Partner in Problems, Leader in Solutions

Procedure for reporting “Whistleblowing” violations

Gen-Art > Procedure for reporting “Whistleblowing” violations

PROCEDURE FOR REPORTING “WHISTLEBLOWING” VIOLATIONS PURSUANT TO LEGISLATIVE DECREE. 24/2023

Approved by the Board of Directors: 15 December 2023

1. Premise
1.1 Purpose

This procedure (hereinafter Procedure) has the purpose of regulating the process of transmission, reception, analysis and management of Reports (so-called. Whistleblowing) on information, adequately detailed, referable to employees and/or third parties relating to violations of laws and regulations, of the Code of Ethics and Conduct, of the 231 Organizational Model adopted by Gen-Art S.r.l., as well as of the system of rules and procedures in force in the scope of the company organisation. The procedure is also aimed at implementing Legislative Decree 10 March 2023 n. 24, published in the Official Gazette. dated 15.03.2023, containing the transposition of Directive (EU) 2019/1937 concerning "the protection of persons who report violations of Union law (so-called Whistleblowing discipline)". In particular. the Legislative Decree 10 March 2023 n. 24 transposes Directive (EU) 2019/1937 into our legal system, concerning the protection of people who report violations of national or European Union regulatory provisions (so-called Whistleblowing Directive), of which they have become aware in a working, public or private. The purpose of the Directive is to regulate the protection of whistleblowers within the Union, through minimum protection standards, aimed at harmonizing national regulations.

Legislative Decree 24/2023, by repealing the previous provisions relating to whistleblowing, intends to strengthen the principles of transparency and responsibility regarding reporting, as well as preventing the commission of crimes, collecting in a single regulatory text, in an organic manner, the the entire regulation of reporting channels and protections recognized for whistleblowers in both the public and private sectors. The aforementioned decree recognizes that reporting plays a key role in preventing regulatory violations and ensures that reporting companies, both public and private, more structured protection in order to encourage reporting and combat illegality. Furthermore, to guarantee internal reporting channels and their correct application, the legislator has also established an external reporting channel, the management of which is delegated to the National Anti-Corruption Authority (hereinafter "ANAC"), a body also responsible for impose administrative fines on organizations in various cases, including in the case of failure to prepare internal reporting channels or failure to adopt procedures for making and managing reports.

Gen-Art S.r.l. (hereinafter also only the "Company") constantly implements strategies aimed at preventing illegality and, therefore, has implemented the principles and provisions contained in the aforementioned Legislative Decree 24/2023.

1.2 Scope of application

This Procedure applies to the Company that has adopted the Organization, Management and Control Model pursuant to Legislative Decree 231/01, with resolution of the Board of Directors dated 28.02.23, together with the Code of Ethics and Conduct.

Reports relating to:

  • Disputes, claims or requests linked to a personal interest of the Reporter, which concern exclusively the discipline of the employment relationship or relations with hierarchically superior figures, unless they are connected or referable to the violation of regulations or internal rules/procedures;
  • Violations relating to national security, as well as procurement relating to aspects of defense or national security, unless such aspects fall under secondary law of the European Union;
  • Violations regulated mandatorily by European Union or national acts, as indicated in the art. 1, co. 2, letter. b), of Legislative Decree no. 24/2023 (on financial services, products and markets and prevention of money laundering and terrorist financing, transport safety and environmental protection);
  • Facts or circumstances falling within the application of national or European Union provisions relating to classified information, forensic or medical secrecy and the secrecy of judicial decisions, or falling within the application of national provisions relating to criminal procedure, autonomy and independence of the judiciary, of the provisions on the functions and responsibilities of the Superior Council of the Judiciary, in matters of national defense and public order and security, as well as in matters of exercise and protection of the right of workers to consult their representatives or trade unions, of protections against illegal conduct or acts carried out as a result of such consultations, of the autonomy of the social partners and their right to stipulate collective agreements, as well as of the repression of anti-union conduct.

2. Definitions

Violations: behaviors, acts or omissions that harm the public interest or the integrity of the public administration or private entity.

