1. PREMISE

On March 15, 2023, Legislative Decree 24/2023 (hereinafter also referred to as the "Whistleblowing Decree") came into force, which, in implementation of EU Directive 2019/1937, defined new rules for the protection of persons who report violations of European law and national provisions, of which they have become aware in the work context. The Whistleblowing Decree, in particular, in deference to the principles introduced by the European legislator, aims to encourage whistleblowers to first turn to the relevant legal entity to which they are associated so that the prevention and investigation of violations can, in the first instance, be conducted using relevant information acquired from those closest to the facts indicated as the origin of the alleged violation.

Therefore, in the private sector, the aforementioned legislation introduced, for all companies that have employed an average of at least 50 workers in the last year and/or have adopted an Organization, Management and Control Model pursuant to Legislative Decree 231/01, the obligation to set up internal channels for the reporting of wrongdoing and/or to update previously established channels.

With this Procedure, Pizeta Pharma S.p.A. is implementing the above legislation, aiming to achieve the objectives of preventing European and national wrongdoing and protecting whistleblowers.

To this end, this Procedure is intended to provide the potential whistleblower with clear operational guidance regarding the subject matter, content, recipients, and method of transmission of reports, and regarding the forms of protection provided by our system in his/her favour.

Pizeta Pharma S.p.A. is committed to ensuring the correct, continued and effective application of this Procedure.

1. 1. External and internal regulatory references

Legislative Decree no. 24/2023 - Implementation of (EU) Directive 2019/1937 regarding the protection of persons who report breaches of European Union law and laying down provisions regarding the protection of persons who report breaches of national regulations

Legislative Decree no. 231/2001 - Regulating the administrative liability of legal persons, companies and associations, including those without legal personality, pursuant to Article 11 of Law No. 300 of September 29, 2000

ANAC guidelines - approved by Resolution No. 311 of July 12, 2023, regarding the protection of persons who report violations of EU law and the protection of persons who report violations of national regulations, as well as procedures for the submission and handling of external reports

CONFINDUSTRIA Operating guide on the "New Whistleblowing Discipline" adopted in October 2023

Code of Ethics of the Company Pizeta Pharma S.p.A.

Model 231 - Organization, Management and Control Model pursuant to Legislative Decree No. 231/2001 of the Company Pizeta Pharma S.p.A.

E.U. Regulation 2016/679 (GDPR) on the protection of personal data

Legislative Decree no. 196/2003 – Personal Data Protection Code

1. 2. Scope of application

This Procedure applies to the Company Pizeta Pharma S.p.A. and is intended for all potential Whistleblowers, Persons Concerned and Facilitators, as defined in the following paragraph, as well as the corporate figures and functions identified by the Company and however involved, directly or indirectly, in the management of Reports of Breaches.

1. 3. Definitions       

For the purposes of this Procedure, the following definitions are adopted:

ANAC: Italian National Anti-Corruption Authority

Anonymous Reporting: reporting from which the identity of the Whistleblower cannot be obtained

Breaches: behaviours, acts or omissions that violate national and European Union regulations, as better specified below (Section 3.2), and that harm the public interest or integrity of the Company, which the Whistleblowers have become aware of in the work context.

Company: Pizeta Pharma S.p.A.

Decree 231: Legislative Decree No. 231 of June 8, 2001, governing the administrative liability of legal persons, companies and associations, including those without legal personality

Designated Department: the body in charge of handling Reports, which, in Pizeta Pharma S.p.A., is represented by Supervisory Body appointed in accordance with Legislative Decree 231/01, composed of Agata Nasini

Facilitator: a natural person who assists a whistleblower in the reporting process, operating within the same work context and whose assistance must be kept confidential;

Information on Breaches: information, including reasonable suspicions, about actual or potential breaches, whisch occurred or are very likely to occur in the organisation in which the whistleblower or the person making the complaint to the judicial or accounting authorities has a legal relationship pursuant to Article 3, paragraph 1 or 2 of the Whistleblowing Decree, as well as information concerning conduct aimed at concealing such violations

Internal Reporting: the written or oral communication of information on breaches which is submitted through the internal reporting channel, established and managed by Pizeta Pharma S.p.A.

