Whistleblowing Privacy Policy

Privacy notice pursuant to Articles 13 and 14 of European Regulation 2016/679 on the processing of personal data within the scope of the Whistleblowing System

In implementation of the current legislation on the subject (Legislative Decree 24/2023 - “Implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law and containing provisions on the protection of persons who report breaches of national law”), Manetti Blanchard S.r.l. (hereinafter also the “Company” or “Manetti Blanchard”) has implemented a system for receiving and managing reports of alleged wrongdoing, which allows the management of the Report (“Report”) submitted by you to the Company through the Company’s specific dedicated channels.

The system is dedicated to receiving and managing Reports, including anonymous ones, received by the Company from company personnel and/or third parties regarding any breaches of national or European Union provisions, breaches of internal rules (rules of conduct set out in the Code of Ethics, the 231 Model and more generally in the Company’s regulatory framework), unlawful conduct and irregularities regarding the conduct of the Company’s business activities.

Pursuant to Articles 13 and 14 of European Regulation 2016/679 (hereinafter “GDPR”), the Company provides this privacy notice regarding the processing of personal data/information (“Data”) relating to you (as the “Whistleblower”), collected directly or otherwise collected, in relation to the Report you submitted, as well as the processing of the data/information of the data subjects affected by the Report itself (hereinafter also “Whistleblowing”).

This Privacy Notice is made available to and brought to the attention of potential data subjects by publication on the Company’s institutional website.

The Company reserves the right, at its discretion, to change, modify, add or remove any part of this Privacy Notice at any time.

All that being said, the Company provides below the privacy notice on the processing of personal data carried out in relation to the management of Reports, governed by Manetti Blanchard’s “Reporting Procedure”.

1. DATA CONTROLLER

The Data Controller is Manetti Blanchard S.r.l., VAT No. 14317200963, whose contact details are as follows:

• Registered office: via Maurizio Gonzaga 7 Milan (MI), 20123;

• PEC address: manettiblanchard@legalmail.it.

The Controller has established the Supervisory Body, appointed pursuant to Art. 6, point 1, letter b) of Legislative Decree No. 231/2001, endowed with independent powers of initiative and control, which is also the owner of the report management process governed by the “Reporting Procedure”, whose members have been appointed as persons authorized to process personal data and have received, in this regard, appropriate operational instructions.

In order to follow up on Reports, the Supervisory Body may use the support of internal/external Company personnel, who will be identified and appointed as persons authorized to process personal data and who will receive, in this regard, appropriate operational instructions.

2. PURPOSES, LEGAL BASIS AND OBLIGATORY OR OPTIONAL NATURE OF THE PROCESSING

Personal Data is processed exclusively for the purposes of investigating and ascertaining the facts subject to the Report and adopting any subsequent measures, as provided for by Legislative Decree 24/2023.

In particular, the personal data collected are only those necessary and relevant for achieving the purposes indicated above, on the basis of the “principle of data minimisation”.

Regarding this data, its provision is voluntary and the Data Subject is requested to provide only the data necessary to describe the facts subject to the Report without communicating personal data that is redundant or additional to what is necessary for the purposes indicated above. If such data is provided, the Controller will refrain from using it and will delete it.

Personal Data is processed on the legal basis of legal obligation, pursuant to Art. 6, paragraph 1, letter b) (Legislative Decree 24/2023 – Legislative Decree 231/01), and the Controller’s legitimate interest, pursuant to Art. 6, paragraph 1, letter f) of the GDPR (provided that the interests or fundamental rights and freedoms of the Data Subject do not prevail), to manage reports of wrongdoing that the Whistleblower has become aware of for work-related reasons, within their work environment or for other reasons, as well as to protect internal and external Data Subjects involved in the Whistleblowing procedure.

3. TYPES OF DATA PROCESSED

Within the scope of the Whistleblowing procedure, the personal data/information subject to processing are the Data of the “Whistleblower” (or “Data Subject”), the “Reported Person” and the persons involved and/or connected to the facts subject to the Report”, such as, for example, any witnesses (“Data Subjects”).

Such Data, collected and processed by the Controller, includes “common” personal data of the Data Subject/Whistleblower, of the Data Subjects (personal details, the position held within the Company to which they belong, contact details such as: email address, postal address, telephone number), any other information present in your Report, and, where necessary, in some cases, also data belonging to special categories pursuant to Art. 9 GDPR or data relating to criminal convictions and offences pursuant to Art. 10 GDPR for the reasons of substantial public interest referred to in the Whistleblowing Decree and in any case within the limits permitted by the relevant legislation, including Articles 9 and 10 GDPR.

