Whistleblowing and Social Responsibility
Whistleblowing and Social Responsibility
Oplium Italia S.r.l. (hereinafter “Oplium Italia” or “the Company”), as a private sector entity employing at least fifty employees with an open-ended or fixed-term employment contract, implements the discipline on whistleblowing pursuant to Articles 2, paragraph 1, letter q), no. 1) and 3, paragraph 2, of Legislative Decree no. 24 of March 10, 2023.
With this “Procedure for the management of reports” (hereinafter “Procedure”), the Company intends to regulate the use of the reporting channels activated in compliance with the provisions of Legislative Decree no. 24/2023.
Oplium Italia S.r.l. (hereinafter “Oplium Italia” or “the Company”), as a private sector entity employing at least fifty employees with an open-ended or fixed-term employment contract, implements the discipline on whistleblowing pursuant to Articles 2, paragraph 1, letter q), no. 1) and 3, paragraph 2, of Legislative Decree no. 24 of March 10, 2023.
With this “Procedure for the management of reports” (hereinafter “Procedure”), the Company intends to regulate the use of the reporting channels activated in compliance with the provisions of Legislative Decree no. 24/2023.
1. Objective
Oplium Italia S.r.l., a company specialized in cybersecurity services, born from the joint venture between Spindox S.p.A. (which holds a 51% share of the share capital) and Oplium Ltda (which holds a 49% share of the share capital), in the pursuit of its business objectives has always been sensitive to the need to ensure conditions of fairness and transparency in the conduct of business and is committed to combating unlawful conduct, both through the dissemination and promotion of ethical values and principles, and through the actual implementation of rules of conduct and control processes, in line with the requirements set by applicable regulations and with the best reference practices. For this reason, the Company has adopted and constantly keeps updated a Code of Ethics.
In order to strengthen its organizational and good governance system, Oplium Italia promotes and encourages the reporting of offenses and/or facts (as defined in paragraph 4 below), even if only potentially, contrary to the law and internal corporate regulations by anyone who, in the work context, has knowledge of them.
The Procedure, therefore, aims to regulate the process of receiving and managing Reports received through the channels indicated below, as well as to define the safeguards and protection measures put in place to protect the Reporters.
In compliance with the provisions of Legislative Decree 24/2023, the internal reporting channels described in the Procedure, as well as their operating methods, have been communicated to the trade union organizations.
1. Objective
Oplium Italia S.r.l., a company specialized in cybersecurity services, born from the joint venture between Spindox S.p.A. (which holds a 51% share of the share capital) and Oplium Ltda (which holds a 49% share of the share capital), in the pursuit of its business objectives has always been sensitive to the need to ensure conditions of fairness and transparency in the conduct of business and is committed to combating unlawful conduct, both through the dissemination and promotion of ethical values and principles, and through the actual implementation of rules of conduct and control processes, in line with the requirements set by applicable regulations and with the best reference practices. For this reason, the Company has adopted and constantly keeps updated a Code of Ethics.
In order to strengthen its organizational and good governance system, Oplium Italia promotes and encourages the reporting of offenses and/or facts (as defined in paragraph 4 below), even if only potentially, contrary to the law and internal corporate regulations by anyone who, in the work context, has knowledge of them.
The Procedure, therefore, aims to regulate the process of receiving and managing Reports received through the channels indicated below, as well as to define the safeguards and protection measures put in place to protect the Reporters.
In compliance with the provisions of Legislative Decree 24/2023, the internal reporting channels described in the Procedure, as well as their operating methods, have been communicated to the trade union organizations.
2. Standards and regulatory references
The Procedure is aimed at implementing Legislative Decree no. 24 of March 10, 2023 "Implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law and laying down provisions concerning the protection of persons who report breaches of national regulatory provisions" (so-called whistleblowing).
This Procedure governs the methods for receiving, managing, and processing reports concerning violations of the company's Code of Ethics, as well as violations of further European and national regulations. All processing of personal data is carried out in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – "GDPR") and Legislative Decree no. 196 of June 30, 2003 (Privacy Code).
The Procedure was drafted drawing inspiration not only from the legislation, but also from the "Guidelines on the protection of persons who report breaches of Union law and protection of persons who report breaches of national regulatory provisions. Procedures for the presentation and management of external reports" prepared by ANAC and approved by Resolution no. 311 of July 12, 2023 and Resolution no. 478 of November 26, 2025.
2. Standards and regulatory references
The Procedure is aimed at implementing Legislative Decree no. 24 of March 10, 2023 "Implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law and laying down provisions concerning the protection of persons who report breaches of national regulatory provisions" (so-called whistleblowing).
This Procedure governs the methods for receiving, managing, and processing reports concerning violations of the company's Code of Ethics, as well as violations of further European and national regulations. All processing of personal data is carried out in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – "GDPR") and Legislative Decree no. 196 of June 30, 2003 (Privacy Code).
The Procedure was drafted drawing inspiration not only from the legislation, but also from the "Guidelines on the protection of persons who report breaches of Union law and protection of persons who report breaches of national regulatory provisions. Procedures for the presentation and management of external reports" prepared by ANAC and approved by Resolution no. 311 of July 12, 2023 and Resolution no. 478 of November 26, 2025.
3. Definitions
For the purposes of properly understanding the Whistleblowing management procedure, it is necessary to define the meaning attributed to the terms used herein:
· Report: written or oral communication regarding potential violations, made through internal or external reporting channels.
· Whistleblowing Report: this is a report of violations consisting of behavior, acts or omissions that harm the public interest or the integrity of the private entity referred to in Art. 2, paragraph 1, letter a) of Legislative Decree no. 24/2023.
· Ordinary Report: report that does not fall within the scope of Whistleblowing Reports for objective or subjective reasons, i.e., reports concerning topics other than those specified in par. 4 or received from subjects other than those indicated in par. 5 of the Procedure or which present one of the exclusion requirements provided for by Legislative Decree no. 24/2023 or for which the Whistleblower has not declared their identity or has not declared that they wish to benefit from the confidentiality of their identity and to make use of the protection provided for by Legislative Decree no. 24/2023.
· Internal report: the communication, written or oral, of information on violations, submitted through the reporting channels established by the Company.
· External report: the communication, written or oral, of information on Violations submitted through the external reporting channel activated by ANAC pursuant to Art. 7 of Legislative Decree no. 24/2023.
· Public disclosure: making information about violations public through the press or electronic means or otherwise through dissemination media capable of reaching a large number of people.
· ANAC: National Anti-Corruption Authority.
· Work context: work or professional activities, present or past, through which, regardless of the nature of such activities, a person acquires information on violations and within which they could risk suffering retaliation in the event of reporting or public disclosure or reporting to the judicial or accounting authority.
· Whistleblower: the natural person who makes the Report or Public Disclosure of information on violations acquired within their work context.
· Reported person: the subject who, within the Report, is identified as responsible for the illegal act or violation object of the Report.
· Involved Person: the natural or legal person mentioned in the internal or external Report or in the public disclosure as the person to whom the violation is attributed or as a person otherwise implicated in the reported or publicly disclosed violation.
· Facilitator: the natural person who assists the Whistleblower in the reporting process, operating within the same work context and whose assistance must be kept confidential.
· Report Manager or Manager: Web platform accessible at the address https://spindox.eticainsieme.it which allows written Reports to be made safely thanks to encryption and non-accessibility by parties other than the Report Managers.
· Platform: Web platform accessible at the address https://spindox.eticainsieme.it which allows written Reports to be made safely thanks to encryption and non-accessibility by parties other than the Report Managers.
· Feedback: communication to the Whistleblower of information regarding the follow-up given or intended to be given to the Report.
· Retaliation: any behavior, act or omission, even if only attempted or threatened, carried out as a result of the Report, the complaint to the judicial or accounting authority or public disclosure and which causes or may cause local or indirect unjust harm to the Whistleblower or to the person who filed the complaint.
