1. PURPOSE

Hi-Lex Italy S.p.A. (hereinafter "the Company") has implemented internal systems for reporting unlawful conduct in order to allow the subjects indicated in paragraph no. 2 below to report acts or facts that may constitute one of the violations listed under the heading "Unlawful conduct or violation" referred to in paragraph no. 2, and in compliance with current legislation:

• Legislative Decree no. 24 of 10 March 2023 "Implementation of Directive (EU) 1937/2019 of 23 October 2019 [...], concerning the protection of persons who report breaches of Union law and laying down provisions concerning the protection of persons who report breaches of national regulatory provisions".

This guide, which is an integral part of the Organisation, Management and Control Model pursuant to Legislative Decree 231/01, aims to define the roles, responsibilities, operating methods and behavioural principles to which the Company's staff must comply in the management of internal reports.

This document, therefore, defines the corporate policies relating to the management of internal reports to be observed in order to ensure the protection and confidentiality of the identity of the whistleblower, aiming to prevent the occurrence/perpetration of unlawful conduct within the Company, as well as compliance with the laws in force.

 

2. DEFINITIONS AND SCOPE

Unlawful Conduct or Violation:

With reference to Hi-Lex Italy S.p.A., the provisions of Legislative Decree 24/2023 apply to subjects who make internal reports of:

- unlawful conduct pursuant to Legislative Decree no. 231 of 8 June 2001, or violations of the organisation and management models provided for therein, which do not fall under numbers 3), 4), 5) and 6) of art. 2 paragraph 1 letter a) of Legislative Decree 24/2023;

In addition, the provisions of Legislative Decree 24/2023 apply to persons who make internal or external reports, public disclosures or complaints to the Judicial or Accounting Authority of:

- offences that fall within the scope of the European Union or national acts indicated in the annex to Decree 24/2023 or national acts that constitute implementation of the European Union acts indicated in the annex to Directive (EU) 2019/1937, although not indicated in the annex to the aforementioned Decree, relating to the following sectors: public procurement; financial services, products and markets and the prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; protection of privacy and protection of personal data and security of networks and information systems;

- acts or omissions affecting the financial interests of the Union as referred to in Article 325 of the Treaty on the Functioning of the European Union as specified in the relevant secondary legislation of the European Union;

- acts or omissions relating to the internal market, as referred to in Article 26(2) of the Treaty on the Functioning of the European Union, including infringements of the European Union competition and State aid rules, as well as infringements concerning the internal market linked to acts infringing corporate tax rules or mechanisms the purpose of which is to obtain a tax advantage which defeats the object or purpose of the applicable legislation corporate tax;

- acts or conduct which frustrate the object or purpose of the provisions of Union acts in the areas referred to in numbers 3), 4) and 5) of art. 2 paragraph 1 letter a) of Legislative Decree 24/2023.

 

By way of example, the following reports do not fall within the above definition, and consequently will not be processed in accordance with the provisions of this document:

 

• reports on situations of a personal nature concerning claims or grievances relating to relations with hierarchical superiors or colleagues, as well as relating to the performance of one's work;
• reports based on mere suspicions or rumors concerning personal facts that do not constitute an offence.

 

Retaliation: any retaliatory or discriminatory behaviour, direct or indirect, directed at the whistleblower for reasons related, directly or indirectly, to the report. These could include, but are not limited to, any disciplinary sanctions, demotion, dismissal or transfer to another location/function.

 

The guide in question applies to Hi-Lex Italy S.p.A., and specifically to all the subjects defined below.

 

Whistleblower: persons with administrative, managerial, control, supervisory or representative functions at the Company; all workers, collaborators, freelancers, consultants, volunteers, trainees, paid and unpaid, who work in the Company; persons who have held the above roles in the past, if information on violations has been acquired during the course of the relationship,  and persons with whom the relationship has not yet arisen – for example, recruitment candidates or employees during the probationary period.

