Whistleblowing

SUMMARY INFORMATION ON THE SYSTEM
OF REPORTING EX LEGISLATIVE DECREE 24/23

Scope of application.

The scope of the legislation in question includes criminal, civil, administrative or accounting offences other than those specifically identified as violations of EU law that harm the integrity of the private entity.

This also includes violations of national regulations:

• the crimes underlying the application of Legislative Decree 231/01 and the violations of the organisation and management models provided for in Legislative Decree 231/01

Violations of the provisions of European legislation:

• offences committed in violation of the EU legislation indicated in Annex 1 to Legislative Decree 24/23 and of all national provisions implementing it

Reports excluded from the scope of Legislative Decree 24/23

Reports that are linked to a personal interest of the whistleblower, that concern his/her individual employment relationships, or that are related to employment relationships with hierarchically superior figures are excluded from the scope of the new regulation.

Content of the report

Reports are information, even for well-founded suspicions, relating to violations already committed or not yet committed, as well as relating to conduct aimed at concealing them.

Reports must concern behaviors, including omissions, of which the reporter has become aware in the workplace.

The following elements must be clear in the reports:

1. the identifying data of the reporting person (name, surname, place and date of birth), as well as a contact address to which subsequent updates should be communicated;
2. the circumstances of time and place in which the reported event occurred and, therefore, a description of the reported events, specifying the details relating to the circumstantial information and, where present, also the methods by which the reported events became known;
3. personal details or other information that allows the identification of the person to whom the reported facts are attributed and, in the case of using the analogue channel (for example registered mail), the indication that the reporting person is sending the whistleblowing report. It is also useful to attach documents to the report that can provide elements of substantiation of the facts reported, as well as the indication of other persons potentially aware of the facts.

Internal reporting methods and subsequent phases

Reports may be made, alternatively, in the following ways:

INTERNAL WRITTEN CHANNEL: ordinary mail (Registered) addressed to “Avv. Andrea Guidi, as Report Manager of COSMETICA HUB SPA” in Bellaria IM 47814 (RN) Via Ravenna n. 151C

The reporting person is advised to insert the report in two sealed envelopes, including, in the first, the reporting person's identification data, together with an identity document, while in the second, the subject of the report, taking care to insert both envelopes in a third envelope reporting, on the outside, the wording "reserved for the reporting manager" and relevant contact details (avoiding the indication of company emails).

INTERNAL ORAL CHANNEL by telephone call to no. 0541/411356 used by the Reports Manager, Attorney Andrea Guidi, as well as a direct meeting, to be arranged in agreement with the Reports Manager, at his office in Bellaria IM 47814 (RN) Via Ravenna no. 151C

Receiving the report
The Report Manager must issue the reporting party with an acknowledgement of receipt within seven days of the submission of the report itself, to be delivered to the address indicated by the reporting party in the report. In the absence of such indication and, therefore, in the absence of the possibility of interacting with the reporting party for follow-up, the report will be considered unmanageable pursuant to the whistleblowing discipline and proof of this reason will be provided and kept at the Manager together with the report.

Admissibility of the report
For the purposes of admissibility, the following must be clearly stated in the report:

• the circumstances of time and place in which the event which is the subject of the report occurred and, therefore, a description of the events which are the subject of the report, which contains the details relating to the circumstantial information and, where present, also the methods through which the reporter became aware of the events;
• personal details or other elements that allow the identification of the person to whom the reported facts are to be attributed.

In light of these indications, the report can therefore be considered inadmissible for:

• lack of data which constitute the essential elements of the report;
• manifest groundlessness of the factual elements attributable to the violations typified by the legislator;
• presentation of facts of a generic nature that are not understood by the proposed offices or person;
• production of documentation only without actually reporting violations.

In the event that the report is deemed inadmissible or inadmissible, the manager of the report will proceed with archiving, communicating the reason to the reporter.

Outcome of the investigation.
Once the investigation activity is completed, the reporting manager can:

• archive the report because it is unfounded, justifying the reasons;
• declare the report to be well-founded and contact the competent internal bodies/functions for the relevant follow-up and consequent measures.

Feedback to the reporter
The manager of the report must provide feedback to the reporter within three months of the date of acknowledgement of receipt.

