Whistleblowing

Procedure for submitting and handling reports

1. PURPOSE OF THE PROCEDURE
With this procedure, NUOVA IDROPRESS SPA (hereinafter the “Company“) intends to govern the methods for submitting and managing Reports coming from the persons referred to in Article 3, paragraphs 3 and 4, of Italian Legislative Decree 24/2023, including in anonymous form, concerning alleged irregularities, offences and/or failures to take action that are detrimental to the public interest or the integrity of the Company and which one has become aware of by reason of or on the occasion of their employment relationship, as detailed below.
More specifically, on the one hand the purpose of this procedure is to describe and govern the process of reporting alleged irregularities, offences and/or failures to take action, providing the whistleblower with clear operational guidance on the subject, contents, recipients and means of submitting Reports, as well as on the forms of protection provided by the Company in accordance with regulatory provisions. On the other hand, to govern the means of ascertaining the validity and grounds for Reports in order to take the appropriate corrective and disciplinary action where appropriate.

2. DEFINITIONS
For the purposes of this Procedure, the following terms shall have the following meanings:
a) Company: NUOVA IDROPRESS SPA.
b) Report: refers to the written communication of information on violations submitted through the dedicated reporting channel that uses encryption to guarantee the confidentiality of the identity of the whistleblower, the person involved and the person mentioned in the report, as well as the content of the report and related documentation.
c) Violations: this refers to conduct, actions or failures to act that harm the public interest or the integrity of the Company, and consist of:
(i) Unlawful conduct pursuant to Italian Legislative Decree no. 231 of 8 June 2001, or violations of the Organisation and Management Models and the Code of Ethics.
(ii) Offences falling within the scope of application of the European Union or national acts enumerated in the Annex to Italian Legislative Decree no. 24/2023 or of the national laws implementing the acts of the European Union set out in the Annex to Directive (EU) 2019/1937 but not indicated in the Annex to Italian Legislative Decree 24/2023
relating to the following areas: public contracts; financial services, products and markets and prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; privacy and personal data protection and security of networks and information
systems.
(iii) Actions or failures to act detrimental to the Union’s financial interests referred to in Art. 325 of the Treaty on the Functioning of the European Union specified in the relevant secondary legislation of the European Union.
(iv) Actions or failures to act relating to the internal market referred to in Art. 26, paragraph 2, of the Treaty on the Functioning of the European Union, including infringements of EU competition and State aid rules, as well as infringements concerning the internal market related to actions in breach of corporate tax rules or mechanisms whose purpose is to obtain a tax advantage that frustrates the object or purpose of the applicable corporate tax
law.
(v) Actions or conduct that frustrate the object or purpose of the provisions of the Union acts referred to in (ii), (iii) and (iv).
d) Whistleblower: means the natural person who can report information on violations acquired during their work, i.e:
(i) Employee of the Company, including temporary, intermittent, apprenticeship and ancillary workers.
(ii) Self-employed workers and contractors who work for the Company, including under work contracts.
(iii) Worker or contractor who work for a company that provides goods or services or who work for third parties.
(iv) Freelancers and consultants working for the Company.
(v) Volunteers and trainees, paid or otherwise, who work for the Company.
(vi) Company shareholder and person with functions of administration, management, control, supervision or representation, even if such functions are exercised on a de facto basis.
(vii) For the above-mentioned persons even when the legal relationship has not yet begun (if the information was acquired during the selection process or in other pre-contractual stages), during the trial period or after the termination of the employment or other legal relationship if the information on violations was acquired during the same.
e) Person involved: means the natural or legal person mentioned in the Report as the person who committed the Violation or as a person otherwise implicated in the reported Violation.
f) Employment context: this refers to the past or present work or professional activities carried out within the framework of the legal relationship between the Whistleblower and the Company, through which, irrespective of the nature of such activities, a person acquired information about violations and in the context of which they could risk suffering
retaliation in the event of Whistleblowing.
g) Parties Tasked with Handling Reports: this means the party tasked with receiving the Reports and carrying out the activities of verification and management of the facts reported, as detailed in this procedure.

