Whistleblowing and Social Responsibility
Whistleblowing and Social Responsibility
Oplium Italia S.r.l. (hereinafter referred to as "Oplium Italia" or "the Company"), as a private sector entity employing at least fifty subordinate workers with an open-ended or fixed-term employment contract, implements the whistleblowing regulations pursuant to Arts. 2, § 1, letter q), no. 1) and 3, § 2, of Legislative Decree no. 24 of March 10, 2023.
With this "Procedure for the management of reports" (hereinafter "Procedure"), the Company intends to regulate the use of reporting channels activated in compliance with the provisions of Legislative Decree no. 24/2023.
Oplium Italia S.r.l. (hereinafter referred to as "Oplium Italia" or "the Company"), as a private sector entity employing at least fifty subordinate workers with an open-ended or fixed-term employment contract, implements the whistleblowing regulations pursuant to Arts. 2, § 1, letter q), no. 1) and 3, § 2, of Legislative Decree no. 24 of March 10, 2023.
With this "Procedure for the management of reports" (hereinafter "Procedure"), the Company intends to regulate the use of reporting channels activated in compliance with the provisions of Legislative Decree no. 24/2023.
1. Objective
Oplium Italia S.r.l., a company specializing in cybersecurity services, created from the joint venture between Spindox S.p.A. (which holds a 51% share of the share capital) and Oplium Ltda (which holds a 49% share of the share capital), in the pursuit of its business objectives, has always been sensitive to the need to ensure conditions of correctness and transparency in the conduct of business, committing to combat illicit conduct, both through the dissemination and promotion of ethical values and principles, and through the effective implementation of conduct rules and control processes, in compliance with the requirements established by the applicable standards and with the best reference practices. For this reason, the Company has adopted and constantly keeps updated a Code of Ethics.
In order to strengthen its organizational and good governance system, Oplium Italia promotes and encourages the reporting of illegalities and/or facts (as defined in par. 4 below), even if only potentially, contrary to the law and to the company's internal regulations, by any person who, in the work context, becomes aware of them.
The purpose of the Procedure is, therefore, to regulate the process of receiving and managing Reports received through the channels indicated below, as well as to define the protections and protection measures established in favor of Whistleblowers.
In compliance with the provisions of Legislative Decree 24/2023, the internal reporting channels described in the Procedure, as well as their respective operating methods, have been communicated to the trade union organizations.
1. Objective
Oplium Italia S.r.l., a company specializing in cybersecurity services, created from the joint venture between Spindox S.p.A. (which holds a 51% share of the share capital) and Oplium Ltda (which holds a 49% share of the share capital), in the pursuit of its business objectives, has always been sensitive to the need to ensure conditions of correctness and transparency in the conduct of business, committing to combat illicit conduct, both through the dissemination and promotion of ethical values and principles, and through the effective implementation of conduct rules and control processes, in compliance with the requirements established by the applicable standards and with the best reference practices. For this reason, the Company has adopted and constantly keeps updated a Code of Ethics.
In order to strengthen its organizational and good governance system, Oplium Italia promotes and encourages the reporting of illegalities and/or facts (as defined in par. 4 below), even if only potentially, contrary to the law and to the company's internal regulations, by any person who, in the work context, becomes aware of them.
The purpose of the Procedure is, therefore, to regulate the process of receiving and managing Reports received through the channels indicated below, as well as to define the protections and protection measures established in favor of Whistleblowers.
In compliance with the provisions of Legislative Decree 24/2023, the internal reporting channels described in the Procedure, as well as their respective operating methods, have been communicated to the trade union organizations.
2. Normative and regulatory references
The Procedure aims to comply with Legislative Decree no. 24 of March 10, 2023 “Implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council, of October 23, 2019, on the protection of persons who report breaches of Union law and containing provisions concerning the protection of persons who report breaches of national regulatory provisions” (so-called whistleblowing).
This Procedure regulates the methods of receiving, managing, and processing reports regarding violations of the company's Code of Ethics, as well as violations of other European and national regulations. All processing of personal data is carried out in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – “GDPR”) and Legislative Decree no. 196 of June 30, 2003 (Privacy Code).
The Procedure was drafted taking into account, in addition to the regulatory text, the “Guidelines on the protection of persons who report breaches of Union law and the protection of persons who report breaches of national regulatory provisions. Procedures for the submission and management of external reports” prepared by ANAC and approved by Resolution no. 311 of July 12, 2023 and Resolution no. 478 of November 26, 2025.
2. Normative and regulatory references
The Procedure aims to comply with Legislative Decree no. 24 of March 10, 2023 “Implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council, of October 23, 2019, on the protection of persons who report breaches of Union law and containing provisions concerning the protection of persons who report breaches of national regulatory provisions” (so-called whistleblowing).
This Procedure regulates the methods of receiving, managing, and processing reports regarding violations of the company's Code of Ethics, as well as violations of other European and national regulations. All processing of personal data is carried out in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – “GDPR”) and Legislative Decree no. 196 of June 30, 2003 (Privacy Code).
The Procedure was drafted taking into account, in addition to the regulatory text, the “Guidelines on the protection of persons who report breaches of Union law and the protection of persons who report breaches of national regulatory provisions. Procedures for the submission and management of external reports” prepared by ANAC and approved by Resolution no. 311 of July 12, 2023 and Resolution no. 478 of November 26, 2025.
3. Definitions
For the correct understanding of the Whistleblowing management procedure, it is necessary to define the meaning assigned to the terms used herein:
· Report: written or oral communication, concerning potential violations, made through internal or external reporting channels.
· Whistleblowing Report: this refers to a report of violations consisting of behavior, acts, or omissions that prejudice the public interest or the integrity of the private entity referred to in art. 2, § 1, letter a) of Legislative Decree 24/2023.
· Ordinary Report: a report that does not fall within the scope of Whistleblowing Reports for objective or subjective reasons, i.e., reports relating to subjects other than those specified in par. 4 or received from subjects other than those indicated in par. 5 of the Procedure or that present one of the exclusion requirements provided for by Legislative Decree 24/2023 or for which the Whistleblower has not declared their identity or has not declared that they wish to benefit from the confidentiality of their identity and the protections provided for by Legislative Decree 24/2023.
· Internal report: the written or oral communication of information on violations, submitted through the reporting channels established by the Company.
· External report: the written or oral communication of information on Violations submitted through the external reporting channel activated by ANAC pursuant to art. 7 of Legislative Decree no. 24/2023.
· Public disclosure: making information about violations public through the press or electronic media or any other means of dissemination capable of reaching a large number of people.
· ANAC: National Anti-Corruption Authority.
· Work context: work or professional activities, present or past, through which, regardless of the nature of those activities, a person acquires information about violations and within the scope of which they could run the risk of suffering retaliation in the event of a report, public disclosure, or communication to the judicial or accounting authority.
· Reporter or Whistleblower: the natural person who makes the Report or Public Disclosure of information on violations acquired within the scope of their work context.
· Reported person: subject who, within the scope of the Report, is identified as responsible for the unlawful act or violation subject to the Report.
· Involved person: the natural or legal person mentioned in the internal or external Report, or in the public disclosure, as the person to whom the violation is attributed or as a person in any way implicated in the reported or publicly disclosed violation.
· Facilitator: the natural person who assists the Whistleblower in the reporting process, operating in the same work context and whose assistance must be kept confidential.
· Report manager or Manager: Web platform accessible at the address https://spindox.eticainsieme.it which allows for secure written Reports thanks to encryption and inaccessibility by subjects other than the Report Managers.
· Platform: Web platform accessible at the address https://spindox.eticainsieme.it which allows for secure written Reports thanks to encryption and inaccessibility by subjects other than the Report Managers.
· Feedback: communication to the Whistleblower of information regarding the follow-up given or intended to be given to the Report.
· Retaliation: any behavior, act, or omission, even if only attempted or threatened, carried out as a result of the Report, the communication to the judicial or accounting authority, or the public disclosure, and which causes or may cause unfair harm to the Whistleblower or to the person who submitted the communication, directly or indirectly.