3. Definitions
For the purposes of properly understanding the Whistleblowing management procedure, it is necessary to define the meaning attributed to the terms used herein:
· Report: written or oral communication regarding potential violations, made through internal or external reporting channels.
· Whistleblowing Report: this is a report of violations consisting of behavior, acts or omissions that harm the public interest or the integrity of the private entity referred to in Art. 2, paragraph 1, letter a) of Legislative Decree no. 24/2023.
· Ordinary Report: report that does not fall within the scope of Whistleblowing Reports for objective or subjective reasons, i.e., reports concerning topics other than those specified in par. 4 or received from subjects other than those indicated in par. 5 of the Procedure or which present one of the exclusion requirements provided for by Legislative Decree no. 24/2023 or for which the Whistleblower has not declared their identity or has not declared that they wish to benefit from the confidentiality of their identity and to make use of the protection provided for by Legislative Decree no. 24/2023.
· Internal report: the communication, written or oral, of information on violations, submitted through the reporting channels established by the Company.
· External report: the communication, written or oral, of information on Violations submitted through the external reporting channel activated by ANAC pursuant to Art. 7 of Legislative Decree no. 24/2023.
· Public disclosure: making information about violations public through the press or electronic means or otherwise through dissemination media capable of reaching a large number of people.
· ANAC: National Anti-Corruption Authority.
· Work context: work or professional activities, present or past, through which, regardless of the nature of such activities, a person acquires information on violations and within which they could risk suffering retaliation in the event of reporting or public disclosure or reporting to the judicial or accounting authority.
· Whistleblower: the natural person who makes the Report or Public Disclosure of information on violations acquired within their work context.
· Reported person: the subject who, within the Report, is identified as responsible for the illegal act or violation object of the Report.
· Involved Person: the natural or legal person mentioned in the internal or external Report or in the public disclosure as the person to whom the violation is attributed or as a person otherwise implicated in the reported or publicly disclosed violation.
· Facilitator: the natural person who assists the Whistleblower in the reporting process, operating within the same work context and whose assistance must be kept confidential.
· Report Manager or Manager: Web platform accessible at the address https://spindox.eticainsieme.it which allows written Reports to be made safely thanks to encryption and non-accessibility by parties other than the Report Managers.
· Platform: Web platform accessible at the address https://spindox.eticainsieme.it which allows written Reports to be made safely thanks to encryption and non-accessibility by parties other than the Report Managers.
· Feedback: communication to the Whistleblower of information regarding the follow-up given or intended to be given to the Report.
· Retaliation: any behavior, act or omission, even if only attempted or threatened, carried out as a result of the Report, the complaint to the judicial or accounting authority or public disclosure and which causes or may cause local or indirect unjust harm to the Whistleblower or to the person who filed the complaint.
4. Objective scope of application
The adopted Procedure applies to all Reports received through the channels defined in par. 8.
Reports can be of two types: "Whistleblowing Reports" and "Ordinary Reports".
Whistleblowing Reports are exclusively those relating to:
· violations of European Union restrictive measures referred to in Chapter I-bis, Title I, Book II of the criminal code (Art. 275-bis "Violation of restrictive measures of the European Union", Art. 275-ter "Violation of information obligations", Art. 275-quater "Violation of conditions of authorization to carry out activities", Art. 275-quinquies "Negligent violation of restrictive measures of the European Union") as well as Article 12, paragraph 1-bis, of Legislative Decree July 25, 1998, no. 286 (aggravated circumstance in the event of aiding and abetting the illegal entry of designated individuals, in violation of a prohibition, obligation, or restriction imposed by an EU restrictive measure);
· violations of European or national implementing provisions consisting of offenses concerning the following sectors: public procurement; financial services, products, and markets, and prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; protection of privacy and personal data, and security of network and information systems;
· violations of European provisions consisting of: i) acts or omissions affecting the financial interests of the Union; ii) acts and omissions concerning the internal market. This includes violations of EU rules on competition and State aid, corporate tax, and arrangements designed to obtain a tax advantage that defeats the object or purpose of the applicable corporate tax law; iii) acts and behaviors that defeat the object or purpose of EU provisions in the areas mentioned above;
· violations of the Code of Ethics adopted by Oplium Italia resulting in violations referred to in the previous points.
Such Reports must relate to conduct, acts, or omissions that the reporter became aware of within the context of their employment relationship with the Company.
The Whistleblowing Report cannot consist of claims, disputes, or requests of a personal nature by the reporting person or the person who has made a complaint to the judicial or accounting authority, relating exclusively to their individual employment relationships, or concerning their employment relationships with hierarchically superior figures.
The Ordinary Reports are Reports that do not fall within the scope of Whistleblowing Reports by objective or subjective scope, i.e., Reports concerning subjects other than those listed above or received from parties other than those indicated in par. 5 of this Procedure.
Ordinary Reports will also be processed by protecting the confidentiality of the reporter's identity in compliance with the provisions specifically adopted on this matter by the Company and this Procedure.
4. Objective scope of application
The adopted Procedure applies to all Reports received through the channels defined in par. 8.
Reports can be of two types: "Whistleblowing Reports" and "Ordinary Reports".
Whistleblowing Reports are exclusively those relating to:
· violations of European Union restrictive measures referred to in Chapter I-bis, Title I, Book II of the criminal code (Art. 275-bis "Violation of restrictive measures of the European Union", Art. 275-ter "Violation of information obligations", Art. 275-quater "Violation of conditions of authorization to carry out activities", Art. 275-quinquies "Negligent violation of restrictive measures of the European Union") as well as Article 12, paragraph 1-bis, of Legislative Decree July 25, 1998, no. 286 (aggravated circumstance in the event of aiding and abetting the illegal entry of designated individuals, in violation of a prohibition, obligation, or restriction imposed by an EU restrictive measure);
· violations of European or national implementing provisions consisting of offenses concerning the following sectors: public procurement; financial services, products, and markets, and prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; protection of privacy and personal data, and security of network and information systems;
· violations of European provisions consisting of: i) acts or omissions affecting the financial interests of the Union; ii) acts and omissions concerning the internal market. This includes violations of EU rules on competition and State aid, corporate tax, and arrangements designed to obtain a tax advantage that defeats the object or purpose of the applicable corporate tax law; iii) acts and behaviors that defeat the object or purpose of EU provisions in the areas mentioned above;
· violations of the Code of Ethics adopted by Oplium Italia resulting in violations referred to in the previous points.
Such Reports must relate to conduct, acts, or omissions that the reporter became aware of within the context of their employment relationship with the Company.
The Whistleblowing Report cannot consist of claims, disputes, or requests of a personal nature by the reporting person or the person who has made a complaint to the judicial or accounting authority, relating exclusively to their individual employment relationships, or concerning their employment relationships with hierarchically superior figures.
The Ordinary Reports are Reports that do not fall within the scope of Whistleblowing Reports by objective or subjective scope, i.e., Reports concerning subjects other than those listed above or received from parties other than those indicated in par. 5 of this Procedure.
Ordinary Reports will also be processed by protecting the confidentiality of the reporter's identity in compliance with the provisions specifically adopted on this matter by the Company and this Procedure.
5. Subjective scope of application: protected individuals
The entities who can make Reports and fall within the scope of protection under Legislative Decree 24/2023 are:
· the company top management and the members of the corporate bodies of Oplium Italia with functions of administration, management, control, supervision or representation, even if these functions are exercised on a purely de facto basis;
· all employees, whether on fixed-term or open-ended contracts;
· all those who, in various capacities, maintain employment relationships, including self-employment, of collaboration with Oplium Italia, including: shareholders, volunteers and trainees (paid and unpaid), temporary workers, self-employed professionals and consultants, agents, intermediaries, suppliers and commercial partners;
· workers or collaborators who provide goods or services or who carry out works in favor of third parties at Oplium Italia;
· any person who became aware of the breach during the application process or in other pre-contractual phases, or even during the probation period and after the termination of the employment relationship, if the information about the breaches was acquired during the course of the same legal relationship.
