whistleblowing PROCEDURE

1. Introduction

This Procedure applies to VERNICI CALDART S.r.l. and aims to regulate the process of receiving, analyzing, and managing reports (known as Whistleblowing) containing adequately substantiated information that the whistleblower has become aware of in the course of their work, regarding violations by Personnel and/or Third Parties of national or European Union regulations that harm the public interest or the integrity of VERNICI CALDART S.r.l., or violations of the current system of rules and procedures. This Procedure is implemented in accordance with Legislative Decree of March 10, 2023, no. 24 (hereinafter also referred to as the "Decree" or "Legislative Decree 24/2023"), which transposes EU Directive 2019/1937 concerning the protection of persons who report violations of European Union law.

The aforementioned regulation provides, in summary:

• The establishment of internal reporting channels within the company, ensuring confidentiality, even using encryption tools.

• The identification of an autonomous structure, either internal or external to the company, responsible for managing the internal reporting channel.

• The obligation to maintain the confidentiality of the whistleblower's identity, the individuals involved and/or mentioned in the report, the content of the report, and related documentation.

• Protective measures for the whistleblower as well as facilitators, individuals within the same work context as the whistleblower, those bound by a stable emotional or familial relationship within the fourth degree, colleagues, and legal entities connected to the whistleblower.

• The option to file a complaint with the judicial or auditing authority, the possibility (if one of the conditions specified in Article 6, paragraph 1, of Legislative Decree 24/2023 is met) to make external reports through the channel managed by the National Anti-Corruption Authority (hereinafter ANAC), as well as the ability to make public disclosures (if one of the conditions specified in Article 15, paragraph 1, of Legislative Decree 24/2023 is met), through the press or electronic media or dissemination means capable of reaching a large number of people.

• Disciplinary measures and pecuniary administrative sanctions imposed by ANAC against those who violate the rules regarding the management of reports and against the whistleblower if their civil liability is established, for defamation or slander, with intent or gross negligence.

2. Authorized Reporting Parties

Individuals operating within the working context of VERNICI CALDART S.r.l. are authorized to make reports, including but not limited to:

• Company executives and members of corporate bodies, even if they hold such positions de facto

• Employees

• Customers, partners, suppliers (including subcontractors)

• Self-employed workers or individuals with collaboration agreements

• Freelancers, consultants

• Volunteers and interns (paid or unpaid)

• Anyone with a legitimate interest in the company's activities

who possess information regarding violations attributable to the Personnel of VERNICI CALDART S.r.l. and/or Third Parties.

The provisions of this procedure also apply to anonymous reports, provided they are adequately substantiated.

3. Exclusions from the Procedure

The following reports are excluded from this Procedure:

• Security incidents involving human resources, material resources, and intangible assets (such as software malfunctions, company computer network failures, accidental loss or destruction of documents, ICT security incidents, theft).

• Commercial complaints, for which appropriate contact channels are available.

• Requests to exercise personal data protection rights against VERNICI CALDART S.r.l. under EU Regulation No. 2016/679 (GDPR) and Legislative Decree of June 30, 2003, No. 196 (Personal Data Protection Code), as well as Legislative Decree of August 10, 2018, No. 101, and subsequent amendments and additions.

• Disputes, claims, or requests related to the personal interests of the whistleblower, which pertain exclusively to the discipline of the employment relationship or relationships with superiors, unless they are linked to or attributable to the violation of internal rules/procedures or regulations.

• Violations related to national security, as well as contracts related to defense or national security matters, unless such aspects fall within the relevant EU derived law.

• Violations mandated by EU or national acts, as indicated in Article 1, paragraph 2, letter b) of Legislative Decree 24/2023 (concerning services, financial products and markets, anti-money laundering, prevention of terrorism financing, transport safety, and environmental protection).

• Matters or circumstances falling within the scope of national or EU provisions regarding classified information, attorney-client privilege or medical patient confidentiality, and confidentiality of cout deliberations, or falling within the scope of national provisions on criminal procedure, the autonomy and independence of the judiciary, the functions and powers of the Superior Council of the Judiciary (CSM), national defense, public order and safety, as well as the exercise and protection of the right of workers to consult their representatives or unions.

