law against any retaliation or discriminatory conduct are employees, former employees, interns, collaborators, consultants, volunteers, trainees, shareholders, persons with administrative, management, control, supervisory, or representation functions at the Companies, as well as facilitators and colleagues of the reporting person who have a regular and current relationship with them. Furthermore, personnel of suppliers, contractors, subcontractors, or other service providers of the Companies are protected.

How to report

The Companies have established internal reporting channels, managed by an independent external company.

The channels are:

1. in written form:

• by accessing the whistleblowing web platform

2. in oral form, through a direct meeting with the Manager or a delegate specifically trained in the matter and appointed for this purpose, also pursuant to privacy regulations. The meeting will be guaranteed within 20 working days of the request, to be sent to the address whistleblowing@noverim.it. The report in oral form, subject to the written consent of the reporting person, is documented by the Manager, by recording on a device suitable for storage and listening or by means of an integral transcript. In the event of a transcript, the Reporting Person must verify, rectify, or confirm the content of the transcript by signing it.

   It is necessary that the report be as detailed as possible.

   In particular, for the purpose of the admissibility assessment, the following essential elements must clearly emerge from the report:

• The identifying data of the reporting person (name, surname, place and date of birth) as well as a contact detail (e-mail and phone number);

• the circumstances of time and place in which the fact object of the report occurred;

• description of the facts object of the report with details on circumstantial news;

• manner in which the facts object of the report became known;

• personal details of the reported person or other elements allowing their identification.

It is recommended, where possible, to also attach documents proving the validity of the facts object of the report, as well as the indication of other subjects potentially aware of the facts.

Reports made anonymously will in any case be taken into consideration as ordinary reports (not manageable under whistleblowing regulations) provided that they are adequately detailed, specific, and based on precise and concordant factual elements (and not of generic or confused content), so as to allow their evaluation and the necessary investigations.

The Reporting Person is therefore invited to interact with the Manager through the internal channel used to make the report or another authorized channel (please note that the web platform allows the Reporting Person to access it at any time by clicking on “Follow your case” and to respond to any questions or requests from the Manager aimed at collecting and evaluating information).

In the event that the Reporting Person has not indicated their contact details (Anonymous Report) or the Reporting Person does not interact with the Manager, it will not be possible to proceed adequately with the investigation of the Report, without any liability being attributed to the Manager and/or the Companies. In this case, depending on the nature of the Report, the Manager may process the report as ordinary or archive the case.

What to report

The subject of the report may be any conduct or facts that, in the opinion of the reporting person, constitute or are potentially capable of constituting civil, criminal, administrative, and accounting offenses and are harmful to a public or private interest.

This channel can be used to report violations, i.e., behaviors, acts, or omissions that harm the integrity of the Companies or the public interest, referable - by way of non-limiting example - to:

• violations of laws and regulations (national and European);

• unlawful conduct relevant under Legislative Decree no. 231/2001;

• acts of corruption;

• corporate fraud;

• human rights;

• behaviors that cause damage or prejudice, even if only to image, to the Companies.

The report cannot relate to:

• complaints, claims, or requests linked to a personal interest of the reporting person that relate exclusively to their individual employment relationships or inherent to their work relationships with hierarchically superior figures;

• news clearly lacking foundation, information acquired solely on the basis of unreliable rumors or gossip (so-called hallway rumors);

• information that is already entirely in the public domain.

How reports are managed

Within 7 days of receipt, an acknowledgment of receipt of the report will be given, and within 3 months of such notice, feedback will be provided to the reporting person on the follow-up given or intended to be given to the report.

The Manager of reports may interface with the reporting person if further investigation is deemed necessary or initiate a dialogue aimed at obtaining clarifications or documents.

Reporting persons are therefore invited to interact with the Manager, and please remember that, in case of anonymity, unreachability, or inactivity of the Reporting Person, the Manager may process the report as ordinary or archive the case.

Guarantee of confidentiality and protections

Absolute confidentiality is guaranteed to the reporting person and to the subjects indicated above.

No form of personal or professional retaliation is permitted or tolerated by reason of the report made.

If you believe you have suffered retaliation because of the report, it is possible to communicate it to the National Anti-Corruption Authority (ANAC) by providing all relevant documentation.

Anyone who abuses the protections provided by Legislative Decree 24 of 2023, reporting facts or acts manifestly unfounded or opportunistic, for the sole purpose of damaging the reported person or other subjects, may be held liable in judicial and disciplinary proceedings.

Any processing of personal data is carried out in compliance with regulations on the protection of personal data. See the attached Privacy Notice.

In the case of ordinary reports made to one's manager and/or hierarchical superior, the protections provided by Legislative Decree no. 24 of 2023 are not guaranteed, unless the Reporting Person specifies or shows the intention to benefit from the aforementioned protections.

For further details on the reporting procedure, a copy of the Whistleblowing Protocol may be requested from the Human Resources Office or by writing to the following address whistleblowing@noverim.it.