3. Definitions
For the correct understanding of the Whistleblowing management procedure, it is necessary to define the meaning assigned to the terms used herein:
· Report: written or oral communication, concerning potential violations, made through internal or external reporting channels.
· Whistleblowing Report: this refers to a report of violations consisting of behavior, acts, or omissions that prejudice the public interest or the integrity of the private entity referred to in art. 2, § 1, letter a) of Legislative Decree 24/2023.
· Ordinary Report: a report that does not fall within the scope of Whistleblowing Reports for objective or subjective reasons, i.e., reports relating to subjects other than those specified in par. 4 or received from subjects other than those indicated in par. 5 of the Procedure or that present one of the exclusion requirements provided for by Legislative Decree 24/2023 or for which the Whistleblower has not declared their identity or has not declared that they wish to benefit from the confidentiality of their identity and the protections provided for by Legislative Decree 24/2023.
· Internal report: the written or oral communication of information on violations, submitted through the reporting channels established by the Company.
· External report: the written or oral communication of information on Violations submitted through the external reporting channel activated by ANAC pursuant to art. 7 of Legislative Decree no. 24/2023.
· Public disclosure: making information about violations public through the press or electronic media or any other means of dissemination capable of reaching a large number of people.
· ANAC: National Anti-Corruption Authority.
· Work context: work or professional activities, present or past, through which, regardless of the nature of those activities, a person acquires information about violations and within the scope of which they could run the risk of suffering retaliation in the event of a report, public disclosure, or communication to the judicial or accounting authority.
· Reporter or Whistleblower: the natural person who makes the Report or Public Disclosure of information on violations acquired within the scope of their work context.
· Reported person: subject who, within the scope of the Report, is identified as responsible for the unlawful act or violation subject to the Report.
· Involved person: the natural or legal person mentioned in the internal or external Report, or in the public disclosure, as the person to whom the violation is attributed or as a person in any way implicated in the reported or publicly disclosed violation.
· Facilitator: the natural person who assists the Whistleblower in the reporting process, operating in the same work context and whose assistance must be kept confidential.
· Report manager or Manager: Web platform accessible at the address https://spindox.eticainsieme.it which allows for secure written Reports thanks to encryption and inaccessibility by subjects other than the Report Managers.
· Platform: Web platform accessible at the address https://spindox.eticainsieme.it which allows for secure written Reports thanks to encryption and inaccessibility by subjects other than the Report Managers.
· Feedback: communication to the Whistleblower of information regarding the follow-up given or intended to be given to the Report.
· Retaliation: any behavior, act, or omission, even if only attempted or threatened, carried out as a result of the Report, the communication to the judicial or accounting authority, or the public disclosure, and which causes or may cause unfair harm to the Whistleblower or to the person who submitted the communication, directly or indirectly.
4. Objective scope of application
The adopted Procedure applies to all Reports received through the channels defined in par. 8.
Reports can be of two types: “Whistleblowing Reports” and “Ordinary Reports”.
Whistleblowing Reports are exclusively those concerning:
· violations of European Union restrictive measures provided for in Chapter I-bis, Title I, Book II of the Penal Code (Art. 275-bis “Violation of European Union restrictive measures”, Art. 275-ter “Violation of information obligations”, Art. 275-quater “Violation of authorization conditions for the exercise of activities”, Art. 275-quinquies “Negligent violation of European Union restrictive measures”), as well as Article 12, § 1-bis, of the legislative decree of July 25, 1998, no. 286 (aggravating factor in the case of facilitating the clandestine entry of designated natural persons, in violation of a prohibition, obligation or restriction imposed by a EU restrictive measure);
· violations of European or national implementing provisions consisting of offenses relating to the following sectors: public procurement; financial services, products and markets and prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; protection of privacy and personal data and security of network and information systems;
· violations of European provisions consisting of: i) acts or omissions affecting the financial interests of the Union; ii) acts and omissions relating to the internal market. This includes violations of EU competition and state aid rules, corporate tax rules, and arrangements the purpose of which is to obtain a tax advantage that defeats the object or purpose of the applicable corporate tax law; iii) acts and behaviors that defeat the object or purpose of the provisions of Union acts in the sectors referred to above;
· violations of the Code of Ethics adopted by Oplium Italia resulting in the violations referred to in the previous points.
Such Reports must concern behaviors, acts, or omissions of which the reporter became aware in the context of the work relations maintained with the Company.
The Whistleblowing Report cannot consist of claims, disputes, or requests of a personal nature of the reporting person or the person who has submitted a communication to the judicial or accounting authority, relating exclusively to their individual work relations or inherent to their work relations with hierarchically superior figures.
Ordinary Reports are Reports that do not fall within the scope of Whistleblowing Reports for objective or subjective reasons, i.e., Reports relating to topics other than those listed above or received from subjects other than those indicated in par. 5 of this Procedure.
Ordinary Reports will also be managed protecting the confidentiality of the reporter's identity, in compliance with the provisions specifically adopted by the Company in this matter and with this Procedure.
4. Objective scope of application
The adopted Procedure applies to all Reports received through the channels defined in par. 8.
Reports can be of two types: “Whistleblowing Reports” and “Ordinary Reports”.
Whistleblowing Reports are exclusively those concerning:
· violations of European Union restrictive measures provided for in Chapter I-bis, Title I, Book II of the Penal Code (Art. 275-bis “Violation of European Union restrictive measures”, Art. 275-ter “Violation of information obligations”, Art. 275-quater “Violation of authorization conditions for the exercise of activities”, Art. 275-quinquies “Negligent violation of European Union restrictive measures”), as well as Article 12, § 1-bis, of the legislative decree of July 25, 1998, no. 286 (aggravating factor in the case of facilitating the clandestine entry of designated natural persons, in violation of a prohibition, obligation or restriction imposed by a EU restrictive measure);
· violations of European or national implementing provisions consisting of offenses relating to the following sectors: public procurement; financial services, products and markets and prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; protection of privacy and personal data and security of network and information systems;
· violations of European provisions consisting of: i) acts or omissions affecting the financial interests of the Union; ii) acts and omissions relating to the internal market. This includes violations of EU competition and state aid rules, corporate tax rules, and arrangements the purpose of which is to obtain a tax advantage that defeats the object or purpose of the applicable corporate tax law; iii) acts and behaviors that defeat the object or purpose of the provisions of Union acts in the sectors referred to above;
· violations of the Code of Ethics adopted by Oplium Italia resulting in the violations referred to in the previous points.
Such Reports must concern behaviors, acts, or omissions of which the reporter became aware in the context of the work relations maintained with the Company.
The Whistleblowing Report cannot consist of claims, disputes, or requests of a personal nature of the reporting person or the person who has submitted a communication to the judicial or accounting authority, relating exclusively to their individual work relations or inherent to their work relations with hierarchically superior figures.
Ordinary Reports are Reports that do not fall within the scope of Whistleblowing Reports for objective or subjective reasons, i.e., Reports relating to topics other than those listed above or received from subjects other than those indicated in par. 5 of this Procedure.
Ordinary Reports will also be managed protecting the confidentiality of the reporter's identity, in compliance with the provisions specifically adopted by the Company in this matter and with this Procedure.
5. Subjective scope of application: the protected subjects
The entities who can make Reports and who fall within the scope of protection under Legislative Decree 24/2023 are:
· the directors and members of the corporate bodies of Oplium Italia with administration, management, control, supervision, or representation functions, even if such functions are exercised de facto;
· all employees, both fixed-term and permanent;
· all those who, in any capacity, have working relationships, including self-employed and collaborative, with Oplium Italia, including: shareholders, volunteers and interns (paid and unpaid), temporary workers, self-employed professionals and consultants, agents, intermediaries, suppliers, and business partners;
· workers or collaborators who provide goods or services or perform works for third parties at Oplium Italia;
· any person who became aware of the violation during the application process or in other pre-contractual phases, or even during the probationary period or after the termination of the employment relationship, if the information about the violations was acquired in the course of the same legal relationship.