IT platform: an IT tool adopted by the Company to enable the transmission and management of Whistleblowing Reports, electronically, in compliance with the regulatory dictate and reference guidelines. Specifically, Pizeta Pharma S.p.A.  has adopted the Legality Whistleblowing platform of the provider Digital PA, which can be accessed from the Company's website

Model 231: Organization, Management and Control Model adopted by Pizeta Pharma S.p.A. pursuant to Legislative Decree 231/01

Person concerned: natural or legal person mentioned in the report as the person to whom the violation is attributed or who is otherwise implicated in the violation

Procedure: this Whistleblowing Procedure

Retaliation: any behaviour, act or omission, even if only attempted or threatened, carried out as a result of the Report, the complaint to the judicial or accounting authority, or public disclosure, and which causes or may cause to the person making the Report or the person who filed the complaint, either directly or indirectly, unfair damage that is to be understood as unjustified damage as an effect caused directly or indirectly by the retaliation and inherent in the content of the retaliation itself

SB: Supervisory Body appointed in accordance with Legislative Decree 231/01 with the duty of supervising the operation of and compliance with Model 231

Work Context: present or past working or professional activities carried out in the context of the relationships referred to in Article 3, paragraphs 3 or 4, of the Whistleblowing Decree, through which, regardless of the nature of such activities, a person acquires information about violations and in the context of which he/she could risk retaliation in the event of a public report or disclosure or a complaint to the judicial or accounting authorities

Whistleblower: the person who makes the Report or public disclosure of information about violations acquired in the context of his/her work.

Whistleblowing Decree: Legislative Decree No. 24 of March 10, 2023, issued in implementation of EU Directive 2019/1937 of the European Parliament and of the Council of October 23, 2019, on the protection of persons who report breaches of Union law and laying down provisions regarding the protection of persons who report breaches of national laws

Whistleblowing report: written or oral communication of information on Breaches committed or which, on the basis of specific elements, might be committed within the Company, of relevant unlawful conduct pursuant to Decree 231 falling within the perimeter defined by Legislative Decree 24/2023 and for which the system of protection provided for the Whistleblower is applicable

Whistleblowing: an instrument to counter and prevent corruption, mismanagement, and prevent violations of law in the public and private sectors

 

2. WHISTLEBLOWING SYSTEM
   1. What to report

A report is classifiable as a "Whistleblowing Report," and therefore subject to this Procedure, with consequent activation of the system of protections provided for the Whistleblower, only and exclusively if it concerns one of the Breaches listed below:

1. unlawful conduct that is relevant under Decree 231;
2. violations of Model 231 adopted by Pizeta Pharma S.p.A.

The following may also constitute Whistleblowing Reports for the purposes of applying this Procedure:

• Breaches, inherent to the areas listed above, which have not yet been committed, but which the Whistleblower reasonably believes could be, based on concrete elements, such as irregularities and/or anomalies (symptomatic indicators);
• Conduct aimed at concealing Breaches;
• communications about the Retaliation that Whistleblowers and similar parties believe they have suffered, as a result of the Reports made.

Finally, it should be noted that the information on Breaches must concern conduct, acts or omissions of which the Whistleblower has become aware in his/her work context. What is of relevance, in fact, is the existence of a qualified relationship between the Whistleblower and the Company in which the former works, a relationship that relates to present or even past work or professional activities, as more fully specified below with regard to the eligible parties (par. 2.3).

1. 2. Reports excluded from the application of whistleblowing regulations

In compliance with the provisions of the Whistleblowing Decree, the following cannot be the subject of Whistleblowing and, therefore, remain excluded from the scope of this Procedure and the system of protections provided for the Whistleblower:

• reports related to a personal interest of the Whistleblower, which pertain to his/her own individual work relationships, i.e., relating to work relationships with hierarchically superior figures (e.g., labour disputes, discrimination, interpersonal conflicts between colleagues, reports on data processing carried out in the context of the individual work relationship in the absence of an injury to the public interest or the integrity of the private entity);
• reports on violations already mandatorily regulated in certain special sectors, to which ad hoc reporting regulations continue to apply (i.e., financial services, money laundering prevention, terrorism, transport security);
• violations regarding national security and defence;
• information that is clearly unsubstantiated, information that is already totally in the public domain, as well as information acquired only on the basis of poorly reliable indiscretions or rumours (so-called hearsay).

This does not affect regulations on classified information, forensic or medical professional secrecy, rules of criminal procedure, information covered by investigative secrecy in criminal proceedings or under regulations on the autonomy and independence of the judiciary, national defence, public order and security, and the exercise of the right of workers to consult with their representatives or trade unions.

