Reporting procedure [Whistleblowing]

1. PURPOSE AND SCOPE OF APPLICATION

1.1 PURPOSE

The term Whistleblowing refers to the voluntary disclosure by an individual, known as the “whistleblower” or “Reporting Person,” of an unlawful act that harms the public interest or the integrity of the organization, committed within the working environment and of which the individual has direct knowledge.

Legislative Decree No. 24 of March 10, 2023 (hereinafter, the “Decree”), which implements EU Directive 2019/1937, aims to strengthen the protection of reporting persons and extend the scope of confidentiality safeguards to additional individuals other than the Reporting Person, who may nonetheless be subject to retaliatory actions — including indirect ones — due to their role in the reporting process and/or their specific relationship with the Reporting Person. The Decree also allows for the submission of anonymous reports.

This policy outlines the procedures through which Specialcavi Baldassari S.r.l. (hereinafter, the “Company”) implements the regulations on Whistleblowing and describes the process for handling reports submitted through the internal reporting channel by anyone who becomes aware of acts and/or facts — even if only potentially — that are contrary to law and/or to the Company’s internal policies and regulations.

1.2 Recipients

The following individuals are entitled to the protections and safeguards provided under the applicable legislation:

  • Employees under a subordinate employment contract;

  • Self-employed individuals carrying out their work at the organization;

  • Suppliers, subcontractors, and their employees;

  • Freelancers and consultants;

  • Volunteers and interns, whether paid or unpaid;

  • Shareholders and individuals with functions of administration, management, control, supervision, or representation, even if such functions are exercised de facto;

  • Individuals who do not yet have a formal legal relationship with the organization (e.g., during pre-contractual negotiations), as well as those whose relationship has ended or who are currently undergoing a probationary period.

Given the broad scope of subjective application of the relevant legislation, the following individuals are also entitled to the protections and safeguards provided:

  • Facilitators, defined as natural persons who assist (by providing advice or support) the Whistleblower in the reporting process and who operate within the same working environment;

  • Individuals within the same working environment as the Whistleblower who have a stable emotional or family relationship with the latter, up to the fourth degree;

  • Co-workers within the same working environment who have a regular and ongoing professional relationship with the Whistleblower;

  • Entities owned exclusively or jointly (in majority shareholding) by the Whistleblower;

  • Entities where the Whistleblower works;

  • Entities operating within the same working environment as the Whistleblower.

2.  SUBJECT OF THE REPORT

Reports may concern information regarding breaches of specific national and European Union regulations. There is no exhaustive list of offenses or irregularities that may constitute the subject of whistleblowing; reports are considered relevant if they refer to behaviors, risks, or irregularities—whether committed or attempted—that harm the public interest or the integrity of the organization.

Therefore, reportable breaches include actions, behaviors, or omissions that damage the public interest or the integrity of the entity, and which consist of:

  • Administrative violations;

  • Violations falling within the scope of Legislative Decree 231/2001;

  • Breaches within the scope of application of EU or national acts (not otherwise mandatorily regulated);

  • Acts or omissions harming the financial interests of the European Union as referred to in Article 325 of the TFEU (e.g., fraud and unlawful activities);

  • Acts or omissions relating to the internal market, as referred to in Article 26(2) of the TFEU (e.g., fraud affecting the EU budget and corrupt practices);

  • Acts or conduct that undermine the purpose or the objectives of the provisions laid down in EU acts in the areas listed in items 3), 4), and 5).

It should be noted that, according to the Decree, the protections and safeguards provided by the legislation do not apply to reports concerning:

  • Disputes, claims, or requests linked to the personal interest of the Reporting Person or that pertain exclusively to their individual employment relationships;

  • Violations that are already mandatorily regulated by specific EU or national acts (e.g., financial services, money laundering and terrorism, transport safety, environmental protection, consumer protection);

  • Breaches relating to national security, including procurement affecting national defense or security interests, unless such matters fall under applicable EU law.

Reporting Persons must ensure that their report is as detailed as possible and that the information provided about the alleged offender is sufficient to allow for their identification and for the verification of the reported facts. Supporting documents may be attached to demonstrate the accuracy and credibility of the information.

If a report is generic and lacks sufficient information to initiate an investigation, the Case Handler shall request additional details from the Reporting Person through the dedicated Platform. If the Reporting Person cannot be contacted or does not provide further details within fifteen (15) working days of the request, the Case Handler will close the report.

