NRG GLASS MOULDS SRL, aware of the importance of establishing reporting channels in order to protect the integrity of the Company and ensure compliance with the principles of legality, fairness and transparency, including in relation to third parties in the conduct of business activities, adopts this procedure in accordance with the applicable regulations, and in particular with Legislative Decree No. 24/2023, implementing EU Directive 2019/1937.

PURPOSE

This Procedure aims to regulate the management process (internal company channels, recipients, management and analysis of reports) of reports made pursuant to the regulations on Whistleblowing.

In particular, this procedure is aimed at:

• protecting the integrity of the organisation through appropriate handling of reports received;
• protecting the confidentiality of the identity of the reporting person, the person involved, and any person mentioned in the report, as well as the content of the report and related documentation at every stage of the process;
• ensuring compliance with the provisions that protect the reporting person from any retaliatory acts as a result of the report.

 

WHAT BEHAVIOURS CAN BE REPORTED

Relevant Reports are reports concerning conduct, acts or omissions that harm the public interest or the integrity of the company, of which the reporting person has become aware in the course of their work, and which consist of:

• unlawful conduct relevant under Legislative Decree No. 231/2001 and violations of the 231 Model, such as, by way of example: corrupt behaviour towards the Public Administration, violations of Health and Safety at Work regulations, violations of environmental legislation, etc. It is noted that such reports may only be made through internal reporting channels, subject to the provisions of Article 6 of Legislative Decree No. 24/2023 where the relevant conditions are met;
• violations of European Union restrictive measures as referred to in Chapter I-bis, Title I, Book II of the Criminal Code, as well as Article 12, paragraph 1-bis, of Legislative Decree of 25 July 1998, No. 286.

 

Excluded from the scope of this policy are reports linked to a personal interest of the reporting person that relate exclusively to their own individual employment relationship, or to their relationship with hierarchically superior figures, or to aspects of the personal life of the reported person, without any direct or indirect connection to business and/or professional activities (e.g.: employment disputes, discrimination, interpersonal conflicts among colleagues, reports on data processing carried out in the context of an individual employment relationship in the absence of harm to the public interest or the integrity of the private body).

Also excluded are reports that are manifestly unfounded, information already entirely in the public domain, information acquired solely on the basis of unreliable rumours or hearsay (so-called corridor gossip), or reports that are pretextual, defamatory, slanderous, or made solely with the intent to harm the reported person.

The aforementioned “excluded reports” are therefore not considered whistleblowing reports and the company will handle them in accordance with its own internal company regulations.

WHO CAN SUBMIT A REPORT

Personal Scope

This procedure applies, in terms of personal scope, to Relevant Reports made by the following persons:

• employees (subordinate workers);
• self-employed workers and collaborators who carry out their work activities at the Company;
• freelance professionals and consultants who provide their services at the Company;
• volunteers and trainees, paid and unpaid, who carry out their activities at the Company;
• shareholders and persons with administrative, management, control, supervisory or representative functions, even where such functions are exercised solely as a matter of fact at the Company;
• candidates;
• probationary workers;
• former employees and former collaborators.

 

Anonymous Reports

In the event of receipt of anonymous reports, it is specified that these, only where they are specific, detailed and supported by appropriate documentation, will be considered and handled as ordinary reports following the same internal procedures provided for whistleblowing reports. In any case, anonymous reports will be recorded by the Channel Manager and the documentation received will be retained.

INTERNAL COMPANY REPORTING CHANNELS

Available Internal Reporting Channels

To enable the transmission of both written and oral reports, the Company, having consulted with the trade unions, activates and maintains the following reporting channels:

• Channel for reports in written form:

Online method: My Whistleblowing Online Platform by MyGo Srl, a company belonging to the Zucchetti Group;

https://private.mygovernance.it/mywhistleblowing/nrg-glass-moulds/96385

• Channel for reports in oral form:

Online method: My Whistleblowing Online Platform by MyGo Srl, a company belonging to the Zucchetti Group;

https://private.mygovernance.it/mywhistleblowing/nrg-glass-moulds/96385

Should the reporting person request a direct meeting, it will be arranged by the Channel Manager within a reasonable timeframe, in a location that may be either inside or outside the organisation’s premises, and in a manner that ensures confidentiality.