Reports falling into the above-mentioned categories will not be processed under this Procedure and will be forwarded to the relevant company departments.

4. Management of the Process

The internal reporting channel is managed by the Reporting Office, which is composed of specifically trained personnel, both internal and external to the company.

5. Submission of Reports

Personnel of VERNICI CALDART S.r.l. and/or Third Parties who become aware of information regarding violations attributable to Personnel of VERNICI CALDART S.r.l. and/or Third Parties, whether committed or potentially committed based on concrete evidence, are required to make a report using the following methods. In accordance with the Whistleblowing Decree, the Company has established a dedicated internal reporting channel that allows for the electronic submission of written reports via a specific platform while ensuring the confidentiality of the whistleblower's identity, the individuals involved, or mentioned in the report, as well as the content of the report and related documentation, even through encryption tools.

The platform is accessible through the website www.vernicicaldart.it. Anonymous whistleblowing reports are permitted.

It is worth noting that the platform allows the whistleblower the option to stay in contact with the Reporting Office during the handling of an anonymous report, providing clarifications and/or additional documentation through a messaging system that ensures anonymity. However, it should be noted that submitting an anonymous whistleblowing report may make it more challenging to investigate the reported conduct and communicate effectively between the Office and the whistleblower, potentially affecting the usefulness of the report.

The whistleblower may also request to submit an oral report through a direct meeting with the Reporting Office, explicitly stating this need in writing through the dedicated reporting portal.

With the whistleblower's consent, the conversation can be documented through recording on an appropriate device for preservation and listening, or through a written report, which the whistleblower can review, correct, and confirm by signature.

Reports submitted to a party other than those indicated in this Procedure are forwarded to the Reporting Office in their original form, along with any supporting documentation, within seven days of receipt for further preliminary analysis. The recipient cannot retain a copy or take any independent action for analysis and/or investigation. Failure to communicate a received report constitutes a violation of the Procedure and may lead to appropriate measures, including disciplinary action.

6. Preliminary Assessment of the Report

Upon receiving the report, the Reporting Office:

a. Provides the whistleblower with an acknowledgment of receipt of the report within seven days from the date of receipt.

b. Conducts a preliminary analysis of the contents of the report, if deemed appropriate, possibly with the assistance of specialized external consultants, to assess its relevance within the scope of the Whistleblowing Decree and, in general, this Procedure.

c. Archives the report if it deems it inadmissible based on what is provided in the Whistleblowing Decree and this Procedure, such as:

• Clear groundlessness due to the absence of factual elements related to specified violations.

• Determination of generic content of the report of wrongdoing, making it impossible to understand the facts, or reports of misconduct accompanied by inappropriate or irrelevant documentation, rendering the content of the report unclear.

• Submission of solely documentation without reporting of illicit conduct.

In this case, the Office, in accordance with the Whistleblowing Decree, must provide written justification to the whistleblower for archiving the report.

d. Take charge of the management of the report.

7. Management of Internal Reporting

The management of the report is carried out in accordance with the provisions of this Procedure. In managing the report, the Reporting Office performs the following activities:

a. Maintains communication with the whistleblower and, if necessary, requests additional information; for this purpose, the platform allows for the exchange of information and/or documents.

b. Provides diligent follow-up to the received reports.

c. Provides feedback on the report within three months from the date of acknowledgment of receipt of the report or, in the absence of such acknowledgment, within three months from the expiration of the seven-day period from the submission of the report.

The Office has the authority to seek support from internal functions or specialized external consultants, while respecting the confidentiality requirements specified in the Whistleblowing Decree and this Procedure. The Office may also request clarifications and/or additional information from the individuals involved during the conduct of the report management activities.

Furthermore, the whistleblower can provide additional information if the reported incident has continued, been interrupted, or it has been aggravated.

The reports, along with the related documentation, are stored through the platform for the time necessary for their processing and, in any case, not exceeding five years from the date of communication of the outcome of the report management process.

8. Internal Investigation Activities

To evaluate a report, the Reporting Office may conduct the necessary internal investigations, either directly or by appointing an internal or external entity, subject to confidentiality obligations.

Members of the Office interact by exchanging information and/or documents through the platform, which allows for the creation of a dossier for each case, containing information and documentation related to each report.