1. 3. Eligible subjects

Pursuant to the Whistleblowing Decree, the following individuals are eligible to submit Whistleblowing Reports:

1. Company employees, including workers whose relationship is part-time or fixed-term, intermittent, in apprenticeship, ancillary or arising from labour supply contracts (Legislative Decree 81/2015) and casual labourers (Article 54-bis Decree Law 50/2017);
2. freelance professionals, consultants and, in general, the Company's suppliers who, as part of or in connection with the performance of their work for the Company, might acquire information about violations relevant for the purposes of this Procedure;

1. volunteers or interns, paid or unpaid for their work at the Company;
2. persons who perform, even on a merely de facto basis, administrative, managerial, supervisory or representative functions at the Company;
3. Company shareholders.

It should be noted that under the relevant regulations, the listed individuals are also considered eligible to file a Whistleblowing Report:

• during the probationary period and prior to the establishment of the employment or other legal relationship (for information on violations acquired prior to the establishment of the relationship);
• after the establishment of the employment or other legal relationship (where information on violations was acquired during the terminated relationship).
  4. Contents of Internal Reports

All Internal Reports must be documented and substantiated, so as to provide the necessary and appropriate elements to enable an appropriate follow-up activity on the merits of the reported facts.

In particular, it is necessary for each Report to include the following elements:

1. the personal details of the Whistleblower (for the case of Anonymous Reports see below);
2. a detailed description of the facts that occurred and the manner in which they became known;
3. date and place where the facts occurred;
4. name and role of the persons involved or elements that may enable their identification;
5. name of any other persons who may give an account of the facts that are the subject of the Report;
6. any documents that may confirm the accuracy of the facts reported;
7. any other information that may provide useful confirmation of the existence of the facts reported.

It should be noted that the Report must not take an insulting tone or contain personal insults. The use of such expressions may be submitted, by the Designated Department, to the appropriate company functions for appropriate evaluations, including disciplinary ones.

The Report must not contain facts that are not relevant for the purposes of the same, nor special categories of personal data, as per art. 9 GDPR (for example, those from which racial and ethnic origin, philosophical and religious beliefs, membership of political parties or trade unions, as well as health, sex life or sexual orientation may be inferred), nor data relating to criminal convictions and offences referred to in art. 10 of the GDPR, except in cases where this is unavoidable and necessary for the purposes of the Report itself.

In any case, the Company will take care to process only the data strictly necessary for the management of the individual Report, deleting any additional data that may be provided to the same, due to the principle of minimization.

Anonymous reports, not bearing any personal details of the Whistleblower, are accepted provided they are substantiated and supported by appropriate documentation. In this regard, it should be noted that, in line with relevant best practices, they will be treated in the same way as ordinary reports, and therefore excluded from the protection of the Whistleblowing system.

In any case, the Designated Department will also record the aforementioned reports and conserve the relevant documentation. If, however, the anonymous Whistleblower is subsequently identified, the protections provided for Whistleblowers will be guaranteed to him/her.

1. 5. Internal channels

Internal Reports may be submitted alternatively using the following channels established by the Company:

• IT platform “Legality Whistleblowing” accessible at the following link https://pizetapharma.segnalazioni.net/, also published in the Whistleblowing section of the Company's website. The platform allows Whistleblowing Reports to be made both in written form, by filling out a special web form, and orally, through voice messaging systems capable of distorting the voice of the Whistleblower at the time of submission.
• Face-to-face meeting with the Designated Department, to be arranged within a reasonable period of time, at the request of the Whistleblower submitted via the above-mentioned IT Platform. In such a case, with the consent of the Whistleblower, the Report is documented by the Designated Department, either by recording on a device suitable for storage and listening or by taking minutes. In the case of minutes, Whistleblower shall verify, possibly rectify, and confirm the minutes of the meeting by signing them.

It should be noted that in order to best protect the confidentiality of Whistleblower's identity, the IT Platform should be accessed from personal devices which are not connected to the company network.

If the Report is submitted in a manner different from those described and it is nonetheless evident that it is a Whistleblowing Report (e.g., it bears the words "whistleblowing" on the envelope or in the subject line or text of the communication), the receiving party shall transmit it to the Designated Department, promptly, within 7 days at the latest, through the dedicated channels, simultaneously giving notice to the Whistleblower.