Violation Information: information, including well-founded suspicions, regarding violations committed or which, on the basis of concrete elements, could be committed in the organization with which the reporting person or the person making a complaint to the judicial or accounting authority has a legal relationship pursuant to Legislative Decree . lgs. n. 24/2023, article 3, paragraphs 1 or 2, as well as the elements regarding conduct aimed at concealing such violations.

Report or report: the written or oral communication of information about violations.

Internal reporting: The communication, written or oral, of information about violations, submitted through the internal reporting channel.

External reporting: The communication, written or oral, of information about violations, submitted through the external reporting channel.

Public disclosure or publicly disclose: make information on violations public through the press or electronic means or in any case through means of dissemination capable of reaching a large number of people.

Reporting person: the natural person who reports or publicly discloses information on violations acquired within their work context.

Facilitator: natural person who assists a reporting person in the reporting process, operating within the same working context and whose assistance must be kept confidential.

Work context: work or professional activities, present or past, carried out within the relationships referred to in Legislative Decree no. 24/2023 article 3, paragraphs 3 or 4, through which, regardless of the nature of these activities, a person acquires information on violations and in the context of which they could risk suffering retaliation in the event of reporting or public disclosure or reporting to the judicial or accounting authority.

Person involved: the natural or legal person mentioned in the internal or external report or in the public disclosure as the person to whom the violation is attributed or as the person otherwise implicated in the violation reported or disclosed publicly.

Retaliation: any behaviour, act or omission, even if only attempted or threatened, carried out as a result of the report, the complaint to the judicial or accounting authority or the public disclosure and which causes or may cause the reporting person or the person who filed the complaint. reports, directly or indirectly, unjust damage.

Following: the action undertaken by the person entrusted with the management of the reporting channel to evaluate the existence of the facts reported, the outcome of the investigations and any measures adopted.

Reply: communication to the reporting person of information relating to the follow-up that is given or intended to be given to the report;

Whistleblowing function: internal subject (natural person or office) or external, endowed with autonomy, impartiality and independence identified by the administrative body as the recipient of whistleblowing reports and who is entrusted with the management of the internal reporting channels.


3. Recipients

This procedure applies to all people (hereinafter "Recipients") who report, report to the judicial or accounting authority or publicly disclose information on violations of which they have become aware within their work context, and in particular:
  • Employees, subordinate workers, self-employed workers, as well as holders of collaborative relationships with the Company, or who operate on behalf of or in favor of the Company, including with third parties;
  • Freelancers and consultants;
  • Volunteers and interns, paid and unpaid;
  • Shareholders and people with administrative, management, control, supervisory or representation functions, even if these functions are exercised on a purely de facto basis.
    The protections provided for the whistleblower also apply if the report, the complaint to the judicial or accounting authority or the public disclosure of information occurs in the following cases:
  • When the legal relationship has not yet started, if the information on the violations was acquired during the selection process or in other pre-contractual phases;
  • During the trial period;
  • After the dissolution of the legal relationship if the information on the violations was acquired during the relationship itself.
  • The protection measures provided for by this Procedure also apply:
  • To facilitators, i.e. natural persons who assist a reporting person in the reporting process, operating within the same working context and whose assistance must be kept confidential;
  • To people from the same working context as the reporting person, the person who has filed a complaint with the judicial or accounting authority or the person who has made a public disclosure and who are linked to them by a stable emotional or kinship bond within the fourth degree .
  • To work colleagues of the reporting person or of the person who has filed a complaint with the judicial or accounting authority or made a public disclosure, who work in the same working context as the person and who have a usual and current relationship with said person;
  • To entities owned by the reporting person or by the person who has filed a complaint with the judicial or accounting authority or who has made a public disclosure or for which the same people work, as well as to entities that operate in the same working context as the aforementioned people.


4. Reports

Current legislation provides for various reporting channels: i) internal reporting channels; ii) external reporting channel, the management of which is delegated to ANAC; iii) public disclosure. As a matter of priority, the reporting party must use internal channels and, if certain conditions indicated in this procedure are met, can make an external report or public disclosure. Furthermore, the whistleblower can always file a complaint with the judicial authority.


