Information on the processing of personal data pursuant to Art. 13 of European Regulation no. 679/2016 (“GDPR”) in relation to the management of anti-corruption reports

Dear user,

we hereby wish to provide appropriate information pursuant to Art. 13 of EU Reg. no. 679/2016 (“GDPR”) regarding the fundamental elements of the processing carried out on data provided following an anti-corruption report, for the purposes of managing said report.

The personal data collected will be processed according to principles of fairness, lawfulness, transparency, data minimization, and the protection of confidentiality and the rights of the data subjects.

Reports may also be submitted anonymously. Should the reporter choose to provide their name and surname, such data will be processed exclusively for purposes related to the management of the report and will not be disclosed.

Data collected

The data collected may include common data of a non-anonymous reporter, such as name and surname, as well as data and information relating to the facts being reported, the persons involved or informed of the facts, the locations, the periods, and any previous complaints or reports.

The report may contain, even incidentally, special categories of personal data or data relating to criminal convictions and offenses, if included by the reporter in the description of the facts or in the attachments.

Purpose and legal basis of processing

The data collected by Gruppo Millepiani S.p.A. will be processed for the receipt, preliminary investigation, verification, and management of anti-corruption reports, for the fulfillment of legal and/or organizational obligations related to the anti-corruption management system, as well as for the establishment, exercise, or defense of a right in court, where necessary.

The legal basis for processing is identified, depending on the case, as the fulfillment of legal obligations, the legitimate interest of the Controller in the prevention and management of illicit or non-compliant conduct, and, where applicable, the consent of the data subject for specific processing methods.

Duration of processing and data retention

Data will be kept for the time necessary to manage the report and any subsequent activities, in compliance with the principles of proportionality and storage limitation, unless further retention is required by law or to protect the Company's rights.

Processing methods

Processing is carried out using electronic and/or paper tools, adopting suitable technical and organizational measures to protect the confidentiality, integrity, and availability of the data.

The content of the report and the identity of the reporter, if provided, are managed with criteria of confidentiality and access limited only to authorized subjects based on their respective functions.

Nature of data provision

Providing the reporter's identifying data is optional. Providing information regarding the reported facts is necessary to allow for the evaluation and management of the report; incomplete or non-detailed information could make the preliminary investigation impossible or difficult.

Categories of subjects who may have access to the data

Data may be processed by subjects authorized by the Controller and, where necessary, communicated to consultants, professionals, subjects in charge of IT system maintenance, public or judicial authorities, within the limits strictly necessary for the management of the report and applicable obligations.

Personal data will not be disseminated.

Rights of the data subject

The data subject may exercise, within the limits provided by applicable legislation, the rights referred to in Articles 15 et seq. of the GDPR, including access, rectification, erasure, restriction, objection, and portability, as well as lodge a complaint with the Data Protection Authority.

Data Controller

The Data Controller is Gruppo Millepiani S.p.A., with registered office in Misinto (MB), Via Della Longura n. 21, VAT no. 02731550121.

For further information or to exercise privacy rights, you may write to: privacy@millepiani.com.