Regulation for the transmission, reception and management of reports of illicit activities and the protection of the whistleblower (Whistleblowing)

1. SUBJECT AND PURPOSE OF THE REGULATION AND REGULATORY CONTEXT

1.1 Object and purpose of the regulation

The “Whistleblowing” institution consists in the possibility, provided to the Recipients, to report behaviors, acts or omissions potentially harmful to the public interest or the integrity of AK GROUP SRL (“Reporting”). The purpose of this regulation (“Regulation”) is to remove the factors that may hinder or discourage the use of the Whistleblowing institution, such as doubts and uncertainties about the procedure to follow and fears of retaliation or discrimination. The Regulation is drafted in compliance with Legislative Decree no. 24 of 10 March 2023 implementing EU Directive no. 1937/2019 (so-called “Whistleblowing Directive”). The purpose of this document is to represent the operating methods for managing reports of violations of which the Reporters have become aware within their working context and any resulting investigations. The aim of the Regulation is therefore, on the one hand, to provide the Reporting Party with clear operational instructions regarding the subject, content, recipients and methods of transmission of the reports and, on the other, to inform him about the forms of protection and confidentiality that are recognized and guaranteed to him.

1.2 Regulatory Context

Legislative Decree 10 March 2023 n. 24, implementing Directive (EU) 2019/1937, regulates the protection of people who report violations of national or European Union legal provisions that they have become aware of in a work context (so-called whistleblowing ). In summary, the legislation provides:

• a protection regime for specific categories of individuals who report information, acquired in the work context, relating to violations of national or European Union regulatory provisions that harm the public interest or the integrity of the entity;
• protective measures, including the prohibition of retaliation, to protect the Reporter as well as the Facilitators, the Work Colleagues, as well as the Related Parties and Legal Entities associated with the Reporter;
• the establishment of internal reporting channels for the transmission of Reports which guarantee, also through the use of encryption tools, the protection of the confidentiality of the identity of the Reporter, of the Person involved and/or in any case mentioned in the Report, of the content of the Report and of the related documentation;
• the need to involve the representatives or trade union organizations referred to in art. 51 of Legislative Decree. n. 81/2015 before activating the aforementioned reporting channels;
• the right to file a complaint with the judicial or accounting authority;
• the possibility (if one of the conditions set out in art. 6, paragraph 1, Legislative Decree no. 24/2023 applies) of making external Reports through the channel managed by the National Anti-Corruption Authority (hereinafter ANAC), as well as of making public Disclosures (if one of the conditions set out in art. 15, paragraph 1, Legislative Decree no. 24/2023 applies), through the press or electronic or dissemination means capable of reaching a large number of people (on this point see paragraph 4);
• disciplinary measures as well as administrative pecuniary sanctions imposed by ANAC in the cases provided for by articles 16 and 21 of the Legislative Decree. n. 24/2023.

The provisions in question apply to private sector entities that have employed at least 50 subordinate workers with fixed-term or permanent employment contracts in the last year and, regardless of the number of workers employed, to entities that have adopted the organisation and management models provided for by the Legislative Decree. n. 231/2001. In attuazione del D.lgs.

n. 24/2023, this Regulation aims to regulate the process of transmission, reception and management of reports on information, adequately detailed, that harm the public interest or the integrity of the company.

1.3 Definitions

For the purposes of this Regulation, the following are definitions of the terms used:

1. Work colleagues : individuals who work in the same work context as the Reporter and who have a habitual and ongoing relationship with said person;
2. Ethics Committee : the internal body referred to in § 3.1.2 of an autonomous nature and composed of personnel specifically trained in Whistleblowing matters;
3. Work context : the work or professional activities, present or past, carried out in the context of the relationships referred to in § 1.3.1, through which, regardless of the nature of such activities, a person acquires information on the Violations;
4. Recipients : the subjects who can make the Report and/or who enjoy protection in the event of a Report as indicated in § 1.3.1.;
5. Decree : Legislative Decree 10 March 2023 n. 24, concerning the protection of persons reporting violations of European Union law and containing provisions concerning the protection of persons reporting violations of national regulatory provisions;
6. Facilitator : a natural person who assists the Reporter in the reporting process, operating within the same work context and whose assistance must be kept confidential;
7. Reported Person : the natural or legal person mentioned in the Report as the person to whom the Violation is attributed or as a person otherwise mentioned in the reported Violation;
8. Retaliation : any behavior, act or omission, even if only attempted or threatened, carried out as a result of the Report, the complaint to the judicial authority or the public disclosure and which causes or may cause the Reporting Person or the person who filed the complaint, directly or indirectly, unjust damage;
9. Reporting Party(ies) : natural person included among the Recipients who makes the Report pursuant to this Regulation:
10. Report : the report submitted by a Reporter pursuant to this Regulation (§ 3);
11. Internal Report: the Report submitted through the channel referred to in § 3.1.2;
12. External Report: the Report submitted via the channel referred to in § 4;
13. Related parties : persons in the same work context as the Whistleblower, informer or person making a public disclosure and who are linked to them by a stable emotional or kinship bond within the fourth degree;
14. Related Legal Entities : entities owned by the Reporting Party (exclusively or with majority participation by third parties), or for which the Reporting Party works, or which operate in the same work context as the Reporting Party;
15. Violations: behaviors, acts or omissions that harm the public interest or the integrity of the company and which consist of:

• • Illicit conduct relevant pursuant to Legislative Decree 231/2001, or violations of the Organizational Model adopted by the company, including violations of the Code of Ethics, procedures and other internal rules that form an integral part of the Model;
  • Offences relating to the application of the laws and regulations, both of the European Union and national, indicated in the annex to the Decree or of the national acts that constitute implementation of the acts of the European Union indicated in the annex to Directive (EU) 2019/1937 in the field of: public procurement; financial services, products and markets and prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; protection of privacy and protection of personal data and security of networks and information systems;
  • Acts or omissions that harm the financial interests of the European Union;
  • Acts or omissions relating to the internal market (including infringements of competition and State aid and those relating to tax);
  • Acts or behaviors that frustrate the object or purpose of the provisions referred to in numbers 2), 3) and 4).

1.3.1. Recipients

The Recipients are the individuals who can make the Reports and/or who, even if different from the Reporting Party, enjoy protection in the event of a Report, and in particular:

• employees of AK GROUP SRL including workers whose employment relationship is governed by Legislative Decree 81/2015 or by art.54bis of Legislative Decree 50/2017;
• self-employed workers, including those indicated in Chapter I of Law no. 81/2017, who carry out their work activity at the company;
• the collaborators referred to in articles 409 of the Italian Code of Civil Procedure and art. 2 of the Legislative Decree. n. 81/2015, freelancers and consultants who work for the company;
• volunteers and interns, paid and unpaid, who work for the company;
• people with administrative, management, control, supervisory or representative functions;
• suppliers of goods and services, as well as freelancers, consultants or customers;
• any individual shareholders who hold shares in AK GROUP SRL;
• the Facilitators;
• the reporting person’s work colleagues;
• the Related Subjects;
• The associated legal entities.

The protection also applies to all the subjects listed above if the Report, denunciation or public disclosure occurs in the following cases:

• when the legal relationship has not yet begun, if information on the violations was acquired during the selection process or in other pre-contractual stages;
• during the probationary period;
• after the termination of the legal relationship if the information on the violations was acquired during the course of the relationship itself.

2. VIOLATIONS​

The scope of application of this Regulation includes reports relating to behaviors, acts or omissions that harm the public interest or the integrity of the company as identified in art. 2 of the Legislative Decree. n. 24/2023 of which the Reporting Person has become aware in the Work Context. The Reporting, public disclosure or denunciation may also include those elements that concern conduct aimed at concealing Violations, such as the destruction of evidence regarding the commission of the violation. Violations that can be reported or denounced do not include news that are clearly unfounded, information that is already entirely in the public domain, or information acquired only on the basis of unreliable rumors or hearsay. In particular, the following are excluded from the scope of application of this procedure: Reports relating to:

• disputes, claims or requests related to a personal interest of the Reporting Person which pertain exclusively to their individual employment relationships, or inherent to their employment relationships with hierarchically superior figures (e.g. labor disputes, discrimination between colleagues, interpersonal conflicts);
• breaches of national security, as well as procurement relating to defence or national security aspects, unless such aspects are covered by the relevant secondary legislation of the European Union;
• violations where they are already regulated on a mandatory basis by European Union or national acts which already guarantee specific reporting procedures, such as in the financial sector (Part II of the Annex to the Decree and national provisions which implement the EU acts indicated in Part II of the Annex to Directive (EU) 2019/1937);
• requests to exercise rights regarding the protection of personal data towards the company (so-called privacy rights), pursuant to Regulation (EU) no. 2016/679 (GDPR) and the former Legislative Decree. n. 196/2003, for which reference is made to the contact details of the IT Manager of AK GROUP SRL

The application of national or European Union provisions on classified information, legal and medical professional secrecy, secrecy of judicial decisions, secrecy of investigations in criminal proceedings, provisions on the autonomy and independence of the judiciary, provisions on national defense and public order and security shall remain unchanged. The application of the provisions on the exercise of the right of workers to consult their representatives or trade unions, protection against unlawful conduct or acts carried out as a result of such consultations, autonomy of the social partners and their right to enter into collective agreements, as well as the repression of anti-union conduct pursuant to art. 28 of Law no. 300/1970 shall also remain unchanged.

3. REPORTS​

3.1. Internal reports

3.1.1. Oggetto e Requisiti: Piattaforma Informatica

To allow all legitimate subjects to make a Report pursuant to the Decree, AK GROUP SRL has signed a contract with Audit People – Società Benefit Srl (hereinafter “ Audit People ”), certified in compliance with the ISO 9001 standard for the “ Supervisory body and whistleblowing management services for Legislative Decree 231 and compliance programs” , in order to make available to the Recipients a technological platform in the form of a “ landing page ” on the EthicPoint.eu website, located at https://ethicpoint.eu/ak-group/ a cloud application accessible from any device (computer, iPad, smartphone) by filling in the predefined fields to identify oneself or using the anonymity option. The service made available to the Recipients includes:

• a dedicated email address: akgroup@ethicpoint.eu;
• a toll-free number dedicated to providing initial assistance to the whistleblower;
• the activation of a physical mailbox (Po Box).

The service provided by Audit People complies with the provisions of the Decree and the Guidelines of the National Anti-Corruption Authority (ANAC). Through the IT channel, the Reporter will be guided through each phase of the Report and will be asked, in order to best substantiate the same, a series of fields to be filled in respecting the required requirements. It is essential that the elements indicated are known directly by the Reporter and not reported or referred to by other subjects. Anonymous Reports are also taken into consideration, where these are adequately detailed and made with a wealth of details, that is, they are such as to bring out facts and situations relating them to specific contexts (e.g.: documentary evidence, indication of names or particular qualifications, mention of specific offices, proceedings or particular events, etc.). The Report must be detailed with a high degree of completeness and exhaustiveness. The Reporting Party is required to provide all available and useful elements to enable the competent bodies to proceed with the necessary and appropriate checks and investigations to verify the validity of the facts which are the subject of the Report, such as:

1. a clear and complete description of the facts which are the subject of the Report;
2. the circumstances of time and place in which the facts which are the subject of the Report were committed;
3. the personal details or other elements that allow the identification of the individual(s) who carried out the reported facts (e.g. qualification, place of work where the activity is carried out);
4. any documents supporting the Report;
5. the indication of any other subjects who can report on the facts which are the subject of the Report;
6. any other information that may provide useful evidence regarding the existence of the reported facts.

In order for a Report to be detailed, the requirements set out in the previous point do not necessarily have to be met simultaneously, given that the Reporter may not have full access to all the information requested. Audit People will forward the Reports received to the Ethics Committee specifically appointed by AK GROUP SRL (3.1.2).

