Report management system - Whistleblowing

In compliance with the provisions of Directive (EU) 2019/1937, Legislative Decree 24 of 10 March 2023 and the rules deriving from the transposition of the same, by the Sarbanes - Oxley Act of 2002, by the Organization Model, management and control pursuant to Legislative Decree no. 231 of 2001 and the internal Anti-Corruption Regulatory Instruments, Sauro has adopted a Whistleblowing reporting management system through the Whistleblowing Platform , which allows Sauro S.r.l to manage information contributions relating to subsidiaries in Italy and abroad.

The platform is suitable for guaranteeing, with IT methods, the confidentiality of the identity of the reporter who can also access anonymously and is available at the following link. Furthermore, reports may also be sent via other channels (forms: in written or oral form, through dedicated telephone lines or voice messaging systems).

Whatever channel is used, we guarantee the receipt, analysis and processing of reports submitted by: stakeholders, Sauro employees (Sauro staff and all those, both natural and legal persons, who operate in Italy and abroad to achieve Sauro's objectives, each within their own functions and responsibilities) and other third parties, even in anonymous form.

The reports must have as their object behaviors concerning violations of national and European Union regulatory provisions which harm the public interest or the integrity of the public administration or private entity, carried out by Sauro employees, in violation of the Code of Ethics, laws, regulations, provisions of the Authorities, internal regulations and disciplines referred to in Decree 231 and EC Models.

Maximum confidentiality is guaranteed on the subjects and facts reported, as well as on the identity of the whistleblowers, so that whoever makes the report is not subject to any form of retaliation.

Without prejudice to the preferential use of the reporting channels made available by Sauro Srl, in the cases strictly indicated pursuant to art. 6 of Legislative Decree 24 of 10 March 2023, it is also possible to report to the competent authority in the matter (ANAC).

The information and personal data that are communicated in the context of reports are processed to manage and follow up on the reports themselves, as well as to investigate any reported conduct and take the necessary measures in accordance with applicable laws, including legislation on the protection of personal data. For more information on the methods and purposes of the processing of personal data included in the reports and collected during the procedure, we invite you to consult the information for the processing of data of those reporting, reported or other third parties involved. To find out more click here.

Finally, for reports not covered by this field of application, in compliance with the applicable legislation, regardless of the object and the entity involved, everyone is always guaranteed the possibility of sending reports directly to Sauro Srl through the Contact Form.

For more information you can consult the section FAQ below or download the procedure

FAQs

1. Who is entitled to make reports?

Reports may be made by the following persons:

  • a) Employed workers, including workers who perform:

    1. • Part-time, intermittent, fixed-term, supply, apprenticeship, ancillary work (whose employment relationship is governed by Legislative Decree No. 81/2015);

    2. • Occasional services (pursuant to Article 54-bis of Decree-Law No. 50/2017, conv. by Law No. 96/2017);

  • b) Self-employed persons:

    1. • Under a work contract (Article 2222 of the Civil Code);

    2. • With a collaboration relationship (Article 409 of the Civil Code)

    3. • With a collaboration relationship that takes the form of exclusively personal, continuous work, the manner of performance of which is organised by the principal;

  • d) Self-employed professionals and consultants working for Sauro S.r.l.;

  • e) Volunteers and paid and unpaid trainees working for Sauro S.r.l.;

  • f) Shareholders and persons with administrative, management, control, supervisory or representative functions, even if such functions are exercised on a de facto basis at Sauro S.r.l..

A report may also be made in the following cases:

  1. • When the employment relationship has not yet started, if information on violations was acquired during the selection process or other pre-contractual stages;

  2. • During the probationary period;

  3. • After termination of the legal relationship if information on breaches was acquired during the course of the relationship.

2. What reports are allowed?

They must always be reported:

  • • Administrative, accounting, civil or criminal offences;

  • • Unlawful conduct relevant under Legislative Decree 231/2001, or violations of the organisation and management models provided for therein;

  • • Offences falling within the scope of European Union or national acts relating to the following areas: public procurement; services, products and financial markets and prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; privacy and personal data protection and security of networks and information systems;

  • • Acts or omissions affecting the financial interests of the union;

  • • Acts or omissions affecting the internal market;

  • • Acts or conduct that frustrate the object or purpose of the provisions of Union acts.

3. Which reports are not covered by Whistleblowing?

Excluded from this type of report are:

  • • Challenges, claims or demands linked to a personal interest of the whistleblower or the person making a report to the judicial or accounting authorities that relate exclusively to their individual employment relationships or to their employment relationships with hierarchically superior figures;

  • • Reports concerning national security;

  • • Reports already mandatorily regulated by European Union or national acts concerning financial services, products and markets and the prevention of money laundering, etc.

