This procedure governs the methods and guarantees for the confidential submission of reports of violations and offenses pursuant to Legislative Decree No. 24 of March 10, 2023, implementing “Directive (EU) 2019/1937 of the European Parliament and of the Council of October 29, 2019, regarding the protection of persons who report violations of Union law and containing provisions regarding the protection of persons who report violations of national regulatory provisions.”
In particular, this document aims to define: a) the roles and responsibilities of the functions involved in managing reports; b) the objective scope and content of the report; c) the subjective scope of application; d) the procedure and channels to be used for reporting alleged violations; e) the methods for managing the report and the procedure that is established when a report is made; f) the methods of informing the whistleblower and the reported person about the development of the procedure; g) the specific protection measures granted to persons making reports.
For the purposes of this document, the following terms are used with the meanings stated in Legislative Decree 24/2023:
Violations: Behaviors, acts, or omissions that harm the public interest or the integrity of the public administration or private entity and consist of:
Information on violations: Information, including well-founded suspicions, regarding violations committed or which, based on concrete elements, could be committed within the organization with which the reporting person or the person who files a complaint with the judicial or accounting authority maintains a legal relationship pursuant to Article 3, paragraph 1 or 2, as well as elements regarding conduct aimed at concealing such violations.
Report or reporting: The written or oral communication of information on violations.
Internal report: The written or oral communication of information on violations, submitted through the internal reporting channel referred to in Article 4.
External report: The written or oral communication of information on violations, submitted through the external reporting channel referred to in Article 7.
Public disclosure or publicly disclose: Making information on violations publicly available through the press or electronic media or otherwise through means of dissemination capable of reaching a large number of people.
Reporting person: The natural person who reports or publicly discloses information on violations acquired in their work context.
Facilitator: A natural person who assists a reporting person in the reporting process, operating within the same work context and whose assistance must be kept confidential.
Work context: The work or professional activities, present or past, carried out within the relationships referred to in Article 3, paragraphs 3 or 4, through which, regardless of the nature of such activities, a person acquires information on violations and within which they could risk suffering retaliation in case of reporting or public disclosure or complaint to the judicial or accounting authority.
Person concerned: The natural or legal person mentioned in the internal or external report or in the public disclosure as a person to whom the violation is attributed or as a person otherwise implicated in the reported or publicly disclosed violation.
Retaliation: Any conduct, act, or omission, even if only attempted or threatened, carried out because of the report, complaint to the judicial or accounting authority, or public disclosure and that causes or may cause to the reporting person or the person who has filed the complaint, directly or indirectly, unjust harm.
Follow-up: The action taken by the subject entrusted with the management of the reporting channel to assess the existence of the reported facts, the outcome of the investigations, and any measures adopted.
Feedback: Communication to the reporting person of information regarding the follow-up given or intended to be given to the report.
Public sector entities: Public administrations referred to in Article 1, paragraph 2, of Legislative Decree No. 165 of March 30, 2001, independent administrative authorities of guarantee, supervision, or regulation, public economic entities, bodies governed by public law referred to in Article 3, paragraph 1, letter d), of Legislative Decree No. 50 of April 18, 2016, public service concessionaires, companies under public control and in-house companies, as defined, respectively, by Article 2, paragraph 1, letters m) and o), of Legislative Decree No. 175 of August 19, 2016, even if listed.
Private sector entities: Entities, other than those falling within the definition of public sector entities, which:
The Recipients of this procedure are identified in accordance with the provisions of Article 3, paragraphs 3 and 5 of Legislative Decree 24/2023 and belong to the following categories:
The protections provided by this procedure also apply when the report is made in the following cases:
These protections are also extended to:
The report may concern and relate to behaviors, acts, or omissions that harm the public interest or the integrity of the Company and consist of:
The report management process illustrated in this document does not refer to:
The application of the provisions regarding the exercise of employees’ right to consult their representatives or unions, as well as protection against unlawful conduct or acts carried out due to such consultations, remains unaffected.
The whistleblower is required to provide all elements useful to allow the Reporting Manager to conduct diligent and appropriate verifications to confirm the validity of the reported facts and for the preliminary assessment of admissibility. In particular, they must specify:
Any anonymous reports may be considered for further verification only when the information contained therein allows for an adequate investigation in compliance with the provisions of this procedure and Articles 4, 5, and 12 of Legislative Decree 24/2023.
According to law, the Company, after consulting with union representatives, has activated its own internal reporting channel as per Legislative Decree 24/2023, which guarantees the confidentiality of the identity of the reporting person, the person involved, and the person mentioned in the report, as well as the content of the report and related documentation.
The management of the reporting channel is entrusted to the Reporting Manager appointed by resolution of the Board of Directors.