Conversely, if the Whistleblower does not expressly state that he/she wishes to benefit from the protections, or such intention is not inferred from the Report, said Report is considered to be an ordinary Report, which is outside the scope of this Procedure.

1. 6. The Designated Department

Pizeta Pharma S.p.A. has identified SB, in the person of Agata Nasini, as the Designated Department.

SB has autonomy and its component has received adequate and specific professional training in the management of Whistleblowing Reports, as well as in the protection and security of personal data.

 

3. MANAGEMENT OF REPORTS THROUGH THE INTERNAL CHANNEL
   1. Operating procedure

For all Reports received, the Designated Department:

1. receives, issues acknowledgement of receipt to the Whistleblower and records the Report;
2. preliminarily examines the Report received and classifies it;
3. investigates and ascertains the contents of the Report;
4. gives feedback to the Whistleblower;
5. concludes the process;
6. prepares and submits periodic reporting to Top Management;
7. stores the Reports and related documentation.

The steps in the process of handling the Report, listed above, are explained in detail below.

1. 2. Receipt and Registration of the Report

Following the receipt of the Report through the Internal Channels, the Designated Department shall send the Whistleblower an acknowledgement of receipt within 7 (seven) days from the date of receipt of the Report.

It should be noted that this acknowledgement of receipt does not constitute a confirmation of the admissibility and/or procedural feasibility and/or substantiation of the Report, but is only intended to inform the Whistleblower that the Report has been properly received.

In the event that the Report is obtained through a face-to-face meeting with the Whistleblower, the Designated Department will enter it into the Platform and assign it a progressive identification number.

The IT Platform also serves as a Reports Register.

1. 3. Preliminary assessment of the Report

The Designated Department shall promptly take charge of and preliminarily analyze the Report received in order to assess whether it is procedural and admissible.

If necessary, and where the reporting methods permit, the Designated Department may request additional information or supporting documentation from the Whistleblower, invariably via the dedicated channels, in order to allow for a more comprehensive and conclusive assessment of the Report.

At the outcome of this preliminary examination, the Designated Department will classify the Report into one of the following categories, which will entail a different and specific workflow for handling the Report itself:

1. Report inadmissible where the facts described are not attributable to reportable violations under the Whistleblowing Decree or come from individuals who are not listed among those eligible to make Reports;
2. Report inadmissible on the grounds that:

• It is manifestly unfounded, owing to the lack of factual elements capable of justifying further investigation;
• It is manifestly generic in content, such that the facts represented cannot be understood;
• It is accompanied by inappropriate or irrelevant documentation;
• it was not possible to gather sufficient information in order to be able to proceed with further investigation.

3. Admissible and procedurally feasible Report: these are all those Reports that prove to be sufficiently substantiated and relevant to the perimeter of this Procedure. With regard to this category, the Designated Department initiates the next stage of Investigation described in the following paragraph.

In the event that the Report concerns a matter excluded from the objective scope of application of this Procedure, it may be treated in the same way as an ordinary Report and, therefore, if not manifestly unfounded and is sufficiently substantiated and documented, it will be forwarded, by the Designated Department to the Board of Directors and/or the Board of Statutory Auditors, giving timely notice to the Whistleblower.

At the outcome of the preliminary examination described above, the Designated Department:

• in hypotheses a), and b), orders the archiving of the Report, formalizing the reasons that led him/her to this decision;
• in hypothesis c), proceeds to the next Investigative stage.
  4. Investigation and assessment of the report

At the end of the preliminary examination phase, where the Report received has been classified as admissible and actionable, the Designated Department will initiate internal verification and investigation activities in order to gather further detailed information and ascertain the grounds or groundlessness of the reported facts.

The Designated Department will evaluate, in accordance with the principles of objectivity, competence and professional diligence, the assessments necessary for the purposes of the investigation, and may, for example:

• proceed to the hearing of the Whistleblower, the Person Concerned and/or any other internal/external persons who may provide information on the reported facts, and request, if necessary, additional documents and information useful for the evaluation of the Report;
• involve other company functions and/or external consultants, in view of the specific technical and professional skills required (providing due guarantees of confidentiality and protection).

In any case, it should be noted that the follow-up activities carried out will be carried out in compliance with the legislation on the protection of personal data, as well as the legislation on remote control ex art. 4 of law 300/1970 as amended (so-called Workers' Statute) and the prohibition of investigation of workers' opinions, and ex art. 8 of law 300/1970 and art. 10 of Legislative Decree 276/2003.