The subjects to whom the whistleblower protection measures can be extended are:
· facilitators;
· persons in the same working context as the Whistleblower, the person who made a complaint to the judicial or accounting authority, or the person who made a public disclosure, and who are linked to them by a stable emotional bond or kinship within the fourth degree;
· working colleagues of the Whistleblower, of the person who filed a complaint with the judicial or accounting authority, or of the person who made a public disclosure, who work in the same working context as them and who have a regular and current relationship with said person;
· entities owned by the Whistleblower or by the person who filed a complaint with the judicial or accounting authority or who made a public disclosure, or for whom the same persons work, as well as entities operating in the same working context as the aforementioned persons.
5. Subjective scope of application: protected individuals
The entities who can make Reports and fall within the scope of protection under Legislative Decree 24/2023 are:
· the company top management and the members of the corporate bodies of Oplium Italia with functions of administration, management, control, supervision or representation, even if these functions are exercised on a purely de facto basis;
· all employees, whether on fixed-term or open-ended contracts;
· all those who, in various capacities, maintain employment relationships, including self-employment, of collaboration with Oplium Italia, including: shareholders, volunteers and trainees (paid and unpaid), temporary workers, self-employed professionals and consultants, agents, intermediaries, suppliers and commercial partners;
· workers or collaborators who provide goods or services or who carry out works in favor of third parties at Oplium Italia;
· any person who became aware of the breach during the application process or in other pre-contractual phases, or even during the probation period and after the termination of the employment relationship, if the information about the breaches was acquired during the course of the same legal relationship.
The subjects to whom the whistleblower protection measures can be extended are:
· facilitators;
· persons in the same working context as the Whistleblower, the person who made a complaint to the judicial or accounting authority, or the person who made a public disclosure, and who are linked to them by a stable emotional bond or kinship within the fourth degree;
· working colleagues of the Whistleblower, of the person who filed a complaint with the judicial or accounting authority, or of the person who made a public disclosure, who work in the same working context as them and who have a regular and current relationship with said person;
· entities owned by the Whistleblower or by the person who filed a complaint with the judicial or accounting authority or who made a public disclosure, or for whom the same persons work, as well as entities operating in the same working context as the aforementioned persons.
6. Report manager
The receipt and management of Reports are entrusted to an external party to the Company, autonomous, impartial, and adequately trained, competent in the management of the reporting channel and Reports (hereinafter, the “Recipient”).
This party has been identified as Dr. Claudia Putzulu, Legal Manager & Labor Relations Manager of Spindox S.p.A.
In identifying the Recipient, the Company verified the absence of conflict of interest situations and the existence of the autonomy and independence requirements necessary for the correct performance of the assignment. In particular, the compatibility of the assignment with any other roles held by the Recipient was assessed, in order to prevent the accumulation of tasks from compromising the effectiveness of the management of Reports or the objectivity of the related evaluations.
In any case, the Recipient is required to refrain from handling the Report if they find themselves, even potentially, in a conflict of interest situation, including cases where they coincide with the reporting person, the person involved, or anyone otherwise affected by the Report, or if a situation arises that could compromise their objectivity and independence of judgment.
In such cases, as well as in the event of the Recipient's absence or impediment, the management of the Report is entrusted to a substitute, possessing the same requirements of autonomy, independence, impartiality, confidentiality, and adequate competence requested for the Recipient, identified by Oplium Italia as Nevio Sestini, CFO of Oplium Italia S.r.l.
If, exceptionally, the substitute also finds themselves in a situation of conflict of interest or cannot carry out the assignment, the reporting person retains the right to resort to the external reporting channel, in the cases and under the conditions provided for by Legislative Decree 24/2023.
The Recipient of the report receives a formal appointment that also includes the designation letter as an authorized person ex arts. 29 EU Reg. 679/2016 (also “GDPR”) and 2-quaterdecies Legislative Decree no. 196/2003 (also “Privacy Code”). The letter provides specific instructions for the correct processing of personal data related to the Report, for which the Company is the Data Controller ex art. 4 par. 1 no. 7) GDPR.
6. Report manager
The receipt and management of Reports are entrusted to an external party to the Company, autonomous, impartial, and adequately trained, competent in the management of the reporting channel and Reports (hereinafter, the “Recipient”).
This party has been identified as Dr. Claudia Putzulu, Legal Manager & Labor Relations Manager of Spindox S.p.A.
In identifying the Recipient, the Company verified the absence of conflict of interest situations and the existence of the autonomy and independence requirements necessary for the correct performance of the assignment. In particular, the compatibility of the assignment with any other roles held by the Recipient was assessed, in order to prevent the accumulation of tasks from compromising the effectiveness of the management of Reports or the objectivity of the related evaluations.
In any case, the Recipient is required to refrain from handling the Report if they find themselves, even potentially, in a conflict of interest situation, including cases where they coincide with the reporting person, the person involved, or anyone otherwise affected by the Report, or if a situation arises that could compromise their objectivity and independence of judgment.
In such cases, as well as in the event of the Recipient's absence or impediment, the management of the Report is entrusted to a substitute, possessing the same requirements of autonomy, independence, impartiality, confidentiality, and adequate competence requested for the Recipient, identified by Oplium Italia as Nevio Sestini, CFO of Oplium Italia S.r.l.
If, exceptionally, the substitute also finds themselves in a situation of conflict of interest or cannot carry out the assignment, the reporting person retains the right to resort to the external reporting channel, in the cases and under the conditions provided for by Legislative Decree 24/2023.
The Recipient of the report receives a formal appointment that also includes the designation letter as an authorized person ex arts. 29 EU Reg. 679/2016 (also “GDPR”) and 2-quaterdecies Legislative Decree no. 196/2003 (also “Privacy Code”). The letter provides specific instructions for the correct processing of personal data related to the Report, for which the Company is the Data Controller ex art. 4 par. 1 no. 7) GDPR.
7. Reporting Characteristics
The Report must be detailed and must contain – where possible - the following elements:
· An indication that it is a Whistleblowing Report for which the reporter wishes to keep their identity confidential and benefit from the protections provided in the event of any retaliation; in the absence of this indication, the Report will be processed as ordinary;
· the identity of the person making the Report, indicating their role within the company or the firm/entity where they carry out their work activity, as well as consent - or lack thereof – to reveal their identity to parties other than the manager of the Report and/or the human resources department responsible for managing the disciplinary procedure;
· a clear and complete description of the facts being reported;
· the circumstances of time and place in which the fact being reported occurred;
· the identity or other elements allowing the identification of the subject to whom the reported facts are attributed;
· the indication of the beneficiaries and those harmed by the misconduct;
· the indication of any other parties who can report on the facts being reported;
· the attachment, where possible, of any documents that can confirm the validity of the reported facts;
· any other information that can provide useful feedback regarding the existence of the reported facts.
· From this perspective, it is advisable that Reports are as detailed as possible and offer the greatest number of elements, in order to allow the Company to carry out the necessary checks.
Reports cannot concern information that is patently groundless, information that is already entirely in the public domain, or information acquired solely on the basis of unreliable rumors or hearsay (so-called grapevine rumors).
7.1. Special cases
7.1.1. Anonymous reports
Anonymous Reports, i.e., those from which it is not possible to obtain the identity of the whistleblowing party, are taken into consideration by the Manager, provided that they are detailed and precise and allow for the gathering of objective evidence through the investigation activities carried out by the Manager.
Such Reports will be considered Ordinary Reports and the guarantees and protections provided for the so-called Whistleblowing Reports will not be applicable, unless the reporting party is subsequently identified and suffers retaliation.
In any case, we encourage the use of named Reports, reminding you that management methods have been designed to ensure the maximum confidentiality of the whistleblowing party, in full compliance with current legislation.