3.  REPORTING CHANNELS

The Decree provides for three channels through which whistleblowers may submit reports:

  • The internal channel, activated by the Company;

  • The external channel, managed by ANAC (National Anti-Corruption Authority);

  • Public disclosures, via the press or social media.

The law stipulates that Reporting Persons shall primarily use the internal reporting channel, and may use the external channel or proceed with a public disclosure only under specific conditions.

3.1 INTERNAL REPORTING CHANNEL

The Company provides employees and external stakeholders with a reporting channel accessible via the link in the Whistleblowing section of the Sustainability section of the website www.specialcavi.it, which will take you directly to the IT platform dedicated to receiving reports, "LEGALITY WHISTLEBLOWING - Reporting of illegal activities“ (hereinafter also referred to as the ”Platform") designed and developed by the supplier DigitalPA. The platform can be accessed at the following link: Whistleblowing Platform.

The Platform is offered in SaaS (Software as a Service) mode, ensuring third-party system independence, and is accessible exclusively via the Internet through the HTTPS protocol. All data are encrypted both during transmission and storage using advanced encryption systems, offering maximum protection for the Reporting Person’s identity.

Upon accessing the Platform, users may choose between submitting a written or voice report and may consult the Whistleblower Manual, which contains detailed information on how to file a report and how to safeguard the privacy and security of shared information.

The Platform allows for the submission of a “confidential report”, whereby the Reporting Person may register with an email address and password, or alternatively provide personal data directly in the report form without creating an account; in such cases, the personal data remain separate from the report. The report is transmitted anonymously to the Case Handler, who may only access the identity of the Reporting Person if necessary, and the Reporting Person will be duly notified.

The Platform also allows for “anonymous reporting”, in which case the identity of the whistleblower cannot be traced, as no personal data are collected. Reporting Persons wishing to remain anonymous are advised to remove any identifying information from the report text and attachments.

At the end of the reporting process, the Reporting Person receives a receipt number, which uniquely identifies the report and must be used to monitor the report’s status within the Platform.

Duplicate reports on the same matter must be avoided. Any additional information should be added to the original report thread.

The Company adopts all appropriate measures to prevent traceability of connections from the corporate network; however, Reporting Persons are encouraged to file reports using a personal device via a private (non-corporate) internet connection for greater security.

3.1.1 Internal Personnel Responsible for Handling Reports

The internal personnel responsible for handling reports (the “Case Handler”) is qualified to receive and process reports based on their professional expertise and assigned functions. In compliance with principles of impartiality and confidentiality, the Case Handler carries out all necessary actions to assess the report, including interviewing individuals who may provide relevant information.

3.1.2 Investigation and Internal Review Phase

The Case Handler receives reports via the Platform and acknowledges receipt to the Reporting Person within seven (7) days of submission. A communication channel is established between the Case Handler and the Reporting Person for follow-up requests or clarifications. Therefore, the Reporting Person should regularly access the Platform and monitor the progress using the receipt number provided.

To handle reports effectively, the Case Handler may involve qualified collaborators (e.g., other Company departments or external experts), all trained and authorized, to verify the following:

  • Whether the Reporting Person qualifies as an eligible whistleblower;

  • Whether the reported matter falls within the reportable categories;

  • The credibility of the report: it will be dismissed if unsubstantiated, or an internal investigation will follow if deemed credible.

The Case Handler shall provide a response to the report within three (3) months of the acknowledgment date, or, if no acknowledgment is issued, within three months of the seven-day deadline from the report’s submission.

During the internal investigation, in order to verify the report’s validity, the Case Handler may:

  • Analyze databases to identify connections between the reported individual and third parties;

  • Collect relevant company documents;

  • Review company-assigned devices to seek evidence (e.g., emails or messages), in accordance with internal IT policies;

  • Interview individuals with relevant knowledge;

  • Offer a direct meeting with the Reporting Person, providing details regarding the time, place, and manner of the meeting.

For verification purposes, the Case Handler may delegate inquiries to specialized departments and/or third parties, ensuring that:

  • A formal assignment is issued, clearly defining the scope and the type of information required;

  • Any data that could directly or indirectly reveal the identity of the Reporting Person is excluded;

  • Any information about the reported person is omitted unless strictly necessary;

  • The appointed party is reminded of the obligation of confidentiality (if external, this must be formalized in the service contract).