Confidentiality Protection

The above channels guarantee the confidentiality of the identity of the reporting person, the person involved, and any person mentioned in the report, as well as the content of the report and the related documentation, in the following manner:

• digital channel: it is equipped with encryption tools appropriate to and compliant with the requirements of Legislative Decree No. 24/2023.

 

Where requested by the reporting person, any direct meeting is conducted exclusively by the Channel Manager, in a confidential manner and with the completion of a report form.

Who Manages the Reporting Channel

The management of the reporting channel is entrusted to the Human Resources Office of Vetri Speciali S.p.A. (the “Channel Manager”).

Conflict of Interest Management

Should any member of the Human Resources Office be in a conflict of interest, as a reporting person, a reported person, or a person involved in the report, they shall fulfil the obligation to issue an acknowledgement of receipt and shall promptly transmit the report to another member of the Human Resources Office who is not themselves in a state of conflict of interest, and shall abstain from any further activity in relation to the report. This provision also applies in the event that a conflict of interest emerges during the processing of a report, with effect from that point.

Characteristics of the Report

In order to allow for an adequate verification process, it is necessary for the report to be as detailed and specific as possible, so as to allow for the reconstruction of events and the assessment of the validity of the information reported. In particular, the following should be indicated:

• the identifying details of the reporting person (first name, last name, place and date of birth) and, in the case of a direct meeting, contact details to which the acknowledgement of receipt and subsequent feedback may be sent, as well as any requests for supplementary information or clarification;
• the circumstances of time and place in which the reported event occurred, including a description of the facts that are the subject of the report, specifying details relating to circumstantial information and, where relevant, the manner in which the reporting person became aware of the facts;
• the personal details or other elements that may identify the person to whom the reported facts are attributed;
• any documents attached;
• any individuals potentially aware of the facts.

 

REPORT MANAGEMENT PROCEDURE

Upon receipt of the report, the Channel Manager carries out the following activities:

• issues the reporting person an acknowledgement of receipt of the report within seven days of the date of receipt;
• maintains communications with the reporting person and may, where necessary, request additional information from them;
• diligently follows up on the reports received by engaging the persons responsible for handling the report, such as the Supervisory Body (ODV) for reports relating to Legislative Decree No. 231/2001;
• provides feedback to the reporting person within three months of the date of the acknowledgement of receipt or, in the absence of such acknowledgement, within three months of the expiry of the seven-day period from the submission of the report. Such feedback may also be of an interim nature where the investigation has not yet been concluded. Upon completion of the investigation, the outcome must in any case be communicated to the reporting person.

 

For the adequate handling of the report, internal or external parties may be involved, based on the specific technical and professional expertise required, who are not in a conflict of interest and who will in any case be bound by the confidentiality obligations provided for by law.

Upon conclusion of the investigation, if the report is found to be well-founded, the Channel Manager will refer the matter to the competent internal bodies/functions for the relevant follow-up actions, with a view to implementing preventive, corrective or disciplinary measures against the reported person.

THE EXTERNAL REPORTING CHANNEL (ANAC)

In order to use the reporting channel established by ANAC, certain conditions must be met. In particular, the reporting person may use the external procedure only if one of the following conditions applies: the internal company reporting channel in their work environment is not active or, even if activated, does not comply with Legislative Decree No. 24/2023; they have already made an internal report and it has not been followed up; they have reasonable grounds to believe that, if they were to make an internal report, it would not be dealt with effectively or that the report itself could give rise to a risk of retaliation; they have reasonable grounds to believe that the violation could constitute an imminent or manifest danger to the public interest. Any retaliation suffered may also be reported through this same channel.