The entities to whom the whistleblower protection measures can be extended are:
· facilitators;
· persons in the same work context as the Whistleblower, the person who made a report to the judicial or accounting authority, or the person who made a public disclosure, and who are linked to them by a stable emotional bond or kinship up to the fourth degree;
· work colleagues of the Whistleblower, of the person who made a report to the judicial or accounting authority, or of the person who made a public disclosure, who work in the same work context and who have a regular and ongoing relationship with that person;
· entities owned by the Whistleblower or by the person who made a report to the judicial or accounting authority or made a public disclosure, or for whom the same persons work, as well as entities operating in the same work context as the aforementioned persons.
5. Subjective scope of application: the protected subjects
The entities who can make Reports and who fall within the scope of protection under Legislative Decree 24/2023 are:
· the directors and members of the corporate bodies of Oplium Italia with administration, management, control, supervision, or representation functions, even if such functions are exercised de facto;
· all employees, both fixed-term and permanent;
· all those who, in any capacity, have working relationships, including self-employed and collaborative, with Oplium Italia, including: shareholders, volunteers and interns (paid and unpaid), temporary workers, self-employed professionals and consultants, agents, intermediaries, suppliers, and business partners;
· workers or collaborators who provide goods or services or perform works for third parties at Oplium Italia;
· any person who became aware of the violation during the application process or in other pre-contractual phases, or even during the probationary period or after the termination of the employment relationship, if the information about the violations was acquired in the course of the same legal relationship.
The entities to whom the whistleblower protection measures can be extended are:
· facilitators;
· persons in the same work context as the Whistleblower, the person who made a report to the judicial or accounting authority, or the person who made a public disclosure, and who are linked to them by a stable emotional bond or kinship up to the fourth degree;
· work colleagues of the Whistleblower, of the person who made a report to the judicial or accounting authority, or of the person who made a public disclosure, who work in the same work context and who have a regular and ongoing relationship with that person;
· entities owned by the Whistleblower or by the person who made a report to the judicial or accounting authority or made a public disclosure, or for whom the same persons work, as well as entities operating in the same work context as the aforementioned persons.
6. Report manager
The receipt and management of Whistleblowing reports are entrusted to an external party to the Company, autonomous, impartial, and adequately trained, competent in managing the whistleblowing channel and the Whistleblowing reports (hereinafter, the "Manager").
This party was identified as Dr. Claudia Putzulu, Legal Manager & Labor Relations Manager of Spindox S.p.A.
In identifying the Manager, the Company verified the absence of conflict of interest situations and the existence of the autonomy and independence requirements necessary for the correct performance of the mandate. In particular, the compatibility of the mandate with any other roles performed by the Manager was assessed, in order to prevent the accumulation of functions from compromising the effectiveness of managing the Whistleblowing reports or the objectivity of the respective evaluations.
In any case, the Manager is obliged to abstain from handling the Whistleblowing report whenever they find themselves, even potentially, in a conflict of interest situation, including cases where they coincide with the reporting person, with the person involved, or in any way interested in the Whistleblowing report, or whenever a situation arises that could compromise their objectivity and autonomy of judgment.
In these scenarios, as well as in cases of absence or impediment of the Manager, the management of the Whistleblowing report is entrusted to a substitute party, who possesses the same requirements of autonomy, independence, impartiality, confidentiality, and adequate competence required for the Manager, identified by Oplium Italia as Nevio Sestini, CFO of Oplium Italia S.r.l.
If, exceptionally, the substitute also finds themselves in a conflict of interest situation or cannot perform the mandate, the reporting person retains the option to resort to the external whistleblowing channel, in the cases and under the conditions provided by D. Lgs. 24/2023.
The Whistleblowing Manager receives a formal mandate that also includes the designation letter as authorized in accordance with arts. 29 of EU Reg. 679/2016 (also "GDPR") and 2-quaterdecies of D. Lgs. no. 196/2003 (also "Privacy Code"). The letter provides specific instructions for the correct processing of personal data contained in the Whistleblowing report, of which the Company is the Data Controller under art. 4, § 1, no. 7) of the GDPR.
6. Report manager
The receipt and management of Whistleblowing reports are entrusted to an external party to the Company, autonomous, impartial, and adequately trained, competent in managing the whistleblowing channel and the Whistleblowing reports (hereinafter, the "Manager").
This party was identified as Dr. Claudia Putzulu, Legal Manager & Labor Relations Manager of Spindox S.p.A.
In identifying the Manager, the Company verified the absence of conflict of interest situations and the existence of the autonomy and independence requirements necessary for the correct performance of the mandate. In particular, the compatibility of the mandate with any other roles performed by the Manager was assessed, in order to prevent the accumulation of functions from compromising the effectiveness of managing the Whistleblowing reports or the objectivity of the respective evaluations.
In any case, the Manager is obliged to abstain from handling the Whistleblowing report whenever they find themselves, even potentially, in a conflict of interest situation, including cases where they coincide with the reporting person, with the person involved, or in any way interested in the Whistleblowing report, or whenever a situation arises that could compromise their objectivity and autonomy of judgment.
In these scenarios, as well as in cases of absence or impediment of the Manager, the management of the Whistleblowing report is entrusted to a substitute party, who possesses the same requirements of autonomy, independence, impartiality, confidentiality, and adequate competence required for the Manager, identified by Oplium Italia as Nevio Sestini, CFO of Oplium Italia S.r.l.
If, exceptionally, the substitute also finds themselves in a conflict of interest situation or cannot perform the mandate, the reporting person retains the option to resort to the external whistleblowing channel, in the cases and under the conditions provided by D. Lgs. 24/2023.
The Whistleblowing Manager receives a formal mandate that also includes the designation letter as authorized in accordance with arts. 29 of EU Reg. 679/2016 (also "GDPR") and 2-quaterdecies of D. Lgs. no. 196/2003 (also "Privacy Code"). The letter provides specific instructions for the correct processing of personal data contained in the Whistleblowing report, of which the Company is the Data Controller under art. 4, § 1, no. 7) of the GDPR.
7. Characteristics of the Complaint
The Report must be substantiated and must contain – whenever possible – the following elements:
· An indication that it is a Whistleblowing Report for which the reporter wishes to keep their identity confidential and benefit from the protections provided in the event of potential retaliation; in the absence of such indication, the Report will be treated as an ordinary one;
· the details of the person making the Report, indicating their potential role in the company or the company or entity where they perform their work activity, as well as their consent – or lack thereof – to disclose their identity to parties other than the manager of the Report and/or the human resources department responsible for managing the disciplinary procedure;
· a clear and complete description of the facts being reported;
· the circumstances of time and place in which the fact being reported occurred;
· details or other elements allowing the identification of the person to whom the reported facts are attributed;
· an indication of the beneficiaries and those harmed by the wrongdoing;
· an indication of any other parties who can testify about the facts being reported;
· the attachment, whenever possible, of any documents that can confirm the truthfulness of the reported facts;
· any other information that can provide useful confirmation regarding the existence of the reported facts.
· In this light, it is advisable that the Reports be as detailed as possible and provide the greatest number of elements to enable the Company to carry out the necessary verifications.
Reports may not concern manifestly unfounded news, information that is already entirely in the public domain, as well as information acquired solely based on unreliable rumors or speculation (so-called "hearsay").
7.1. Special cases
7.1.1. Anonymous reports
Anonymous Reports, i.e., those from which it is not possible to obtain the identity of the Whistleblower, are considered by the Manager, provided they are well-founded and precise, and allow for the collection of objective elements through the investigation activities carried out by the Manager.
Such Reports will be considered as Ordinary Reports, and the guarantees and protections provided for so-called Whistleblowing Reports will not be applicable, except in the event that the Whistleblower is subsequently identified and suffers retaliation.
In any case, the use of nominative Reports is encouraged, keeping in mind that the management methods were designed to guarantee maximum confidentiality for the whistleblower, in full compliance with current legislation.