9. Closing of the Report

The results collected during the internal investigations are analyzed to understand the context of the report, ascertain if a relevant violation has indeed occurred in accordance with this Procedure and/or the Whistleblowing Decree, and identify disciplinary measures, measures to remedy the situation that has arisen, and/or prevent a similar situation from recurring in the future.

If a violation is confirmed, the Office may:

• 1. Initiate a sanctioning procedure against the individuals involved, in compliance with applicable laws and any applicable collective bargaining agreements.

• 2. Evaluate, in conjunction with other relevant company functions, the advisability of initiating a disciplinary procedure against the whistleblower in cases where bad faith and/or purely defamatory intent are confirmed, as evidenced by the groundlessness of the report.

• 3. Collaborate with the company function concerned with the violation to develop any necessary action plan for addressing identified control weaknesses, ensuring monitoring of its implementation.

10. Data Preservation and Archiving

The information and any other personal data acquired are processed, also within the portal, in compliance with the confidentiality obligations under Article 12 of Legislative Decree 24/2023 and the principles outlined in Articles 5, paragraph 1, letter e), and Articles 5, paragraph 1, letter c), and Article 25 of the GDPR, as well as Article 3, paragraph 1, letter e) of Legislative Decree No. 51 of 2018.

Personal data that are manifestly unnecessary for the processing of a specific report are not collected, or if collected accidentally, are promptly deleted.

To ensure the management and traceability of reports and related activities, the Reporting Office prepares and updates all information concerning the reports and ensures, using the Portal and its functionalities, the archiving of all related supporting documentation for the time strictly necessary for their resolution and in any case for no longer than 5 years, commencing from the date of communication of the outcome of the report.

Originals of paper reports received are kept in a special protected environment.

11. Guarantees and Protections

11.1 Protection of the Whistleblower's Identity

The personnel of VERNICI CALDART S.r.l. involved in managing reports are required to ensure the confidentiality of the whistleblower's identity.

Subject to legal obligations, the identity of the reporting person and any other information from which their identity may be directly or indirectly inferred cannot be disclosed to persons other than those involved in the management of the reporting channel under this Procedure without the express consent of the whistleblower.

Confidentiality is also guaranteed for those who make reports before or after the commencement or termination of their employment relationship, during the probationary period, or during the selective or pre-contractual phase, provided that such information has been acquired within the work context.

Confidentiality regarding the identity of individuals involved and/or mentioned in the report is also guaranteed, with the same protections afforded to the whistleblower.

In any case, protection of the whistleblower's identity is waived in cases where the judicial authority has established, in criminal proceedings, liability for offenses such as slander, defamation, or other crimes committed through the report, or civil liability for the same reasons, including cases of intent and gross negligence, as well as in other cases where anonymity is not legally enforceable (criminal, tax, or administrative investigations, inspections by regulatory bodies).

Within the disciplinary proceedings, if the allegation is based, in whole or in part, on the report, and knowledge of the whistleblower's identity is essential for the defense of the accused, the report can only be used in the disciplinary proceeding with the express consent of the whistleblower to disclose their identity.

Disclosure of the whistleblower's identity and any other information or element of the report, from which the identity of the whistleblower may be directly or indirectly deduced, is permitted only when necessary and proportionate under the law, within the context of investigations by national authorities or judicial proceedings, including for the purpose of safeguarding the right to defense of the individuals involved. In such cases, the whistleblower is notified in writing of the reasons for the disclosure of the confidential data.

Violation of the confidentiality obligation, subject to the exceptions mentioned above, may result in the imposition of pecuniary administrative sanctions by ANAC, as well as the adoption of punitive and disciplinary measures by the company.

11.2 Protection Measures

Any retaliatory acts against those who make a report are prohibited. Retaliatory acts are defined as any behavior, action, or omission, even if attempted or threatened, that is carried out because of the report and causes or may cause unjust harm to the reporter, either directly or indirectly.

Protection measures are applied within the limits and conditions established by Chapter III of Legislative Decree 24/2023 and are also extended to:

• Facilitators, i.e., individuals who assist the reporter in the reporting process, operating within the same work context.

• Individuals within the same work context as the reporter who are connected to them by a stable emotional or familial relationship up to the fourth degree, as well as colleagues who work in the same work context and have a regular and current relationship with the reporter.