4.1 Purpose and Object of the Report

The reporting is aimed at bringing to the attention of the Company behaviors, acts or omissions that damage the public interest or the integrity of the Company itself.
In particular, the reports may concern violations which consist of:
  • Illegal conduct pursuant to Legislative Decree. n. 231/2001 or violations of the Company's Organization and Management Model;
  • Offenses falling within the scope of European Union or national acts relating to the following sectors: financial services, products and markets and prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental Protection; food and feed safety and animal health and welfare; public health; consumer protection; protection of privacy and protection of personal data and security of networks and information systems;
  • Acts or omissions detrimental to the financial interests of the Union;
  • Acts or omissions relating to the internal market;
  • Acts or behavior that nullify the object or purpose of the provisions set out in Union acts.


4.2 Contents of the report

In order to guarantee more adequate investigative activity, the report must be sufficiently documented and detailed in such a way as to provide all the elements useful for carrying out the necessary checks regarding the validity of the facts being reported.
Specifically, the report must contain the following elements (where known):
  • A complete and detailed description of the fact or behaviour, including omission, which is the subject of the report and the ways in which it became known;
  • Indication of the date and place in which the fact or behaviour, including omission, which is the subject of the report occurred;
  • The personal details, the role held or other elements that may allow the identification of the person/those who carried out the reported fact or behavior;
  • The personal details, the role held or other elements that may allow the identification of other subjects who can report on the fact or behavior reported;
  • The indication of any other information and/or deed and/or document however represented or stored on any medium, which is useful for verifying the validity of the facts in question
    reporting;
  • The ways in which the whistleblower wishes to be contacted (e-mail address or telephone number, if any).
  • Furthermore, it is appropriate to indicate in the report whether:
  • The facts being reported have been learned first hand or have been reported to the reporting party by third parties;
  • The reported facts were also brought to the attention of other company functions;
  • The reported facts were also transmitted to public bodies or judicial police officials.
  • The report, as well as being complete and exhaustive, must be timely so as to allow for more efficient investigation activities, as well as the adoption of the necessary preventive and corrective measures.
  • Please note that the whistleblowing function is subject to confidentiality obligations, the transgression of which entails criminal and civil liability for the function itself; therefore, the reporter can provide, without fear of any type of repercussion, any information deemed useful to the investigation.
    It should be noted that even anonymous reports, i.e. without elements that allow the identification of their author, presented in accordance with this procedure, adequately detailed and accompanied by sufficient elements to allow adequate investigation, are treated as "ordinary" reports. and will be taken into consideration


4.3 Internal signaling channels and their operation

The Company provides Recipients with alternative channels for sending internal reports, suitable for guaranteeing the confidentiality of the identity of the reporter, the facilitator, the person involved or in any case the subjects mentioned in the report, the content of the report and the related documentation . The whistleblowing function responsible for managing the report is assigned to an external party identified in the Supervisory Body; this choice provides a guarantee of confidentiality and independence of judgment of the function. Any reports incorrectly submitted to a person other than the Whistleblowing Function must be transmitted to the latter within 7 days from the date of their receipt, giving simultaneous notice of the transmission to the whistleblower.
The Report can be submitted in the following ways:
  • By registered letter, to the address: Gen-Art Srl, Via Nettunense Km. 17,900 – 00075 Lanuvio (RM). In this case, in order to benefit from the guarantee of confidentiality, it is necessary for the report to be placed in two closed envelopes, including in the first, the reporting person's identification data, together with an identity document; in the second, the subject of the report: both envelopes must be inserted into a third closed envelope bearing the words on the outside “Reserved for the reporting manager”;
  • Orally, via dedicated telephone number (+39 06 93491141) active during working hours at the Whistleblowing Function which will take care of drawing up a specific report, also verified and signed by the reporting person. This meeting will be scheduled by the Whistleblowing Function within 30 days of the reporting person's request.


