WHISTLEBLOWING

WHISTLEBLOWING PROCEDURE

1. OBJECTIVE

This procedure aims to regulate the process of receiving, analyzing and managing reports (so-called Whistleblowing) on information (including well-founded suspicions), of which the reporter has become aware within the working context of TrueItalian Experience S.r.l. (hereinafter also "the Company" or the "Body"), regarding violations committed or which, on the basis of concrete elements, could be committed by Company personnel and/or third parties, of the regulatory provisions referred to in Legislative Decree. Legislative Decree 231/2001, as well as violations of the Organisation, Management and Control Model adopted pursuant to Legislative Decree 231/2001 (hereinafter also "Model 231"), of the procedures established for its implementation and of the Company's Code of Ethics .

The procedure also regulates the archiving process and subsequent cancellation of both the reports and the documentation related to them, with the methods indicated in this document.

The procedure is also aimed at implementing Legislative Decree 10 March 2023 n. 24 (hereinafter also “Decree”), published in the Official Gazette. dated 16.03.2023, containing the transposition of Directive (EU) 2019/1937 concerning "the protection of people who report violations of Union law (so-called Whistleblowing discipline)".

The Company adopts the measures deemed most appropriate to facilitate the timely reporting of violations of Model 231, of the procedures established for its implementation and of the Code of Ethics, drawing inspiration from the principles and provisions set out in Legislative Decree no. 10 March 2023. 24 regarding Whistleblowing.

2. SUBJECTIVE SCOPE OF APPLICATION

The recipients of the procedure, to which they have direct access, are the employees of TrueItalian Experience, the top management, the members of the corporate bodies and the Supervisory Body.

In general, according to the provisions of the art. 3 of the Decree, the subjects who can make reports are:

• employed workers even during the probationary period and self-employed workers, as well as collaborators, freelancers and consultants who carry out their work at the Company;
• shareholders and people with administrative, management, control, supervisory or representative functions;
• interns who work for the Company;
• workers or collaborators of contractors, subcontractors and suppliers of the Company;
• former employees of the Company;
• candidates for a job position at the Company, who have acquired information on the violations during the selection process or in other phases of the pre-contractual negotiation;
• in general, any person who in various capacities comes into contact with the Company.

Wide and indiscriminate access to this procedure is guaranteed through its publication in a specific section of the company website.

3. INTERNAL REPORTS

Reports in written form can be sent via ordinary mail to the address:

TrueItalian Experience – San Polo D'Enza (RE) 42020 – Via Ermete Conti n. 7.

In order to ensure the confidentiality of the report, it is necessary for it to be inserted in two closed envelopes, including, in the first, the identifying data of the reporting person and a contact channel that can be used by the Supervisory Body on a confidential basis to provide the expected feedback (personal email, telephone, postal address of the reporter), together with a copy of an identity document and, in the second, the subject of the report. Both envelopes must then be inserted into a third envelope bearing the words "Reserved for the Supervisory Body" on the outside.

The whistleblower may also request to make a report in oral form through a direct meeting (set within a reasonable time) with the Supervisory Body, explaining this need through communication by ordinary mail, to the address indicated above, or via email, to the email address: odv@trueitalianexperience.it. The interview, subject to the consent of the person making the report, is documented by the p personnel in charge by recording on a device suitable for storage and listening, or by means of a report, which the reporting party can verify, rectify and confirm by signing.

Both reporting channels are suitable for protecting the confidentiality of the identity of the reporter, of the subjects involved or otherwise mentioned, of the content of the report and of any documentation attached to it. Correspondence addressed to the Supervisory Body is accessible exclusively to members of the Body itself.

4. ACTIVITIES, RULES AND RESPONSIBILITIES

4.1 Process owner

The owner of the reporting management process is the Company's Supervisory Body.

To manage reports, the Supervisory Body can avail itself of the support of the competent corporate entities, as well as, where necessary, of external entities formally appointed and specifically trained in the matter.

If the report concerns the conduct of one or more members of the Supervisory Body, it is required to promptly inform the Board of Directors of the Company, which will evaluate whether to entrust the investigation to the Supervisory Body, with the exclusion of the the subject(s) involved, or whether to manage it directly, in accordance with this procedure, also with the support of an external consultant.

4.2 Object and requirements of the report

TrueItalian Experience considers relevant reports, for the purposes of the application of this procedure, behaviors, acts or omissions to constitute violations of Legislative Decree 231/2001 (including the commission or attempted commission of one or more predicate crimes) or violations of the Model 231, of the procedures for its implementation and of the Company's Code of Ethics.

There are limitations to the application perimeter of the objective scope of the reports.

