Whistleblowing Information

Ceccato Spa , aware of the importance of activating adequate reporting channels in order to protect the integrity of the Company and ensure compliance with the principles of legality, fairness and transparency, also towards third parties, in the exercise of corporate activities, has activated specific corporate reporting channels in compliance with Legislative Decree no. 24/2023, implementing EU Directive 2019/1937.

With this Notice, Ceccato Spa intends to promote the widest possible dissemination among all Recipients of any useful information on the channels, procedures and prerequisites for making both internal and external reports.

WHO CAN MAKE A REPORT

The following are authorised to report:

• subordinate workers ;
• self-employed workers and collaborators who carry out their work activity at the Company;
• freelancers and consultants who work for the Company;
• volunteers and interns , paid and unpaid, who carry out their work at the Company;
• shareholders and persons with administrative, management, control, supervisory or representative functions , even if such functions are exercised on a mere de facto basis, within the Company,

even when the legal relationship has not yet begun , if the information on the violations was acquired during the selection process or in other pre-contractual phases or during the probationary period or after the dissolution of the legal relationship if the information on the violations was acquired during the relationship itself.

WHAT BEHAVIOURS CAN BE REPORTED

Relevant Reports are reports concerning behaviors, acts or omissions that harm the public interest or the integrity of the Company of which the reporter has become aware in the work context and which consist of:

• offences falling within the scope of the European Union acts relating to the following sectors : public procurement; financial services, products and markets and prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; public health; consumer protection; protection of privacy and personal data and security of networks and information systems;

• acts or omissions which harm the financial interests of the European Union , such as fraud, corruption and any other illegal activity related to Union expenditure;
• acts or omissions relating to the internal market , including breaches of EU rules on competition and State aid as well as on corporate taxation, free movement of goods , persons, services and capital ;
• acts or behaviors that frustrate the object or purpose of the provisions of the acts of the European Union in the sectors indicated above. This area includes, for example, the so-called abusive practices that contravene the protection of free competition (adoption of predatory pricing, target discounts, bundled sales, etc.).

Reports linked to a personal interest of the reporting person that relate exclusively to their individual employment relationships, or inherent to their employment relationships with hierarchically superior figures or to aspects of the life of the reported individual, without any direct or indirect connection with the company and/or professional activity, are excluded from the scope of the regulation.

Also excluded are news that are clearly unfounded , information that is already in the public domain, information acquired only on the basis of unreliable rumours or hearsay (so-called corridor gossip ) or that is specious, defamatory , slanderous or aimed exclusively at damaging the person reported.

The aforementioned “ excluded reports ” are therefore not considered whistleblowing reports and, therefore, the company may decide whether to include in its internal company regulations whether and how to deal with this type of report.

FEATURES OF THE REPORTING

In order to allow for adequate verification, the report must be as detailed as possible in order to allow for the reconstruction of the fact and the verification of the validity of what has been reported. In particular, the following must be indicated:

• The identifying data of the reporting person (name, surname, place and date of birth) and, in the case of using the telephone line or direct meeting , an address where the acknowledgement of receipt of the report and subsequent feedback can be received, as well as any requests for additions and clarifications;

• the circumstances of time and place in which the reported event occurred and, therefore, a description of the reported events , specifying the details relating to the circumstantial information and, where present , also the methods by which the reported events became known;
• the personal details or other elements that allow the identification of the possible subject to whom the reported facts are to be attributed;
• any attached documents ;
• any persons potentially aware of the facts.

In the event of receiving anonymous reports , it is specified that these, only if they are timely, detailed and supported by suitable documentation, will be considered and treated as ordinary reports, albeit with the same internal procedures envisaged for whistleblowing reports.

INTERNAL REPORTING CHANNELS

To allow the transmission of written and oral reports, the Company, after consulting the representatives or trade unions, activates and maintains open the following reporting channels:

1. Channel for written reports:
   1. Online Platform ( report form )
2. Channel for oral reporting :
   1. a telephone line active from Monday to Friday from 09:00 to 12:00, at the number +39 331 6368592 with forwarding to the Channel Manager. In order to guarantee confidentiality, the whistleblower must immediately communicate that he intends to make a “ Whistleblowing Report” .

If requested by the reporter, it is possible to arrange a direct meeting with the Channel Manager. The direct meeting is held exclusively by the Channel Manager in a confidential manner and by drafting the reporting form.

Ceccato Spa, in full compliance with the Whistleblowing Decree, guarantees that the above channels ensure the confidentiality of the identity of the reporting person, of the person involved and of the person mentioned in the report, as well as of the content of the report and of the related documentation.

The management of the reporting channel is entrusted to a Whistleblowing Committee.

REPORT MANAGEMENT PROCEDURES

The Channel Manager, upon receiving the report, carries out the following activities:

• issues the reporting party with a notice of receipt of the report within seven days of the date of
• reception;
• maintains dialogue with the reporting person and may request additions from the latter if necessary;
• by diligently following up on the reports received by activating the subjects responsible for managing the report;
• provides feedback to the reporting party within three months of the date of the acknowledgement of receipt or, in the absence of such acknowledgement, within three months of the expiry of the seven-day period from the submission of the report. This feedback may also be of an interlocutory nature, if the investigation has not yet been completed. Once the investigation has been completed, the results must in any case be communicated to the reporting party.

For the appropriate treatment of the report, internal or external subjects may be involved, in consideration of the specific technical and professional skills required, who are not in conflict of interest and who will in any case be bound by the confidentiality obligations provided for by the law.

Following the investigation, if the report is found to be well-founded, the Manager of the reporting channel will contact the competent internal bodies/functions for the relevant follow-ups for the purposes of activating preventive, corrective or disciplinary actions against the reported person.

THE EXTERNAL REPORTING CHANNEL (ANAC)

In order to use the reporting channel established by ANAC, certain conditions must be met. In particular, the whistleblower may use the external procedure only if one of the following conditions applies: in his/her work context, the internal company reporting channel is not active or, even if activated, does not comply with Legislative Decree no. 24/2023; he/she has already made an internal report and it has not been followed up; he/she has reasonable grounds to believe that, if he/she were to make an internal report, it would not be effectively followed up or the report itself could lead to the risk of retaliation; he/she has reasonable grounds to believe that the violation could constitute an imminent or obvious danger to the public interest. Any retaliation suffered can be reported to the same channel.

See https://www.anticorruzione.it/-/whistleblowing

The data will be processed in compliance with the provisions of GDPR n. 679/2016 and Legislative Decree n. 24/2023.

See [ Privacy Whistleblowing ].