3.REPORTS
3.1 Report subject and contents
The Reports must relate to Violations that the Whistleblower has become aware of in the context of their work.
More specifically, the following Violations are considered relevant for reporting purposes:

1. Unlawful conduct relevant pursuant to and for the purposes of Italian Legislative Decree no. 231/2001.
2. Offences committed in violation of European Union law relating to specific sectors as set out in the Annex to Italian Legislative Decree no. 24/2023 and all national provisions implementing them.
3. Actions or failures to act detrimental to the financial interests of the European Union, as identified in European Union Regulations, Directives, Decisions, Recommendations and Opinions (e.g. fraud, corruption and any other illegal activity related to Union expenditures).
4. Actions or failures to act affecting the internal market that jeopardise the free movement of goods, persons, services and capital, including violations of competition, state aid and corporate tax rules and mechanisms whose purpose is to obtain a tax advantage that frustrates the object or purpose of the applicable corporate tax law.
5. Actions or conduct that frustrate the object or purpose of the provisions of the European Union acts mentioned in points 3, 4, and 5 above (e.g. abusive practices such as abusive pricing, target discounts, bundled sales).

The following conduct cannot be the subject of Reports:

Disputes, claims or requests linked to an interest of a personal nature of the Whistleblower that relate exclusively to their individual employment relationships, or inherent in their employment relationships with hierarchical superiors (e.g. reports concerning labour disputes and pre-litigation, discrimination between co-workers, interpersonal conflicts between the Whistleblower and another worker or with hierarchical superiors, reports concerning data processing carried out in the context of the individual employment relationship in the absence of injury to the public interest or to the Company’s integrity).

Reports of violations where already mandatorily regulated by European Union or national acts indicated in Part II of the Annex to Italian Legislative Decree no. 24/2023 or by national laws implementing the acts of the European Union set out in Part II of the Annex to Directive (EU) 2019/1937 but not indicated in Part II of the Annex to Italian Legislative. Decree 24/2023. In fact, the Decree does not apply to reports of violations governed by the directives and regulations of the European Union and the implementing provisions of the Italian legal system, which already guarantee specific reporting procedures.

Reports of breaches of national security, as well as of procurement relating to aspects of national security defence, unless these aspects are covered by relevant secondary EU law.

The Whistleblower must provide all the elements necessary so that the Report manager can perform the relevant checks and verifications on the facts raised, in order to confirm the Report’s merits. The Reports must therefore:
• Be sufficiently clear and detailed.
• Be based on precise, concordant elements.
• Relate to facts that are verifiable and known directly to the whistleblower.
• Enable adequate verification of the Report’s merits by providing, among other things, the following information together with any supporting documentation:
– Clear, complete description of the conduct, including any failures to act, that is the subject of the Report.
– The times and places in which the actions were committed and the related conduct.
– Information that makes it possible to identify the persons, company departments or organisational units involved.
– Any third parties involved or potentially damaged.
– Any documentation confirming the validity of the reported facts.
– Any other information or evidence that may constitute useful evidence as to the existence of the facts reported.

The Reports must not relate to mere suspicions or rumours, nor to grievances, demands, claims or requests of a personal nature of the whistleblower.
The Reports must be made in good faith and must not contain libellous and/or defamatory information. Slanderous and/or defamatory Reports may give rise to civil and/or criminal liability for the whistleblower and to the application of disciplinary sanctions.

3.2 Methods for Submitting Reports

NUOVA IDROPRESS SPA has set up a dedicated reporting channel to guarantee the confidentiality of the identity of the Whistleblower and the proper handling of anonymous Reports.

The Reports must be made by submitting a specific form using the Report Management Portal, accessible at the following link:

https://nuova-idropress.smartleaks.cloud

The report will be assigned a case number so that its status, management and contents can be monitored from this same link.