Information on reportable violations does not include news that is clearly unfounded, information that is already totally in the public domain, as well as information acquired only on the basis of unreliable rumors or rumors (so-called rumours).

Add to this that reports based on unfounded suspicions or rumors relating to personal facts not constituting an offense are excluded from the scope of this procedure.

The scope of this procedure also does not include disputes, claims or requests linked to a personal interest, which relate exclusively to one's individual working relationships, or inherent to one's working relationships with hierarchically superior figures.

The report must be complete, exhaustive and detailed, in order to allow verification of its validity. Reporters, therefore, are required to provide all available and useful elements to allow the necessary and appropriate checks and assessments to verify the validity of the facts covered by the report, such as, by way of example:

• the circumstances of time and place in which the reported facts were committed;
• a clear and complete description of the facts covered by the report;
• the personal details or other elements that allow the identification of the person(s) who committed the reported facts;
• any other information that may provide useful feedback regarding the existence of the facts reported;
• the indication of any other subjects who can report on the facts being reported;
• any documents supporting the report.

The requirements described above do not necessarily have to be respected at the same time, in consideration of the fact that the reporting parties may not have full availability of all the information requested at the time of sending the report, but they must be able to be reconstructed in the investigation phase.

Any anonymous reports will not be processed pursuant to this procedure, but will in any case be recorded, stored and evaluated by the Supervisory Body, if they are timely, detailed and supported by suitable documentation.

It is understood that, should the identity of the anonymous reporter be subsequently revealed, he or she will be guaranteed all the protections provided for pursuant to Legislative Decree 24/2023 (see paragraph 6).

4.3 Transmission of the report

Anyone who becomes aware of information on violations, as defined in this procedure, committed or which, based on concrete elements, could be committed, is required to promptly report to the Company's Supervisory Body.

Reports received from other corporate entities or other control bodies of the Company must be forwarded (in original), within seven days of receipt, to the Supervisory Body, without retaining a copy and using the channels set up in order to protect the confidentiality and integrity of the reported subjects and the effectiveness of the investigations.

Failure to promptly transmit said reports to the Supervisory Body constitutes a violation of the procedure and constitutes a disciplinary offense punishable by sanction (see paragraph 7).

4.4 Verification of the report / Preliminary investigations

Once the report has been received, the Supervisory Body provides the reporting party, within seven days from the date of receipt of the report, with an acknowledgment of receipt of the same, using the contact details provided.

The Supervisory Body must immediately carry out the necessary investigations, guaranteeing the confidentiality of the identity of the reporter, of the subjects involved or otherwise mentioned and of the content of the report in all subsequent phases of its management.

Within three months of the acknowledgment of receipt of the report or, in the absence of such notice, within three months of the expiry of the seven-day period from the submission of the same, the Supervisory Body provides the reporting party with feedback, using the contacts provided, with information regarding the follow-up that has been given or is intended to be given to the report.

During the investigation, the Supervisory Body may avail itself of the support of competent corporate entities or, where necessary, external consultants and, if it deems it appropriate - depending on the nature of the alleged violation - it may inform the Board of Directors of the Company.

If, following the outcome of the investigation, no elements emerge to follow up on the report, the Supervisory Body proceeds to archive the information, formalizing the analytical justification.

If, however, following the outcome of the investigation, the report is found to be well founded, the Supervisory Body starts the subsequent investigation phase.

4.5 Verification of the report / Specific investigation

In the event of a report requiring investigation, the Supervisory Body proceeds with an in-depth investigation of the facts reported, adhering to procedures compliant with the laws in force and the applicable employment contracts which include, among other things, the faculty - on the part of the competent functions - to analyze company email (only upon prior notification) and all documents pertinent to company activities, as well as carry out interviews with employees and third parties. For this purpose, the Supervisory Body may make use of internal or external resources, in relation to the necessary skills.

The Supervisory Body may request additions or clarifications from the reporting party. Furthermore, it can acquire information from the people involved in the report, who also have the right to request to be heard or to produce written observations or documents.

In any case, the Company guarantees that as part of internal investigation activities, the processing of personal data, including those of a sensitive or judicial nature, takes place in full compliance with the regulations on privacy.

4.6 Outcome of the investigation and subsequent obligations

If the outcome of the investigation proves that the report is well founded, the Supervisory Body reports the provisions that are alleged to have been violated and expresses its assessment regarding the elements of evidence ascertained, the nature of the violation and its seriousness with respect to the principles and provisions of Model 231 or of the Code of Ethics.

The Supervisory Body is in turn required to immediately inform, according to its competence, the corporate entities with the necessary sanctioning and disciplinary powers and authorities.

Furthermore, it can propose to the competent bodies the disciplinary measure it deems most suitable, proportionate and sufficiently dissuasive in order to prevent the repetition of the violation.