7.1.2. Reports received from parties other than the Operator
In the event that a Whistleblowing Report is received by an entity other than the Manager, the recipient has the obligation to:
handle the information acquired in a manner appropriate to guarantee its full confidentiality;
ii. contact the Manager – via oral channel – in order to receive instructions regarding the methods for transmitting the incorrectly received Report;
iii. transmit the Report to the Manager without delay, and in any case within 7 (seven) days;
iv. following communication to the Manager, delete the Report from their devices;
v. in the case of a Report of retaliation, contact ANAC – through the channels and in the manner provided by that entity on its website https://www.anticorruzione.it/-/whistleblowing – in order to receive instructions regarding the methods for transmitting the incorrectly received Report.
7. Reporting Characteristics
The Report must be detailed and must contain – where possible - the following elements:
· An indication that it is a Whistleblowing Report for which the reporter wishes to keep their identity confidential and benefit from the protections provided in the event of any retaliation; in the absence of this indication, the Report will be processed as ordinary;
· the identity of the person making the Report, indicating their role within the company or the firm/entity where they carry out their work activity, as well as consent - or lack thereof – to reveal their identity to parties other than the manager of the Report and/or the human resources department responsible for managing the disciplinary procedure;
· a clear and complete description of the facts being reported;
· the circumstances of time and place in which the fact being reported occurred;
· the identity or other elements allowing the identification of the subject to whom the reported facts are attributed;
· the indication of the beneficiaries and those harmed by the misconduct;
· the indication of any other parties who can report on the facts being reported;
· the attachment, where possible, of any documents that can confirm the validity of the reported facts;
· any other information that can provide useful feedback regarding the existence of the reported facts.
· From this perspective, it is advisable that Reports are as detailed as possible and offer the greatest number of elements, in order to allow the Company to carry out the necessary checks.
Reports cannot concern information that is patently groundless, information that is already entirely in the public domain, or information acquired solely on the basis of unreliable rumors or hearsay (so-called grapevine rumors).
7.1. Special cases
7.1.1. Anonymous reports
Anonymous Reports, i.e., those from which it is not possible to obtain the identity of the whistleblowing party, are taken into consideration by the Manager, provided that they are detailed and precise and allow for the gathering of objective evidence through the investigation activities carried out by the Manager.
Such Reports will be considered Ordinary Reports and the guarantees and protections provided for the so-called Whistleblowing Reports will not be applicable, unless the reporting party is subsequently identified and suffers retaliation.
In any case, we encourage the use of named Reports, reminding you that management methods have been designed to ensure the maximum confidentiality of the whistleblowing party, in full compliance with current legislation.
7.1.2. Reports received from parties other than the Operator
In the event that a Whistleblowing Report is received by an entity other than the Manager, the recipient has the obligation to:
handle the information acquired in a manner appropriate to guarantee its full confidentiality;
ii. contact the Manager – via oral channel – in order to receive instructions regarding the methods for transmitting the incorrectly received Report;
iii. transmit the Report to the Manager without delay, and in any case within 7 (seven) days;
iv. following communication to the Manager, delete the Report from their devices;
v. in the case of a Report of retaliation, contact ANAC – through the channels and in the manner provided by that entity on its website https://www.anticorruzione.it/-/whistleblowing – in order to receive instructions regarding the methods for transmitting the incorrectly received Report.
8. Reporting channels
8.1. Internal channels
Oplium Italia, in order to pursue the objective stated in the previous paragraph 1, has established two internal reporting channels that can be used by recipients as an alternative.
Written Reporting Channel: “eticainsieme” Platform.
The Company has activated an IT channel accessible from any browser (including mobile devices) that allows reports to be sent in writing and is available at the following link: https://spindox.eticainsieme.it
The Reporting platform, equipped with technical security measures appropriate to the standards of art. 32 GDPR, resides on a third-party server located in the European Union and provides a guided path for the reporter that will allow them to insert the necessary information for the reconstruction and evaluation of the facts, as well as the use of encryption measures, which guarantee the confidentiality not only of the reporter, but also of the facilitator, the person involved or otherwise mentioned in the Report, as well as the content of the Report and the documentation.
Oral reporting channel: telephone contact at the number +39 3442063500.
8.1.1.1. Reports in written form
With particular reference to the written reporting channel, the Company has adopted the Reporting platform (eticainsieme), available at the following address: https://spindox.eticainsieme.it which will automatically inform the Case Manager, the only party authorized to access the platform and view the Reports, of the submission of the Report.
If using the platform, the reporter must answer some open and closed questions, which will allow the Case Manager to delve deeper into the subject of the report as well as, if correctly completed, to comply with the requirements requested by law for whistleblowing Reports.
The platform also allows uploading documentation that the reporter feels appropriate to bring to the attention of the Case Manager to support their Report.
Furthermore, the tool allows interaction via messaging within the platform, between the reporter and the Case Manager, in order to delve deeper into the topics communicated or integrate/rectify the information previously provided.
The Platform also allows the reporter to keep updated on the status of the submitted Report and to obtain Feedback.
At the end of the Reporting procedure, the Platform will provide the reporter with a 16-digit code that will allow them to access the system and, therefore, their Report to:
· monitor its progress;
· integrate their Report with further factual elements or other documentation;
· have direct contact with the Case Manager, also initiating a potential exchange of requests and information;
· obtain Feedback from the Case Manager.
The loss of the code has no effect on the Report, which will still be processed within the times and in the ways established by this Procedure.
The availability of the code is essential to be able to access one's own Report at any time, in order to monitor progress, to provide further information than already reported, and to learn about the Feedback. In its absence, these operations will not be available.
In such cases, for confidentiality reasons to protect the Reporter, the code linked to each Report cannot be recovered in any way. If you feel it appropriate to provide new information that has come to light or to learn the outcomes of the investigation, it is still possible to open a new Report.
8.1.1.2. Oral reports
With particular reference to the oral Whistleblowing channel, it is possible to contact the Whistleblowing Officer via the following number: +39 3442063500
You will need to call the telephone number indicated above between 9:00 AM – 6:30 PM, Monday to Friday, public holidays excluded, in order to present your report or possibly schedule an appointment (in person or via video conference) with the Whistleblowing Officer.
During the phone call, the whistleblower must indicate:
At the end of the Whistleblowing procedure, the Platform will, in fact, provide the whistleblower with a 16-digit code which will allow them to access the system and, therefore, their Report to:
· their contact details, taking care not to specify their name;
· the preference to present their report over the phone or to meet the Officer in person, or to schedule a video call (in these last two cases, the Officer will take care to arrange an appointment within 7 days of the first contact).
During the telephone conversation or video call, the Officer will request from the whistleblower the information necessary to acquire and evaluate the Report, in accordance with the questions present on the online Platform, and will take care to record them in it. Once registration is complete, the Officer will communicate the 16-digit code automatically generated by the Platform to the whistleblower, through which the Whistleblower can later independently access to monitor the progress of the Report and interact with the Officer. If the Whistleblower is unable to access the Platform, they may request a further meeting to provide additional information or obtain Feedback.
In the case of an in-person meeting, the Report may be collected and minuted in a document verified and signed by the whistleblower and/or the Report will be registered on the Platform during the meeting.
8.1.1.3. Report management
The management of the Report follows the schedule and procedures indicated below:
· within 7 (seven) days of receiving the Report, the Manager will send the whistleblower an acknowledgment of receipt of the report, using the reporting channel. In the case of an oral report (request for a meeting and/or use of the telephone line), the receipt of the report is simultaneous with the entry of the Report into the Platform and on that occasion the Whistleblower will be given the personal Code associated with the Whistleblowing Report.
· the Manager starts the investigation phase and classifies the Report as “Whistleblowing” or “Ordinary”. With reference only to Ordinary Reports, where there is another competent corporate function, the Manager simultaneously forwards the same, adopting appropriate measures to ensure the confidentiality of the whisteblower's identity. Otherwise, they will proceed with its management in accordance with the Procedure;
· within 3 (three) months, starting from the date of the acknowledgment of receipt, the Manager provides Feedback to the whistleblower.