4.4 Investigation activities on the validity of the internal report

In order to ensure efficient and timely management of the report, the Whistleblowing Function carries out the following activities:
  • Issues to the reporting party an acknowledgment of receipt of the report;
  • Maintains discussions with the reporting person;
  • Gives a correct follow-up to the reports received;
  • Provides feedback to the reporter.
More specifically, once the report has been acquired through one of the aforementioned channels, the Whistleblowing Function proceeds to notify the reporting person of the receipt of the report within 7 days from the date of its acquisition.
The Whistleblowing Function itself carries out an assessment of the existence of the essential requirements of the report to evaluate its admissibility.
The report is considered inadmissible and is archived by the Whistleblowing Function for the following reasons:
a) manifest unfoundedness due to the absence of factual elements attributable to the violations typified by the legislator and indicated in the previous paragraph 4.1;
b) manifest non-existence of the legal requirements for making the report with particular reference to the people who can submit reports, indicated in the previous paragraph 3;
c) ascertained generic content of the report of an offense such as not to allow the understanding of the facts, or report of an offense accompanied by inappropriate or irrelevant documentation such as not to allow the content of the report itself to be understood;
d) production of documentation only in the absence of reporting illicit conduct.
It is understood that the Whistleblowing Function, where what is reported is not adequately detailed, if the information initially provided by the whistleblower is not considered sufficient for the investigation activities and/or the report is not suitable for identifying possible violations, may request to the reporting party, through the methods and contact details indicated by the latter, additional elements. The reporting party must send the requested additions within 30 days; after this deadline, the report will be archived due to the impossibility of proceeding or its unfounded nature.
In any case, the report will be responded to and the reason for the dismissal will be communicated to the person making the report. Once the admissibility of the report as whistleblowing has been assessed, the investigation is started: the verification activity on the validity of what is reported in the report is entrusted to the Whistleblowing Function which must start, without delay, a timely and accurate investigation in compliance with the principles of impartiality, fairness and confidentiality towards the subjects involved.
During the verification, the Whistleblowing Function may carry out any activity deemed necessary or appropriate for this purpose, including hearing the whistleblower, the person involved in the alleged violation and any other subjects who may report circumstances useful for the purposes of the investigations, adopting the necessary precautions, as well as requesting additions to the reporter if necessary. The whistleblowing function may also make use of an investigation team (organizational staff or external experts). Upon completion of the verification and in any case within 3 months from the date on which the acknowledgment of receipt was sent to the reporting party, or in the absence of such notification, within 3 months from the expiry of the 7-day deadline from the submission of the report, the Whistleblowing Function will provide feedback to the report and draw up a summary report of the investigation activity carried out and the results that emerged during the same. If, following the outcome of the verification, the report is found to be well founded, the Whistleblowing Function, in relation to the nature of the violation, will:
a) urge the Company to submit a complaint to the competent judicial authority in the cases provided for by law;
b) communicate the outcome of the investigation to the Manager of the structure to which the author of the ascertained violation belongs, so that he can arrange for the adoption of the relevant management measures, including, if the conditions exist, the exercise of disciplinary action;
c) propose to the company management and the competent structures the adoption of any further measures and/or actions that may be necessary in the specific case, such as the application of the sanctioning system;
d) propose changes to organizational procedures in order to prevent further cases of violation;
e) propose the update of Model 231 if the need arises;
f) request the company management to apply the protections provided for by the law towards
of the staff who sent the report or were involved during the investigation phase.
Otherwise, if the outcome of the verification is that the report is found to be unfounded, the Whistleblowing Function will archive it.
Please note that any violation of the confidentiality obligations committed by the whistleblowing function or by the organization's staff determines the immediate application of the sanctioning system adopted by the Company or further measures pursuant to the law.


4.5 Archiving of documentation relating to internal reports

The responsibility for managing the archive of reports and related documentation is the responsibility of the Whistleblowing Function through a dedicated IT and paper archive within the Function itself. The reports and the related documentation are kept for the time strictly necessary and in any case no longer than 5 years, starting from the date of communication of the final outcome of the reporting procedure. The reports received orally during the meeting with the reporting party are formally recorded, verified and signed by the reporting party and subject to the same retention period.