 

Reported: the person to whom the whistleblower attributes the commission of the unlawful act/irregularity represented in the report.

 

3. REFERENCES

• Code of Ethics (Annex 1);
• Organization, Management and Control Model pursuant to Legislative Decree 231/2001;
• Legislative Decree 231 of 2001;
• Legislative Decree no. 24 of 10 March 2023 (Annex 3).

 

4. RESPONSIBILITIES AND PRINCIPLES OF CONDUCT

The Company's personnel involved, in any capacity, in the company's activities, are required to comply with the principles of conduct set out in this guide, the provisions of the law on the subject, the rules referred to in the Code of Ethics and the provisions contained in the Model and the body of procedure adopted by the Company.

Under no circumstances is it permitted for the Company's employees to proceed independently with the conduct of investigations in order to ascertain the actual existence of the fact.

All information received will be processed by  the Whistleblowing Committee (hereinafter the CRS) in full compliance with the principles of confidentiality and confidentiality and, for the applicable areas, in accordance with the provisions of current legislation on the protection of personal data[1]. For further information on confidentiality, please refer to art. 12 of Legislative Decree 24/2023 (Annex 3).

It should be noted that failure to comply with this guide constitutes a disciplinary offence for failure to comply with Model 231 and the rules-provisions referred to therein, which may be sanctioned by the Company.

The identification and imposition of any sanctions will take into account the principles of proportionality and adequacy with respect to the alleged violation, and in any case, the form and methods provided for by current legislation.

With particular reference to employees, the sanctioning system will be applied in accordance with the provisions of the National Collective Labour Agreement applied.

 

5. CONTENTS OF THE REPORT

In the information provided, the whistleblower is required to describe all the available and useful elements to allow the necessary and appropriate checks and assessments to be carried out to verify the validity of the facts reported, such as:

 

• identity of the whistleblower and contact information (optional);
• a clear and complete description of the facts that are the subject of the report;
• the circumstances of time and place in which the acts that are the subject of the report were committed;
• personal details or other elements that make it possible to identify the person(s) who have/have carried out the reported facts (e.g. title, place of employment where the activity is carried out);
• any documents supporting the report;
• the indication of any other subjects who may report on the facts being reported;
• any other information that may provide useful evidence about the existence of the facts reported.

6. OPERATING METHODS

 

1. 1. Whistleblowing Channels

The Company has implemented the following communication channel for reporting unlawful conduct, which can be reached at the address hi-lex.segnalazioni.net or by framing the following QR Code:

 

In the event of receipt of reports through channels other than the one provided, the Company will not be taken into consideration.

 

The Whistleblower may:

• Confidentially and securely access the system in different ways:

1. Confidential Mode, by registering with the system to send a report "nominative and

with confidential identity management" (registered user);

2. Anonymous Mode, by sending a report without registration and identification;

• Enter your reports, written or spoken, through an intuitive and easy-to-fill procedure;

• Submit the report via the web platform or from the Legality Whistleblowing mobile app.

 

1. 2. Whistleblowing management

Once the report has been received according to the channels provided for in this guide, it will be handled as follows:

1. registration and custody;
2. preliminary investigation;
3. investigation and communication of the outcome;
4. archiving.

 

The whistleblower will be able to monitor the progress of the advanced report through the portal and communicate additional information.

It should be noted that, pursuant to art. 5 of Legislative Decree 24/2023:

˗ the dedicated platform will issue the reporting person with an acknowledgment of receipt of the report within seven

days from the date of receipt;

˗ the SRC will respond to the report within three months of the date of the acknowledgement of receipt or, in the absence of such acknowledgement, within three months of the expiry of the seven-day period from the submission of the alert.

 

1. 1. 1. Registration and custody

The platform used guarantees the registration of data and the existence of a single archive for all reports. All the contents of the report and the identity of the whistleblower are protected by an encryption system.