Reports can be made through the following methods:
An internal report presented to a subject other than the Reporting Manager is transmitted by the recipient, respecting the guarantees of confidentiality, to the latter within seven days of its receipt, simultaneously notifying the reporting person of the transmission.
If the Internal Report containing serious, precise, and consistent elements concerns the Reporting Manager themselves, it must be transmitted to the Board of Directors, through hand delivery of any supporting documentation or by sending a registered letter with return receipt or express courier addressed to the Company’s headquarters, with the following wording: “Personal Confidential to the attention of the Board of Directors.”
The Board of Directors, after collectively evaluating whether the Internal Report is accompanied by the necessary information to preliminarily verify its validity and initiate subsequent investigation activities, follows up on it by conducting the investigation, also using company expertise and, if necessary, specialized consultants, always respecting the confidentiality required by law in this matter as well as the provisions contained in this document.
The investigation follows the procedure described in this procedure.
The decision of the Board of Directors is formalized through a written resolution.
The Reporting Person may also submit an External Report to the National Anti-Corruption Authority (ANAC), albeit only residually and, specifically, only under the following conditions: i. the internal reporting channel adopted by the Company is not active or is active but not compliant with the provisions of Legislative Decree 24/2023; ii. the Internal Report submitted according to the terms provided by this procedure has not been followed up; iii. the Reporting Person has well-founded and proven reasons to believe that, if they made an Internal Report, it would not be effectively followed up, or it could determine the risk of Retaliation; iv. the Reporting Person has well-founded reason to believe that the violation may constitute an imminent or manifest danger to the public interest; v. if the case of conflict has not been regulated in the internal procedure, if the reporting manager is in a conflict of interest situation with respect to a specific report (for example, as a reported person or Reporting Person).
The external reporting channel established by ANAC guarantees, like the internal channel mentioned above defined by the Company, the confidentiality of the identity of the Reporting Person, the content of the report, the Person involved, and persons possibly involved in the Report.
External Reports are made in written form through the IT platform made available by ANAC on its website in the section dedicated to “Whistleblowing.” The Report may also be made orally through telephone lines or voice messaging systems, or at the request of the Reporting Person, through a direct meeting scheduled within a reasonable timeframe; the methods of access to these channels and the related instructions are specified by ANAC on its website.
The Reporting Person is also guaranteed the possibility of making a Public Disclosure in the presence of one of the following conditions: i. the Reporting Person has previously made an Internal and/or External Report and has not received feedback within the timeframes provided by this procedure regarding the measures envisaged or adopted to follow up on the Report; ii. the Reporting Person has well-founded reason to believe that the Violation may constitute an imminent or manifest danger to the public interest; iii. the Reporting Person has well-founded reason to believe that the External Report may entail the risk of Retaliation or may not have effective follow-up due to the specific circumstances of the concrete case, such as those in which evidence may be concealed or destroyed or where there is a well-founded fear that the person who received the Report may be colluding with the author of the Violation or involved in the violation itself.
The Company provides clear information about the methods, prerequisites, procedure, and guarantees for making internal reports, as well as about the channel, procedures, and prerequisites for making external reports, through an information notice published on the company website and delivered on request to external stakeholders involved in the scope of application of this procedure.
The following are the phases and related operational activities assigned to the Reporting Manager as a result of receiving a report.
The whistleblowing report management procedure begins following the receipt of the report.
A person who intends to make an Internal Report can do so according to the methods indicated above.
Only when using the IT platform, the Reporting Person accesses a guided path, structured through a series of questions and requests for supporting elements, aimed at describing in a clear, precise, and detailed manner the situation that is the subject of the Report.
Reports must be based on precise and consistent factual elements. The Reporting Person is invited to attach all documentation proving the reported facts, refraining from undertaking autonomous initiatives of analysis and investigation.
The Reporting Manager issues to the reporting person a specific acknowledgment of receipt of the report within seven days of the date of receipt (via IT platform, by registered mail with return receipt, or in person).
The Reporting Person is invited to review the Whistleblowing information notice (present on the IT platform, delivered by registered mail with return receipt, or in person) complete with the information note in which it is communicated that:
An internal report presented to a subject other than the Reporting Manager is transmitted by the recipient, respecting the guarantees of confidentiality, to the latter within seven days of its receipt, simultaneously notifying the reporting person of the transmission.
When, at the request of the reporting person, the report is made orally during a meeting with the assigned personnel, it, with the consent of the reporting person, is documented by the assigned personnel through recording on a device suitable for storage and playback or by minutes. In case of minutes, the reporting person can verify, rectify, and confirm the minutes of the meeting by signing.