See: https://www.anticorruzione.it/-/whistleblowing

PRIVACY NOTICE

Pursuant to Article 13 of Legislative Decree No. 196/2003 (the Personal Data Protection Code, hereinafter also the “Privacy Code”) and Article 13 of European Regulation No. 679/2016 (hereinafter also the “GDPR”), we provide the following information.

Data Controller

The data controller is NRG Glass Moulds Srl, registered office in Borgo Mantovano (MN) – Strada Nazionale, no. 38/A, e-mail: amministrazione@nrgmoulds.it.

Place of Data Processing

The related processing operations take place in Italy and there is no transfer or disclosure of data abroad or to non-EU countries. No data is communicated or disclosed, except for statistical purposes and in any case in an anonymous and/or aggregated form.

Purposes of Data Processing

The personal data you provide is used solely for the purpose of managing the Whistleblowing report you have submitted.

Data Processed

The personal data processed are exclusively:

• personal data (first name, last name, telephone number, etc.)
• report data (location, date, subject, etc.)

 

Legal Basis for Processing

The legal basis on which personal data is processed is the legal obligation arising from the provisions of Article 6 of Legislative Decree No. 231 of 2001, as amended by Law No. 179 of 2017, containing “Provisions for the protection of persons who report offences or irregularities of which they have become aware in the context of a public or private employment relationship”, and from EU Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (the Whistleblowing Directive), transposed into national law by Legislative Decree of 10 March 2023, No. 24.

Retention Period

The personal data you have provided will be deleted within 5 years of collection.

With Whom We Share the Collected Data

Your personal data may be accessed by employees responsible for handling Whistleblowing reports and by members of the Supervisory Body (OdV) under Legislative Decree No. 231/2001. Furthermore, given that Whistleblowing reports are submitted via the My Whistleblowing software, your personal data may also be accessed by the provider of the aforementioned application, which has been appointed as data processor pursuant to Article 28 of the GDPR. It is understood that, in line with the principle of protecting the confidentiality of the reporting person under Law No. 179/2017, the sharing of your personal data will be limited to the strict minimum necessary to guarantee your confidentiality.

Methods of Data Processing

Personal data is processed both by automated and manual means for the purposes indicated above. Specific security measures are observed to prevent data loss, unlawful or incorrect use, and unauthorised access.

Rights of Data Subjects

Under certain conditions, you have the right to exercise the rights provided for under Articles 7, 8, 9 and 10 of the Privacy Code and Articles 15, 16, 17, 18, 19, 20, 21 and 22 of the GDPR, and in particular to request:

• access to your personal data,
• a copy of the personal data you have provided to us (portability),
• the rectification of data in our possession,
• the erasure of any data for which we no longer have a legal basis for processing,
• objection to processing where provided for by applicable law,
• withdrawal of your consent, where processing is based on consent;
• restriction of the manner in which we process your personal data, within the limits provided for by personal data protection legislation.

 

The exercise of these rights is subject to certain exceptions aimed at safeguarding the public interest (such as the prevention or detection of crime) and our own interests (such as the maintenance of professional secrecy). In the event that you exercise any of the above-mentioned rights, it will be our responsibility to verify that you are entitled to do so, and we will respond, as a general rule, within one month.

Anyone with concerns regarding compliance with the privacy policy adopted by NRG Glass Moulds Srl, its application, the accuracy of their personal data or the use of collected information may contact us by e-mail at: amministrazione@nrgmoulds.it. However, should you wish to do so, you may also submit your complaints or reports, pursuant to Article 77 of the GDPR, to the data protection authority, using the relevant contact details:

Italian Data Protection Authority (Garante per la protezione dei dati personali) – Piazza di Monte Citorio, No. 121 – 00186 ROME – Fax: (+39) 06.69677.3785 – Tel: (+39) 06.696771 – E-mail: garante@gpdp.it – Certified e-mail: protocollo@pec.gpdp.it.