The Manager diligently follows up on the Report, conducting the verification of the grounds with full access to any information necessary for the execution of the task. For the purposes of the verification activity, the Manager may mandate internal offices and/or third parties to conduct in-depth investigations, taking care to:
· give a formal mandate, defining the scope of action and specifying the information they intend to obtain from the requested investigation;
· omit any information that could, even indirectly, lead to the whistleblower's identity or the content of the Report;
· omit any information relating to the Reported Person, unless strictly necessary for the proper performance of the assigned task;
· reiterate to the appointed person the obligation of confidentiality of the processed data (in the case of external subjects, this obligation must be formalized).
In cases where, for investigative reasons, it is necessary to make other subjects aware of the content of the Report and/or the documentation attached to it, the Manager obscurities the personal data of the Whistleblower, as well as of the other subjects whose identity must remain confidential (such as the Facilitator, the Reported Person, the other persons mentioned in the Report).
In any case, the general details of the Whistleblower and any other information from which this identity can be directly or indirectly inferred will not be disclosed to third parties other than the Manager without the Whistleblower's consent, subject to the exceptional cases detailed below:
· within the scope of proceedings before the Court of Auditors, the identity of the whistleblower may be disclosed after the closure of the investigation phase;
· within criminal proceedings, the identity of the whistleblower is covered by secrecy pursuant to art. 329 of the Code of Criminal Procedure (until the accused or suspect can have knowledge of it and, in any case, not beyond the closure of the preliminary investigations).
Within the scope of the disciplinary proceedings against the Reported Person:
· the identity of the Whistleblower cannot be disclosed if the disciplinary charge is based on separate and further assessments than the Report, even if resulting from it;
· if the Report is based in whole or in part on the Report and knowledge of the Whistleblower's identity is indispensable for the defense of the accused, the Report will be usable in the disciplinary proceedings only with the express consent of the whistleblower to the disclosure of their identity.
8.1.1.4. Archiving: closure of the Report and retention of documentation
Upon completion of the investigation, the Manager will draft a report taking one or more of the following measures:
· filing of the Report due to insufficient elements;
· filing of the Report due to irrelevance of the reported facts;
· proposal for amendment to the Code of Ethics or other internal procedures;
· proposal to initiate disciplinary or sanction proceedings - in accordance with the provisions of the current disciplinary and sanction system - against the Reported individuals who have been found to have committed a violation, unlawful act or irregularity;
· proposal to initiate disciplinary or sanction proceedings - in accordance with the provisions of the current disciplinary and sanction system and this Procedure – against Reporters who have made unfounded Reports, based on untrue factual circumstances and made with intent or gross negligence.
8.1.1.5. Retention of documentation
In accordance with the provisions of the current legislation, the Report and the relative documentation will be kept for the time strictly necessary for its management and in any case no later than 5 years from the closure of the management process on the Platform.
The original media of the Reports received through the dedicated telephone line and/or through the request for a hearing and/or other modalities are kept by the Manager, as well as by uploading to the Platform in the appropriate competent section, also in a specific protected environment.
8.2. External channel and public disclosure
Without prejudice to the fact that Whistleblowers are invited, by virtue of the principles of transparency, loyalty, trust, and collaboration that characterize their relationship with the Company, to use one of the internal reporting channels provided by Oplium Italia, the Whistleblower may make:
an external report to the National Anti-Corruption Authority (ANAC) if one of the following conditions is met:
the internal reporting channel has not been activated or, if activated, the channel made available to the whistleblower does not comply with the requirements of the legislation;
an internal report has already been made and has not been followed up;
the whistleblower has reasonable grounds to believe that, if they made an internal report, it would not be effectively followed up or that it could lead to a risk of retaliation;
the whistleblower has reasonable grounds to believe that the violation may constitute an imminent or obvious danger to the public interest.
The external reporting channel is activated at ANAC, which publishes on its website, in a dedicated and easily accessible section, the information necessary for sending the report: https://www.anticorruzione.it/-/whistleblowing.
a public disclosure by making information on violations public through the press or other dissemination media capable of reaching a large number of people
Protection for the person making a public disclosure pursuant to Legislative Decree no. 24/2023 applies if one of the following conditions is met:
the whistleblower has previously made an internal and external report, or has directly made an external report, under the conditions and in the manner provided for internal and external reports, and no response was given within the timeframes established by law regarding the measures planned or adopted to follow up on the reports;
the whistleblower has reasonable grounds to believe that the violation may constitute an imminent or obvious danger to the public interest;
the whistleblower has reasonable grounds to believe that the external report may carry a risk of retaliation or may not be effectively followed up due to the specific circumstances of the concrete case, such as those where evidence may be concealed or destroyed, or where there is a well-founded fear that the recipient of the report may be in collusion with the perpetrator of the violation or involved in the violation itself.
8. Reporting channels
8.1. Internal channels
Oplium Italia, in order to pursue the objective stated in the previous paragraph 1, has established two internal reporting channels that can be used by recipients as an alternative.
Written Reporting Channel: “eticainsieme” Platform.
The Company has activated an IT channel accessible from any browser (including mobile devices) that allows reports to be sent in writing and is available at the following link: https://spindox.eticainsieme.it
The Reporting platform, equipped with technical security measures appropriate to the standards of art. 32 GDPR, resides on a third-party server located in the European Union and provides a guided path for the reporter that will allow them to insert the necessary information for the reconstruction and evaluation of the facts, as well as the use of encryption measures, which guarantee the confidentiality not only of the reporter, but also of the facilitator, the person involved or otherwise mentioned in the Report, as well as the content of the Report and the documentation.
Oral reporting channel: telephone contact at the number +39 3442063500.
8.1.1.1. Reports in written form
With particular reference to the written reporting channel, the Company has adopted the Reporting platform (eticainsieme), available at the following address: https://spindox.eticainsieme.it which will automatically inform the Case Manager, the only party authorized to access the platform and view the Reports, of the submission of the Report.
If using the platform, the reporter must answer some open and closed questions, which will allow the Case Manager to delve deeper into the subject of the report as well as, if correctly completed, to comply with the requirements requested by law for whistleblowing Reports.
The platform also allows uploading documentation that the reporter feels appropriate to bring to the attention of the Case Manager to support their Report.
Furthermore, the tool allows interaction via messaging within the platform, between the reporter and the Case Manager, in order to delve deeper into the topics communicated or integrate/rectify the information previously provided.
The Platform also allows the reporter to keep updated on the status of the submitted Report and to obtain Feedback.
At the end of the Reporting procedure, the Platform will provide the reporter with a 16-digit code that will allow them to access the system and, therefore, their Report to:
· monitor its progress;
· integrate their Report with further factual elements or other documentation;
· have direct contact with the Case Manager, also initiating a potential exchange of requests and information;
· obtain Feedback from the Case Manager.
The loss of the code has no effect on the Report, which will still be processed within the times and in the ways established by this Procedure.
The availability of the code is essential to be able to access one's own Report at any time, in order to monitor progress, to provide further information than already reported, and to learn about the Feedback. In its absence, these operations will not be available.
In such cases, for confidentiality reasons to protect the Reporter, the code linked to each Report cannot be recovered in any way. If you feel it appropriate to provide new information that has come to light or to learn the outcomes of the investigation, it is still possible to open a new Report.
8.1.1.2. Oral reports
With particular reference to the oral Whistleblowing channel, it is possible to contact the Whistleblowing Officer via the following number: +39 3442063500
You will need to call the telephone number indicated above between 9:00 AM – 6:30 PM, Monday to Friday, public holidays excluded, in order to present your report or possibly schedule an appointment (in person or via video conference) with the Whistleblowing Officer.
During the phone call, the whistleblower must indicate:
At the end of the Whistleblowing procedure, the Platform will, in fact, provide the whistleblower with a 16-digit code which will allow them to access the system and, therefore, their Report to:
· their contact details, taking care not to specify their name;
· the preference to present their report over the phone or to meet the Officer in person, or to schedule a video call (in these last two cases, the Officer will take care to arrange an appointment within 7 days of the first contact).