The Reporting Manager conducts a preliminary assessment of the contents of the received report in order to: a) Ascertain the gravity and relevance of the unlawful conduct attributed to the reported person; b) Verify the presence of concurrent personal interests of the whistleblower or other subjects in relation to the latter; c) Where necessary, conduct verification activities and, in any case, ask the whistleblower and/or any other subjects involved in the report for necessary and appropriate clarifications and/or integrations, including documentary ones, adopting appropriate precautions to guarantee the confidentiality of the whistleblower.
The Reporting Manager declares the report inadmissible, proceeding with its archiving and communicating this to the reporting person, in the following cases:
The Reporting Manager provides Feedback to the Reporting Person in reasonable times (and, in any case, within a maximum of 3 months from the date of the acknowledgment of receipt of the Report) about the failure to pass the preliminary phase. This, without prejudice to any further subsequent action by the Company regarding the reasons for not passing.
The Reporting Manager has the task of diligently following up on the received reports and maintains communications with the reporting person, with the possibility of requesting from the latter any useful or necessary integration.
Having positively passed the preliminary admissibility assessment, the Reporting Manager proceeds with the management and verification of the validity of the circumstances represented in the report in compliance with the principles of impartiality and confidentiality, carrying out any activity deemed appropriate, including the hearing of the reporting person.
The Reporting Manager also proceeds to hear the person involved, to whom the violation is attributed, particularly if requested, through the acquisition of written observations and documents.
Correspondence with the reporting person is kept only by means of communications made on an IT platform equipped with all security measures aimed at guaranteeing maximum confidentiality.
Incoming communications will be accessible through personal and confidential credentials in the possession of only the Reporting Manager.
The Reporting Manager notifies the reporting person in writing (IT platform or registered mail with return receipt) in case it is necessary to proceed with the revelation of the identity of the same for the usability of the report in a disciplinary proceeding against the accused subject.
The Reporting Manager then proceeds in the case outlined to request and possibly acquire the consent of the reporting person to the revelation of their identity, under penalty of the unusability of the report in the related disciplinary proceeding.
At any time, the whistleblower may request information from the Reporting Manager on the progress of the procedure by sending a specific request, using the same methods used for transmitting the report.
The Reporting Manager, where there are no serious impediments (e.g., ongoing criminal investigations and corresponding obligations of secrecy), responds to the request for information referred to in the previous paragraph within the term of 5 (five) working days from the date of receipt of the request itself.
The Reporting Manager provides feedback on the report within three months from the date of the acknowledgment of receipt or, in the absence of such notice, within three months from the expiry of the seven-day period from the submission of the report.
Based on the investigative findings, the Reporting Manager prepares an information note for the Board of Directors with an invitation to formulate an intervention plan and implementation of the necessary corrective actions for the removal of the identified criticalities.
The Reporting Manager monitors the state of implementation and the effectiveness of the actions undertaken by the Company.
“Sources of liability, in disciplinary and other competent venues, are possible forms of abuse of this procedure, such as reports that prove to be unfounded, made with intent or gross negligence, or those manifestly opportunistic and/or made for the sole purpose of damaging the reported person or other subjects, as well as any other hypothesis of improper use or intentional instrumentalization of this Procedure.
Similarly sanctioned, pursuant to Article 17 of Legislative Decree 24/2023, are also all the ascertained violations of the measures put in place to protect the whistleblower, including all discriminatory acts adopted by the Entity against the whistleblower (ref. Article 17, paragraph 4 of Legislative Decree 24/2023) or pressures or discrimination aimed at influencing the investigation.
Disciplinary sanctions will be proportionate to the extent and severity of the ascertained unlawful behaviors and may even lead to the termination of the employment or consultation relationship, in compliance with the applicable legal provisions as well as the regulations of the CCNL (National Collective Labor Agreement) of the reference sector.
For sanctions, refer to the Disciplinary System of Model 231.
Retaliatory or discriminatory dismissal of the reporting subject is null and void, as are the change of duties and any other retaliatory or discriminatory measure adopted as a consequence of the report.
Internal reports and related documentation are kept in the paper and digital archives of the Reporting Manager for the time necessary for the processing of the report and in any case no more than five years from the date of communication of the final outcome of the reporting procedure, in compliance with confidentiality obligations and principles of lawfulness of processing.
The Reporting Manager also maintains a register with chronological annotation of the reports received.
