Whistleblowing Procedure

1. INTRODUCTION AND PURPOSE OF THE PROCEDURE

1.1. Regulatory Context

On March 15, 2023, Legislative Decree No. 24/2023 (hereinafter referred to as the “Whistleblowing Decree”) was published in the Official Gazette, implementing EU Directive 2019/1937, concerning the protection of individuals who report violations of European Union law and containing provisions regarding the protection of whistleblowers.

“Whistleblowing,” in particular, refers to the reporting of behaviors, acts, or omissions that violate the provisions of the Organization, Management and Control Model pursuant to Legislative Decree 231/2001, or national or European Union legal provisions that harm the public interest or the integrity of a public administration or a private entity, made by an individual who became aware of it within their public or private work context.

1.2. Purpose of the Procedure

This procedure applies to New Line RdM and aims to implement and regulate the irregularity reporting system within the Company’s activities.

The procedure incorporates the provisions of the Whistleblowing Decree and complies with the legislation on personal data protection, particularly with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council, dated April 27, 2016, regarding the protection of natural persons concerning the processing of personal data.

The reporting system regulated here also holds relevance for Legislative Decree June 8, 2001, No. 231, which, regarding internal reports, applicable sanctions and the prohibition of retaliation in relation to them, refers to the aforementioned Decree.

In addition to the aforementioned legal provisions, the procedure has been prepared considering the provisions of our Code of Ethics.

This document aims to illustrate the process for reporting unlawful conduct within the corporate context, specifically:

  • identify individuals who may submit reports;
  • define the scope of behaviors, events, or actions that may be subject to reporting;
  • identify the channels through which reports can be made;
  • outline the operational methods for submitting and managing reports, as well as any consequent verification activities;
  • inform the whistleblower and the reported person about the forms of protection that are recognized and guaranteed.

2. DEFINITIONS

“ANAC” The National Anti-Corruption Authority

“Privacy Code” Legislative Decree June 30, 2003, No. 196 (“Code regarding the protection of personal data”) which provides for the protection of individuals and other subjects concerning the processing of personal data

“Decree 231” Legislative Decree June 8, 2001, No. 231 and subsequent amendments and integrations

“Whistleblowing Decree” Legislative Decree March 10, 2023, No. 24

“Recipient” Refers to an individual designated by New Line as the recipient and manager of Whistleblowing Reports, with a duty of confidentiality regarding the information acquired

“Directive” Directive (EU) 2019/1937

“GDPR” Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, regarding the protection of natural persons concerning the processing of personal data, as well as the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation)

“Model 231” The organization and management model provided by Decree 231, not adopted by the Company

“Procedure” or “Whistleblowing Procedure” This procedure approved by the administrative body and published in December 2023

“Whistleblower(s)” Those who have the right to make a Whistleblowing Report under the Whistleblowing Decree and, in general, this Procedure, including employees, collaborators, shareholders, individuals who perform (even de facto) functions of administration, management, control, supervision, or representation of the Company and other third parties who interact with the Company (including suppliers, consultants, intermediaries, etc.), as well as interns, probationary workers, job candidates and former employees

“Whistleblowing Report” or “Report” The report submitted by a Whistleblower in accordance with the principles and rules of this Procedure

“Anonymous Whistleblowing Report” or “Anonymous Report” Reports that do not contain details that allow or could allow, even indirectly, the identification of the Whistleblower

“Involved Person” The natural or legal person mentioned in the Report as the person to whom the Violation is attributed or as a person otherwise implicated in the reported Violation

“Connected Parties” Individuals to whom the same protections provided by the Whistleblowing Decree for the Whistleblower apply, including: (i) facilitators; (ii) individuals in the same work environment as the Whistleblower who are connected to them by a stable affective or familial relationship up to the fourth degree; (iii) colleagues of the Whistleblower who work in the same work environment and have a habitual and ongoing relationship with the Whistleblower; (iv) entities owned by the Whistleblower or for which the Whistleblower works, or entities that operate in the same work environment

“Facilitator” a natural person who assists the Whistleblower in the process of making the Report, operating within the same work environment, whose assistance must be kept confidential (these are individuals who, having a qualified connection with the Whistleblower, could suffer retaliation due to this connection).