4. Which reports are not taken into account?

Where reports made anonymously do not present precise, concordant and adequately substantiated information, Sauro S.r.l. reserves the right to take them into consideration.

Inadmissible reports will not be taken into consideration.

5. When do protective measures apply?

The protection measures apply to the persons referred to in Article 3 of Legislative Decree No. 24/2023 when the following conditions are met:

  • • at the time of the reporting or public disclosure, the reporting or whistleblowing person had reasonable grounds to believe that the information on the violations reported, publicly disclosed or denounced was true and fell within the objective scope of Art. 1 of Legislative Decree no. 24/2023;

  • • the report or public disclosure was made on the basis of the provisions of Chapter II of Legislative Decree 24/2023;

6. When do protective measures not apply?

Protection measures do not apply if the reasons that led the person to report or publicly disclose are irrelevant to his or her protection.

7. When does one lose protection?

Protection is lost and a disciplinary sanction is imposed if it is established, even with a first degree judgement, that the reporting person is criminally liable for offences of defamation or slander or, in any case, for the same offences committed with the report to the judicial or accounting authorities, or that he/she is civilly liable, for the same reason, in cases of wilful misconduct or gross negligence.

Finally, with regard to limitations of liability, Sauro S.r.l. complies with Article 20 of Decree 24/2023.

8. When are rights limited?

The data subject's rights may be restricted pursuant to and to the effects of Article 2-undecies of Legislative Decree No. 196 of 30 June 2003 ('Privacy Code', as amended by Legislative Decree No. 101/2018), for the time and to the extent that this constitutes a necessary and proportionate measure, if their exercise may result in concrete and effective prejudice to the confidentiality of the identity of the reporting subjects.

9. How to report?

At the reporting party's discretion, you may choose to submit a report:

  • • in written form by filling in the form on the Sauro S.r.l. notice board or at the Manager's office.

  • • through this platform

  • • orally through a direct meeting with the Manager.

For the latter method, a report will be drawn up to be countersigned.

10. What must the report contain?

The Report must concern unlawful conduct of which the reporting person has become aware by reason of the functions performed.

Any element useful for carrying out checks on the truthfulness and validity of the reported offence must be reported, and in particular must contain at least the following elements:

  • • a complete and exhaustive description of the fact reported, including the circumstances of the place, time and manner in which such irregularities took place;

  • • specification of the person(s) who allegedly perpetrated the reported facts;

  • • possible elements and generalities enabling the person(s) who allegedly committed the aforesaid reported facts to be identified;

  • • any other type of information, document, written or oral evidence or testimony that may be useful to provide confirmation of the truthfulness of the facts reported

  • • indication of willingness to benefit from Whistleblowing protections.

The personal details of the person who intends to make the report (Whistleblower) may not be disclosed and the report may be made anonymously.

11. When do I need to make an external report?

The conditions for making an external report to ANAC are met, where it cannot be ensured that the report is effectively followed up, in particular:

  • • the reporting person has already made an internal report and the report has not been followed up by the designated person or office.

  • • the manager has a conflict of interest with respect to the specific report or the report could give rise to a risk of retaliation.

  • • The breach is deemed to constitute an imminent or obvious danger to the public interest.

The channel for external reporting is as follows: https://www.anticorruzione.it/-/segnalazioni-contratti-pubblici-e-anticorruzione

12. What are the deadlines for cancelling reports?

Internal whistleblowing reports, and the related documentation, are retained for the time necessary to process the report and in any case for no longer than 5 years from the date of the communication of the final outcome of the reporting procedure.

13. How are personal data processed?

The processing of personal data in the context of reports is carried out by Sauro S.r.l., as Data Controller, in compliance with the legislation on the protection of personal data and any other applicable laws and/or regulations, internal procedures to which reference should be made.

14. What happens after the report?

The receiver follows up on what has been received, assessing the existence of the Whistleblower's legitimacy and that the report falls within the scope of the rule. This is followed by an assessment of the circumstances of time and place in which the event occurred.

At the end of the preliminary verification:

  • • If the prerequisites are not met, the report is dismissed, stating the reasons;

  • • If the prerequisites are met, the preliminary investigation is opened.

15. Will I be informed about the proceedings concerning my report?

Within three months of the date of the acknowledgement of receipt or, in the absence of such an acknowledgement, within three months of the expiry of the seven-day time limit from the submission of the report, the receiver shall provide feedback on the report, stating

  • • Whether the file has been closed (giving the reasons for the decision);

  • • Whether, if the report is justified, it has been sent to the competent internal bodies;

  • • Whether the activity has been carried out or still to be carried out (in the case of reports involving a more time-consuming investigation activity) and any measures taken (measures taken or referral to the competent authority).