 

1. 1. 2. Preliminary investigation

The purpose of the preliminary investigation is to verify the validity of the report received. Upon receipt of the report, the SRC will proceed with the preliminary verification of the same, guaranteeing the total confidentiality of the whistleblower and maintaining the greatest possible confidentiality on the content of the report.

The investigation must be conducted in accordance with impartiality and independence. No person in conflict of interest should be involved in the investigation or decision-making process, nor should anyone who may be responsible for failing to take steps to prevent or detect the alleged breaches. Actual or potential conflicts of interest must be promptly reported to the SRC or the CEO by those involved in the investigations.

If the report concerns one of the members of the SRC, he or she must refrain from any activity and the management of the report will be carried out exclusively by the remaining members.

In the course of these preliminary checks, the SRC will be able to engage with the whistleblower via the portal in order to obtain further information about the report.

If, at the end of the preliminary analysis phase, it emerges that there is no sufficiently detailed evidence or, in any case, that the facts referred to in the report are unfounded, the report will be archived indicating the reasons behind the choice.

 

1. 1. 3. Investigation and communication of the outcome

The preliminary activity consists of carrying out an investigation and collection of evidentiary material aimed at reconstructing the facts and verifying the actual existence of a condition of internal wrongdoing within the Company.

The CRS is the entity appointed by the Company to carry out the investigation and the definition of the report, however all the Company Functions have the task of collaborating with the CRS during the performance of the aforementioned activity, guaranteeing the anonymity of the whistleblower.

In carrying out this activity, the SRC may request the support of third-party specialists if deemed necessary.

All the subjects involved by the CRS in the investigation must be expressly authorized subjects and must guarantee the confidentiality provided for by the legislation (of the whistleblower, of the report, of the reported, etc.).

In any case, the SRC guarantees the confidentiality of the whistleblower towards the external parties participating in the investigations.

Upon completion of the activity, for each report analyzed, the SRC prepares a final report containing:

 

• the established facts;
• the evidence collected;
• the causes and deficiencies that allowed the reported situation to occur.

 

At the end of the investigation, if the SRC finds that the report received is unfounded, it will close the report and, where possible, notify the whistleblower.

In the event that the report is found to be well-founded, the CRS activates the company managers to take the necessary and most appropriate mitigating and/or corrective actions by transmitting the outcome of the investigation to the administrative body, for the possible reporting of the offence to the competent authorities and the initiation of disciplinary proceedings aimed at imposing, if necessary, the applicable disciplinary sanctions.

Any sanctions will be imposed, in full compliance with the provisions of the law, taking into account the provisions of the sanctioning system defined for the violation of Model 231, the Code of Ethics and company protocols.

 

1. 1. 4. Archiving

In order to ensure the traceability, confidentiality, preservation and availability of data throughout the procedure, the documents are stored and archived exclusively on the dedicated platform "for the time

necessary for the processing of the report and in any case no later than five years from the date of communication of the final outcome of the reporting procedure" (art. 14 of Legislative Decree 24/2023).

 

1. 3. Improper reporting and prohibition of discriminatory behaviour

The Company reserves the right to take disciplinary action against the whistleblower if the report is deemed unfounded and made with intent or gross negligence.

This includes, for example, cases where the report was made to damage the image of another employee or to give oneself an unfair advantage.

The Company also reserves the right to take disciplinary action against those who engage in retaliatory and/or discriminatory conduct towards the whistleblower regardless of the outcome of the report.

 

1. 4. External Reporting

The reporting person may make an external report if, at the time of submission, one of the following conditions is met:

    a) unavailability of the dedicated platform made available by the company;

    (b) the reporting person has already made an internal report and the report has not been acted upon;

    (c) the reporting person has reasonable grounds to believe that, if the reporting person were to make an internal report, it would not be effectively followed up or that the report would lead to a risk of retaliation;

    (d) the reporting person has reasonable grounds to believe that the breach may constitute an imminent or obvious danger to the public interest.