ANNEX A

INFORMATION ON THE PROCESSING OF PERSONAL DATA pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 IN RELATION TO “WHISTLEBLOWING” REPORTS

Pasquale Bruni S.p.a. and Pasquale Bruni Boutique S.r.l. - hereinafter jointly referred to as the “Companies” - inform that personal data (including any sensitive data, such as racial and ethnic origin, religious or philosophical beliefs, political opinions, membership in political parties, trade unions, as well as personal data suitable to reveal health status and sexual orientation) of Reporting Persons, the Reported Person, and other subjects potentially involved (collectively, “Personal Data”), acquired on the occasion of managing Reports, will be processed in full compliance with current regulations on personal data protection and will also be limited to those strictly necessary to verify the validity of the Report and for its management.

1. Purpose of the processing

The data provided by the Reporting Person in order to represent alleged unlawful conduct of which they became aware by reason of their relationship with the Companies committed by subjects who interact with it in various capacities, are processed for the purpose of carrying out the necessary investigative activities aimed at verifying the validity of the fact object of the report and the adoption of consequent measures.

2. Type of data processed

The receipt and management of reports give rise to the processing of so-called “common” personal data (name, surname, work role, etc.), and may also give rise, depending on the content of the reports and the acts and documents attached to them, to the processing of so-called “special” personal data (data relating to health conditions, sexual orientation, or trade union membership, referred to in Art. 9 GDPR) and personal data relating to criminal convictions and offenses (referred to in Art. 10 GDPR).

3. Legal basis of processing and methods of processing

The legal basis for the processing of Personal Data is identified in Art. 6, paragraph 1, letter c) of Regulation (EU) 2016/679, i.e., compliance with a legal obligation to which the data controller is subject.

With reference solely to the storage of Personal Data following the closure of the report management procedure, the legal basis is represented by the legitimate interest of the Data Controller and the data subjects in exercising their rights, in all cases where it becomes necessary (e.g., opening of disciplinary proceedings, judicial actions, claims for damages related to the report).

Pursuant to Art. 5 of the GDPR, data processed within the management of reports must be processed lawfully, fairly, and transparently, collected for specified, explicit, and legitimate purposes, adequate, relevant, and limited to what is strictly and objectively necessary to verify the validity of the report, accurate and if necessary updated.

During activities aimed at verifying the validity of the Report, all necessary measures will be adopted to protect data from accidental or unlawful destruction, loss, and unauthorized disclosure.

Based on the provisions of personal data legislation and Legislative Decree no. 24/2023, the Data Controller, the Data Processor, and persons authorized to process personal data are required to respect the following fundamental principles:

· process data lawfully, fairly, and transparently toward data subjects («lawfulness, fairness, and transparency»);

· collect data solely for the purpose of managing and following up on reports made by subjects protected by Legislative Decree 24/2023 («purpose limitation»);

· ensure that data are adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed («data minimization»). Personal data that are manifestly not useful for processing a specific report will not be collected or, if collected accidentally, will be deleted without delay;

· ensure that data are accurate and, if necessary, updated; all reasonable measures must be adopted to delete or rectify promptly inaccurate data relating to the specific report being managed («accuracy»);

· guarantee the prohibition of tracking reporting channels;

· guarantee, where possible, the tracking of authorized personnel activity in compliance with safeguards protecting the reporting person, in order to avoid improper use of data relating to the report. Tracking of any information that could lead back to the identity or activity of the reporting person must be avoided.

4. Scope of communication and transfer of data

Personal Data collected within the receipt and management of the report will not be disseminated abroad and disclosed in any way.

Exclusively for the specified purposes, Personal Data may be communicated to third parties to whom the Companies and/or the Manager might entrust certain activities (or parts thereof); such subjects will operate as independent Controllers or will be designated as Processors and are essentially included in the following categories:

• Consultants (Law Firms, etc.);

• Companies in charge of personnel administration and management;

• Investigative agencies;

• Institutions and/or Public Authorities, Judicial Authorities, Police Bodies.

5. Storage of personal data

The Companies retain personal data within the terms provided by Art. 14 of Legislative Decree no. 24/2023, i.e., for the time necessary to process the report and in any case for no longer than 5 years starting from the date of communication of the final outcome of the Report to the Manager. Personal data that are manifestly not useful for processing a specific report are not collected or, if collected accidentally, are deleted promptly.

If the report proves to be unfounded, data must not be stored beyond the deadline provided by law to propose a complaint or charge against the Reporting Person.

6. Rights of the data subject

The data subject, in the persons of the Reporting Person or Facilitator, has the right to access at any time data concerning them and to exercise the rights provided by Articles 15 to 22 of the GDPR, as applicable (right of access to personal data, right to rectify them, right to obtain erasure or so-called right to be forgotten, right to restriction of processing, right to data portability, or right to object to processing), by sending an e-mail to the address: whistleblowing@noverim.it. Furthermore, the data subject has the right to lodge a complaint with the Data Protection Authority.

The aforementioned rights cannot be exercised by the reported person, for the time and within the limits in which this constitutes a necessary and proportionate measure, pursuant to Art. 2-undecies of the Italian Privacy Code, as the exercise of such rights could cause actual and concrete prejudice to the protection of the confidentiality of the reporting person's identity.

7. Data Controller and Authorized Processing Subjects

The Data Controller of Personal Data collected within Internal Reporting are the Companies.

The Manager, specifically appointed as Data Processor pursuant to Art. 28 GDPR, as well as the Competent Internal Subject, have been authorized to process personal data by the Companies, from which they have also received adequate operational instructions.