3.1.2. Gestione: Il Comitato Etico

The management of the internal reporting channel is entrusted to a specially appointed Ethics Committee, composed of the Head of Governance and Compliance of AK GROUP SRL, who is the person to whom Audit People will forward the Reports. The Ethics Committee carries out the following activities:

• issues the Reporting Party with an acknowledgement of receipt of the Report within seven days of the date of receipt;
• carries out a preliminary analysis of the contents of the same, if deemed appropriate by the same, also with the support of specialized external consultants, in order to evaluate its relevance in relation to the scope of application of the Decree and, in general, of the Regulation;
• archive the Report if you believe it is not admissible, for example:
• • in the event of manifest groundlessness due to the absence of factual elements suitable to justify investigations;
  • in the event of ascertained generic content of the report of illicit conduct which does not allow for understanding the facts, or in the event of a report of illicit conduct accompanied by inappropriate or irrelevant documentation.
    In such case, the Ethics Committee shall provide a written justification to the Reporting Party regarding the reasons for archiving;
• in the event that it is not archived, it takes charge of managing the Report and transmits to the Supervisory Body (OdV) the Reports having relevance pursuant to Legislative Decree 231/2001.

3.1.3. Modalità di effettuazione dell’istruttoria

Within 15 days of receiving the Report, the Ethics Committee and/or the Supervisory Body in the case of reports having relevance 231 will start the investigation. The investigation is the set of activities aimed at verifying the content of the internal Reports received and acquiring elements useful for the subsequent evaluation phase, ensuring maximum confidentiality on the identity of the Reporter, of the person involved in or in any case mentioned in the report and of the Facilitators and on the subject of the Report. The investigation has the main purpose of verifying the truthfulness of the information subjected to investigation, providing a precise description of the ascertained facts. For these purposes, the Ethics Committee/Supervisory Body maintains discussions with the Reporting person and may request additions from the latter, if necessary. During the investigation phase, the Ethics Committee/Supervisory Body, in order to evaluate an internal Report, may carry out the appropriate internal investigations, either directly or by appointing a person internal or external to the company, without prejudice to the obligation of confidentiality. It is everyone’s duty to cooperate with the Investigator in carrying out the investigation. For each investigation, the Investigator prepares a final report containing at least:

• the ascertained facts;
• the evidence collected;
• the causes and deficiencies that allowed the reported situation to occur.

The evidence collected during internal investigations is analyzed to understand the context of the internal Report, to establish whether a relevant violation pursuant to the Decree has actually occurred. If, following the investigative activity carried out, the Report has been found to be well-founded, the Ethics Committee/Supervisory Body , always respecting the confidentiality of the Reporter, of the person involved in or in any case mentioned in the report and of the Facilitators, will inform the Company’s directors, who will alternatively or jointly, depending on the nature of the offence, to:

• file a complaint with the competent judicial authority;
• take appropriate action, including possible disciplinary action;
• decide on the measures necessary to protect the Company.

The report will certainly be archived by the Ethics Committee/OdV in the following cases, upon request for integration or clarification:

• groundlessness due to the absence of factual elements suitable to justify investigations;
• groundlessness following the investigation;
• generic content of the report which does not allow for understanding the facts or report of illicit activities accompanied by inappropriate or irrelevant documentation;
• production of documentation only, in the absence of reporting of illicit conduct or irregularities;
• report completely unrelated to the subject of this Regulation;
• lack of data which constitute essential elements of the Report.

3.1.4. Conclusione della procedura

The procedure must be concluded within three months from the date of the notice of receipt or, in the absence of such notice, within three months from the expiry of the period of seven days from the submission of the Report. A notice of conclusion of the procedure is sent to the Reporting Person.

3.1.5. Modalità di archiviazione

In order to guarantee the traceability, confidentiality, conservation and availability of data throughout the procedure, the documents are stored and archived both in digital format, through password-protected network folders, and in paper format, in a special secured cabinet, accessible only to specifically authorised and trained persons. The data are stored for the time necessary to process the specific internal Report, and in any case no longer than five years from the date of communication of the final outcome of the internal Report procedure.

4. EXTERNAL REPORTS

In addition, Recipients may make an external Report through an external channel managed by ANAC. Access to this channel, however, is permitted only if at the time of submitting the Report:

• the internal channel is not active or, if active, does not comply with the provisions regarding the subjects and methods of submitting internal reports which must be able to guarantee the confidentiality of the identity of the Reporter and of the other protected subjects;
• the Reporter has already made an internal Report and this has not been followed up by the Ethics Committee;
• the Reporting Person has reasonable grounds to believe, on the basis of the specific circumstances alleged and information that can actually be acquired and, therefore, not on simple insinuations, that, if he were to make an internal Report, it would not be followed up effectively or this could lead to the risk of Retaliation;
• the Reporting Party has reasonable grounds to believe that the violation may constitute an imminent or manifest danger to the public interest.