During the telephone conversation or video call, the Officer will request from the whistleblower the information necessary to acquire and evaluate the Report, in accordance with the questions present on the online Platform, and will take care to record them in it. Once registration is complete, the Officer will communicate the 16-digit code automatically generated by the Platform to the whistleblower, through which the Whistleblower can later independently access to monitor the progress of the Report and interact with the Officer. If the Whistleblower is unable to access the Platform, they may request a further meeting to provide additional information or obtain Feedback.
In the case of an in-person meeting, the Report may be collected and minuted in a document verified and signed by the whistleblower and/or the Report will be registered on the Platform during the meeting.
8.1.1.3. Report management
The management of the Report follows the schedule and procedures indicated below:
· within 7 (seven) days of receiving the Report, the Manager will send the whistleblower an acknowledgment of receipt of the report, using the reporting channel. In the case of an oral report (request for a meeting and/or use of the telephone line), the receipt of the report is simultaneous with the entry of the Report into the Platform and on that occasion the Whistleblower will be given the personal Code associated with the Whistleblowing Report.
· the Manager starts the investigation phase and classifies the Report as “Whistleblowing” or “Ordinary”. With reference only to Ordinary Reports, where there is another competent corporate function, the Manager simultaneously forwards the same, adopting appropriate measures to ensure the confidentiality of the whisteblower's identity. Otherwise, they will proceed with its management in accordance with the Procedure;
· within 3 (three) months, starting from the date of the acknowledgment of receipt, the Manager provides Feedback to the whistleblower.
The Manager diligently follows up on the Report, conducting the verification of the grounds with full access to any information necessary for the execution of the task. For the purposes of the verification activity, the Manager may mandate internal offices and/or third parties to conduct in-depth investigations, taking care to:
· give a formal mandate, defining the scope of action and specifying the information they intend to obtain from the requested investigation;
· omit any information that could, even indirectly, lead to the whistleblower's identity or the content of the Report;
· omit any information relating to the Reported Person, unless strictly necessary for the proper performance of the assigned task;
· reiterate to the appointed person the obligation of confidentiality of the processed data (in the case of external subjects, this obligation must be formalized).
In cases where, for investigative reasons, it is necessary to make other subjects aware of the content of the Report and/or the documentation attached to it, the Manager obscurities the personal data of the Whistleblower, as well as of the other subjects whose identity must remain confidential (such as the Facilitator, the Reported Person, the other persons mentioned in the Report).
In any case, the general details of the Whistleblower and any other information from which this identity can be directly or indirectly inferred will not be disclosed to third parties other than the Manager without the Whistleblower's consent, subject to the exceptional cases detailed below:
· within the scope of proceedings before the Court of Auditors, the identity of the whistleblower may be disclosed after the closure of the investigation phase;
· within criminal proceedings, the identity of the whistleblower is covered by secrecy pursuant to art. 329 of the Code of Criminal Procedure (until the accused or suspect can have knowledge of it and, in any case, not beyond the closure of the preliminary investigations).
Within the scope of the disciplinary proceedings against the Reported Person:
· the identity of the Whistleblower cannot be disclosed if the disciplinary charge is based on separate and further assessments than the Report, even if resulting from it;
· if the Report is based in whole or in part on the Report and knowledge of the Whistleblower's identity is indispensable for the defense of the accused, the Report will be usable in the disciplinary proceedings only with the express consent of the whistleblower to the disclosure of their identity.
8.1.1.4. Archiving: closure of the Report and retention of documentation
Upon completion of the investigation, the Manager will draft a report taking one or more of the following measures:
· filing of the Report due to insufficient elements;
· filing of the Report due to irrelevance of the reported facts;
· proposal for amendment to the Code of Ethics or other internal procedures;
· proposal to initiate disciplinary or sanction proceedings - in accordance with the provisions of the current disciplinary and sanction system - against the Reported individuals who have been found to have committed a violation, unlawful act or irregularity;
· proposal to initiate disciplinary or sanction proceedings - in accordance with the provisions of the current disciplinary and sanction system and this Procedure – against Reporters who have made unfounded Reports, based on untrue factual circumstances and made with intent or gross negligence.
8.1.1.5. Retention of documentation
In accordance with the provisions of the current legislation, the Report and the relative documentation will be kept for the time strictly necessary for its management and in any case no later than 5 years from the closure of the management process on the Platform.
The original media of the Reports received through the dedicated telephone line and/or through the request for a hearing and/or other modalities are kept by the Manager, as well as by uploading to the Platform in the appropriate competent section, also in a specific protected environment.
8.2. External channel and public disclosure
Without prejudice to the fact that Whistleblowers are invited, by virtue of the principles of transparency, loyalty, trust, and collaboration that characterize their relationship with the Company, to use one of the internal reporting channels provided by Oplium Italia, the Whistleblower may make:
an external report to the National Anti-Corruption Authority (ANAC) if one of the following conditions is met:
the internal reporting channel has not been activated or, if activated, the channel made available to the whistleblower does not comply with the requirements of the legislation;
an internal report has already been made and has not been followed up;
the whistleblower has reasonable grounds to believe that, if they made an internal report, it would not be effectively followed up or that it could lead to a risk of retaliation;
the whistleblower has reasonable grounds to believe that the violation may constitute an imminent or obvious danger to the public interest.
The external reporting channel is activated at ANAC, which publishes on its website, in a dedicated and easily accessible section, the information necessary for sending the report: https://www.anticorruzione.it/-/whistleblowing.
a public disclosure by making information on violations public through the press or other dissemination media capable of reaching a large number of people
Protection for the person making a public disclosure pursuant to Legislative Decree no. 24/2023 applies if one of the following conditions is met:
the whistleblower has previously made an internal and external report, or has directly made an external report, under the conditions and in the manner provided for internal and external reports, and no response was given within the timeframes established by law regarding the measures planned or adopted to follow up on the reports;
the whistleblower has reasonable grounds to believe that the violation may constitute an imminent or obvious danger to the public interest;
the whistleblower has reasonable grounds to believe that the external report may carry a risk of retaliation or may not be effectively followed up due to the specific circumstances of the concrete case, such as those where evidence may be concealed or destroyed, or where there is a well-founded fear that the recipient of the report may be in collusion with the perpetrator of the violation or involved in the violation itself.
9. Protection of whistleblowers and reported persons
Oplium Italia, firmly convinced of the importance of the whistleblowing system in the fight against unlawful or irregular conduct, guarantees protection for the whistleblower against any form of retaliation, discrimination, or penalization, direct or indirect, for reasons connected, directly or indirectly, to the Whistleblowing report.
By way of example, every whistleblower is protected in cases of:
dismissal, suspension, or equivalent measures;
demotion or lack of promotion;
change of duties, change of workplace, reduction of salary, modification of working hours;
suspension of training or any restriction of access to it;
negative performance reviews or negative references;
adoption of disciplinary measures or other sanctions, including monetary ones;
coercion, intimidation, harassment, or ostracism;
discrimination or otherwise unfavorable treatment;
failure to convert a fixed-term employment contract into an open-ended employment contract, where the worker had a legitimate expectation of such conversion;
non-renewal or early termination of a fixed-term employment contract;
damage, including to the person's reputation, particularly on social media, or economic or financial loss, including loss of business opportunities and loss of income;
inclusion in improper lists on the basis of a formal or informal sectoral or industrial agreement, which may make it impossible for the person to find employment in the sector or industry in the future;
early termination or cancellation of the contract for the supply of goods or services;
cancellation of a license or permit;
request to undergo psychiatric or medical examinations;
demand for results that are impossible to achieve in the ways and within the times indicated;
artificially negative performance evaluation;
unjustified revocation of assignments;
unjustified failure to assign duties with simultaneous attribution to another subject;
repeated rejection of requests (e.g., leaves, vacations).