3. SCOPE OF APPLICATION

Violations that may be reported under the Whistleblowing Decree must concern behaviors, acts, or omissions that harm the public interest or the integrity of the public administration or the private entity (i.e., New Line), of which the Whistleblower became aware within the work context of New Line and which consist of:

I. Unlawful conduct relevant under Decree 231, which does not fall within the offenses listed below (the “231 Reports”);

II. Offenses falling within the scope of European Union or national acts (as referenced in the Whistleblowing Decree) related to the following sectors:

  1. public procurement;
  2. financial services, products and markets and prevention of money laundering and terrorist financing;
  3. product safety and compliance;
  4. transport safety;
  5. environmental protection;
  6. radiation protection and nuclear safety;
  7. food and feed safety, animal health and welfare;
  8. public health;
  9. consumer protection;
  10. protection of privacy and personal data and security of networks and information systems.

III. Acts or omissions that harm the financial interests of the European Union, as indicated in the Whistleblowing Decree;

IV. Acts or omissions concerning the internal market, including violations of European Union rules on competition and State aid, as well as violations related to the internal market connected to acts that breach corporate tax laws or mechanisms aimed at obtaining a tax advantage that undermines the object or purpose of the applicable corporate tax legislation, as indicated in the Whistleblowing Decree;

V. Acts or behaviors that undermine the object or purpose of the provisions of Union acts in the sectors mentioned in points 2), 3) and 4).

4. TYPES OF REPORTS

The following types of reports are identified at New Line:

  • Violations of codes of conduct
  • Financial/Accounting/Administrative violations
  • Reputational violations
  • Corruption
  • Incitement to corruption
  • Abuse
  • Theft
  • Absenteeism
  • Harassing or violent behavior
  • Violation of recruitment/hiring procedures
  • Conflict of interest
  • Disclosure of confidential information (Violation of confidentiality obligation)
  • HR Department Violations
  • General Management Violations
  • Other (Conduct considered unlawful and likely to cause harm to New Line RDM or to employees or other individuals working at the company and not falling under the previous categories)

The Whistleblower is encouraged to make Reports as detailed as possible and to provide the maximum amount of information to enable proper verification and achieve appropriate feedback.

5. INTERNAL REPORTING CHANNEL

The Company has activated, pursuant to the Whistleblowing Decree, the following internal reporting channel that allows the submission of reports in written and oral form via electronic means and ensures, including through encryption, the confidentiality of the Whistleblower and the Involved Person, as well as the content of the report and related documentation.

https://newlinerdm.segnalazioni.net

Access to the internal reporting channel is granted only to the Recipient of the Reports (as identified in the following section of this Procedure).

System administrators may access the reporting channel only for technical needs and do not access the reports in any way.

Anonymous Reports will also be considered, provided they are adequately detailed and specific, as the platform allows for the establishment of a communication channel with the Whistleblower even in this case.

6. DESIGNATED RECIPIENTS OF REPORTS

The Company has designated the Chief Executive Officer together with the Head of Human Resources of the Company as the Recipients of the Reports, who have received specific training in this regard (the “Recipient”).

The names of the Recipients are made public so that, if a Recipient is an Involved Person in the Report, the Whistleblower may choose to direct the Report using a specific type that excludes this person:

  • HR Department Violations: excludes the Head of Human Resources
  • General Management Violations: excludes the Chief Executive Officer

7. MANAGEMENT OF INTERNAL REPORTS

7.1. Preliminary Evaluation of the Report

Upon receipt of the Report, the Recipient:

  • conducts a preliminary analysis of its contents, if deemed appropriate, also with the support of specialized external consultants, in order to assess its relevance in relation to the scope of the Whistleblowing Decree and, in general, of the Procedure;
  • archives the Report if it is considered inadmissible according to the provisions of the Whistleblowing Decree and this Procedure, such as in the following cases: o manifestly unfounded due to the absence of factual elements attributable to the typified Violations; o verified generic content of the report of wrongdoing that does not allow an understanding of the facts or any verification; o submission of documentation only without reporting any unlawful conduct.
  • In such cases, the Recipient must provide the Whistleblower with a written explanation of the reasons for the archiving;
  • As provided by Article 4 of the Whistleblowing Decree, the Report submitted to a person other than the Recipient must be forwarded immediately (within seven days) to the latter, with simultaneous notification to the Whistleblower.