4.6 External reports

The reporting person can make an external report, through a specific channel activated by the ANAC, if, at the time of its submission, one of the following conditions occurs:
a) the reporting person has already made an internal report pursuant to the previous art. 4.3 and the same was not followed up;
b) the reporting person has reasonable grounds to believe that, if he/she made an internal report, it would not be followed up effectively or that the same report could lead to the risk of retaliation;
c) the reporting person has reasonable grounds to believe that the violation may constitute an imminent or obvious danger to the public interest.
ANAC publishes on its website, in a dedicated, easily identifiable and accessible section, all information relating to:
  • Illustration of protection measures for the whistleblower;
  • Your contact details (telephone number, postal address, ordinary and certified email address);
  • Instructions on the use of the external signaling channel and the internal signaling channels;
  • The illustration of the confidentiality regime applicable to external reports and internal reports provided for by Legislative Decree no. 24/2023;
  • The methods with which ANAC can request the reporter to provide additions, the deadlines for responding to an external report, the types of feedback that ANAC can give to an external report;
  • The list of third sector bodies that provide support measures to reporting persons and that have entered into agreements with the ANAC.
  • The website of the National Anti-Corruption Authority is accessible at the following address: https://www.anticorruzione.it/


4.7 Public Disclosure

The whistleblower may make a public disclosure by placing information on violations in the public domain through the press or electronic means or in any case through means of dissemination capable of reaching a large number of people when:
  • Has previously made an internal and external report or has directly made an external report pursuant to Legislative Decree. n. 24/2023 and the same were not responded to within the terms established by the Decree;
  • Has reasonable grounds to believe that the violation may constitute an imminent or obvious danger to the public interest;
  • Has reasonable grounds to believe that external reporting may involve the risk of retaliation or may not be effectively followed up due to the specific circumstances of the specific case, such as those in which evidence may be hidden or destroyed or in which there is well-founded fear that those who have received the report may be colluding with the author of the violation or involved in the violation itself.
    Outside of these conditions, public disclosure cannot be considered lawful.


5. Protection of the whistleblower's confidentiality

The identity of the reporter and any other information from which such identity can be deduced, directly or indirectly, cannot be revealed without the express consent of the reporter himself to persons other than those competent to receive or follow up on the reports, expressly authorized to process such data pursuant to EU Regulation 2016/679 (art. 29 and 32) and Legislative Decree. 196/2003 (art. 2-quaterdecies).
In the event that the report leads to the establishment of criminal proceedings, the confidentiality of the person making the report will be protected within the limits set by the art. 329 c.p.p. which imposes the obligation of secrecy of the preliminary investigation documents until the moment in which the suspect has the right to have knowledge of them and in any case no later than the closure of the preliminary investigations.
As part of the disciplinary proceedings, the identity of the reporting person cannot be revealed, where the contestation of the disciplinary charge is based on investigations that are distinct and additional to the report, even if consequent thereto. If the dispute is based, in whole or in part, on the report and knowledge of the identity of the reporting person is indispensable for the defense of the accused, the report will be used for the purposes of disciplinary proceedings only in the presence of the express consent of the reporting person to the revelation of one's identity. In this case, a written communication will be previously sent to the reporting party with the reasons that require the disclosure of his or her identity.
In the event that the identity of the whistleblower must be revealed because it is essential to guarantee the defense of the person involved, the whistleblower will be notified by written communication of the reasons for revealing the confidential data.
The confidentiality of the person involved and of the people mentioned in the report is also protected until the conclusion of the proceedings initiated due to the report.
Confidentiality is also guaranteed in the case of reports made orally as well as if they reach personnel other than those authorized and competent to manage the reports, to whom, in any case, they must be sent without delay. Violation of the obligation of confidentiality constitutes a source of disciplinary responsibility based on the provisions of the disciplinary system adopted by the Company, without prejudice to any further form of liability provided by law.