The application of the protection regime against retaliation provided by the decree is subject to certain conditions and requirements:
The subject has reported, denounced, or made a public disclosure based on a reasonable belief that the information regarding the reported, disclosed, or denounced violations was true and fell within the objective scope of application of the decree.
The Whistleblowing report or public disclosure was made in compliance with the rules set forth in Legislative Decree 24/2023.
A consequential relationship is required between the Whistleblowing, disclosure, or denunciation made and the retaliatory measures suffered.
Mere suspicions or "rumors" are not sufficient.
Neither the certainty of the facts nor the personal motives that led the subject to report, denounce, or make a public disclosure are relevant.
In the absence of such conditions:
the reports, public disclosures, and denunciations do not fall within the scope of the whistleblowing regulation, and therefore the provided protection does not apply to the person who reports, denounces, or makes the public disclosure;
similarly, protection is excluded for other subjects who, due to the role assumed in the context of the whistleblowing/denunciation process and/or the particular relationship linking them to the whistleblower or denouncer, suffer indirect retaliation.
The aforementioned protection applies to Whistleblowers and extends to the following subjects:
Facilitators;
persons in the same working environment as the reporting person, the person who filed a complaint with the judicial or accounting authority, or the person who made a public disclosure, and who are linked to them by a stable emotional bond or kinship up to the fourth degree;
colleagues of the reporting person, the person who filed a complaint with the judicial or accounting authority, or the person who made a public disclosure, who work in the same working environment and have a regular and current relationship with said person;
entities owned by the reporting person, the person who filed a complaint with the judicial or accounting authority, or the person who made a public disclosure, or for which the same persons work, as well as entities operating in the same working environment as the aforementioned persons.
The protection of Whistleblowers also applies if the Whistleblowing occurs in the following cases:
when the legal relationship (e.g., relationship of subordinate work, collaboration, consulting, supply, etc.) has not yet started, if the information about the violations was acquired during the selection process or in other pre-contractual stages;
during the probationary period;
following the dissolution of the legal relationship if the information about the violations was acquired during the relationship itself.
Protection does not apply in cases where the criminal liability of the reporting person for the offenses of defamation or slander, or in any case for the same offenses committed with the complaint to the judicial or accounting authority, or their civil liability, under the same heading, in cases of willful misconduct or gross negligence, has been established, even by a first-instance judgment.
9. Protection of whistleblowers and reported persons
Oplium Italia, firmly convinced of the importance of the whistleblowing system in the fight against unlawful or irregular conduct, guarantees protection for the whistleblower against any form of retaliation, discrimination, or penalization, direct or indirect, for reasons connected, directly or indirectly, to the Whistleblowing report.
By way of example, every whistleblower is protected in cases of:
dismissal, suspension, or equivalent measures;
demotion or lack of promotion;
change of duties, change of workplace, reduction of salary, modification of working hours;
suspension of training or any restriction of access to it;
negative performance reviews or negative references;
adoption of disciplinary measures or other sanctions, including monetary ones;
coercion, intimidation, harassment, or ostracism;
discrimination or otherwise unfavorable treatment;
failure to convert a fixed-term employment contract into an open-ended employment contract, where the worker had a legitimate expectation of such conversion;
non-renewal or early termination of a fixed-term employment contract;
damage, including to the person's reputation, particularly on social media, or economic or financial loss, including loss of business opportunities and loss of income;
inclusion in improper lists on the basis of a formal or informal sectoral or industrial agreement, which may make it impossible for the person to find employment in the sector or industry in the future;
early termination or cancellation of the contract for the supply of goods or services;
cancellation of a license or permit;
request to undergo psychiatric or medical examinations;
demand for results that are impossible to achieve in the ways and within the times indicated;
artificially negative performance evaluation;
unjustified revocation of assignments;
unjustified failure to assign duties with simultaneous attribution to another subject;
repeated rejection of requests (e.g., leaves, vacations).
The application of the protection regime against retaliation provided by the decree is subject to certain conditions and requirements:
The subject has reported, denounced, or made a public disclosure based on a reasonable belief that the information regarding the reported, disclosed, or denounced violations was true and fell within the objective scope of application of the decree.
The Whistleblowing report or public disclosure was made in compliance with the rules set forth in Legislative Decree 24/2023.
A consequential relationship is required between the Whistleblowing, disclosure, or denunciation made and the retaliatory measures suffered.
Mere suspicions or "rumors" are not sufficient.
Neither the certainty of the facts nor the personal motives that led the subject to report, denounce, or make a public disclosure are relevant.
In the absence of such conditions:
the reports, public disclosures, and denunciations do not fall within the scope of the whistleblowing regulation, and therefore the provided protection does not apply to the person who reports, denounces, or makes the public disclosure;
similarly, protection is excluded for other subjects who, due to the role assumed in the context of the whistleblowing/denunciation process and/or the particular relationship linking them to the whistleblower or denouncer, suffer indirect retaliation.
The aforementioned protection applies to Whistleblowers and extends to the following subjects:
Facilitators;
persons in the same working environment as the reporting person, the person who filed a complaint with the judicial or accounting authority, or the person who made a public disclosure, and who are linked to them by a stable emotional bond or kinship up to the fourth degree;
colleagues of the reporting person, the person who filed a complaint with the judicial or accounting authority, or the person who made a public disclosure, who work in the same working environment and have a regular and current relationship with said person;
entities owned by the reporting person, the person who filed a complaint with the judicial or accounting authority, or the person who made a public disclosure, or for which the same persons work, as well as entities operating in the same working environment as the aforementioned persons.
The protection of Whistleblowers also applies if the Whistleblowing occurs in the following cases:
when the legal relationship (e.g., relationship of subordinate work, collaboration, consulting, supply, etc.) has not yet started, if the information about the violations was acquired during the selection process or in other pre-contractual stages;
during the probationary period;
following the dissolution of the legal relationship if the information about the violations was acquired during the relationship itself.
Protection does not apply in cases where the criminal liability of the reporting person for the offenses of defamation or slander, or in any case for the same offenses committed with the complaint to the judicial or accounting authority, or their civil liability, under the same heading, in cases of willful misconduct or gross negligence, has been established, even by a first-instance judgment.
10. The penalty system
Failure to comply with the Procedure entails the application of this disciplinary system. Oplium Italia will, therefore, take any appropriate disciplinary action against:By way of example, each reporter is protected in cases of:
the Reporter, in the event of abuse of the Reporting tool,
the Reported Parties, in the event of verification of the reported violations,
the Manager, in the event of failure to comply with this procedure,
those who violate the protection of the Reporter's confidentiality and the retaliation prohibitions established for the protection of the Reporter.
Specifically, the Company has provided for sanctions against those who are found responsible for the offenses referred to in art. 21, paragraph 1, Legislative Decree no. 24/2023, namely:
commission of retaliation;
obstruction or attempted obstruction of the Reporting;
breach of the duty of confidentiality;
failure to establish Reporting channels;
failure to adopt procedures for making and managing the Reporting;
adoption of procedures not compliant with Legislative Decree no. 24/2023;
failure to carry out verification and analysis activities of the Reporting;
established criminal liability of the reporter, even with a first-degree conviction, for the crimes of defamation and slander;
civil liability of the reporter, in cases of intent or gross negligence, for the same crimes mentioned above.
10.1. The disciplinary system for non-managerial employees
The violation, breach, evasion, imperfect, or partial application of the provisions relating to the Whistleblowing System indicated in the Procedure by the Company's employees constitutes a punishable disciplinary offense.
Such violations may lead, depending on the severity of the breach, to the application of disciplinary measures in accordance with the provisions of Article 7 of Law no. 300 of May 20, 1970 (the so-called "Workers' Statute") and subsequent amendments and integrations.
Specifically, for non-managerial employees, these measures are those provided for by the disciplinary rules set out in the National Collective Bargaining Agreement (CCNL) for the Metalworking (industry) sector applied to the Company, namely:
verbal warning;
written warning;
fine not exceeding three hours of hourly pay calculated on the minimum salary scale;
suspension from work and pay for up to a maximum of three days;
dismissal.
