Whistleblowing - Legal Information

Schweitzer Project S.p.A. Whistleblowing Procedure

1. Purpose and Scope 
2. Definitions and Abbreviations
3. Subject of the report 
4. The reporting procedure and available channels 
4.1 Internal Channels 
A) Written notification to be sent in a sealed envelope 
B) Reporting through personal meetings 
4.2 External Channels 
4.3 Dissemination 
4.4 Complaint 
4.5 Whistleblowing report verification 
5. Protection and responsibility of the whistleblower 
6. Processing of personal data 

1. Purpose and scope
This document describes the whistleblowing procedure adopted by Schweitzer Project S.p.A. (also Schweitzer or the Company) in order to comply with the correct application of the regulations in force. In particular, the following procedure describes the requirements for internal and external whistleblowing and the communication channels available.
For the transmission of any misconduct, communication channels must be provided that allow for confidential treatment of information on the identity of the whistleblower. Reports of unlawful conduct must always be substantiated and based on specific and consistent facts. Any form of reprisal against whistleblowers in the context of the employment relationship must be prevented.
With Legislative Decree No. 24/2023, the scope of application was broadened compared to the previous provisions on the subject. Under the aforementioned legal provisions, the following persons may make protected declarations:
employees of public administrations
employees of public service units;
employees of private sector entities;
the self employed ;
workers or collaborators, who are employed by entities in the public or private sector;
freelancers and consultants
volunteers and trainees, paid and unpaid;
shareholders and persons with administrative, management, supervisory or representative functions;
facilitators;facilitators;
employees or collaborators during the probationary period or after the termination of the legal relationship if the information on violations was acquired in the course of the relationship;
persons in the same work environment as the whistleblower;
whistleblower's work colleagues;
entities owned by the whistleblower;
persons who are linked to the whistleblower by a stable emotional or family relationship up to the fourth degree.
For a complete list, please refer to Legislative Decree 24/2023.
Legislative sources of reference and guidelines are:
- Law No 179 of 30 November 2017 'Provisions for the protection of whistleblowers of crimes or irregularities of which they have become aware in the context of a public or private employment relationship'.
- Legislative Decree No 24 of 10 March 2023 'Implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of whistleblowers reporting breaches of Union law and laying down rules for the protection of whistleblowers reporting breaches of national law.
- European Regulation 2016/679 (General Data Protection Regulation - GDPR) - European Data Protection Regulation, as well as Legislative Decree 196/2003 - Personal Data Protection Code, harmonised by Legislative Decree 101/2018;
- ANAC Guidelines No. 311/2023 "Guidelines on the protection of whistleblowers reporting breaches of Union law and on the protection of whistleblowers reporting breaches of national law. Procedures for the transmission and processing of external reports.

2. Definitions and abbreviations
ANAC: National Anti: National Anti--Corruption AuthorityCorruption Authority
Employment context: Current or past professional activities carried out in the context of an employment relationship with the Company that enable a person, regardless of the nature of such activities, to obtain information about violations. In the event of a public whistleblowing or open accusation, a whistleblower in the work environment would risk retaliation.
Person involved: The natural or legal person indicated in the internal or external report or publication as the person to whom the violation or irregularity is attributed or who is otherwise involved in the reported or publicised irregularity.
GDPR: European Regulation 2016/679 (General Data Protection Regulation - GDPR).
Addressee: The natural or legal person responsible for receiving whistleblowers’ reports.
Whistleblowers: The natural person who submits a substantiated report of unlawful conduct based on specific and consistent facts.
Channel: Communication channels through which messages can be forwarded.
Reporting: The written or verbal transmission of information on violations to the internal or external bodies responsible.
Report Manager: The person responsible for receiving, investigating, assessing and finalising reports.
Reporting process: The formal process for reporting to the competent authorities (through internal or external channels) unlawful conduct or conduct that violates company regulations.
Facilitator: A person who supports a whistleblower in a work context as part of the whistleblowing procedure and whose support is to be treated confidentially in accordance with LD 24/2023.
Acknowledgement: Provision of information to reporting parties on the measures taken or planned as a result of the alert.
Company: Schweitzer Project S.p.A.
Public dissemination: Publication of information about offences in print, digital media, on the Internet or in any other way that can reach a large number of people.

