Whistleblowing – Legislative Decree 24/2023

Pursuant to Legislative Decree 24/2023, Muraro Isidoro & Sons S.r.l. has implemented its internal channel to report behaviours, acts, or omissions that harm public interest or the integrity of public administration or private entities, ensuring the confidentiality of the subjects protected by the Decree.

What can be reported

Violations of national or EU regulations that harm public interest or the integrity of public administration or private entities, which have been discovered in the context of working and/or commercial relationships with Muraro Isidoro & Sons S.r.l., including:

• administrative, accounting, civil, or criminal offences;
• unlawful conduct relevant under Legislative Decree 231/2001, or violations of the organisational and management models provided therein;
• offences falling within the scope of EU or national acts related to the following sectors: public procurement; financial services, products, and markets; prevention of money laundering and terrorist financing; product safety and compliance; transportation safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; protection of privacy and personal data and security of networks and information systems;
• acts or omissions harming the financial interests of the Union;
• acts or omissions concerning the internal market;
• acts or behaviours undermining the purpose or objectives of the provisions under Union acts.

Reporting Channels

• Internal channel provided by Muraro Isidoro & Sons S.r.l.;
• external (ANAC);
• public disclosure (via press, electronic media, or dissemination means capable of reaching a large number of people) only under the conditions specified in Legislative Decree 24/2023;
• reporting to the judicial or auditing authority.

Reporters are required to use the internal channel, developed according to the highest security standards available to safeguard the rights of the reporter, except in cases expressly provided for in art. 6 where the reporter may directly contact ANAC.

Anonymous reports are allowed by the decree, but their use is discouraged as they hinder both communication with the reported and the conduct of the procedure.

Conteent of the Report

The whistleblower is required to provide all useful elements to enable competent offices to carry out due and appropriate verification to verify the validity of the reported facts.

To this end, the report should preferably include the following elements:

• personal details of the reporting party with indication of the position or function held within the company, or other connection with it;
  
• clear and complete description of the reported facts;
• if known, the circumstances of time and place in which the acts were committed;
• if known, the personal details or other elements (such as the position and department in which the activity is carried out) that allow the identification of the person who committed the act or acts reported;
• indication of any other parties who can provide information on the reported facts;
• indication of any documents that can confirm the validity of such facts;
• any other information that may provide useful confirmation of the reported facts.

Handling of Reports by Muraro Isidoro & figli S.r.l.

The reporting party will be notified of the receipt of the report within 7 days from the date of receipt;

Dialogue with the reporting party will be maintained, and if necessary, requests for additional information or clarifications will be made to manage the report effectively;

Prompt follow-up will be given to received reports by conducting the relevant inquiries;

The final outcome will be communicated to the reporting party within three months from the notice of receipt of the report.

Subjects Whose Confidentiality is Protected

The identity of the reporter cannot be disclosed to persons other than those competent to receive or follow up on the reports;

Protection covers not only the name of the reporter but also all elements of the report from which the identification of the reporter can be derived, even indirectly;

The report is exempt from access to administrative documents and the right of generalised civic access;

Confidentiality protection extends to the identity of the individuals involved (reported parties) and individuals mentioned in the report, as well as facilitators, individuals in the same work context, and colleagues of the reporting party, in compliance with the same guarantees provided in favour of the reporting party.

Protection is guaranteed if:

• At the time of reporting or denunciation to the judicial or auditing authority or public disclosure, the reporting or denouncing party had reasonable grounds to believe that the information on the reported violations, publicly disclosed, or reported was true and fell within the objective scope of the report (art. 1 para 1 Legislative Decree 24/23);
• The report or public disclosure was made on the basis of what is provided for in Chapter II of Legislative Decree 24/23, namely through the channels and under the conditions identified therein.

Except for specific liability limitations provided for in article 20 of Legislative Decree 24/23, when the criminal liability of the reporting party is established, even by first-instance judgment, for the offences of defamation or slander or for the same offences committed with the denunciation to the judicial or auditing authority, or their civil liability, for the same reasons, in cases of wilful misconduct or gross negligence, confidentiality protections are not guaranteed, and the reporting or denouncing party is subject to disciplinary action.

Protection of Personal Data

The processing of personal data related to the receipt and management of reports is carried out by Muraro Isidoro & Sons S.r.l., as data controller, in compliance with European and national principles regarding the protection of personal data, providing appropriate information to the reporting parties and individuals involved in the reports, and adopting measures to protect the rights and freedoms of the data subjects.

Furthermore, the rights of access, rectification, and deletion provided for in articles 15 to 22 of Regulation (EU) 2016/679 are guaranteed, except for the limitations indicated in article 2-undecies of Legislative Decree 30 June 2003, no. 196.

Reports and related documentation are kept for the time necessary for the processing of the report itself and, in any case, no later than 5 years from the date of communication of the final outcome of the reporting procedure, in compliance with the confidentiality obligations under European and national legislation on the protection of personal data. Read the Privacy Policy here.