3.3 Duties and responsibilities

The person assigned by the Company to process, manage and check the reports has an appropriate level of authority, independence and autonomy.
The Parties Tasked with Handling Reports are in charge of receiving and handling the Reports covered by this Procedure.
These parties shall also have access to all information and facts related to the Reports received. The Parties Tasked with Handling Reports are responsible for checking the validity and handling of the Report, and act in accordance with the principles of impartiality, fairness, transparency and confidentiality to carry out any activity deemed appropriate. Within seven days from the date of receipt of the report, the Parties Tasked with Handling Reports will issue an acknowledgement of receipt to the Whistleblower via the same channels used to submit the original Report. The Parties Tasked with Handling Reports may contact the Whistleblower, if known, if they find the Report to be excessively general or that it contains inappropriate or irrelevant documentation in order to request further information for the purpose of verifying the issues raised. If no further information is provided or what is provided is deemed to be insufficient, the case will be closed.

While checking the information provided, the Parties Tasked with Handling Reports may avail themselves of the support of the relevant corporate functions or departments, and, where deemed appropriate, of external consultants specialised in the field of the Report and whose involvement is functional to the investigation of the Report. Only the contents of the report will be forwarded to these parties. Where necessary for the conduct of investigations, the identity of the whistleblower may be disclosed to third parties involved in the investigations only with the express consent of the whistleblower themself (pursuant to Article 12, paragraph 2, of Italian Legislative Decree no. 24/2023).

In this case, the parties involved bear the same duties of conduct aimed at ensuring the confidentiality of the Whistleblower.

Based on the information provided, the Parties Tasked with Handling Reports assess:

• Whether to proceed with the closure of the case on the grounds that it is manifestly unfounded due to the absence of factual elements capable of justifying an investigation, or due to the ascertained generic content of the Report that does not allow the facts to be understood, or because the Report is accompanied by inappropriate or irrelevant documentation.
• Whether to initiate an audit or a fraud investigation.
• Whether it is necessary to involve the Judicial Authorities.
• Whether it is necessary to involve administrative bodies or independent authorities with supervisory and control functions.

In any case, if the Report is well-founded, the Parties Tasked with Handling Reports must contact the supervising internal and/or external bodies/institutions so that they can take any measures within their purview.

It is not incumbent on the Parties Tasked with Handling the Report to ascertain individual responsibilities, whatever their nature, nor to ascertain the legitimacy or merit of any actions and measures adopted by the reported Company, thereby encroaching on the responsibilities of the persons in charge within the Company or of the judiciary or other public authorities.

3.4 Confidentiality

In compliance with confidentiality requirements, the documentation relating to each Report received (i.e. all the information and supporting documents from which the identity of the Whistleblower or of other persons mentioned in the Report may be deduced) is kept for as long as is necessary for the handling of the Reports received, and in any case for no longer than five years from the date of the communication of the final outcome of the Whistleblowing procedure. Therefore, without prejudice to the rights recognisable to the Whistleblower under Regulation (EU) 2016/679 and Italian Legislative Decree no. 24/2023, the Report may not be viewed or copied by anyone.

Without the Whistleblower’s express consent, the identity of the Whistleblower and any other information from which such identity can be directly or indirectly deduced may not be disclosed to persons other than those authorised to receive or follow up on the Reports and expressly authorised to process such data pursuant to Articles 29 and 32, para. 4, of Regulation (EU) 2016/679 and Article 2-quaterdecies of the Personal Data Protection Code set out in Italian Legislative Decree no. 196/2013, and in accordance with the company’s data protection procedures.

The Company also ensures the confidentiality of the information relating to (i) the identity of the Person involved; (ii) the Facilitator (both with reference to the identity and to the activity in which the assistance takes place); (iii) persons other than the reported person, but nevertheless implicated as mentioned in the report (e.g. witnesses), until the conclusion of the proceedings initiated on account of the report and in compliance with the same guarantees provided to the Whistleblower.

The reported person does not have the right to always be informed of the Report concerning them. This right is guaranteed within the framework of the proceedings that may be initiated against them following the conclusion of the verification and analysis of the Report, and in the event that such proceedings are based in whole or in part on the Report.

4. ENTRY INTO FORCE
This procedure shall enter into force on 01/12/2023