WHISTLEBLOWING POLICY

INTRODUCTION AND LEGAL REFERENCES

Revision No. 01– 8^th November 2024

1. APPLICABLE LEGISLATION

Legislative Decree no. 24/2023, implementing EU Directive 2019/1937, sets rules for the protection of individuals reporting violations (so-called "whistleblowing"). This document outlines the procedures for reporting violations and protections for whistleblowers.

Other relevant regulations  

- EU Regulation 2016/679 (GDPR) and Privacy Code (Legislative Decree 196/2003 and 101/2018), governing the processing of personal data.

2. PURPOSE OF THE DOCUMENT

This procedure outlines how ERQOLE HOSPITALITY S.r.L. manages reports of violations. The document provides information on channels for making internal and external reports and how to file a report with judicial authorities or other competent bodies.

3. SCOPE OF APPLICATION

3.1 Who can report? (Whistleblowers)

The following individuals can make reports:

- Employees (permanent, temporary, part-time, full-time, etc.).

- Freelancers and collaborators.

- Interns, trainees, and volunteers.

- Directors, administrators, shareholders, and others with corporate functions.

- Suppliers, freelancers, and consultants working with the Company.

Even those initiating a collaboration with the Company (e.g., during the recruitment process) can make a report, or after the termination of the relationship, if the information on violations was acquired during the course of the relationship.

3.2 What types of violations can be reported?

Reports can address violations including:

- Administrative, accounting, civil, or criminal offenses.

- Offenses as per Legislative Decree No. 231/01 (corporate administrative responsibility).

- Financial fraud or other violations of public interests.

- Violations not yet committed but that the Whistleblower believes may occur, based on well-founded and substantiated suspicions;

Exclusions:  

The following are not considered valid reports:

- Personal or work-related issues (e.g., disputes with supervisors).

- National security matters or sectors regulated by other reporting methods (e.g., financial or environmental areas).

- Rumours or unfounded information.

3.3 How to make a report?

The report must be clear, detailed, and include the following information:

1. A detailed description of the violation, with the date, location, and context.
2. The person(s) responsible for the unlawful act (including their role or position in the company).
3. Any additional details that could help clarify the violation (such as documents, evidence, etc.).

The report can be made anonymously but must still contain sufficient information to be processed.

What should notbe included in a report:

- Insults or personal attacks. The use of such language may be subject to review by the Report Manager and relevant company departments for appropriate evaluations, including disciplinary actions.

- Vague or unfounded information.

4. INTERNAL REPORTING CHANNELS

The internal reporting channels are:

1. Online platform: Through the Valore 24 Whistleblowing platform, available continuously 24 hours a day, 7 days a week. Access to the WB Platform can be made directly via the following URL: https://www.miramis.com

2. Postal Mail: Sending a report via physical letter, using two sealed envelopes. The first envelope contains the whistleblower's identifying information along with a photocopy of the identification document. The second envelope contains the report (to separate the whistleblower's personal details from the report). Both envelopes must be placed inside a third sealed envelope labelled "Confidential" addressed to the Report Manager.

3. Voice Messages: Through the voice messaging system integrated into the Valore 24platform.

4. In-Person Meeting: Requesting a meeting with the designated persons for managing reports.

5. MANAGEMENT OF REPORTS

1. Receipt and Registration: All reports received will be recorded and acknowledged.

2. Preliminary Assessment: Each report will be reviewed to assess its validity and classified based on severity.

3. Internal Investigation: If necessary, internal checks will be conducted to clarify the reported facts.

4. Feedback to the Whistleblower: Where possible, the whistleblower will receive feedback on the handling of their report.

5. Conclusion of the Process: Once the investigation is complete, necessary actions will be taken, and the report will be closed.

6. Reporting to Management: A comprehensive report will be submitted to company executives.

7. Data Retention: All reports and related documents will be stored securely.

The Report Manager will send an acknowledgment to the Whistleblower within 7 (seven) days from the date of receipt of the Report.

Within 3 (three) months from the acknowledgment date or, in the absence of such acknowledgment, within 3 (three) months from the expiration of the 7 (seven) day period after the report's submission, the Report Manager will provide feedback to the Whistleblower, through the platform or another suitable means, on the actions taken or planned in response to the Report.