7.1.2. Complaints received by subjects other than the Manager
In the event that a Whistleblowing Report is received by a party other than the Manager, the recipient is obliged to:
handle the information they have become aware of in a manner appropriate to guarantee its full confidentiality;
ii. contact the Manager – via oral channel – in order to receive instructions on the methods of transmission of the wrongly received Report;
iii. transmit the Report to the Manager, without delay, and in any case within 7 (seven) days;
iv. after communication to the Manager, delete the Report from their devices;
v. in the event of a Report of retaliation, contact ANAC – through the channels and in the manners provided by that body on its website https://www.anticorruzione.it/-/whistleblowing – in order to receive instructions on the methods of transmission of the wrongly received Report.
7. Characteristics of the Complaint
The Report must be substantiated and must contain – whenever possible – the following elements:
· An indication that it is a Whistleblowing Report for which the reporter wishes to keep their identity confidential and benefit from the protections provided in the event of potential retaliation; in the absence of such indication, the Report will be treated as an ordinary one;
· the details of the person making the Report, indicating their potential role in the company or the company or entity where they perform their work activity, as well as their consent – or lack thereof – to disclose their identity to parties other than the manager of the Report and/or the human resources department responsible for managing the disciplinary procedure;
· a clear and complete description of the facts being reported;
· the circumstances of time and place in which the fact being reported occurred;
· details or other elements allowing the identification of the person to whom the reported facts are attributed;
· an indication of the beneficiaries and those harmed by the wrongdoing;
· an indication of any other parties who can testify about the facts being reported;
· the attachment, whenever possible, of any documents that can confirm the truthfulness of the reported facts;
· any other information that can provide useful confirmation regarding the existence of the reported facts.
· In this light, it is advisable that the Reports be as detailed as possible and provide the greatest number of elements to enable the Company to carry out the necessary verifications.
Reports may not concern manifestly unfounded news, information that is already entirely in the public domain, as well as information acquired solely based on unreliable rumors or speculation (so-called "hearsay").
7.1. Special cases
7.1.1. Anonymous reports
Anonymous Reports, i.e., those from which it is not possible to obtain the identity of the Whistleblower, are considered by the Manager, provided they are well-founded and precise, and allow for the collection of objective elements through the investigation activities carried out by the Manager.
Such Reports will be considered as Ordinary Reports, and the guarantees and protections provided for so-called Whistleblowing Reports will not be applicable, except in the event that the Whistleblower is subsequently identified and suffers retaliation.
In any case, the use of nominative Reports is encouraged, keeping in mind that the management methods were designed to guarantee maximum confidentiality for the whistleblower, in full compliance with current legislation.
7.1.2. Complaints received by subjects other than the Manager
In the event that a Whistleblowing Report is received by a party other than the Manager, the recipient is obliged to:
handle the information they have become aware of in a manner appropriate to guarantee its full confidentiality;
ii. contact the Manager – via oral channel – in order to receive instructions on the methods of transmission of the wrongly received Report;
iii. transmit the Report to the Manager, without delay, and in any case within 7 (seven) days;
iv. after communication to the Manager, delete the Report from their devices;
v. in the event of a Report of retaliation, contact ANAC – through the channels and in the manners provided by that body on its website https://www.anticorruzione.it/-/whistleblowing – in order to receive instructions on the methods of transmission of the wrongly received Report.
8. Reporting channels
8.1. Internal channels
Oplium Italia, in order to pursue the objective stated in paragraph 1 above, has established two internal reporting channels that can be used by the recipients alternatively.
Written Reporting Channel: “eticainsieme” Platform.
The Company has activated an IT channel accessible from any browser (including mobile devices) that allows sending written reports and is available at the following link: https://spindox.eticainsieme.it
The Reporting platform, equipped with technical security measures appropriate to the standards of art. 32 of the GDPR, resides on a server – located in the European Union – of a third-party subject and provides a guided path for the whistleblower that will allow them to enter the information necessary for the reconstruction and assessment of the facts, and the use of encryption measures, which guarantee the confidentiality not only of the whistleblower, but also of the facilitator, the person involved or in any way mentioned in the Report, as well as the content of the Report and the documentation.
Oral Reporting Channel: telephone contact to the number +39 3442063500.
8.1.1.1. Written complaints
With particular reference to the Whistleblowing channel in written form, the Company has adopted the Whistleblowing platform (eticainsieme), available at the following address: https://spindox.eticainsieme.it which will automatically inform the Manager of the submission of the Report, this being the only subject authorized to access the platform and consult the Reports.
In case of using the platform, the whistleblower must answer some questions, both open and closed, which will allow the Manager to delve deeper into the subject of the report, in addition to, if correctly filled out, respecting the requirements established by law for Whistleblowing Reports.
The platform also allows uploading documentation that the whistleblower considers appropriate to bring to the attention of the Manager in support of their Report.
The tool also enables interaction via internal messaging within the platform between the whistleblower and the Report Manager, in order to delve deeper into the topics of communication or to supplement/rectify the information previously provided.
The Platform also allows the whistleblower to always stay updated on the status of the submitted Report and obtain the respective Response.
At the end of the Reporting procedure, the Platform will, in fact, provide the whistleblower with a 16-digit code that will allow them to access the system and, therefore, their Report to:
· monitor the progress status;
· supplement their Report with additional factual elements or other documentation;
· have direct contact with the Manager, also starting a possible exchange of requests and information;
· obtain the Response from the Manager.
The loss of the code has no effect on the Report, which will in any case be processed within the timeframes and modalities established in this Procedure.
The availability of the code is essential to be able to access your Report at any time in order to monitor the progress status, provide additional information regarding what has already been reported, and learn of the Response. Without it, these operations will not be available.
In these cases, for confidentiality reasons to protect the Whistleblower, the code associated with each Report cannot be recovered in any way. If it is deemed appropriate to provide new information that has come to light or to learn the results of the investigation, it is nevertheless possible to open a new Report.
8.1.1.2. Oral reports
With particular reference to the oral Whistleblowing channel, it is possible to contact the Whistleblowing Manager at the following number: +39 3442063500
You should call the telephone number indicated above between the hours of 9:00 AM and 6:30 PM, Monday to Friday, excluding public holidays, in order to present your report or potentially schedule a meeting (in person or via videoconference) with the Whistleblowing Manager.
During the call, the whistleblower must indicate:
At the end of the Whistleblowing procedure, the Platform will, in fact, provide the whistleblower with a 16-digit code that will allow them to access the system and, therefore, their Report to:
· their contact details, taking care not to specify their name;
· the desire to present their report by telephone or to meet with the Manager in person or to schedule a video call (in these latter two cases, the Manager will arrange to schedule a meeting within 7 days of the first contact).
During the telephone conversation or video call, the Manager will request from the whistleblower the information necessary to acquire and assess the Report, in accordance with the questions present on the online Platform, and will proceed to register them there. Once the registration is complete, the Manager will communicate to the whistleblower the 16-digit code automatically generated by the Platform, through which the Whistleblower can subsequently access independently to monitor the progress of the Report and interact with the Manager. In the event that the Whistleblower is unable to access the Platform, they may request an additional meeting to provide further information or obtain the Response.
In the case of an in-person meeting, the Report may be collected and recorded in the minutes in a document verified and signed by the whistleblower and/or the Report will be registered on the Platform during the meeting.
8.1.1.3. Complaint management
The management of the Report follows the timeframes and methods indicated below:
· within 7 (seven) days of receipt of the Report, the Manager will send the whistleblower an acknowledgment of receipt of the report, using the reporting channel. In the case of an oral report (request for a meeting and/or use of a telephone line), the receipt of the report is simultaneous with the insertion of the Report into the Platform and, on that occasion, the Whistleblower will be assigned the personal Code associated with the Whistleblowing Report.
· the Manager begins the investigation phase and classifies the Report as “Whistleblowing” or “Ordinary”. With reference only to Ordinary Reports, when there is another competent corporate function, the Manager simultaneously forwards it, adopting appropriate measures to ensure the confidentiality of the whistleblower's identity. Otherwise, they will proceed with its management in accordance with the Procedure;
· within 3 (three) months, starting from the date of the acknowledgment of receipt, the Manager provides a Response to the whistleblower.