1. 5. Conclusion of the process

Upon completion of the investigation phase, the Designated Department shall prepare a written report, to be kept within the IT Platform, outlining:

• the descriptive elements of the Breach (e.g., place and date of occurrence, evidence and documentary evidence);
• the verifications carried out, their outcomes and the corporate or third parties involved in the analysis phase;
• a summary assessment of the analysis process with an indication of the ascertained cases and the relevant reasons;
• the outcome and conclusion of the investigations carried out.

Furthermore, the Designated Department:

1. where he/she detects evidence of the Report’s validity, he/she shall refer the matter to the competent corporate functions (also sharing the report prepared) in order for them to identify and undertake the consequent initiatives (including disciplinary and/or judicial initiatives), which fall under their exclusive responsibility;
2. where, conversely, he/she detects elements of manifest groundlessness of the Report, he/she shall order its archiving with adequate justification;
3. where he/she finds elements of wilful misconduct or gross negligence in the manifestly unfounded Report, he/she shall involve the competent corporate functions for possible disciplinary sanctions as provided above in point (i) and shall order its archiving as provided above in point (ii)
4. where he/she finds it appropriate, he/she shall make recommendations regarding the adoption of any necessary corrective actions on the affected business areas and processes with a view to strengthening the internal control system.
   6. Feedback to the Whistleblower

Within three months from the date of the notice of acknowledgement of receipt or - in the absence of such notice - within three months from the date of expiration of the seven-day period imposed for such notice, depending on the results of the verifications performed, the Designated Department shall acknowledge the Whistleblower by communicating:

• the archiving of the Report, stating the reasons for such;
• the successful ascertainment of the merits of the Report and its transmission to the competent internal bodies;
• where the preliminary investigation is not concluded, the activity carried out up to that moment and/or the activity planned to be carried out.

In this last case, the Designated Department shall also inform the Whistleblower of the subsequent final outcome of the investigation of the Report (archiving or ascertainment of the merits of the Report with transmission to the competent bodies).

1. 7. Periodic reporting to top management

The Designated Department prepares an annual report containing a summary of Whistleblowing Reports:

1. received in the relevant period,
2. received in the previous reporting period but not yet archived,
3. archived in the relevant period.

The report shows the "status" of each Whistleblowing Report (e.g., received, open, proposed for archiving, archived, under investigation/audit, etc.) and any actions taken.

The Designated Department shall forward the Whistleblowing Reports statement to:

1. Board of Directors
2. Board of Statutory Auditors.

Where deemed necessary, the Designated Department shall also promptly inform the Board of Directors in relation to events or information concerning specific Whistleblowing Reports, in order to promptly share and implement the most appropriate actions to protect the interests of the Company.

The audits conducted under this Procedure do not alter the prerogatives and autonomy vested in the Board of Statutory Auditors and the SB by the Law and by the Company's internal regulations; therefore, the aforementioned bodies shall exercise their autonomous powers of control upon receipt of the information addressed to them under this Procedure.

1. 8. Conflict of interest situations

In the event that the Whistleblower believes that there may be situations of conflict of interest with the Designated Department or one of its members (for example, if the Report concerns the Designated Department, as such, or as a Supervisory Body), he/she may forward his/her Report, by registered letter, to the Board of Directors, which will be required to process it in accordance with the timeframe and procedures indicated in this Procedure, guaranteeing, in any case, the confidentiality of the identity of the Whistleblower and the content of the Report.

It should be noted that, in such a case, the Report must be placed in two sealed envelopes, with the first envelope including the Whistleblower's identification data, together with a copy of his/ her identification document; the second envelope must include the subject of the Report; both envelopes must then be placed in a third envelope marked "whistleblowing" on the outside.

All conflict-of-interest situations must in all cases be declared without hesitation and reported in the case file by the Designated Department.

 

4. PROTECTION OF WHISTLEBLOWERS AND SIMILAR PARTIES
   1. Confidentiality obligations regarding the identity of protected subjects

The Company guarantees the confidentiality of the identity of the Whistleblower, the Person Concerned, any Facilitators and other persons mentioned in the Report, as well as the confidentiality of the contents of the Report and the documentation attached to it.

The identity of the Whistleblower and any other information from which such identity may be inferred - directly or indirectly - may not be disclosed, without the express consent of the Whistleblower, to parties other than those authorized to receive or follow-up on Reports, as identified in this Procedure.

