Whistleblowing

Legislative Decree No. 24 of March 10, 2023

UNI/PdR 125:2022

The Company M.M.B. s.r.l. has equipped itself with an internal wrongdoing reporting system in accordance with the requirements of Legislative Decree No. 24 of March 10, 2023, implementing EU Directive 2019/1937 concerning the protection of persons who report violations of National and Union law and in order to create a positive image of transparency and trust as an essential element of a healthy corporate and organisational culture. The company also makes this system available for receiving reports relating to the gender‑equality management system adopted in accordance with UNI/PdR 125:2022.

1. WHO CAN MAKE THE REPORT?

Reports may be submitted by anyone who becomes aware – during activities carried out with the company or through any form of contact with it, regardless of the nature of the relationship or even in the absence of a formal relationship (including individuals who merely witnessed relevant facts or learned of them accidentally) – of circumstances falling within the scope of this procedure and who is able to provide information about them. By way of example, the following may submit reports: employees, including former employees and candidates during the recruitment process; shareholders; members of the Board of Directors; members of supervisory or control bodies; individuals who, although not employees, work for the company and are under its control or act in accordance with its instructions or direction (e.g. interns, contract workers, project workers, agency workers); individuals who, while external to the company’s organisation, work directly or indirectly and on a stable basis for or with the company (e.g. ongoing collaborators, strategic suppliers, agents, intermediaries); local communities and members of civil‑society organisations (e.g. NGOs); any third party affiliated with, connected to, or otherwise linked to the above categories; more generally, any stakeholder of the company; third parties who, due to their role, position, or even mere circumstances of fact, become aware of information relevant to this document.

LEGISLATION PROTECTS THE WHISTLEBLOWER AND PROVIDES PENALTIES FOR RETALIATION FOLLOWING WHISTLEBLOWING, AND THE PROTECTIONS ALSO APPLY TO FACILITATORS, RELATIVES OR ASSOCIATES OF THE WHISTLEBLOWER, AND INDIVIDUALS OWNED BY THE WHISTLEBLOWER OR WORKING IN THE WHISTLEBLOWER’S WORK ENVIRONMENT.

2. WHAT CAN BE REPORTED?

Reports may concern any facts that constitute the unlawful conduct identified in Legislative Decree 24/2023, committed within the company or in connection with activities carried out with it. The Decree specifically includes the following categories of violations:

• • Administrative, accounting, civil or criminal offenses;
  • acts or omissions that infringe EU or national law in the areas of:
    • public procurement;
    • financial services, products and markets and prevention of money laundering and terrorist financing;
    • product safety and compliance;
    • transport security;
    • environmental protection;
    • radiation protection and nuclear safety;
    • food and feed safety and animal health and welfare;
    • public health;
    • consumer protection;
    • privacy and data protection;
    • Network and information systems security;
    • acts or omissions that harm the financial interests of the European Union, as indicated in the Whistleblowing Decree;

To ensure maximum protection for whistleblowers and to guarantee adequate safeguards for those who submit reports, facts that constitute a breach of the company’s gender‑equality management system adopted in accordance with UNI/PdR 125:2022 may also be reported. This means that the present procedure and the use of the internal reporting channel apply – unless otherwise specified – to reports concerning, for example, acts that constitute abuse, violence, harassment (including sexual harassment), bullying, or other discriminatory conduct.

In a broader perspective of continuous improvement, the reporting channel may also be used, including anonymously, to express opinions and provide suggestions for organisational change and to support dialogue and discussion on gender equality

DISPUTES, CLAIMS OR DEMANDS RELATED TO A PURELY PERSONAL INTEREST OF THE REPORTER CANNOT BE REPORTED.

3. WHO WILL TAKE CHARGE OF THE REPORT?

The Whistleblower Manager/Instructor is the person functionally in charge of receiving and taking charge of the reports (within 7 days), assessing the existence of the eligibility requirements of the reports, initiating the relevant investigation, maintaining interlocutions with the whistleblower, and giving feedback to the whistleblower within three months from the date of notice of receipt of the report.

If the report concerns the gender‑equality management system adopted in accordance with UNI/PdR 125:2022, the Report Manager will submit it to the Steering Committee.

THE IDENTITY OF THE REPORTER WILL NOT BE DISCLOSED UNLESS PRIOR CONSENT HAS BEEN GATHERED FROM HIM OR HER.

4. HOW CAN I MAKE THE REPORT?

Reports can be made in a manner:

1. ANONYMOUS: not allowing the report to be associated with the name of the reporter, In this case the reporter is not required to register with the system and can submit the report as an unregistered user in the “Report without registration” section;
2. CONFIDENTIAL: allowing the reporter to be identified, in this case the report requires the user to register in advance and then, once the account is created, the user can submit the report. It is also possible to submit a confidential report without creating an account by filling out the report form from the “Report without registration” section and indicating personal data at the end of the form. The data of the reporter are separate from the report so the confidential report is sent to the Manager anonymously.

Reports can be made through a special platform, accessible at the following link https://mmbsoftware.segnalazioni.net/en/, which guarantees the confidentiality of the identity of the reporter and the information contained in the report through encryption systems; the report is accessible only to the reporter and the Whistleblowing Manager.

The management and processing of any personal data provided will take place in accordance with the rules of the European Regulation 679/2016 and the information contained therein and available at https://mmbsoftware.segnalazioni.net/en/pages/privacy.

Technical instructions for making the report can be found within the platform or at the following links: registered user https://manuali.digitalpa.it/whistleblowing/v4-0-0/en/frontend/manuale-operativo-utente-segnalatore.html or unregistered user https://manuali.digitalpa.it/whistleblowing/v4-0-0/en/frontend/manuale-operativo-utente-segnalatore-non-registrato.html. For further details and insights, please refer to the corporate whistleblowing policy available within the platform and at the following link https://mmbsoftware.segnalazioni.net/en/pages/policy.