If criminal proceedings are opened on the same facts that are the subject of an internal investigation, the Company guarantees respect for the rights of defense recognized by law to the witness or suspect.

Closed reports, as they are clearly unfounded, will be evaluated by the Supervisory Body with the other competent company structures in order to verify whether the report was made for the sole purpose of damaging the reputation or damaging or in any case causing prejudice to the person and /or reported company, for the purposes of activating any appropriate initiative against the reporting party.

The voluntary reporting of facts which are known to be false or clearly unfounded or which are known not to have been committed by the reported person constitutes a disciplinary offence, sanctioned pursuant to the sanctioning system (see par. 7). The Company reserves the right to take any action, even if not of a disciplinary nature, against anyone who intentionally or grossly negligently makes untruthful reports or reports aimed at damaging the Company, the Corporate Bodies or its personnel.

4.7 Conservation and documentation locking

The information and any other personal data acquired are processed in compliance with the confidentiality obligations referred to in the art. 12 of Legislative Decree 24/2023 and the principle referred to in articles. 5, par. 1, letter. e) as well as the articles. 5 par. 1 letter c) and art. 25 of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and art. 3, co. 1, letter. e) of Legislative Decree no. 51 of 2018. Personal data that is clearly not useful for the processing of a specific report are not collected or, if collected accidentally, are deleted immediately.

In order to guarantee the management and traceability of reports and consequent activities, the Supervisory Body takes care of the preparation and updating of all information regarding reports and ensures the archiving of all related supporting documentation for the time strictly necessary for their definition and in any case for no more than 5 years, starting from the date of communication of the final outcome of the report.

The originals of the reports received in paper form are stored in a special environment, accessible only to authorized parties.

5. REPORTING

The Supervisory Body informs the Board of Directors on the status of the reports received, with details of any checks carried out and the related outcomes, when the periodic reports are issued.

• Such periodic reports must contain the following aggregate information:
• summary statement containing the number of reports received, the type of report received (open / anonymous), the status, the subject, the outcome of the activities carried out and any measures adopted;
• any indications regarding the necessary corrective actions on the areas and company processes examined, adopted by the competent management who is informed of the results of the analyses.

Furthermore, if at the end of the investigation unequivocal elements emerge that indicate the validity and particular seriousness of the subject of the report and/or possible cases of criminal or civil liability, the Supervisory Body promptly informs the Board of Directors. Administration, to allow any interventions deemed appropriate by the administrative body.

6. GUARANTEES AND PROTECTIVE MEASURES

6.1 Protection of the identity of the reporter and of the subjects involved / mentioned in the report

The subjects involved in the management of reports are required to protect the confidentiality of the identity of the reporter, of the people involved and/or in any case mentioned in the report, of the content of the report and of the related documentation, also pursuant to the regulations on privacy (Regulation (EU) 2016/679 - GDPR).

Confidentiality is also guaranteed to those who report before the start or after the termination of the employment relationship, or during the probationary period, if said information was acquired within the working context or in the selective or pre-contractual phase.

Confidentiality regarding the identity of the people involved and/or mentioned in the report is also guaranteed, with the same guarantees provided for the reporter.

6.2 Protective measures

The Company prohibits any act of retaliation or discrimination, direct or indirect, against the reporter for reasons connected, directly or indirectly, to the report, even if the report proves to be unfounded in substance.

The protection measures apply within the limits and conditions provided for in Chapter III of Legislative Decree 24/2023 and are also extended to:

• the "facilitators", i.e. the natural persons operating within the same working context with the task of assisting the whistleblower in the reporting process, keeping their assistance activity confidential;
• natural persons who are linked to it by a stable emotional or kinship bond within the fourth degree;
• the whistleblower's work colleagues who work in the same work context and who have a usual and recurring relationship with him;
• the entities owned by the reporter or for which he works as well as the entities that operate in the same working context as the reporter.

Violations of confidentiality protection measures or protection measures from retaliatory or discriminatory acts constitute a disciplinary offence, sanctioned pursuant to the sanctioning system (see par. 7).

However, disclosure of the identity of the reporter and of any other information or element of the report from the disclosure of which the identity of the reporter can be directly or indirectly deduced is permitted only if it represents a necessary and proportionate obligation imposed by law, in the context of investigations by the National Anti-Corruption Authority (ANAC) or by judicial proceedings, also in order to safeguard the right to defense of the person involved. In any case, before disclosing such information it is necessary to obtain the express consent of the person making the report or communicate to him in writing the reasons underlying the need for such disclosure of his identity.

The behavior or fact which is the subject of the report, in particularly serious cases, may be brought to the attention of the Police Authorities, the Judicial Authorities or other competent Authorities, together with the results of the verification activities already carried out by the Company.