The Manager diligently follows up on the Report, carrying out the activity of verifying its merits with full access to any information necessary to perform the task. For the purposes of the verification activity, the Manager may mandate internal departments and/or third parties to conduct an in-depth review, taking care to:
· confer a formal mandate, defining the scope of action and specifying the information they wish to obtain from the requested in-depth review;
· omit any information that could, even indirectly, lead to the identity of the whistleblower or the content of the Report;
· omit any information relating to the Reported Person, when not strictly necessary for the correct performance of the assigned mandate;
· reiterate to the assigned subject the obligation of confidentiality regarding the processed data (in the case of external subjects, this obligation must be formalized).
In cases where, for investigative reasons, it is necessary to disclose the content of the Report and/or the documentation attached to it to other subjects, the Manager proceeds to obscure the personal data of the Whistleblower, as well as of other subjects whose identity must remain confidential (such as the Facilitator, the Reported Person, and other people mentioned in the Report).
In any case, the data of the Whistleblower and any other information from which this identity can be directly or indirectly deduced will not be disclosed to third parties other than the Manager without the consent of the Whistleblower, except in the exceptional cases detailed below:
· within the scope of proceedings before the Court of Auditors, the identity of the whistleblower may be disclosed after the close of the investigative phase;
· within the scope of criminal proceedings, the identity of the whistleblower is protected by secrecy pursuant to art. 329 of the Code of Criminal Procedure (until the accused or suspect can know it and, in any case, not after the close of preliminary investigations).
Within the scope of the disciplinary procedure against the Reported Person:
· the identity of the Whistleblower cannot be disclosed when the accusation of the disciplinary infraction is based on separate and additional findings from the Report, even if consequent to it;
· when the charge is based wholly or partially on the Report and knowledge of the Whistleblower's identity is essential for the defense of the accused, the Report will be usable in the disciplinary procedure only with the express consent of the whistleblower for the disclosure of their identity.
8.1.1.4. Archiving: closure of the Complaint and preservation of documentation
At the end of the investigation, the Manager will draft a report taking one or more of the following measures:
· archiving of the Report due to insufficient elements;
· archiving of the Report due to the irrelevance of the reported facts;
· proposal to amend the Code of Ethics or other internal procedures;
· proposal to initiate disciplinary or sanctioning proceedings – in accordance with the provisions of the current disciplinary and sanctioning system – against the Reported parties in respect of whom the commission of a violation, illegality, or irregularity has been recognized;
· proposal to initiate disciplinary or sanctioning proceedings – in accordance with the provisions of the current disciplinary and sanctioning system and this Procedure – against Reportings who have made unfounded Reports, based on untrue factual circumstances and made with intent or gross negligence.
8.1.1.5. Retention of documentation
In compliance with the provisions of current legislation, the Report and corresponding documentation will be kept for the time strictly necessary for their management and in any case not longer than 5 years from the closure of the management process on the Platform.
The original media of the Reports received through the dedicated telephone line and/or through the request for a hearing and/or other methods are kept by the Manager, in addition to being uploaded to the Platform in the competent section, also in an appropriate protected environment.
8.2. External channel and public disclosure
Without prejudice to the fact that Whistleblowers are invited, by virtue of the principles of transparency, loyalty, trust and collaboration that characterize the relationship with the Company, to use one of the internal Whistleblowing channels provided by Oplium Italia, the Whistleblower may carry out:
an external report to the National Anticorruption Authority (ANAC) whenever one of the following conditions is met:
the internal Whistleblowing channel has not been activated or, if activated, the channel provided to the whistleblower does not comply with legal requirements;
an internal Report has already been made and has not been followed up;
the whistleblower has reasonable grounds to believe that, if they made an internal Report, it would not be effectively followed up or that it could lead to a risk of retaliation;
the whistleblower has reasonable grounds to believe that the violation may constitute an imminent or obvious danger to the public interest.
The external Whistleblowing channel is activated with ANAC, which publishes on its website, in a dedicated and easily accessible section, the information necessary for submitting the Report: https://www.anticorruzione.it/-/whistleblowing.
a public disclosure making information about the violations public through the press or other media capable of reaching a large number of people
Protection for anyone who makes a public disclosure under Legislative Decree No. 24/2023 applies when one of the following conditions is met:
the whistleblower has previously made an internal and external Report or has directly made an external Report, under the conditions and in the manners provided for internal and external reports, and no response was given within the time limits provided by law regarding the measures planned or adopted to follow up on the reports;
the whistleblower has reasonable grounds to believe that the violation may constitute an imminent or obvious danger to the public interest;
the whistleblower has reasonable grounds to believe that the external Report may carry the risk of retaliation or may not be effectively followed up due to the specific circumstances of the concrete case, such as those where evidence may be concealed or destroyed or where there is a well-founded fear that the recipient of the Report may be in collusion with the perpetrator of the violation or involved in the violation itself.
8. Reporting channels
8.1. Internal channels
Oplium Italia, in order to pursue the objective stated in paragraph 1 above, has established two internal reporting channels that can be used by the recipients alternatively.
Written Reporting Channel: “eticainsieme” Platform.
The Company has activated an IT channel accessible from any browser (including mobile devices) that allows sending written reports and is available at the following link: https://spindox.eticainsieme.it
The Reporting platform, equipped with technical security measures appropriate to the standards of art. 32 of the GDPR, resides on a server – located in the European Union – of a third-party subject and provides a guided path for the whistleblower that will allow them to enter the information necessary for the reconstruction and assessment of the facts, and the use of encryption measures, which guarantee the confidentiality not only of the whistleblower, but also of the facilitator, the person involved or in any way mentioned in the Report, as well as the content of the Report and the documentation.
Oral Reporting Channel: telephone contact to the number +39 3442063500.
8.1.1.1. Written complaints
With particular reference to the Whistleblowing channel in written form, the Company has adopted the Whistleblowing platform (eticainsieme), available at the following address: https://spindox.eticainsieme.it which will automatically inform the Manager of the submission of the Report, this being the only subject authorized to access the platform and consult the Reports.
In case of using the platform, the whistleblower must answer some questions, both open and closed, which will allow the Manager to delve deeper into the subject of the report, in addition to, if correctly filled out, respecting the requirements established by law for Whistleblowing Reports.
The platform also allows uploading documentation that the whistleblower considers appropriate to bring to the attention of the Manager in support of their Report.
The tool also enables interaction via internal messaging within the platform between the whistleblower and the Report Manager, in order to delve deeper into the topics of communication or to supplement/rectify the information previously provided.
The Platform also allows the whistleblower to always stay updated on the status of the submitted Report and obtain the respective Response.
At the end of the Reporting procedure, the Platform will, in fact, provide the whistleblower with a 16-digit code that will allow them to access the system and, therefore, their Report to:
· monitor the progress status;
· supplement their Report with additional factual elements or other documentation;
· have direct contact with the Manager, also starting a possible exchange of requests and information;
· obtain the Response from the Manager.
The loss of the code has no effect on the Report, which will in any case be processed within the timeframes and modalities established in this Procedure.
The availability of the code is essential to be able to access your Report at any time in order to monitor the progress status, provide additional information regarding what has already been reported, and learn of the Response. Without it, these operations will not be available.
In these cases, for confidentiality reasons to protect the Whistleblower, the code associated with each Report cannot be recovered in any way. If it is deemed appropriate to provide new information that has come to light or to learn the results of the investigation, it is nevertheless possible to open a new Report.
8.1.1.2. Oral reports
With particular reference to the oral Whistleblowing channel, it is possible to contact the Whistleblowing Manager at the following number: +39 3442063500
You should call the telephone number indicated above between the hours of 9:00 AM and 6:30 PM, Monday to Friday, excluding public holidays, in order to present your report or potentially schedule a meeting (in person or via videoconference) with the Whistleblowing Manager.