Furthermore, the identity of the Whistleblower:

• within the scope of criminal proceedings, is covered by secrecy in the manner and within the limits provided for in Article 329 of the Code of Criminal Procedure;
• within the scope of proceedings before the Court of Audit, may not be revealed until the investigation stage is concluded;
• within the scope of the disciplinary proceeding, may not be disclosed, if the contestation of the relevant charge is based on investigations separate and additional to the Report, even if consequent to it. If the contestation is based in whole or in part on the Report and knowledge of the identity of the Whistleblower is indispensable for the defence of the person accused, the Report may be used for the purposes of the disciplinary procedure only if the Whistleblower expressly consents to the disclosure of his/her identity. In such a case, the Whistleblower must be given written notice of the reasons for the disclosure of the confidential data and asked in writing whether he/she intends to consent to the disclosure of his/her identity, with a warning that - if he/she does not consent - the Report cannot be used in the disciplinary proceedings.

The Whistleblower shall also be given written notice of the reasons for the disclosure of confidential data, when the disclosure of the identity of the Whistleblower and of information from which such identity may be inferred, directly or indirectly, is indispensable for the defence of the Person Concerned.

The identity of the Person Concerned, the Facilitator, and the persons in any way involved and mentioned in the Report shall be protected until the conclusion of the proceedings initiated as a result of the Report, with the same guarantees provided in favour of the Whistleblower in this paragraph.

1. 2. Prohibition of retaliation against protected persons

The Company guarantees the protection of Whistleblowers and persons other than the Whistleblower who, precisely by virtue of the role assumed within the reporting process and/or the particular relationship that binds them to the Whistleblower, could be recipients of Retaliation.

In fact, in compliance with the provisions of Article 17 of the Whistleblowing Decree, no form of Retaliation or discriminatory measure, whether direct or indirect, which affects working conditions, is permitted or tolerated against a Whistleblower who makes an Internal Report pursuant to this Procedure, for reasons directly or indirectly related to the Internal Report.

Discriminatory measures include, but are not limited to, dismissal and unjustified disciplinary actions, harassment in the workplace, and/or any other form of retaliation that results in intolerable working conditions or an objective worsening thereof.

The Whistleblower or other protected persons who, pursuant to the Whistleblowing Decree, believe that they have suffered retaliation, even if only attempted or threatened, for a Reporting previously made, may notify ANAC through the channels available:

• IT platform accessible to the ANAC institutional website;
• oral communication;
• face-to-face meetings scheduled within a reasonable timeframe
  3. Limitations of liability for the whistleblower, complainant, or persons making public disclosures

A Whistleblower who discloses or disseminates information about Breaches covered by the obligation of secrecy (other than classified information, medical and forensic secrecy, and deliberations of judicial bodies), or relating to the protection of copyright or the protection of personal data, or which damages the reputation of the person involved or reported, shall not incur criminal, civil, or administrative liability if, (i) at the time of the disclosure or dissemination, there were reasonable grounds to believe that the disclosure or dissemination of that information was necessary to isclose the Breach and (ii) the Report, public disclosure or complaint to the judicial authority was made in compliance with the conditions envisaged in order to benefit from protection against Retaliation (both conditions must exist to exclude liability).

In any case, criminal, civil or administrative liability is not excluded for conduct, acts or omissions that are not related to the Report, complaint to the judicial or accounting authority, or public disclosure, or that are not strictly necessary to report the Breach.

1. 4. Waivers and settlements

Waivers and settlements with respect to the rights and protections provided for in the Whistleblowing Decree and this Procedure are generally prohibited, unless they occur under special conditions.

It is permitted, however, for the Whistleblower and other protected persons to waive their rights and means of protection, or to make them the subject of a settlement, only if this occurs in the protected venues and, therefore, before a judge, following compulsory attempt at conciliation, or mediation and conciliation agreements prepared before the trade unions or certification bodies.

1. 5. Protected subjects

The protective measures outlined above are extended to:

1. the Facilitator, if any;
2. persons working in the same work context as the Whistleblower, the person who has lodged a complaint with the judicial or accounting authority or the person who has made a public disclosure and those linked to said persons by a stable emotional or family relationship up to the fourth degree;
3. work colleagues of the Whistleblower or of the person who has lodged a complaint with the judicial or accounting authority or made a public disclosure, who work in the same work context as said persons and who have a habitual and current relationship with them;
4. entities owned by the Whistleblower or the person who made a complaint to the judicial or accounting authority or made a public disclosure, or for which these persons work, as well as entities operating in the same work context as the aforementioned persons.