To ensure full transparency, all reports that are archived as irrelevant will be recorded, including the subject of the report and the reasons for which no further investigation was undertaken.

3.2 OTHER REPORTING CHANNELS

Under specific conditions outlined in the Decree, Reporting Persons may use alternative reporting channels: the external channel managed by ANAC, and public disclosures.

3.2.1 External Reporting

The Reporting Person may file a report through the external channel operated by ANAC (National Anti-Corruption Authority) if, at the time of reporting, any of the following conditions apply:

  • There is no obligation to activate an internal reporting channel within the working context, or such a channel is not operational or not compliant with legal standards;

  • An internal report was already submitted following the Company’s procedure, but no appropriate follow-up was provided;

  • The Whistleblower has reasonable grounds to believe that an internal report would not be followed up effectively, or may lead to retaliation;

  • The Whistleblower has reasonable grounds to believe that the breach constitutes a clear or imminent danger to the public interest.

External reports can be submitted in writing through the ANAC digital platform, orally via telephone or voice messaging systems, or, upon request, through a direct meeting arranged within a reasonable time. Procedures are detailed in ANAC Regulation No. 301 of 12 July 2023. If an external report is submitted to a party other than ANAC, it must be forwarded to ANAC within seven (7) days, and the Reporting Person must be notified of the transmission.

3.2.2 Public Disclosure

The Whistleblower may proceed with a public disclosure under one of the following conditions:

  • The Whistleblower has previously made both an internal and external report, or has made an external report directly, but no response was provided within the established timeframes;

  • The Whistleblower has reasonable grounds to believe that the violation represents a clear or imminent threat to the public interest;

  • The Whistleblower has reasonable grounds to believe that an external report may expose them to retaliation or may not be effectively followed up due to specific case circumstances, such as the risk of evidence being concealed or destroyed, or reasonable suspicion that the recipient of the report is complicit or involved in the violation.

4. RETENTION OF DOCUMENTATION

All data and any documentation attached to the report shall be retained for the period necessary to manage and assess the report, and in any case, no longer than five (5) years from the date on which the final outcome of the reporting procedure is communicated.

5. PROTECTION OF THE WHISTLEBLOWER

The identity of the Reporting Person, as well as of any other individuals to whom whistleblowing legislation extends its protective scope, shall not be disclosed to anyone other than the Case Handler, unless expressly authorized.

The confidentiality measures adopted go beyond the protection of identifying data to include all elements of the report from which the identity of the Reporting Person could be directly or indirectly inferred. Disclosure of the Reporting Person’s identity to individuals other than those authorized to receive or handle reports shall only occur with the explicit consent of the Reporting Person.

The Company undertakes to ensure protection against any act of retaliation, discrimination, or penalization, whether direct or indirect, against the Reporting Person for reasons directly or indirectly linked to the report. All personnel involved at any stage of the reporting process are required to maintain the highest level of confidentiality regarding the content of the reports and the individuals involved.

Protection for the Reporting Person will not be granted if the report is proven to be unfounded and defamatory, thereby constituting intentional misconduct on the part of the Reporting Person.

6. PROTECTION AGAINST DEFAMATORY REPORTS AND PROTECTION OF THE REPORTED PERSON

To safeguard the dignity, honor, and reputation of all individuals, the Company is committed to providing the utmost protection against defamatory reports.

In this regard, should a report be found, at the conclusion of the investigation, to be unfounded and submitted with willful misconduct and/or gross negligence, the Company will take appropriate actions to protect itself and its employees.

The Company adopts equivalent privacy safeguards for the Reported Person, subject to applicable legal provisions, as are applied to protect the Reporting Person.

7. SANCTIONS AND DISCIPLINARY MEASURES

If, following the investigation of a report made under this policy, unlawful conduct by employees is confirmed, the Company shall act promptly and without delay by adopting appropriate and proportionate disciplinary measures, taking into account the seriousness and potential criminal relevance of the behavior, including the initiation of criminal proceedings where required under applicable national law.

If the investigation reveals willful or negligent misconduct by third parties who currently have or have had business relations with the Company, the Company shall act without delay, adopting all measures deemed necessary to safeguard its interests.