There is also an additional External Reporting modality which consists of public disclosure, through which information on violations is made public domain through the press or electronic means or in any case through means of diffusion capable of reaching a large number of people. Public disclosure of violations may occur if at the time of disclosure one of the following conditions occurs:

• an internal Report to which the Ethics Committee did not respond within the expected timeframe (three months from the date of the acknowledgement of receipt or, in the absence of such acknowledgement, within three months from the expiry of the seven-day period from the submission of the Report), was followed by an external Report to ANAC which, in turn, did not provide a response to the Reporting Party within reasonable timeframes (three months or, if there are justified and motivated reasons, six months from the date of acknowledgement of receipt of the external Report or, in the absence of such acknowledgement, from the expiry of the seven days from receipt);
• the person has already directly made an external Report to ANAC which, however, has not given feedback to the Reporting Party regarding the measures envisaged or adopted to follow up on the Report within the aforementioned reasonable timeframes;
• the person directly makes a public disclosure because, on the basis of reasonable and well-founded reasons in light of the circumstances of the specific case, he or she believes that the violation may represent an imminent or manifest danger to the public interest or may entail the risk of Retaliation or may not have an effective follow-up because, for example, he or she fears that evidence may be hidden or destroyed or that the person who received the Report may be in collusion with the perpetrator of the violation or involved in the violation itself.

Recipients may contact the competent judicial and accounting authorities directly to file a complaint regarding unlawful conduct of which they have become aware in the workplace.

5. PROTECTION OF THE REPORTER

The identity of the Reporter and any other information from which such identity may be deduced, directly or indirectly, cannot be revealed to external persons. This is also to avoid the exposure of the same to retaliation that could be adopted following the Report. Reports cannot be used beyond what is necessary to adequately follow up on them. Confidentiality is extended to all Recipients as well as to the content of the Report and the related documentation. In particular, the data of the Recipients must be processed by the Ethics Committee as well as by any persons involved in managing the report:

• in compliance with confidentiality criteria;
• lawfully and fairly;
• in full compliance with the minimum security measures, storing and controlling the data being processed in such a way as to avoid even accidental risks of destruction, loss, unauthorised access or unauthorised processing;
• guaranteeing the exercise of the rights of the interested party, pursuant to articles 15 – 22 of the GDPR (right to information; right of access; right to update or rectify; right to erasure; right to object; right to withdraw consent; right to object; right to be forgotten; right to portability), with the limits established by current legislation.

Furthermore, personal data that are clearly not useful for the processing of a specific report are not collected or, if accidentally collected, are immediately deleted. The identity of the Reporter may be revealed only in the cases provided for by the Decree, in particular:

• in the context of criminal proceedings, the identity of the Whistleblower is covered by secrecy in the manner and within the limits set out in Article 329 of the Code of Criminal Procedure;
• in the context of the disciplinary proceedings arising from the investigation, the identity of the Reporter cannot be revealed, where the contestation of the disciplinary charge is based on investigations that are separate and additional to the Report, even if consequent to it. If knowledge of the identity of the Reporter is essential for the defense of the accused and/or the persons involved, the Report may be used for the purposes of the disciplinary proceedings only if the reporting person has given his or her express consent to the disclosure of his or her identity. If the Ethics Committee determines that knowledge of the identity of the Reporter is absolutely necessary for the defense of the Reported Person and/or the persons involved in the disciplinary proceedings, it will obtain their consent; if consent is denied, the report may not be used for the purposes of the disciplinary proceedings, except for the usability of further investigative evidence.

In such cases, the Reporting Party shall be given prior written notice of the reasons for disclosing the confidential data.