Where the situation requires, for the purposes of verification, a longer time, at the expiry of the indicated deadline the Report Manager must send the reporting party an interlocutory communication on the progress of the investigation, which has not yet been completed.

External reporting and public disclosure channel

In order to use the reporting channel established by ANAC, at least one of the following conditions must exist:

• in his/her work context the activation of the internal channel is not foreseen as mandatory or, if foreseen, it has not been activated;
• the report was not followed up;
• has reasonable grounds to believe that if he were to make the internal report it would not be followed up or that he would face retaliation;
• has reasonable grounds to believe that the infringement may constitute an imminent or manifest danger to the public interest.

External reporting is also permitted when there are reasonable grounds to believe that the reporting could lead to the risk of retaliation, such as when similar situations and events have already occurred within the entity.

In any case, the well-founded reasons that legitimise the use of external reporting due to the fear of retaliation or inadequate treatment of the report must be based on concrete circumstances that must be attached to the report and on information that can actually be acquired.

For admissibility purposes, the following must be indicated in the report:

the name and contact details of the whistleblower; the facts reported and the Administration or Entity in which they occurred; the Administration in whose work context the whistleblower operates and the professional profile held by the latter; a brief description of the ways in which the whistleblower became aware of the reported facts.

Public Disclosure

Public disclosure, to be used as a last resort, may only be used in the presence of at least one of the following conditions:

• that the internal and/or external channel has been used previously, but there has been no response or no follow-up has been given within the time limits set by the decree;
• that the whistleblower believes that there are well-founded reasons for an “imminent and obvious danger to the public interest”, considered as a situation of emergency or risk of irreversible damage, including to the physical safety of one or more persons, which requires that the violation be promptly disclosed with wide resonance to prevent its effects.
• that the whistleblower believes that there are reasonable grounds to believe that the external report may entail a risk of retaliation or may not have an effective follow-up because, for example, there may be a well-founded risk of destruction of evidence or collusion between the authority responsible for receiving the report and the perpetrator of the violation.

These are very rare, particularly serious situations of negligence or malicious conduct within the organization which therefore legitimise, only in the presence of actual circumstances, the disclosure to the public of facts or events which otherwise should be treated with rigorous confidentiality.

The prohibition and protection against retaliation

Any form of retaliation against the whistleblower that occurs in the workplace and that causes unjust damage to the protected subjects is prohibited. Retaliatory actions adopted in violation of this prohibition are null and void.

ANAC is the authority responsible for receiving and managing communications from the whistleblower regarding alleged retaliation suffered by the latter.

For this form of protection to be recognized, the following conditions must exist:

• that the whistleblower/denouncer at the time of the report or complaint to the judicial or accounting authority or of the public disclosure had “reasonable grounds” to believe the information was truthful and fell within the scope of the regulation;
• that the report, complaint or disclosure has been made in accordance with the provisions of Legislative Decree 24/23.

The internal sanctioning system: disciplinary code.

The company has a disciplinary code which constitutes, together with other things, the Organizational, Management and Control Model pursuant to Legislative Decree 231/01.

The Disciplinary Code contains all the provisions of the case also in relation to the behaviors connected to the failure to comply with the rules and precepts of Legislative Decree 24/23 and of this act establishing the reporting system and its management. Therefore, in relation to internal disciplinary sanctions, full reference is made to the Disciplinary Code of the MOGC ex Legislative Decree 231/01

The external sanctioning system

From an external point of view, the sanctioning regime distinguishes, for the various cases, between natural and legal persons considered responsible.

With reference, instead, to the hypothesis of the sanction towards those who have adopted a retaliatory act, it was specified that the sanction is given to the natural person identified as responsible for the retaliations.