10.2. The disciplinary system for Executives
For managerial staff, the rules set out in the CCNL for Managers (industry) apply.
Any manager who carries out retaliatory or discriminatory acts, direct or indirect, against anyone who has made a report under this procedure for reasons directly or indirectly linked to the Report itself shall be subject to dismissal.
A similar penalty is foreseen for any manager who, with willful misconduct or gross negligence, makes reports under this procedure that prove to be unfounded.
10.3. Measures against the Directors
Oplium Italia evaluates with extreme rigor the violations of this procedure committed by those who represent the top management of the Company and thus manifest its image to the Institutions, employees, shareholders, and the public. The formation and consolidation of a corporate ethic sensitive to the values of fairness and transparency presuppose, first of all, that these values are acquired and respected by those who guide corporate choices, in order to constitute an example and stimulus for all those who, at any level, operate for the Company.
In the event of a violation by the Directors of internal procedures or the adoption, in the exercise of their powers, of measures that conflict with the provisions of this procedure, the Company will take all appropriate initiatives provided for by current regulations.
Furthermore, without prejudice to any other action to protect the Company, a Director who commits acts of retaliation or discrimination, direct or indirect, against anyone who has made reports for reasons directly or indirectly linked to the report itself, may have their mandate revoked.
A similar penalty is provided for a Director who, through willful misconduct or gross negligence, makes reports that prove to be unfounded.
10. The penalty system
Failure to comply with the Procedure entails the application of this disciplinary system. Oplium Italia will, therefore, take any appropriate disciplinary action against:By way of example, each reporter is protected in cases of:
the Reporter, in the event of abuse of the Reporting tool,
the Reported Parties, in the event of verification of the reported violations,
the Manager, in the event of failure to comply with this procedure,
those who violate the protection of the Reporter's confidentiality and the retaliation prohibitions established for the protection of the Reporter.
Specifically, the Company has provided for sanctions against those who are found responsible for the offenses referred to in art. 21, paragraph 1, Legislative Decree no. 24/2023, namely:
commission of retaliation;
obstruction or attempted obstruction of the Reporting;
breach of the duty of confidentiality;
failure to establish Reporting channels;
failure to adopt procedures for making and managing the Reporting;
adoption of procedures not compliant with Legislative Decree no. 24/2023;
failure to carry out verification and analysis activities of the Reporting;
established criminal liability of the reporter, even with a first-degree conviction, for the crimes of defamation and slander;
civil liability of the reporter, in cases of intent or gross negligence, for the same crimes mentioned above.
10.1. The disciplinary system for non-managerial employees
The violation, breach, evasion, imperfect, or partial application of the provisions relating to the Whistleblowing System indicated in the Procedure by the Company's employees constitutes a punishable disciplinary offense.
Such violations may lead, depending on the severity of the breach, to the application of disciplinary measures in accordance with the provisions of Article 7 of Law no. 300 of May 20, 1970 (the so-called "Workers' Statute") and subsequent amendments and integrations.
Specifically, for non-managerial employees, these measures are those provided for by the disciplinary rules set out in the National Collective Bargaining Agreement (CCNL) for the Metalworking (industry) sector applied to the Company, namely:
verbal warning;
written warning;
fine not exceeding three hours of hourly pay calculated on the minimum salary scale;
suspension from work and pay for up to a maximum of three days;
dismissal.
10.2. The disciplinary system for Executives
For managerial staff, the rules set out in the CCNL for Managers (industry) apply.
Any manager who carries out retaliatory or discriminatory acts, direct or indirect, against anyone who has made a report under this procedure for reasons directly or indirectly linked to the Report itself shall be subject to dismissal.
A similar penalty is foreseen for any manager who, with willful misconduct or gross negligence, makes reports under this procedure that prove to be unfounded.
10.3. Measures against the Directors
Oplium Italia evaluates with extreme rigor the violations of this procedure committed by those who represent the top management of the Company and thus manifest its image to the Institutions, employees, shareholders, and the public. The formation and consolidation of a corporate ethic sensitive to the values of fairness and transparency presuppose, first of all, that these values are acquired and respected by those who guide corporate choices, in order to constitute an example and stimulus for all those who, at any level, operate for the Company.
In the event of a violation by the Directors of internal procedures or the adoption, in the exercise of their powers, of measures that conflict with the provisions of this procedure, the Company will take all appropriate initiatives provided for by current regulations.
Furthermore, without prejudice to any other action to protect the Company, a Director who commits acts of retaliation or discrimination, direct or indirect, against anyone who has made reports for reasons directly or indirectly linked to the report itself, may have their mandate revoked.
A similar penalty is provided for a Director who, through willful misconduct or gross negligence, makes reports that prove to be unfounded.
11. Personal data protection
Each Report may contain so-called personal data, meaning information directly or indirectly attributable to a physical person.
The Company, as Data Controller, ensures that the aforementioned processing activities are carried out consistently with the requirements of EU Reg. 679/2016 (also "GDPR") and current national regulations.
With reference to the Report Manager, Oplium Italia will provide a formal tasking for the processing of personal data through the delivery of a designation letter pursuant to articles 29 GDPR.
The letter provides specific instructions for the correct processing of the personal data referred to in the Report and the precise indication of the security measures to be applied.
With reference to the Reporting Platform, the Platform provider has signed the data protection agreement pursuant to art. 28 GDPR by which it commits to respecting the instructions provided by each company.
The rights referred to in articles 15 to 22 of the GDPR (the right of access to personal data, the right to rectify them, the right to obtain their erasure or the so-called right to be forgotten, the right to restriction of processing, the right to personal data portability, and the right to object to the processing) may be exercised within the limits of the provisions of current legislation, through the channels indicated in the information notice pursuant to art. 13 of the GDPR made available through the Reporting channels and the specific section of the company website.
11. Personal data protection
Each Report may contain so-called personal data, meaning information directly or indirectly attributable to a physical person.
The Company, as Data Controller, ensures that the aforementioned processing activities are carried out consistently with the requirements of EU Reg. 679/2016 (also "GDPR") and current national regulations.
With reference to the Report Manager, Oplium Italia will provide a formal tasking for the processing of personal data through the delivery of a designation letter pursuant to articles 29 GDPR.
The letter provides specific instructions for the correct processing of the personal data referred to in the Report and the precise indication of the security measures to be applied.
With reference to the Reporting Platform, the Platform provider has signed the data protection agreement pursuant to art. 28 GDPR by which it commits to respecting the instructions provided by each company.
The rights referred to in articles 15 to 22 of the GDPR (the right of access to personal data, the right to rectify them, the right to obtain their erasure or the so-called right to be forgotten, the right to restriction of processing, the right to personal data portability, and the right to object to the processing) may be exercised within the limits of the provisions of current legislation, through the channels indicated in the information notice pursuant to art. 13 of the GDPR made available through the Reporting channels and the specific section of the company website.
12. Information and training
The Procedure is subject to publication on the Company’s website at the link https://oplium.com/it/ and is also made available in the “Documentation Oplium Italia” folder in the Microsoft Teams internal channel “WikiOplium”.
Any informational initiatives are identified to bring this Procedure to the attention of potential Reporters (for example, collaborators, suppliers, clients).
On the occasion of the issuance of the Procedure, sowie periodically, the Company organizes training courses on this Procedure, also by integrating the contents during courses on compliance and the Code of Ethics.
12. Information and training
The Procedure is subject to publication on the Company’s website at the link https://oplium.com/it/ and is also made available in the “Documentation Oplium Italia” folder in the Microsoft Teams internal channel “WikiOplium”.
Any informational initiatives are identified to bring this Procedure to the attention of potential Reporters (for example, collaborators, suppliers, clients).
On the occasion of the issuance of the Procedure, sowie periodically, the Company organizes training courses on this Procedure, also by integrating the contents during courses on compliance and the Code of Ethics.