6. PROHIBITION OF RETALIATION

The Reporter may not be sanctioned, demoted, fired, transferred, or subjected to any other organizational measure having negative effects, direct or indirect, on working conditions, as a consequence of his/her report, of the complaint to the judicial or accounting authority or of public disclosure. The prohibition of Retaliation extends to the Recipients. In particular, the following behaviors are considered Retaliation:

1. dismissal, suspension or equivalent measures;
2. demotion or failure to promote;
3. change of duties, change of workplace, reduction of salary, change of working hours;
4. suspension of training or any restriction of access to it;
5. demerit notes or negative references;
6. adoption of disciplinary measures or other sanctions, including pecuniary ones;
7. coercion, intimidation, harassment, or ostracism;
8. discrimination or otherwise unfavorable treatment;
9. failure to convert a fixed-term employment contract into a permanent employment contract, where the worker had a legitimate expectation of such conversion;
10. failure to renew or early termination of a fixed-term employment contract;
11. damage, including to the person’s reputation, particularly on social media, or economic or financial harm, including loss of economic opportunities and loss of income;
12. inclusion in improper lists on the basis of a formal or informal sectoral or industry agreement, which may result in the person being unable to find employment in the sector or industry in the future;
13. early termination or cancellation of the contract for the supply of goods or services;
14. cancellation of a license or permit;
15. request to undergo psychiatric or medical examinations.

In addition to these, Retaliation may also include, for example, the demand for results that are impossible to achieve in the ways and times indicated; an artfully negative performance evaluation; an unjustified revocation of assignments; an unjustified failure to assign assignments with simultaneous attribution to another person; the repeated rejection of requests (e.g. holidays, leave); the unjustified suspension of patents, licenses, etc. Retaliation is prohibited and individuals who have been fired due to the Report have the right to be reinstated in their jobs. In the context of judicial or administrative proceedings or in any case of extrajudicial disputes concerning the ascertainment of Retaliation against the Reporter and other Recipients, it is presumed that the same were carried out due to the Report and the burden of proving that such conduct or actions are motivated by reasons external to the Report is on the person who carried them out. In the event of a claim for compensation presented to the judicial authority by the Reporter, if the same demonstrates having suffered damage, it is presumed, unless proven otherwise, that the damage is a consequence of the Report itself. The adoption of measures deemed retaliatory against the Reporter and the other Recipients can be reported to the National Anti-Corruption Authority by the interested party for the adoption of the consequent actions on the following platform:

Whistleblowing – Form for reporting unlawful conduct pursuant to Legislative Decree no. , and brought before the Judicial Authority for the protection of the legal situations of the injured parties.

7. SANCTIONS

The following subjects are subject to sanctions:

• the Reporter who makes, with intent or gross negligence, Reports which turn out to be unfounded or in bad faith;
• the corporate entity that has adopted discriminatory or retaliatory measures against the Reporter;
• Subjects who obstruct or attempt to obstruct Reports;
• the person responsible for verification activities in the event of failure to carry out verification and analysis activities;
• subjects who do not guarantee the general principles of protection with particular reference to respect for the confidentiality of the identity of the Reporter;
• the reported Person who, following the results of the checks conducted by the Company, is found to have committed illicit or irregular acts, also in accordance with the provisions of the disciplinary system of the collective labor agreement.

Without prejudice to other liability profiles, ANAC applies the sanctions referred to in art. 21 of Legislative Decree 10 March 2023, n. 24.

8. PROTECTION OF THE REPORTED PERSON

The protection measures described cannot be applied to a Reporter who makes reports that are false, defamatory, or slanderous, with the sole purpose of damaging the Reported Person. In particular, when the criminal liability of the Reporter for the crimes of defamation or slander is ascertained, even by a first-instance judgment, or his civil liability, for the same reason, in cases of willful misconduct or gross negligence, the company reserves the right to impose a specific disciplinary sanction on the Reporter. A Reported Person who is informed of a Report against him and who believes the same to be unfounded, false, slanderous or defamatory, may submit a specific request to the Ethics Committee to find out the identity of the Reporter, in order to initiate specific civil and/or criminal proceedings against him to protect his interests.

9. COMMUNICATION AND AWARENESS-RAISING INITIATIVES

The Ethics Committee undertakes communication and awareness initiatives through disclosure on the website and through training initiatives for all staff on the purposes of the institute and its use.