3. Content of the report
The aim of the procedure is to regulate the process of receiving, analysing and processing reports, regardless of who makes them. However, whistleblowers must have become aware of the events or situations to be reported due to the work context.
There is no exhaustive list of all possible violations that can be reported. However, reported issues must at least potentially violate the integrity and ethics of the Company or violate national/European law.
Reference is made to the following acts and omissions:
Criminal offencesCriminal offences;
Torts;
Administrative offencesAdministrative offences
Accounting offencesAccounting offences;
Irregularities - concrete elements (symptomatic indices) such as to lead the whistleblower to believe that one of the breaches provided for in the decree might be committed - (Art. 2(1)(b) Legislative Decree 24/2023)
Violations of EU lawViolations of EU law;
Acts or omissions detrimental to the financial interests of the European Union;
Acts or omissions relating to the internal market that jeopardise the free movement of goods, persons, services and capital;
Acts or conduct that frustrate the object or purpose of the provisions of the European Union;
Acts or omissions that violate the Code of Ethics or other company rules;
Acts or conduct likely to cause financial loss to Company;
Acts or conduct likely to harm Company's image;
Acts or conduct likely to cause harm to the health or safety of Companie's employees, customers and citizens or to cause harm to the environment;
Acts or conduct prejudicial to users or employees or other persons carrying out their activities at Company.
The following areas are excluded from the scope of reporting (see Art. 1 of Legislative Decree 24/2023):
Challenges, claims or demands relating to a personal interest of the whistleblower;
Reports of violations in national security and public procurement in connection with defence or national security - special provisions apply to these areas.
Information on offences to be reported and notified shall in no case include:
Clearly unClearly unffounded information;ounded information;
Information already widely publicised;Information already widely publicised;
Information obtained only based on indiscretions or unreliable rumours.
For the complete list, please refer to Legislative Decree 24/2023.
4. The reporting procedure and available channels
Schweitzer has instructed the professional association Bergs&More (www.bergsmore.com) with offices in Bolzano to handle the reports on behalf of the Company in accordance with the applicable regulations.
Violations of national legislation must be reported through the available internal channels. If the prerequisites are met, external channels may be used as an alternative. Violations of EU law can be reported through internal and external channels, through public disclosure and whistleblowing.
4.1 Internal Channels
In compliance with the provisions of Legislative Decree No. 24/2023, Schweitzer has set up internal channels through which reports can be made in ordinary or anonymous form. Pursuant to Article 5(1)(e) of Legislative Decree No. 24/2023, clear information is provided on the process, procedures, and requirements for internal and external reporting.
To ensure adequate visibility in the workplace and accessibility to persons who, although not in these places, have a legal relationship with the Company, this procedure is published on the Company's website.
Users of these channels are guaranteed confidential treatment of any information concerning their identity or the content of the report. In any case, whistleblowers will receive a confirmation of receipt of their report within 7 days of sending it.
Alerts submitted must contain the following information:
master data of the whistleblowers (in the case of an ordinary report);
the clear and complete description of the reported facts;
the temporal and local circumstances in which the offence was committed;
information or circumstances that make it possible to identify the person or persons who committed the reported offence;
an indication of any other persons in possession of relevant information on the reported facts;
the indication and attachment of documents confirming the accuracy of the facts or circumstances reported;
any other information that may provide useful indications as to the existence and accuracy of the facts or circumstances reported.
A) Written report to be sent in a sealed envelope
Reports can be sent in paper form in a sealed envelope to Bergs&More (www.bergsmore.com) Bolzano office. The envelope must be marked "DO NOT OPEN - Confidential" and sent to the following address: Bergs&More, Via Museo 31, 39100 Bolzano (BZ). The whistleblower must enclose contact details for feedback and further information.
The whistleblower will receive feedback within 3 months after a period of 7 days from the sending of the alert, which can be extended up to a maximum of 6 months in the case of complex investigative activities. The alert manager informs the notifier of the outcome.

B) Reporting Reporting through personal meetingsthrough personal meetings
If he/she so wishes, the whistleblower can arrange a personal meeting with the reporting manager. To arrange such a meeting, please contact the following phone number: +39 0471 324932.
The reporting manager scrupulously checks the reports and provides feedback within 3 months from 7 days of the report (extendable up to a maximum of 6 months in the case of high complexity). The reporting manager informs the whistleblower of the outcome.
4.2 External Channels
Under certain circumstances, whistleblowers may also use an external channel to make reports. One of the following conditions must be met:
- Prescribed internal channels are not active or confidential management of the whistleblower's identity is not ensured;
- The whistleblower has already made a report through the Company's internal channels, which was not properly dealt with;
-The whistleblower has reasonable grounds to believe that a report through internal channels would not be adequately followed up and that there would be a risk of retaliation;
-The whistleblower has reasonable grounds to believe that the offence may pose an immediate or obvious threat to the public interest (e.g. public safety, public health, environmental protection).
In such cases, the relevant report can be made on the ANAC institutional website under 'Whistleblowing': https://www.anticorruzione.it/-/whistleblowing.
If the external channel is used for a report, it will be examined by the ANAC, which will also provide the whistleblower with feedback on the initial examination and the final outcome of the investigation (see Section III of Legislative Decree no. 24/2023).