The Company's process and/or internal disciplinary measures must not be conditioned by any proceedings initiated by the judiciary for the same offence.

7. SANCTION AND DISCIPLINARY MEASURES

TrueItalian Experience foresees and (if the conditions are met) adopts disciplinary sanctions against:

• of those who are responsible for any retaliatory or discriminatory act or in any case for illegitimate prejudice, direct or indirect, towards the reporting party (or anyone who collaborated in ascertaining the facts which are the subject of a report) for reasons connected, directly or indirectly, to reporting;
• of anyone who violates the confidentiality obligations referred to in this procedure;
• of the reported person, or any other subjects involved in the reported facts, for the responsibilities ascertained;
• of those who, having received a report, fail to send it to the Supervisory Body within 7 days, retain a copy of it or use channels that are not suitable for guaranteeing the confidentiality and integrity of the subjects involved and the effectiveness of the investigations;
• of employees, as required by law, who have made an unfounded report with intent or gross negligence.

Disciplinary measures will be proportionate to the extent and seriousness of the illicit conduct ascertained, potentially leading, in the most serious cases, to the termination of the employment relationship.

With reference to the members of the Corporate Bodies, the appropriate initiatives envisaged by current legislation will be taken, potentially even leading to revocation of the office.

With regard to third parties (e.g. partners, suppliers, consultants), the legal remedies and actions provided for in the contracts apply by virtue of specific clauses contained therein.

8. PROCESSING OF PERSONAL DATA

The personal data of the whistleblowers, those reported and all the subjects involved in the reporting are processed in accordance with the current legislation on the protection of personal data referred to in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ( “GDPR”) and referred to in Legislative Decree 196/2003, as amended by Legislative Decree 101/2018.

In particular, it is highlighted in this context that:

• the processing activities underlying the management of the report are carried out in compliance with the principles dictated by the art. 5 GDPR;
• the reporting party must receive information pursuant to art. 13 GDPR which specifies the purposes and methods of processing of personal data and the retention period of the same, the conditions of lawfulness on which the processing is based, the categories of recipients to whom the data may be transmitted in the context of the management of the reporting and the rights recognized to the reporter by the Regulation;
• the reporting system provides for the processing of personal data (potentially also the particular data referred to in art. 9 GDPR) as adequate, relevant and limited to what is necessary with respect to the purposes for which they are collected;
• personal data will be processed for the time necessary to achieve the purposes that justify their collection (e.g. evaluation and management of the report); once the processing purpose has been exhausted, the personal data will be stored on the basis of the criteria and for the periods indicated in the privacy information provided to the interested party and subsequently deleted or anonymized;
• the appropriate technical and organizational measures are implemented to guarantee the security of personal data, in compliance with current legislation, both during the transmission of the report and during the management and archiving of the report;
• the exercise of rights by the whistleblower, the person reported or the third party ("interested" subjects pursuant to privacy legislation), in relation to their personal data processed as part of the reporting management process as described by this procedure, may be limited, pursuant to and for the purposes of Article 2-undecies of Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, in the event that such an exercise could result in actual harm and concrete to other interests protected by specific regulatory provisions, with the clarification that under no circumstances can the reported party be allowed to avail of their rights to obtain information on the identity of the reporter;
• access to personal data is granted only to those responsible and authorized to receive this type of report, limiting the transfer of confidential information and personal data only when this is necessary;
• personal data are retained only for the appropriate and proportionate terms in order to allow the execution of the procedure.
•  

9. NORMATIVE REQUIREMENTS

9.1 External regulatory references

• Legislative Decree 8 June 2001 n. 231, Discipline of the administrative responsibility of legal persons and subsequent amendments;
• GDPR - Regulation (EU) 2016/679 – Privacy;
• Legislative Decree 30 June 2003 n. 196 (Code regarding the protection of personal data) and subsequent amendments and additions, including Legislative Decree 10 August 2018, n. 101, as well as the related legislative provisions;
• L. 20 May 1970, n. 300 art. 7 Workers' Statute, Disciplinary sanctions;
• L. 30 November 2017, n. 179 regarding Whistleblowing;
• Legislative Decree 10 March 2023 n. 24, published in the Official Gazette. on 16 March 2023, containing the transposition of Directive (EU) 2019/1937 on Whistleblowing;
• “Guidelines on the protection of people who report violations of Union law and protection of people who report violations of national regulatory provisions – procedures for the submission and management of external reports” adopted by ANAC with resolution of 12 July 2023;
• “Whistleblowing operational guide” by Confindustria of 27 October 2023.

9.2 Internal regulatory references

• Organization, Management and Control Model pursuant to Legislative Decree 231/2001;
• Ethical code.