7.2. Management of the Report

The management of the Report is carried out in compliance with the provisions of this Procedure. When managing the Report, the Recipient performs the following activities:

  • issues the Whistleblower with an acknowledgment of receipt of the Report within seven days from the date of receipt;
  • maintains communication with the Whistleblower and—if necessary—requests additional information from them;
  • provides diligent follow-up to the Reports received;
  • provides a response to the Report within three months from the date of the acknowledgment of receipt of the Report or, in the absence of such acknowledgment, within three months from the expiration of the seven-day period from the submission of the Report.

The Recipient is entitled to request the support of internal functions or specialized external consultants, in compliance with the confidentiality requirements set forth by the Whistleblowing Decree and this Procedure.

The Recipient is also entitled to request clarifications and/or additional information from the Involved Person during the management of the Report.

Furthermore, the Whistleblower retains the possibility of providing additional information if the reported fact continues, is interrupted, or even worsens.

Reports (and related documentation) are retained by the Recipient for the time necessary to process them and, in any case, no longer than five years from the date of communication of the final outcome of the Report management process.

7.3. Internal Investigation Process

The Recipient, in order to assess a Report, may carry out the necessary internal investigations either directly or by appointing—without prejudice to the obligation of confidentiality—an internal or external party to the Company.

7.4. Closure of the Report

The evidence collected during internal investigations is analyzed to understand the context of the Report, to determine whether a relevant Violation has indeed occurred under this Procedure and/or the Whistleblowing Decree and to identify disciplinary measures, appropriate measures to remedy the situation and/or to prevent a similar situation from recurring in the future.

Furthermore, if a Violation is confirmed, the Recipient may:

  • initiate a sanctioning procedure against the Involved Person, in compliance with applicable laws;
  • evaluate—also together with other competent corporate functions—the opportunity to initiate a disciplinary procedure against the Whistleblower in the case of Reports in which bad faith and/or a merely defamatory intent are confirmed, also evidenced by the unfounded nature of the Report itself;
  • agree, together with the corporate function affected by the Violation, on a possible action plan necessary to address process weaknesses, ensuring monitoring of its implementation.

8. PROTECTION MEASURES

8.1. Protection Measures for the Whistleblower

Reports must be made in good faith, without prejudice to the criminal liability of the Whistleblower if a Report constitutes the offense of slander or defamation or other criminal offenses.

The Whistleblowing Decree provides the following protection measures for the Whistleblower and Connected Parties:

  • prohibition of retaliation due to a Report
  • support measures, which consist of information, assistance and free advice from third-sector entities listed in a directory available on the ANAC website regarding reporting methods and legal provisions in favor of the Whistleblower and the Involved Person;
  • protection against retaliation, which includes: o the possibility to report to ANAC the retaliation they believe they have suffered as a result of a Report; o the provision for the nullity of acts taken in violation of the prohibition of retaliation, which can also be asserted in court;
  • limitation of liability in the case of disclosure (or dissemination) of violations covered by confidentiality obligations or related to the protection of copyright or personal data, or information about violations that harm the reputation of the person involved or reported, if at the time of disclosure (or dissemination) there were reasonable grounds to believe that it was necessary to reveal the Violation;
  • limitation of liability, unless the fact constitutes a crime, for acquiring information about Violations or accessing them;
  • sanctions (as outlined in this Procedure).

8.2. Conditions for the Application of Protection Measures

The above-listed protection measures apply to the Whistleblower and Connected Parties provided that:

  • at the time of the Report, the author of the Report had reasonable grounds to believe that the information about the reported or disclosed Violations was true and fell within the scope of the Whistleblowing Decree;
  • the Report was made in accordance with the provisions of the Whistleblowing Decree.