During the call, the whistleblower must indicate:
At the end of the Whistleblowing procedure, the Platform will, in fact, provide the whistleblower with a 16-digit code that will allow them to access the system and, therefore, their Report to:
· their contact details, taking care not to specify their name;
· the desire to present their report by telephone or to meet with the Manager in person or to schedule a video call (in these latter two cases, the Manager will arrange to schedule a meeting within 7 days of the first contact).
During the telephone conversation or video call, the Manager will request from the whistleblower the information necessary to acquire and assess the Report, in accordance with the questions present on the online Platform, and will proceed to register them there. Once the registration is complete, the Manager will communicate to the whistleblower the 16-digit code automatically generated by the Platform, through which the Whistleblower can subsequently access independently to monitor the progress of the Report and interact with the Manager. In the event that the Whistleblower is unable to access the Platform, they may request an additional meeting to provide further information or obtain the Response.
In the case of an in-person meeting, the Report may be collected and recorded in the minutes in a document verified and signed by the whistleblower and/or the Report will be registered on the Platform during the meeting.
8.1.1.3. Complaint management
The management of the Report follows the timeframes and methods indicated below:
· within 7 (seven) days of receipt of the Report, the Manager will send the whistleblower an acknowledgment of receipt of the report, using the reporting channel. In the case of an oral report (request for a meeting and/or use of a telephone line), the receipt of the report is simultaneous with the insertion of the Report into the Platform and, on that occasion, the Whistleblower will be assigned the personal Code associated with the Whistleblowing Report.
· the Manager begins the investigation phase and classifies the Report as “Whistleblowing” or “Ordinary”. With reference only to Ordinary Reports, when there is another competent corporate function, the Manager simultaneously forwards it, adopting appropriate measures to ensure the confidentiality of the whistleblower's identity. Otherwise, they will proceed with its management in accordance with the Procedure;
· within 3 (three) months, starting from the date of the acknowledgment of receipt, the Manager provides a Response to the whistleblower.
The Manager diligently follows up on the Report, carrying out the activity of verifying its merits with full access to any information necessary to perform the task. For the purposes of the verification activity, the Manager may mandate internal departments and/or third parties to conduct an in-depth review, taking care to:
· confer a formal mandate, defining the scope of action and specifying the information they wish to obtain from the requested in-depth review;
· omit any information that could, even indirectly, lead to the identity of the whistleblower or the content of the Report;
· omit any information relating to the Reported Person, when not strictly necessary for the correct performance of the assigned mandate;
· reiterate to the assigned subject the obligation of confidentiality regarding the processed data (in the case of external subjects, this obligation must be formalized).
In cases where, for investigative reasons, it is necessary to disclose the content of the Report and/or the documentation attached to it to other subjects, the Manager proceeds to obscure the personal data of the Whistleblower, as well as of other subjects whose identity must remain confidential (such as the Facilitator, the Reported Person, and other people mentioned in the Report).
In any case, the data of the Whistleblower and any other information from which this identity can be directly or indirectly deduced will not be disclosed to third parties other than the Manager without the consent of the Whistleblower, except in the exceptional cases detailed below:
· within the scope of proceedings before the Court of Auditors, the identity of the whistleblower may be disclosed after the close of the investigative phase;
· within the scope of criminal proceedings, the identity of the whistleblower is protected by secrecy pursuant to art. 329 of the Code of Criminal Procedure (until the accused or suspect can know it and, in any case, not after the close of preliminary investigations).
Within the scope of the disciplinary procedure against the Reported Person:
· the identity of the Whistleblower cannot be disclosed when the accusation of the disciplinary infraction is based on separate and additional findings from the Report, even if consequent to it;
· when the charge is based wholly or partially on the Report and knowledge of the Whistleblower's identity is essential for the defense of the accused, the Report will be usable in the disciplinary procedure only with the express consent of the whistleblower for the disclosure of their identity.
8.1.1.4. Archiving: closure of the Complaint and preservation of documentation
At the end of the investigation, the Manager will draft a report taking one or more of the following measures:
· archiving of the Report due to insufficient elements;
· archiving of the Report due to the irrelevance of the reported facts;
· proposal to amend the Code of Ethics or other internal procedures;
· proposal to initiate disciplinary or sanctioning proceedings – in accordance with the provisions of the current disciplinary and sanctioning system – against the Reported parties in respect of whom the commission of a violation, illegality, or irregularity has been recognized;
· proposal to initiate disciplinary or sanctioning proceedings – in accordance with the provisions of the current disciplinary and sanctioning system and this Procedure – against Reportings who have made unfounded Reports, based on untrue factual circumstances and made with intent or gross negligence.
8.1.1.5. Retention of documentation
In compliance with the provisions of current legislation, the Report and corresponding documentation will be kept for the time strictly necessary for their management and in any case not longer than 5 years from the closure of the management process on the Platform.
The original media of the Reports received through the dedicated telephone line and/or through the request for a hearing and/or other methods are kept by the Manager, in addition to being uploaded to the Platform in the competent section, also in an appropriate protected environment.
8.2. External channel and public disclosure
Without prejudice to the fact that Whistleblowers are invited, by virtue of the principles of transparency, loyalty, trust and collaboration that characterize the relationship with the Company, to use one of the internal Whistleblowing channels provided by Oplium Italia, the Whistleblower may carry out:
an external report to the National Anticorruption Authority (ANAC) whenever one of the following conditions is met:
the internal Whistleblowing channel has not been activated or, if activated, the channel provided to the whistleblower does not comply with legal requirements;
an internal Report has already been made and has not been followed up;
the whistleblower has reasonable grounds to believe that, if they made an internal Report, it would not be effectively followed up or that it could lead to a risk of retaliation;
the whistleblower has reasonable grounds to believe that the violation may constitute an imminent or obvious danger to the public interest.
The external Whistleblowing channel is activated with ANAC, which publishes on its website, in a dedicated and easily accessible section, the information necessary for submitting the Report: https://www.anticorruzione.it/-/whistleblowing.
a public disclosure making information about the violations public through the press or other media capable of reaching a large number of people
Protection for anyone who makes a public disclosure under Legislative Decree No. 24/2023 applies when one of the following conditions is met:
the whistleblower has previously made an internal and external Report or has directly made an external Report, under the conditions and in the manners provided for internal and external reports, and no response was given within the time limits provided by law regarding the measures planned or adopted to follow up on the reports;
the whistleblower has reasonable grounds to believe that the violation may constitute an imminent or obvious danger to the public interest;
the whistleblower has reasonable grounds to believe that the external Report may carry the risk of retaliation or may not be effectively followed up due to the specific circumstances of the concrete case, such as those where evidence may be concealed or destroyed or where there is a well-founded fear that the recipient of the Report may be in collusion with the perpetrator of the violation or involved in the violation itself.
9. Protection of whistleblowers and the accused
Oplium Italia, firmly convinced of the importance of the Whistleblowing system in combating unlawful or irregular behavior, guarantees the whistleblower protection against any form of retaliation, discrimination, or penalization, whether direct or indirect, for reasons related, directly or indirectly, to the Whistleblowing report.
By way of example, each whistleblower is protected in cases of:
dismissal, suspension, or equivalent measures;
demotion or lack of promotion;
change of duties, change of workplace, salary reduction, modification of working hours;
suspension of training or any restriction of access to it;
negative performance appraisals or negative references;
adoption of disciplinary measures or other sanctions, including monetary ones;
coercion, intimidation, harassment, or ostracism;
discrimination or unfavorable treatment of any kind;
failure to convert a fixed-term employment contract into an indefinite employment contract, when the worker had a legitimate expectation of such conversion;
failure to renew or early termination of a fixed-term employment contract;
damage, including to the person's reputation, particularly on social networks, or economic or financial loss, including loss of business opportunities and loss of income;
inclusion in blacklists based on a formal or informal sector or industry agreement, which may make it impossible for the person to find employment in the sector or industry in the future;
early termination or cancellation of a contract for the supply of goods or services;
cancellation of a license or authorization;
request to undergo psychiatric or medical examinations;
demanding results that are impossible to achieve within the forms and timeframes indicated;
artificially negative performance evaluation;
unjustified revocation of mandates;
unjustified failure to assign mandates with simultaneous assignment to another subject;
repeated rejection of requests (e.g., vacation, leave).