• Entities owned by the reporter or for which the reporter works, as well as entities operating within the same work context as the reporter.

Any retaliatory acts taken due to the report are null and void, and individuals who have been dismissed because of the report have the right to be reinstated in their workplace in accordance with the applicable labor regulations.

Anyone who believes they have suffered retaliation due to the report can report it to ANAC (National Anti-Corruption Authority), which will then inform the National Labor Inspectorate for the respective actions within their jurisdiction.

This regulation does not apply to anonymous reports, as it is intended to protect the reporter from the risk of retaliation. However, it may be applicable if, because of an anonymous report, the reporter's name is revealed, allowing them to avail themselves of the protections provided by the Decree.

11.3 Protection of the Reported Party and the Responsibility of the Reporter

This procedure also includes the protection of the reported party from any abuse of the reporting tools provided by VERNICI CALDART S.r.l. (reports made with fraudulent intent or gross negligence).

VERNICI CALDART S.r.l. ensures the confidentiality of the reported party's identity throughout the entire process of managing the report and protects them from unjustified disciplinary actions, workplace harassment, and any other form of retaliation that would create intolerable working conditions based solely on the existence of a report.

The protections outlined in section 11.2 do not constitute a form of impunity for the reporter. VERNICI CALDART S.r.l. discourages any form of abuse of this procedure and the use of reports for purposes other than those described herein. It commits to taking adequate punitive and disciplinary measures, in accordance with Article 16, paragraph 3, of Legislative Decree 24/2023, against anyone who makes reports with fraudulent intent or gross negligence that are found to be unfounded, blatantly opportunistic, and/or made solely to harm the accused or other parties.

These protections are not guaranteed when the criminal liability of the reporter is established in cases of reports made in bad faith or with gross negligence, or when civil liability for any damages caused by these illicit behaviors is determined.

In cases where such responsibilities are established, VERNICI CALDART S.r.l. will impose a disciplinary sanction on the reporting party.

11.4 Treatment of Personal Data

Any processing of personal data, including communication to and between competent authorities, carried out within the framework of this Procedure, shall be conducted in accordance with Article 13 of Legislative Decree No. 24/2023, in compliance with the GDPR and Legislative Decree of June 30, 2003, and subsequent amendments, as per the specific privacy notice of VERNICI CALDART S.r.l. to which reference is made.

12. Sanctioning and Disciplinary Measures

Upon conclusion of the investigation and in relation to different categories of individuals, should VERNICI CALDART S.r.l. ascertain responsibilities resulting from a breach of this Procedure, it activates the following sanctioning and disciplinary measures:

• Application of the Disciplinary and Sanctioning System for Employees and Corporate Bodies.

• Termination of existing relationships for suppliers/consultants.

• Revision of qualification status for suppliers/consultants.

13. External Reporting and Public Disclosures

Legislative Decree No. 24/2023 provides for the possibility, under certain conditions, of making external reports through the channel managed by ANAC (National Anti-Corruption Authority), as well as making public disclosures through the press or electronic media or other means of dissemination capable of reaching many people.

External reporting can be carried out when:

• The internal channel, even if mandatory, is not active or does not comply with legal requirements.

• The whistleblower has already made an internal report and it has not been followed up within the deadlines set by regulations.

• The whistleblower has reasonable grounds to believe that, if an internal report were made, it would not be effectively followed up or that it may risk retaliation.

• The whistleblower has reasonable grounds to believe that the violation may constitute an imminent or manifest danger to the public interest.

It is the responsibility of the whistleblower to assess the existence of one of the situations listed above before proceeding with an external report.

External reports are made by the whistleblower directly to ANAC through the appropriate channels provided by the Authority on its official website accessible at the following link: www.anticorruzione.it.

The whistleblower has the right to make information about violations relevant to this Procedure publicly available through the press or electronic media or other means of dissemination capable of reaching many people, provided that:

• They have previously made an unsuccessful internal or external report.

• They have reasonable grounds to believe that the violation may constitute an imminent or manifest danger to the public interest.

• They have reasonable grounds to believe that the external report may entail the risk of retaliation or may not be effectively followed up due to specific circumstances of the case.