Data may be collected both directly from the Data Subject and through other parties involved in the Report, using the specific “internal reporting channel” indicated above or through the other communication channels indicated in the following part of this notice.

The data is voluntarily provided by the Data Subject/Whistleblower, even anonymously, to the Controller, which will not process data that is not strictly necessary for the purposes.

By way of example, but not limited to, the “Report” may be submitted by: employees of the Controller and/or third parties who have a relationship with the Controller.

4. PROCESSING METHODS

Data is collected, in compliance with current regulations, using electronic, telemetric and manual tools, with logics strictly connected to the purposes indicated above, so as to ensure the security and confidentiality of the data itself. In particular, it is collected through the following channels:

• the online platform “internal reporting channel”, pursuant to Art. 4 Legislative Decree 24/2023, provided by a selected external provider that adopts a system for reporting corporate wrongdoing compliant with Directive (EU) 2019/1937, which guarantees the security and protection of data as well as the confidentiality of information, through an advanced system of encryption of communications and the database, in line with the provisions of the relevant legislation. This platform allows Reports to be submitted in writing, both anonymously and non-anonymously, and enables communication with the Whistleblower and the provision of feedback on the Report, in compliance with the timeframes provided for by the regulations. The report is promptly managed by the Supervisory Body in order to ensure the management of the reported case in accordance with the requirements of the relevant legislation;

• the sending of an envelope, containing the whistleblower’s identification data and the Report, to the Supervisory Body.

• orally, through a direct meeting with the Supervisory Body.

Data collected using electronic/telemetric tools will not be subject to fully automated processing as specified in Art. 22 GDPR. Specific security measures are observed to prevent data loss, unlawful or incorrect use and unauthorized access.

Furthermore, specific technical and organisational measures, such as encryption, are adopted pursuant to Art. 32 GDPR to ensure the protection of the Data Subjects’ identities, as well as the Whistleblower’s potential anonymity and complete anonymity when accessing the platform (no logs).

5. DATA RETENTION PERIODS

Personal data will be retained only for the time necessary for the purposes for which it is collected, in compliance with the principle of data minimisation pursuant to Art. 5.1.c) GDPR and, in particular, for the purposes of managing the investigation, concluding the activity to define the Report and adopting the related measures in case of confirmation, and in any case no longer than 5 years from the date of communication of the final outcome of the reporting procedure, in accordance with the provisions of Art. 14, paragraph 1 of Legislative Decree 24/2023 and Art. 5, paragraph 1 of the GDPR.

6. DATA RECIPIENTS

Where necessary for requirements connected to the investigative activities, some information related to the Report may be processed by internal company functions to which specific instructions will be provided (reference is made to functions tasked with carrying out investigations into the report in cases where their knowledge is essential for understanding the reported facts and/or for conducting the related investigation and/or processing activities).

The following may become aware of such Personal Data related to the Report: ANAC, the Judicial Authority, other competent Entities/bodies in relation to the reported case, other external parties (e.g. consulting companies, auditing/review firms, law firms, or parties providing services instrumental to the purposes indicated above, limited to the information necessary for the functions assigned to them) where necessary for requirements connected to the investigative activities, as well as the provider that manages the operation, as well as the maintenance of the platform on which the Report can be submitted and which is, for this purpose, appointed “Data Processor” pursuant to Article 28 GDPR.

Under no circumstances will personal data be disclosed.

7. DATA SUBJECT RIGHTS

Articles 15-22 GDPR grant Data Subjects the possibility of exercising specific rights, such as, for example, the right of access, rectification, erasure, and restriction of processing.

The rights mentioned above may be exercised by submitting a request without formalities to the Controller at the PEC address.

The Data Subject may lodge a complaint pursuant to Art. 57, letter f) GDPR with the Italian Data Protection Authority.

In the event that the exercise of the rights mentioned above by the Reported Person may cause actual and concrete prejudice to the protection and confidentiality of the Whistleblower’s personal data, the Controller may limit, delay or exclude such exercise, pursuant to Art. 2-undecies, paragraph 1, letter f) of the Privacy Code (Legislative Decree 196/2003), and not follow up on the request.

In such cases, the Data Subject’s rights, pursuant to Art. 2-undecies, paragraph 3 of the Privacy Code, may be exercised through the Data Protection Authority using the methods referred to in Art. 160 of the Privacy Code.

8. POTENTIAL TRANSFER OF PERSONAL DATA TO NON-EU COUNTRIES

Personal data referring to the whistleblower, or referring to the reported person or a third party, is not transferred to third countries located outside the EU.

They will be, on 08/09/2026