The application of the protection regime against retaliation provided by the decree is subject to certain conditions and requirements:
The subject reported, communicated, or made a public disclosure based on a reasonable belief that the information on the reported, disclosed, or communicated violations is true and falls within the objective scope of application of the decree.
The Whistleblowing report or public disclosure was made in compliance with the discipline provided by Legislative Decree 24/2023.
A causal relationship is required between the Whistleblowing report, disclosure, and communication made and the retaliatory measures suffered.
Mere suspicions or "rumors" are not sufficient.
Neither the certainty of the facts nor the personal motives that led the subject to report, communicate, or make a public disclosure are relevant.
In the absence of these conditions:
Whistleblowing reports, public disclosures, and communications do not fall within the scope of whistleblowing regulations, and therefore, the provided protection does not apply to the person who reports, communicates, or makes a public disclosure;
similarly, protection is excluded for different subjects who, due to the role assumed within the reporting/communication process and/or the particular relationship linking them to the whistleblower or communicator, indirectly suffer retaliation.
The aforementioned protection applies to Whistleblowers and extends to the following subjects:
Facilitators;
persons in the same work context as the whistleblower, the person who made a communication to the judicial or accounting authority, or the person who made a public disclosure, and who are linked to them by a stable emotional bond or kinship up to the fourth degree;
work colleagues of the whistleblower, of the person who made a communication to the judicial or accounting authority, or of the person who made a public disclosure, who work in the same work context and who have a regular and current relationship with that person;
entities belonging to the whistleblower or to the person who made a communication to the judicial or accounting authority or who made a public disclosure, or for whom the same persons work, as well as entities operating in the same work context as the persons indicated above.
The protection of Whistleblowers also applies when the Whistleblowing report occurs in the following cases:
when the legal relationship (e.g., subordinate employment relationship, collaboration, consultancy, supply, etc.) has not yet begun, if information on the violations was acquired during the selection process or other pre-contractual phases;
during the probationary period;
after the dissolution of the legal relationship, if information on the violations was acquired during the course of that relationship.
Protection does not apply in cases where the criminal liability of the whistleblower for the offenses of defamation or slander, or for the same offenses committed in communication to the judicial or accounting authority, or their civil liability, under the same heading, in cases of intent or gross negligence, is established, even by a first-instance judgment.
9. Protection of whistleblowers and the accused
Oplium Italia, firmly convinced of the importance of the Whistleblowing system in combating unlawful or irregular behavior, guarantees the whistleblower protection against any form of retaliation, discrimination, or penalization, whether direct or indirect, for reasons related, directly or indirectly, to the Whistleblowing report.
By way of example, each whistleblower is protected in cases of:
dismissal, suspension, or equivalent measures;
demotion or lack of promotion;
change of duties, change of workplace, salary reduction, modification of working hours;
suspension of training or any restriction of access to it;
negative performance appraisals or negative references;
adoption of disciplinary measures or other sanctions, including monetary ones;
coercion, intimidation, harassment, or ostracism;
discrimination or unfavorable treatment of any kind;
failure to convert a fixed-term employment contract into an indefinite employment contract, when the worker had a legitimate expectation of such conversion;
failure to renew or early termination of a fixed-term employment contract;
damage, including to the person's reputation, particularly on social networks, or economic or financial loss, including loss of business opportunities and loss of income;
inclusion in blacklists based on a formal or informal sector or industry agreement, which may make it impossible for the person to find employment in the sector or industry in the future;
early termination or cancellation of a contract for the supply of goods or services;
cancellation of a license or authorization;
request to undergo psychiatric or medical examinations;
demanding results that are impossible to achieve within the forms and timeframes indicated;
artificially negative performance evaluation;
unjustified revocation of mandates;
unjustified failure to assign mandates with simultaneous assignment to another subject;
repeated rejection of requests (e.g., vacation, leave).
The application of the protection regime against retaliation provided by the decree is subject to certain conditions and requirements:
The subject reported, communicated, or made a public disclosure based on a reasonable belief that the information on the reported, disclosed, or communicated violations is true and falls within the objective scope of application of the decree.
The Whistleblowing report or public disclosure was made in compliance with the discipline provided by Legislative Decree 24/2023.
A causal relationship is required between the Whistleblowing report, disclosure, and communication made and the retaliatory measures suffered.
Mere suspicions or "rumors" are not sufficient.
Neither the certainty of the facts nor the personal motives that led the subject to report, communicate, or make a public disclosure are relevant.
In the absence of these conditions:
Whistleblowing reports, public disclosures, and communications do not fall within the scope of whistleblowing regulations, and therefore, the provided protection does not apply to the person who reports, communicates, or makes a public disclosure;
similarly, protection is excluded for different subjects who, due to the role assumed within the reporting/communication process and/or the particular relationship linking them to the whistleblower or communicator, indirectly suffer retaliation.
The aforementioned protection applies to Whistleblowers and extends to the following subjects:
Facilitators;
persons in the same work context as the whistleblower, the person who made a communication to the judicial or accounting authority, or the person who made a public disclosure, and who are linked to them by a stable emotional bond or kinship up to the fourth degree;
work colleagues of the whistleblower, of the person who made a communication to the judicial or accounting authority, or of the person who made a public disclosure, who work in the same work context and who have a regular and current relationship with that person;
entities belonging to the whistleblower or to the person who made a communication to the judicial or accounting authority or who made a public disclosure, or for whom the same persons work, as well as entities operating in the same work context as the persons indicated above.
The protection of Whistleblowers also applies when the Whistleblowing report occurs in the following cases:
when the legal relationship (e.g., subordinate employment relationship, collaboration, consultancy, supply, etc.) has not yet begun, if information on the violations was acquired during the selection process or other pre-contractual phases;
during the probationary period;
after the dissolution of the legal relationship, if information on the violations was acquired during the course of that relationship.
Protection does not apply in cases where the criminal liability of the whistleblower for the offenses of defamation or slander, or for the same offenses committed in communication to the judicial or accounting authority, or their civil liability, under the same heading, in cases of intent or gross negligence, is established, even by a first-instance judgment.
10. The sanctioning system
Failure to comply with the Procedure implies the application of this disciplinary system. Oplium Italia will, therefore, take all the most appropriate disciplinary measures against:
the Whistleblower, in the event of abuse of the Whistleblowing instrument,
the Reported parties, in the event that the reported offenses are proven,
the Manager, in the event of non-compliance with this procedure,
those who violate the protection of the Whistleblower's confidentiality and the prohibitions of retaliation established for the protection of the Whistleblower themselves.
In particular, the Company has provided for sanctions against those found responsible for the offenses of art. 21, § 1, D. Lgs. no. 24/2023, namely:
practice of retaliation;
obstruction or attempted obstruction of the Whistleblowing;
violation of the obligation of confidentiality;
failure to establish Whistleblowing channels;
failure to adopt procedures for making and managing the Whistleblowing;
adoption of procedures not compliant with D. Lgs. no. 24/2023;
failure to carry out verification and analysis activities of the Whistleblowing;
proven criminal liability of the whistleblower, even by a first-instance conviction, for the crimes of defamation and slander;
civil liability of the whistleblower, in cases of intent or gross negligence, for the same crimes mentioned above.
10.1. The disciplinary system for non-management staff
The violation, breach, evasion, imperfect or partial application of the provisions relating to the Whistleblowing System indicated in the Procedure by the Company's workers constitutes a punishable disciplinary offense.
Such violations may give rise, depending on the severity of the offense, to the application of disciplinary measures in accordance with the provisions of Art. 7 of Law No. 300 of May 20, 1970 (the so-called "Workers' Statute") and its subsequent amendments and additions.
In particular, for non-managerial level workers, such measures are those provided for by the disciplinary rules of the CCNL Metalworkers (industry), applied to the Company, namely:
verbal warning;
written warning;
fine not exceeding three hours of hourly pay calculated on the tabular minimum;
suspension from work and pay for a maximum of three days;
dismissal.