If the Report is submitted to someone other than the Report Manager but qualifies as a Report under this Procedure, that person must forward it to the Report Manager within 7 (seven) days of receipt, providing written notice of the transfer to the Whistleblower. Conversely, if the Whistleblower does not expressly state a wish to benefit from the protections of the Decree, or if such intent cannot be inferred from the Report, the Report may be treated as a standard report, outside the scope of this Procedure and the Decree, and handled by the relevant company departments.

6. PRINCIPLES AND PROTECTIONS FOR THE WHISTLEBLOWER

1. Confidentiality: Information in reports will be treated confidentially.

2. Non-retaliation: The whistleblower cannot be harmed for making a report. Other Protected Individuals (such as facilitators, colleagues, or organizations owned by thewhistleblower) are also protected from any form of retaliation due to their role in the reporting process or their relationship with the whistleblower.

3. Burden of Proof Shift: One the whistleblower shows they made a report in compliance with the law and faced retaliatory actions, the employer must prove that any adverse actions were unrelated to the report.

4. Liability Limitation: Whistleblowers acting in good faith will not be held responsible for violations of copyright or data protection laws, nor got potential defamation of the person involved or reported.

5. Support measures: the Company will implement measures to protect whistleblowers and ensure a safe working environment.

The National Anti-Corruption Authority (ANAC) maintains a list of third-sector entities that provide support to whistleblowers.

These support measures include information, assistance, and free guidance on reporting procedures, protections against retaliation under national and EU laws, the rights of those involved, and how to access state-sponsored legal aid.

7. DISCIPLINARY CONSEQUENCES

Failure to comply with this procedure may result in disciplinary actions, as provided by law.

The Company may impose sanctions in accordance with the applicable National Collective Labour Agreement against individuals who:

• engage inretaliation against the whistleblower, obstruct or attempt to obstruct reports, or violate confidentiality obligations as described above;

• fail to perform the necessary verification and analysis of received reports.

8. PERSONAL DATA PROCESSING

Reports are handled in compliance with data protection laws (GDPR and the Privacy Code). Data will only be processed for purposes related to report management.

Reports and related documentation are retained only as long as necessary for processing and, in any case, for no more than five years from the final outcome of the reporting procedure or until the conclusion of any related judicial or disciplinary action against the reported individual or the whistleblower.

Appropriate technical measures (e.g., encryption within the WB Platform) and organizational measures are in place to ensure data security, in compliance with current regulations, during the transmission, analysis, management, and storage of the report.

Only the designated and GDPR-authorized Report Manager has access to personal data in the reports, and confidential information and personal data will only be shared with third parties when necessary.

The Company is the data controller.

9. EXTERNAL REPORTING CHANNELS

A whistleblower may submit an external report through channels provided by ANAC in cases such as:

- if no internal reporting channel has been established or if it is inactive;

- if the internal channel does not comply with the requirements set forth in art. 4 of the Decree;

- if an internal report did not result in follow-up actions;

- if there are reasonable grounds, based on specific and consistent circumstances, to believe that an internal report would not be followed up on effectively or could expose the whistleblower to retaliation;

- if there is reasonable cause to believe that the violation could pose an imminent or apparent risk to the public interest.

Public disclosure may occur only under specific circumstances, such as when:

• The whistleblower has received no response within the specified timeframes after making both an internal and external report.
• The violation poses an imminent danger to the public, such as in emergencies or situations with risks of irreversible harm.
• The whistleblower fears retaliation or believes that the report will not lead to effective action, for instance, due to a risk of evidence being destroyed or involvement of individuals responsible for the violation.

In these cases, the whistleblower can publicly disclose the violation by utilizing media such as press outlets or electronic channels to reach a broad audience.

Reporting to Judicial Authorities

The Decree also grants protected individuals the option to file a report with judicial authorities if they become aware of any illegal conduct within a work-related context.

Publication of the Procedure

This Procedure is displayed prominently at company offices, published on the company website www.miramis.com and made available on the company intranet.

‍