The National Anti-Corruption Authority (ANAC) has activated an external reporting channel that guarantees, also through the use of encryption tools, the confidentiality of the identity of the reporting person, the person involved and the person mentioned in the report, as well as the content of the report and related documentation.

 

1. 5. Public Disclosure

A reporting person who makes a public disclosure shall benefit from the protection provided for by this decree if, at the time of public disclosure, one of the following conditions is met:

  (a) the reporting person has previously made an internal and external report or has made an external report directly, under the conditions and in the manner described above, and has not been responded to within the prescribed time limits;

  (b) the reporting person has reasonable grounds to believe that the breach may constitute an imminent or manifest danger to the public interest;

  (c) the reporting person has reasonable grounds to believe that the external report may entail a risk of retaliation or may not be effectively followed up due to the specific circumstances of the case, such as those where evidence may be concealed or destroyed or where there is a well-founded fear that the person receiving the report may be colluding with or involved in the breacher.

 The rules on the professional secrecy of journalists, with reference to the source of the news, remain unchanged.

 

1. 6. Complaint to the judicial or accounting authority

The whistleblower also has the possibility to report to the competent national judicial and accounting authorities the unlawful conduct of which he or she has become aware in his or her work context. If the whistleblower is a public official or a person in charge of a public service, even if he or she has made a report through the internal or external channels provided for by the Decree, he or she is required - by virtue of the combined provisions of art. 331 c.p.p. and art. 361 and 362 of the Criminal Code - to report to the competent judicial or accounting authority the criminally relevant facts and hypotheses of tax damage.

 

7. PROTECTION

To the whistleblower and, in general, to all the subjects indicated in art. 3 paragraph 5 of Legislative Decree 24/2023, the protection against retaliation referred to in art. 16, 17, 18 and 19 of the same Legislative Decree. Please refer to the full text of the decree for further information.

The whistleblower must contact the National Anti-Corruption Authority (ANAC) for the purpose of ascertaining the retaliatory acts suffered.

 

8. SANCTIONS

Without prejudice to the other aspects of liability, ANAC applies the administrative fines provided for by art. 21 of Legislative Decree 24/2023, such as:

    (a) EUR 10 000 to EUR 50 000 when it finds that retaliation has been committed or when it finds that the report has been obstructed or attempted to be obstructed or that the confidentiality obligation referred to in Article 12 has been breached;

    (b) from €10,000 to €50,000 when it ascertains that no reporting channels have been established, that procedures for making and managing reports have not been adopted or that the adoption of such procedures does not comply with those referred to in Articles 4 and 5, and when it ascertains that the verification and analysis of the reports received has not been carried out;

    c) from €500 to €2,500, in the case referred to in Article 16, paragraph 3, unless the reporting person has been convicted, even in the first instance, of the offences of defamation or slander or in any case for the same offences committed with the complaint to the judicial or accounting authorities.

In addition, the sanctions provided for by the disciplinary system adopted pursuant to Article 6, paragraph 2, letter e) of Decree no.  231 of 2001.

 

9. UPGRADE RESPONSIBILITIES

The organizational units involved in the activities governed by this guide are responsible for detecting business events of an operational nature that require updating.

These findings are reported by the SRC itself or to the Chief Executive Officer, who is responsible for coordinating the updating of the document.

 

10. CONTROL ACTIVITIES OF THE SUPERVISORY BODY (SB) 

The Supervisory Body (SB) must supervise:

 

• the adequacy of the information channels set up by the Company for the management of reports and their correct use;
• the updating of this protocol, as a result of changes in the organisational structure and any changes in the regulations in force;
• compliance with the prohibition of "retaliatory or discriminatory acts, direct or indirect, against the whistleblower for reasons related, directly or indirectly, to the report".

 

Provision is made for the transmission to the SB of an information flow relating to the receipt of relevant reports pursuant to Legislative Decree 231/2001, the management of which remains the responsibility of the CRS.

 

Any further anomalies, exceptions and procedural exceptions that occurred during the reference period must be communicated to the SB.