Protection of the Whistleblower also applies if the Report, whether internal or external, complaint to the judicial authorities or public disclosure of information occurs in the following cases:

1. when the relationship with the Company has not yet commenced, if information about violations was acquired during the selection process or other pre-contractual stages;
2. during the probationary period;
3. after the termination of the relationship with the Company if information on violations was acquired during the course of the relationship.

These protections and safeguarding measures provided by the Whistleblowing Decree in favour of the Whistleblower and similar persons apply ONLY if the following conditions are cumulatively met:

• such persons, at the time of the Report, public disclosure or complaint to the judicial or accounting authorities, had reasonable grounds to believe that the Breaches reported were true and fell within the objective scope of application of this Procedure;
• the Report or public disclosure was made in compliance with the provisions of this Procedure, as well as with the provisions of the Whistleblowing Decree (in particular, in compliance with the relevant terms and conditions of access).

These protections are not guaranteed if criminal liability of the Whistleblower is ascertained for offences of defamation or slander, or if his/her civil liability is determined for the same offence,  in cases of wilful misconduct or gross negligence, even by a judgment of first instance.

Any conduct in violation of the protections provided in favour of the Whistleblower and the other persons indicated above may give rise to disciplinary proceedings against the person responsible and may be sanctioned by ANAC with an administrative pecuniary sanction, in accordance with the provisions of Article 21 of the Whistleblowing Decree.

1. 6. Support measures

A list of third sector entities that provide Whistleblowers with support measures is established at ANAC.

The support measures provided consist of information, assistance and advice free of charge on how to report and on the protection from retaliation offered by national and EU regulatory provisions, on the rights of the person involved, and on the terms and conditions of access to legal aid.

 

5. DISCIPLINARY SYSTEM

Any violation of this Procedure will be sanctioned by application of the Disciplinary System adopted by the Company and the applicable National Collective Labour Agreements.

Furthermore, it should be noted that pursuant to the Whistleblowing Decree, the Company may impose disciplinary sanctions against those who:

• have committed acts of retaliation that directly or indirectly cause or may cause unjust harm to the Whistleblower and/or other persons protected under this Procedure;
• have not carried out verification and analysis activities of the Reports received;
• have engaged in actions or conduct for the purpose of obstructing or attempting to obstruct the Report;
• have violated the obligations of confidentiality, as described above.

The Whistleblowing Decree also envisages the imposition of disciplinary sanctions if the Whistleblower's liability has been ascertained, even with a first-degree judgment, for the crimes of defamation or slander, or if his/her civil liability is ascertained in cases of wilful misconduct or gross negligence.

For further details on the disciplinary sanctions envisaged and the relevant procedure for their imposition, please refer to the Disciplinary System adopted by the Company, which has been appropriately amended pursuant to the Whistleblowing Decree, as well as the provisions of the relevant National Collective Labour Agreement.

 

6. DOCUMENTATION MANAGEMENT
   1. Archiving and storage of Reports

Whistleblowing Reports and related documentation are stored within the IT Platform, for as long as is necessary to process the Report and, in any case, for no longer than five years from the date of communication of the final outcome of the reporting procedure, or until the conclusion of any judicial or disciplinary proceedings that may have been pursued against the Person Concerned or the Whistleblower, in compliance with the confidentiality obligations set forth in Article 12 of the Whistleblowing Decree and the principle set forth in Articles 5(1)(e) of the GDPR (limitation of retention) and 3(1)(e) of Legislative Decree No. 51 of 2018.

1. 2. Publication and distribution of the procedure

This Procedure is published on the IT Platform and its adoption is communicated with appropriate notice to employees.

1. 3. Protection of personal data processed

The processing of personal data of the persons involved and/or mentioned in the Reports is protected under the current European Privacy Law.

Pizeta Pharma S.p.A. is the Data Controller of the personal data pertaining to the implementation of this Procedure.

The policy for the processing of personal data associated with the Reports is made available to potential Whistleblowers on the IT Platform.

Access to the personal data inherent to the Reports is granted exclusively to the Designated Department, who is already authorized under the GDPR, limiting the disclosure of confidential information and personal data to third parties to only those times when it is strictly necessary