In particular, retaliation refers to the cases provided for in Article 17 of the Whistleblowing Decree, including but not limited to the following:

  1. dismissal, suspension, or equivalent measures;
  2. demotion or lack of promotion;
  3. change of duties, change of workplace, salary reduction, modification of working hours;
  4. non-renewal or early termination of a fixed-term employment contract;
  5. discrimination or otherwise unfavorable treatment;
  6. early termination or cancellation of the contract for the supply of goods or services.

9. CONFIDENTIALITY OBLIGATIONS

The Company, in establishing and implementing its internal Reporting channels, ensures the confidentiality of the identity of the Whistleblower, the Reported Person and any other individuals involved, as well as the content of the Report and related documentation, through the security systems offered by the channel used.

Reports may not be used beyond what is necessary to provide appropriate follow-up to them.

The identity of the Whistleblower and any information from which it could be inferred, directly or indirectly, may not be disclosed, without the express consent of the Whistleblower, to persons other than those authorized to receive or follow up on Reports and expressly authorized to process such data.

10. DATA PROTECTION

The processing of personal data in the management of the internal reporting channel and the Reports received must be carried out in accordance with Regulation (EU) 2016/679 (GDPR) and Legislative Decree 30 June 2003, no. 196 (as amended and supplemented).

The Company has defined its own model for receiving and managing internal Reports, identifying appropriate technical and organizational measures to ensure a level of security adequate to the specific risks arising from the processing carried out, based on a data protection impact assessment pursuant to Article 35 of the GDPR.

The relationship with external suppliers who process personal data on behalf of the Company is governed by a data processing agreement pursuant to Article 28 of the GDPR, which defines the duration, nature and purpose of the processing, the type of personal data and categories of data subjects, as well as the obligations and rights of the data controller, in accordance with the provisions of Article 28 of the GDPR.

The persons authorized to receive or follow up on Reports under this Procedure have been appointed and instructed to process personal data related to the Reports in accordance with Articles 29 and 32 of the GDPR and Article 2-quaterdecies of the Privacy Code.

Appropriate information must be provided to the Whistleblowers and the Involved Persons pursuant to Articles 13 and 14 of the GDPR.

The exercise of rights by the Involved Person (including the right of access) may be exercised within the limits allowed by applicable law and following an analysis by the designated bodies, in order to balance the need to protect individual rights with the need to prevent and combat violations of corporate governance rules or applicable regulations.

Personal data that are manifestly not useful for the processing of a specific Report are not collected or, if collected, must be deleted immediately.

11. SANCTIONS

Effective, proportionate and dissuasive disciplinary sanctions may be applied:

  • against the Reported Person, if the Reports are found to be well-founded;
  • against the Whistleblower, if Reports are made in bad faith;
  • against the Responsible Person, if the protection principles provided for by the Procedure are violated or if the Reports have been obstructed or if attempts have been made to obstruct them.

The disciplinary procedure is initiated in accordance with the principle of proportionality, as well as the criterion of correlation between the infraction and the sanction and, in any case, in compliance with the procedures provided for by the applicable laws in force.

In order to ensure impartiality and avoid conflicts of interest, decisions regarding any disciplinary measures, complaints, or other actions to be taken are made by the designated corporate organizational functions and, in any case, by individuals other than those who conducted the investigation activities related to the Report.

12. EXTERNAL REPORTING CHANNEL

The Whistleblower may make an external report through the channel established and accessible on the ANAC website.

It is specified that recourse to the external reporting channel established at ANAC may only occur if: I. the internal reporting channel indicated in the Procedure is not active; II. the Whistleblower has already made a Report through the channel indicated in the Procedure and it has not been followed up; III. the Whistleblower has reasonable grounds to believe that, if they were to make an internal Report through the channel provided by this Procedure, it would not be followed up or that the Report could lead to the risk of retaliation; IV. the Whistleblower has reasonable grounds to believe that the Violation to be reported could pose an imminent or obvious danger to the public interest.

For the use of this external reporting channel or for resorting to public disclosure, please refer to the guidelines and the official ANAC website.

13. INFORMATION AND TRAINING

The information about this Procedure is made accessible and available to everyone and published on the institutional website www.newl.it.

The information about the Procedure is also made available during the hiring process of an employee.

Training on whistleblowing and, in general, regarding the provisions of this Procedure is also included in the staff training plans provided by the Company.