10.2. The sanctioning system for Officers
For personnel with managerial positions, the regulations of the CCNL Dirigentes (industry) apply.
Any manager who carries out retaliatory or discriminatory acts, whether direct or indirect, against anyone who has made a report under this procedure for reasons directly or indirectly related to the Report itself, shall be subject to dismissal.
A similar sanction is provided for any manager who, with intent or gross negligence, makes reports under this procedure that prove to be unfounded.
10.3. Measures regarding the Administrators
Oplium Italia evaluates with extreme rigor the violations of this procedure committed by those who represent the top of the Company and therefore manifest its image before Institutions, workers, shareholders, and the public. The formation and consolidation of a corporate ethics sensitive to the values of correctness and transparency presupposes, first of all, that these values are acquired and respected by those who guide corporate choices, so as to constitute an example and stimulus for all who, at any level, operate for the Company.
In the event of a violation by the Directors of internal procedures or the adoption, in the exercise of their duties, of measures that run counter to the provisions of this procedure, the Company takes all appropriate initiatives provided for by current legislation.
Furthermore, without prejudice to any other action in defense of the Company, a Director who commits acts of retaliation or discrimination, direct or indirect, against anyone who has made reports for reasons that are directly or indirectly related to the report itself is subject to the revocation of their mandate.
An analogous sanction is foreseen for any Director who makes reports with malice or gross negligence that prove to be unfounded.
10. The sanctioning system
Failure to comply with the Procedure implies the application of this disciplinary system. Oplium Italia will, therefore, take all the most appropriate disciplinary measures against:
the Whistleblower, in the event of abuse of the Whistleblowing instrument,
the Reported parties, in the event that the reported offenses are proven,
the Manager, in the event of non-compliance with this procedure,
those who violate the protection of the Whistleblower's confidentiality and the prohibitions of retaliation established for the protection of the Whistleblower themselves.
In particular, the Company has provided for sanctions against those found responsible for the offenses of art. 21, § 1, D. Lgs. no. 24/2023, namely:
practice of retaliation;
obstruction or attempted obstruction of the Whistleblowing;
violation of the obligation of confidentiality;
failure to establish Whistleblowing channels;
failure to adopt procedures for making and managing the Whistleblowing;
adoption of procedures not compliant with D. Lgs. no. 24/2023;
failure to carry out verification and analysis activities of the Whistleblowing;
proven criminal liability of the whistleblower, even by a first-instance conviction, for the crimes of defamation and slander;
civil liability of the whistleblower, in cases of intent or gross negligence, for the same crimes mentioned above.
10.1. The disciplinary system for non-management staff
The violation, breach, evasion, imperfect or partial application of the provisions relating to the Whistleblowing System indicated in the Procedure by the Company's workers constitutes a punishable disciplinary offense.
Such violations may give rise, depending on the severity of the offense, to the application of disciplinary measures in accordance with the provisions of Art. 7 of Law No. 300 of May 20, 1970 (the so-called "Workers' Statute") and its subsequent amendments and additions.
In particular, for non-managerial level workers, such measures are those provided for by the disciplinary rules of the CCNL Metalworkers (industry), applied to the Company, namely:
verbal warning;
written warning;
fine not exceeding three hours of hourly pay calculated on the tabular minimum;
suspension from work and pay for a maximum of three days;
dismissal.
10.2. The sanctioning system for Officers
For personnel with managerial positions, the regulations of the CCNL Dirigentes (industry) apply.
Any manager who carries out retaliatory or discriminatory acts, whether direct or indirect, against anyone who has made a report under this procedure for reasons directly or indirectly related to the Report itself, shall be subject to dismissal.
A similar sanction is provided for any manager who, with intent or gross negligence, makes reports under this procedure that prove to be unfounded.
10.3. Measures regarding the Administrators
Oplium Italia evaluates with extreme rigor the violations of this procedure committed by those who represent the top of the Company and therefore manifest its image before Institutions, workers, shareholders, and the public. The formation and consolidation of a corporate ethics sensitive to the values of correctness and transparency presupposes, first of all, that these values are acquired and respected by those who guide corporate choices, so as to constitute an example and stimulus for all who, at any level, operate for the Company.
In the event of a violation by the Directors of internal procedures or the adoption, in the exercise of their duties, of measures that run counter to the provisions of this procedure, the Company takes all appropriate initiatives provided for by current legislation.
Furthermore, without prejudice to any other action in defense of the Company, a Director who commits acts of retaliation or discrimination, direct or indirect, against anyone who has made reports for reasons that are directly or indirectly related to the report itself is subject to the revocation of their mandate.
An analogous sanction is foreseen for any Director who makes reports with malice or gross negligence that prove to be unfounded.
11. Protection of personal data
Each Report may contain so-called personal data, i.e., information directly or indirectly attributable to a natural person.
The Company, in its capacity as Data Controller, ensures that the aforementioned processing activities are carried out in compliance with the provisions of EU Reg. 679/2016 (also referred to as "GDPR") and current national legislation.
With regard to the Report Manager, Oplium Italia will arrange for the granting of a formal mandate for the processing of personal data by delivering a designation letter pursuant to Art. 29 of the GDPR.
The letter provides specific instructions for the correct processing of personal data contained in the Report and the precise indication of the security measures to be applied.
With regard to the Whistleblowing Platform, the Platform provider has signed the data protection agreement pursuant to Art. 28 of the GDPR, whereby it undertakes to comply with the instructions provided by each company.
The rights provided for in Articles 15 to 22 of the GDPR (the right of access to personal data, the right to rectify them, the right to obtain their erasure or the so-called right to be forgotten, the right to restriction of processing, the right to portability of personal data and the right to object to processing) may be exercised within the limits provided for by current legislation, through the channels indicated in the information notice pursuant to Art. 13 of the GDPR made available through the Whistleblowing channels and the specific section of the corporate website.
11. Protection of personal data
Each Report may contain so-called personal data, i.e., information directly or indirectly attributable to a natural person.
The Company, in its capacity as Data Controller, ensures that the aforementioned processing activities are carried out in compliance with the provisions of EU Reg. 679/2016 (also referred to as "GDPR") and current national legislation.
With regard to the Report Manager, Oplium Italia will arrange for the granting of a formal mandate for the processing of personal data by delivering a designation letter pursuant to Art. 29 of the GDPR.
The letter provides specific instructions for the correct processing of personal data contained in the Report and the precise indication of the security measures to be applied.
With regard to the Whistleblowing Platform, the Platform provider has signed the data protection agreement pursuant to Art. 28 of the GDPR, whereby it undertakes to comply with the instructions provided by each company.
The rights provided for in Articles 15 to 22 of the GDPR (the right of access to personal data, the right to rectify them, the right to obtain their erasure or the so-called right to be forgotten, the right to restriction of processing, the right to portability of personal data and the right to object to processing) may be exercised within the limits provided for by current legislation, through the channels indicated in the information notice pursuant to Art. 13 of the GDPR made available through the Whistleblowing channels and the specific section of the corporate website.
12. Information and training
The Procedure is published on the Company's website at the link https://oplium.com/it/ and is also available in the "Oplium Italia Documentation" folder in the internal Microsoft Teams channel "WikiOplium".
Any information initiatives to bring this Procedure to the attention of potential Whistleblowers (for example, employees, suppliers, clients) are identified.
The Company, upon issuance of the Procedure, as well as periodically, organizes training courses on this Procedure, including by incorporating the content into courses on compliance and the Code of Ethics.
12. Information and training
The Procedure is published on the Company's website at the link https://oplium.com/it/ and is also available in the "Oplium Italia Documentation" folder in the internal Microsoft Teams channel "WikiOplium".
Any information initiatives to bring this Procedure to the attention of potential Whistleblowers (for example, employees, suppliers, clients) are identified.
The Company, upon issuance of the Procedure, as well as periodically, organizes training courses on this Procedure, including by incorporating the content into courses on compliance and the Code of Ethics.