4.3 Dissemination
Whistleblowers who publish information on irregularities and violations of the law are protected from sanctions and legal consequences by the provisions of Legislative Decree 24/2023 if the following conditions are met:
- the whistleblower has previously submitted an internal and external report or has submitted an external report directly without receiving feedback on the measures planned or taken;
- the whistleblower has reasonable grounds to believe that the offence may pose an immediate or obvious danger to the public interest;
- the whistleblower has reasonable grounds to believe that the external report is at risk of retaliation or cannot be effectively pursued due to special circumstances. This includes, for instance, the possibility of concealment or destruction of evidence or a well-founded fear that the recipient of the report will cooperate with or be involved with the offender.
4.4 Complaint
Legislative Decree No. 24/2023 also provides for the possibility for whistleblowers to apply to the competent national judicial and accounting authorities to lodge a formal complaint concerning unlawful conduct of which they have become aware in the context of an employment relationship.
Again, the same rules on the confidentiality of information on the identity of the whistleblower and the content of reports apply.
4.5 Whistleblowing report verification
The reporting manager is responsible for managing and verifying the accuracy of the facts presented in the report. The reporting manager respects the principles of impartiality and confidentiality. The reporting manager takes all measures deemed appropriate to ensure that the reported facts are carefully examined. This includes a personal interview with the whistleblower and any other person who can provide relevant information on the reported incidents. This comprehensive approach ensures that the review process is transparent, fair, and thorough.
If the alert manager's checks show that the alert submitted is justified, the following measures may be taken:
- the outcome of the investigation by the reporting manager will be communicated to the responsible manager so that appropriate action can be taken;
- the department concerned is invited to take additional measures to adequately protect the company and prevent the reported irregularities or illegalities;
- you can file a complaint with the competent judicial authority to comply with the legal framework and, if necessary, initiate criminal proceedings.

5. Protection and responsibility of the whistleblower
The protection provisions for whistleblowers set out in Article 3 of Legislative Decree No. 24/2023 apply to the persons referred to in point 1. They must be positive of the truthfulness of the report at the time it is made and make the report in the manner described in this document and provided for by Legislative Decree no. 24/2023.
The identity of the whistleblower and all information that may lead directly or indirectly to that identity may not be disclosed without the express consent of the whistleblower. This confidentiality also extends to the involved persons mentioned by the whistleblower, as well as to any intermediaries or other persons mentioned in the report.
If, at the time of the disclosure or dissemination, there are legitimate grounds for believing that the disclosure or dissemination of the information in question is necessary for the investigation of the offence, the whistleblower, pursuant to Article 3 of Legislative Decree No. 24/2023, is also exempt from punishment in the following cases:
if information is disclosed or disseminated on infringements falling under the obligation of confidentiality or concerning copyright protection or the protection of personal data;
if information about offences damaging the reputation of the person concerned or reported is disclosed or disseminated.
In the above cases, any civil or administrative liability is excluded.
This does not apply to conduct, actions or omissions that are not related to reporting, notifying the authorities, publishing the breach or that are not absolutely necessary to discover the breach.

6. Processing of Processing of personalpersonal datadata
The processing of personal data in relation to reports is carried out by Schweitzer as data controller, in compliance with European and national data protection principles and regulations. Reports received, information and communications between the whistleblower and the reporting manager are documented and stored in accordance with applicable data protection regulations and legal guarantees for the confidentiality of such information. The reports received contain personal data and may only be processed and retained for as long as necessary for their processing. This period includes analysis, further investigation, communication of results and the possibility of any additional comments.
In no case will reports be kept for more than five years after the whistleblower has been informed of the results. As regards access to personal data, these are only known to the whistleblower and, if defined in a specific organisational act, to the employees involved in the processing of the report. As part of the processing of the report, the reporting manager may share anonymous information on specific activities and facts to follow up and verify the report submitted.
Furthermore, the rights set out in Articles 15 to 22 of GDPR 2016/679 may be exercised within the limits of Article 2 of Legislative Decree No. 196 of 30 June 2003.

(dd. 15/12/202315/12/2023)