In detail, the administrative pecuniary sanctions are the following:

a) from 10,000 to 50,000 euros when it is established that the natural person identified as responsible has committed retaliation;

b) from 10,000 to 50,000 euros when it is established that the natural person identified as responsible has hindered the reporting or has attempted to hinder it;

c) from 10,000 to 50,000 euros when it ascertains that the natural person identified as responsible has violated the confidentiality obligation pursuant to art. 12 of Legislative Decree no. 24/2023. The sanctions applicable by the Guarantor for the protection of personal data for the profiles of competence based on the legislation on personal data remain intact;

d) from 10,000 to 50,000 euros when it ascertains that reporting channels have not been established; in this case the responsible body is considered to be responsible;

e) from 10,000 to 50,000 euros when it ascertains that procedures for the performance and management of reports have not been adopted or that the adoption of such procedures does not comply with the provisions of the decree; in this case the responsible body is responsible;

f) from 10,000 to 50,000 euros when it is ascertained that the verification and analysis activity of the reports received has not been carried out; in this case the manager of the reports is considered responsible;

g) from 500 to 2,500 euros, when the civil liability of the reporting person for defamation or slander is ascertained, even by a first-instance judgment, in cases of fraud or gross negligence, unless the same person has already been convicted, even in the first instance, for the crimes of defamation or slander or in any case for the same crimes committed with the complaint to the judicial authority.

The Chairman of the Board of Directors

Information on the processing of data relating to
reports concerning violations of the law
National and/or European Community (cd whistleblowing)

COSMETICA HUB SPAPI: 09198410962 with registered office in Milan, Via Foro Buonaparte n. 67, as Data Controller of personal data, pursuant to art. 13 of EU Regulation 2016/679, informs you that:

interested parties who - having the role of employee, collaborator, partner, supplier or other stakeholder of the Data Controller - report violations of National and/or Union law” (so-called whistleblowing discipline, ref. Legislative Decree 10 March 2023, n. 24) that occurred in reference to the same organization of the Data Controller, will see their personal data processed in the manner set out below.

Purpose of the processing

The collection and processing of personal data are carried out:

• for the management of the obligations referred to in Legislative Decree 10 March 2023, n. 24, relating to the "protection of persons reporting violations of Union law" (so-called whistleblowing discipline) and, in particular, for the management of reporting channels.

Types of data processed

• common data (name, surname, address, contact details, e-mail, telephone number) communicated by you through the reporting channels provided;
• any special data relating to your health, trade union membership, or any political or religious opinions communicated by you through the reporting channels provided.

Data processing methods

There are two reporting channels:

• oral telephone call to the Reporting Manager 0541/411356, Avv. Andrea Guidi
• written by registered mail with return receipt addressed to the Reports Manager, Avv. Andrea Guidi of the Rimini Court, with office in Bellaria Igea Marina, Via Ravenna 151C.

The above data will be stored in paper form at the address of the Reporting Manager with adequate protection measures (archives without the possibility of access by third parties).

Legal bases of the processing

Your personal data are lawfully processed, according to the purposes listed above, in relation to the following legal bases:

• legitimate interest (common and particular data communicated via written paper channel);
• consent (common and specific data communicated via verbal telephone channel);

Mandatory or optional nature of providing data and consequences of refusal

The provision of data is optional, except for different legal obligations that may arise following the processing of the report sent by you.

Communication of data to third parties

The data of the interested parties will not be communicated or transferred to third parties, except for different provisions of law that may arise from the report itself or unless specific consent is given by the interested party (upon specific request of the Report Manager in the cases specifically provided for by Legislative Decree 24/23).

External data controllers and authorised internal subjects

The Manager of the reports indicated above is considered the Data Controller.

Transfer of data abroad

Your data will not be transferred abroad.

Data retention periods

Personal data will be processed for the purposes indicated for a maximum of 5 years, without prejudice to any different provisions of law that may exist.

Rights of the interested party

You may exercise all the rights provided for in Articles 15 to 21 of GDPR 679/2016 by contacting the Reporting Manager indicated above. The Data Controller COSMETICA HUB SPAPI will also be available, where permitted: 09198410962 with registered office in Milan, Via Foro Buonaparte n. 67, at the following contacts tel. 0542 670974 pec cosmetica@legalmail.it - ​​You may also contact the Data Protection Officer, DPO, Lawyer Enrica Vasini, CF VSNNRC78M45C573E, contactable at the email enrica.vasini@ordineavvocatirimini.it. You may contact the data controller and the DPO to exercise the rights recognized to the interested party by the GDPR and to know the updated list of all data controllers, both internal and external, sub-processors and data processors.

Any reason for dissatisfaction or protest may also be reported by you to the Authority for the protection of personal data, Piazza Venezia, 11 – 00187 - Rome, protocollo@pec.gpdp.it .

The Chairman of the Board of Directors