The protection measures provided by Chapter III of Legislative Decree 24/2023 apply to the whistleblower, in particular:
a) Prohibition of retaliation – the whistleblower may not be the target of retaliation due to the report made, such as: a. Dismissal, suspension, or equivalent measures; b. Demotion or lack of promotion; c. Change of functions, change of workplace, reduction of salary, change of working hours; d. Suspension of training or any restriction of access to it; e. Negative merit notes or negative references; f. Adoption of disciplinary measures or other sanctions, including pecuniary ones; g. Coercion, intimidation, harassment, or ostracism; h. Discrimination or otherwise unfavorable treatment; i. Failure to convert a fixed-term employment contract into a permanent employment contract, where the worker had a legitimate expectation of such conversion; j. Non-renewal or early termination of a fixed-term contract; k. Damage, including to the person’s reputation, especially on social media, or economic or financial prejudices, including loss of economic opportunities and loss of income; l. Inclusion in improper lists based on a formal or informal sectoral or industrial agreement, which may result in the person being unable to find employment in the sector or industry in the future; m. Early termination or cancellation of a contract for the supply of goods or services; n. Cancellation of a license or permit; o. Request for psychiatric or medical examinations.
Acts taken in violation of the prohibition of retaliation are null and void. People who have been dismissed because of the report have the right to be reinstated in the workplace, pursuant to Article 18 of Law 300/1970 or Article 2 of Legislative Decree 23/2015, according to the specific discipline applicable to the worker.
The whistleblower who is the recipient of discriminatory acts also has the right to appeal to the judicial authority so that it may adopt all measures, including provisional ones, necessary to ensure protection of the subjective legal situation asserted, including compensation for damages, reinstatement in the workplace, the order to cease the conduct implemented in violation of the prohibition of discrimination, and the declaration of nullity of the acts thus adopted.
b) Limitation of liability – an entity or person who reveals or disseminates information on violations covered by the obligation of secrecy or relating to the protection of copyright or the protection of personal data, or reveals or disseminates information on violations that offend the reputation of the person involved or reported, is not punishable when, at the time of the revelation or dissemination, there were well-founded reasons to believe that the revelation or dissemination of the same information was necessary to reveal the violation and the report was made.
c) Waivers and settlements – waivers and settlements, total or partial, that have as their object the rights and protections provided by Legislative Decree 24/2023 are not valid, unless they are made in the forms and manner referred to in Article 2113, paragraph 4 of the Civil Code.
When the criminal liability of the reporting person is established, even with a first-degree judgment, for the crimes of defamation or calumny or in any case for the same crimes committed with the complaint to the judicial or accounting authority, or their civil liability, for the same title, in cases of intent or gross negligence, the protections referred to in this chapter are not guaranteed and a disciplinary sanction is imposed on the reporting or complaining person.
The provision also applies in cases of anonymous reporting or complaint to the judicial or accounting authority or public disclosure, if the reporting person was subsequently identified and has suffered retaliation, as well as in cases of reporting submitted to the institutions, bodies, and organizations of the European Union.
Any processing of personal data, including communication to competent Authorities, must be carried out in accordance with current regulations.
In application of the principle of minimization, personal data that manifestly are not useful for the processing of a specific report are not collected or, if accidentally collected, are immediately deleted.
The rights referred to in Articles 15 to 22 of Regulation (EU) 2016/679 may be exercised within the limits of the provisions of Article 2-undecies of Legislative Decree 196/2003 and in particular:
“The rights referred to in Articles 15 to 22 of the Regulation cannot be exercised with a request to the data controller or with a complaint pursuant to Article 77 of the Regulation if the exercise of such rights could result in effective and concrete prejudice to the confidentiality of the identity of the person who reports violations of which they have become aware by reason of their employment relationship or functions performed, pursuant to Legislative Decree 24/2023.”
The company guarantees adequate information and training on whistleblowing to all personnel, including through individual delivery to all stakeholders of the information notice attached to this procedure.
This information notice, in the case of new hires, is delivered by the Human Resources Manager to the candidate at the time of hiring.
The company undertakes, finally, any further awareness initiative through the most suitable instruments to disseminate the knowledge of the channels, procedures, and guarantees for submitting reports in compliance with regulatory provisions.
The Reporting Manager periodically collects and organizes in anonymous form the data relating to reports and the status of report management procedures (e.g., number of reports received, types of reported offenses, roles and functions of the accused, time frames for defining the disciplinary procedure, etc.) received during the year in order to:
The Reporting Manager annually accounts for the correct functioning of the internal Reporting systems to the Board of Directors, reporting in their report the aggregate information on the results of the activity carried out and on the follow-up given to the Internal Reports received.
In drafting this report, the Reporting Manager is required to comply with the provisions of the discipline on the protection of the identity of the Reporting Person and the applicable regulations on personal data protection.
This procedure enters into force on 01/01/2025 and is transmitted to the Recipients in the following ways:
For anything not provided for in this procedure, reference is made to Legislative Decree 24/2023.
AET – Apparati Elettromeccanici e Telecomunicazioni srl operates in the railway infrastructure sector and specializes in railway track systems, technological systems, and civil works.
© Copyright AET srl | All rights reserved | COMPANY DATA | PRIVACY POLICY | COOKIE POLICY