6. No Retaliation

The Company guarantees the reporting party the application of protection measures in the event that:
1. at the time of reporting the reporter had reasonable grounds to believe that the information transmitted was true and had as its object what is indicated in the previous paragraph 4.1;
2. the report was made in accordance with the provisions of this procedure.
The reasons that lead the person to report, denounce or publicly disclose the violation are irrelevant to his protection.
No form of retaliation, direct or indirect, will be tolerated against the whistleblower for reasons connected, directly or indirectly, to the report.
In particular, the Legislative Decree. 24/2023 identifies, by way of example and not exhaustively, some cases which, if carried out as a result of the report, constitute retaliation:
  • Dismissal, suspension or equivalent measures;
  • Demotion in rank or failure to promote;
  • Change of functions, change of place of work, reduction of salary, modification of working hours;
  • The suspension of training or any restriction of access to it;
  • Negative merit notes or negative references;
  • The adoption of disciplinary measures or other sanctions, including pecuniary ones;
  • Coercion, intimidation, harassment or ostracism
  • Discrimination or otherwise unfavorable treatment;
  • Failure to convert a fixed-term employment contract into a permanent employment contract, where the worker had a legitimate expectation of such conversion;
  • Failure to renew or early termination of a fixed-term employment contract;
  • Damage, including to the person's reputation, particularly on social media, or economic or financial harm, including loss of economic opportunities and loss of income;
  • Improper listing on the basis of a formal or informal sectoral or industry agreement, which may result in the person being unable to find employment in the sector or industry in the future;
  • The early termination or cancellation of the contract for the supply of goods or services;
  • The cancellation of a license or permit;
  • The request to undergo psychiatric or medical tests.
Without prejudice to the possibility of taking legal action, in the event that the reporting party becomes civilly or criminally liable in relation to what has been declared, the Company will take the actions deemed most appropriate against anyone who should carry out, or threaten to carry out be, acts of retaliation against the whistleblower himself.
In the event that an employee of the Company believes that they have suffered retaliation due to the report made, they can inform the Whistleblowing Function which will take action to protect the whistleblower in accordance with the law.
Furthermore, the whistleblower who believes that, as a result of the report made, he or she has suffered retaliatory conduct of any kind and resulting in any type of provision, may notify the ANAC which will inform the National Labor Inspectorate for the measures within its jurisdiction. .
In particular, both the retaliatory dismissal of the whistleblower (who has the right to be reinstated in the workplace, pursuant to the applicable legislation) and the change in duties pursuant to art. 2103 of the civil code and any other retaliatory measure or measure adopted against him and connected, directly or indirectly, to the report made.
The protection measures provided for by Legislative Decree. 24/2023, including the prohibition of retaliation, also apply:
  • To the facilitators;
  • To people from the same working context as the reporting person, the person who has filed a complaint with the judicial or accounting authority or the person who has made a public disclosure and who are linked to them by a stable emotional or kinship bond within the fourth degree ;
  • To work colleagues of the reporting person or of the person who has filed a complaint with the judicial or accounting authority or made a public disclosure, who work in the same working context as the person and who have a usual and current relationship with said person;
  • To entities owned by the reporting person or by the person who has filed a complaint with the judicial or accounting authority or who has made a public disclosure or for which the same people work, as well as to entities that operate in the same working context as the aforementioned people.
    It should be noted that, without prejudice to the specific limitations of liability provided by the legislator, the protection provided in the event of retaliation does not apply and a disciplinary sanction is imposed on the whistleblower in the event that his or her responsibility is ascertained, even with a first degree sentence. criminal law for crimes of defamation or slander or in any case for the same crimes committed with the report to the judicial or accounting authority or its civil liability, in cases of willful misconduct or gross negligence.


7. Processing of personal data

Any processing of personal data, including communication between the competent authorities, provided for by this Procedure, must be carried out in accordance with Regulation (EU) 2016/679, Legislative Decree 30 June 2003, n. 196 and Legislative Decree 18 May 2018, n. 51.
The personal data collected in relation to the processing of the report are kept until the conclusion of the activity and subsequently deleted. Personal data that is manifestly not useful for examining the report is not collected or, if collected accidentally, is deleted immediately. To this end, the reporting person is required to communicate only those data that he considers relevant for the purposes of the report, also taking into account the possibility for the Transparency Manager to intervene to request further information.
The Company has defined its own model for receiving and managing internal reports, identifying technical and organizational measures suitable to guarantee a level of security adequate for the specific risks deriving from the processing carried out, on the basis of an impact assessment on data protection, and regulating the relationship with any external suppliers who process personal data on their behalf pursuant to article 28 of Regulation (EU) 2016/679 or article 18 of Legislative Decree no. 51 of 2018.


8. Dissemination and Update

This procedure is disseminated to all company staff, and is made freely available on the company website in the section https://gen-art.com/certificazioni/. The procedure is subject to periodic review and updating by the Company.