INFORMATION PURSUANT TO ARTICLES 13 AND 14 OF REGULATION (EU) 2016/679 (“GDPR”) REGARDING THE PROCESSING OF PERSONAL DATA OF INDIVIDUALS INVOLVED IN THE MANAGEMENT OF WHISTLEBLOWING REPORTS.

Lesepidado S.r.l., with registered and administrative offices in Castel San Pietro Terme, Fraz. Osteria Grande – Bologna – amministrazione@lesepidado.it (hereinafter, “Lesepidado” or the “Data Controller“), hereby provides information on the processing of personal data of whistleblowers, reported persons, and any other third parties involved (hereinafter collectively referred to as “Data Subjects“) carried out by the same in relation to the management of reports of wrongdoing governed by the “Whistleblowing Policy” (hereinafter, “Policy“).

1. Categories of data subject to processing.

Personal data of the whistleblower, the reported person, and any third parties mentioned in the report will be processed, limited to the data necessary to carry out the required investigative activities aimed at verifying the validity of the reported facts and the adoption of consequent measures as indicated in the Policy.

If provided, data revealing racial or ethnic origin, political opinions, religious and/or philosophical beliefs, trade union membership, as well as genetic data, biometric data, data concerning health or a person’s sex life or sexual orientation, and data relating to criminal convictions and offenses may also be processed.

2. Purpose and legal basis of processing

The personal data of the Data Subjects are processed for the following purposes:

1. To ensure the correct and complete management of reports of unlawful conduct pursuant to Legislative Decree. 24/2023
2. To carry out the necessary investigative activities aimed at verifying the validity of the reported facts and the adoption of consequent proceedings
3. To protect a right of the Data Controller in court
4. To respond to a request from the Judicial Authority or an equivalent Authority

The legal basis is the fulfillment of a legal obligation.

As per regulations, the confidentiality of the whistleblower’s identity is guaranteed, managing personal data separately from the content of the report made.

Any matching can only be performed in exceptional cases according to applicable legal provisions (e.g., to exercise the right of defense of the accused, subject to the whistleblower’s consent; in cases where the criminal liability of the whistleblower for the crimes of calumny or defamation is established, even by a first-instance judgment; in cases of reports that prove to be unfounded, made with intent or gross negligence).

In exceptional cases, when the report has given rise to disciplinary proceedings and is based solely on the whistleblower’s report, the identity of the latter may be disclosed to the person subject to the disciplinary proceedings if this is absolutely indispensable for exercising their right of defense. In such cases, the report will be usable for the purposes of the disciplinary proceedings only with the whistleblower’s consent to the disclosure of their identity.

Special categories of personal data and judicial data will be processed for this purpose, respectively, pursuant to Art. 9, para. 2, letter b) and Art. 10 of the GDPR.

With regard to any processing of personal data following the closure of the report analysis procedure, the legal basis is represented by the legitimate interest of the Controller in exercising its rights in all cases where it becomes necessary (e.g., reopening of judicial proceedings, claims for damages related to the report), pursuant to Art. 6, para. 1, letter f) and Art. 9, para. 2, letter f) of the GDPR.

3. Source of personal data

The Controller collects data through reports made via the Whistleblowing channel on the company website. The data of the Data Subjects contained within the report are provided directly by the whistleblower. Whistleblowers may be employees and/or collaborators, directors, consultants and, in general, all stakeholders of the Controller, Group companies, or any person with a legitimate interest.

To preserve investigative purposes, in cases provided for by law, the reported person, pursuant to Art. 14, para. 5, letter d) of the GDPR, may not be immediately informed of the processing of their data by the Controller, as long as there is a risk of compromising the possibility of effectively verifying the validity of the report or collecting the necessary evidence.

4. Data processing methods

Lesepidado collects the personal data of the Data Subject in archives, both electronic and telemetric, and processes them using methods strictly necessary for the purposes indicated and, in any case, with the use of technical and organizational measures adequate to guarantee the security of the processing and therefore the confidentiality of the data.

The data will be processed in compliance with the principles of lawfulness, fairness, relevance, and non-excessiveness, as provided for by the legislation on the protection of personal data.

Processing will be carried out by internal personnel formally authorized by the Controller, bound by the obligation of confidentiality and adequately trained in the matter.

5. Data retention period

Data are stored for the time necessary to process the report as well as for the entire period necessary for the conduct of any proceedings resulting from the management of the report (disciplinary, criminal, accounting) and in any case no later than five years from the date of communication of the final outcome of the reporting procedure.

Retention for a longer period is reserved in relation to requests from public authorities or the Data Protection Authority, as well as for a longer period but within the limits of the statute of limitations for rights, in relation to needs connected to the exercise of the right of defense in the event of disputes.

6. Nature of the provision and consequences of any refusal

The provision of the whistleblower’s data is mandatory. Any refusal to provide the data makes it impossible to follow the procedure pursuant to the Legislative Decree. 24/2023.

However, anonymous reporting is possible. Nevertheless, the application of the reporting procedure will only be possible if the reports are adequately substantiated and provided with a wealth of detail, i.e., where they are able to bring to light facts and situations by relating them to specific contexts.

7. Data recipients

The communication of the personal data collected occurs mainly to third parties and/or recipients whose activity is necessary for the performance of activities inherent to the management of the report, as well as to respond to certain legal obligations.

In particular, transmission may occur to:

1. Managers of the function affected by the report
2. The company in charge of managing the Web platform, in its capacity as External Processor pursuant to Art. 28 of EU Reg. 679/2016.
3. Institutions and/or public Authorities, Judicial Authorities, Police bodies, external legal counsel under mandate, private investigation companies, which will act as independent Data Controllers.

Personal data will not be disseminated or disclosed in any way to subjects other than those identified above.

Furthermore, they will not be transferred abroad to third countries.

8. Rights of the data subjects

Data Subjects may request from the Controller, by e-mail request to the address amministrazione@lesepidado.it, access to data concerning them, their rectification, integration, or deletion, as well as the restriction of processing or opposition (rights under Articles 15 to 22 of the GDPR) where the conditions are met. Data Subjects also have the right to lodge a complaint with the Data Protection Authority in the event of unlawful or illicit processing of their data by the Controller.

Osteria Grande, 2023-01-27