Whistleblowing Reports

REGULATION FOR THE MANAGEMENT OF REPORTS OF ILLEGAL CONDUCT AND RELATED FORMS OF PROTECTION

In order to encourage and facilitate the reporting of wrongdoing and, thus, reduce the risk of irregularities, the company Le Sac. Srl (“Le Sac” or the “Company”) has equipped itself with a company regulation that governs the internal system for reporting violations (Whistleblowing), as per Legislative Decree no. 24 of 10 March 2023 (so-called “Whistleblowing Decree”), issued in implementation of EU Directive 2019/1937 of the European Parliament and of the Council.

The Company's Whistleblowing system protects against any detrimental consequences

anyone who intends to report violations of national or European Union regulations that harm the public interest or the integrity of the public administration or private entity, of which he or she has become aware in the work context, while ensuring the confidentiality and protection of the personal data of the reporter, the reported person and all the persons involved.

The procedure cannot be used to submit complaints or warranty requests.

Operating Modes

1. Reporting Channels

Pursuant to Legislative Decree no. 24 of 10 March 2023, the Company has equipped itself with internal Reporting Channels that guarantee the confidentiality of the identity of the Reporter, the facilitator, the person involved and the person mentioned in the Report, as well as the content of the Report itself and the related documentation. These Reporting Channels, which are alternatives to each other and have the same purpose and effectiveness, are managed solely by the Manager, i.e. by a body composed of persons specifically appointed and external to the Company, who possess professional, autonomy, independence and impartiality requirements. It is specified that the Company does not have access to the Reporting Channels.

a) Report to the Manager in oral form

The Company allows the Reporter to make his/her Reports in oral form. Oral Reports are made through telephone lines to the addresses of the Report Manager (Tel. 0341.287976 - 0341.288467) or, at the request of the Reporter, through a direct meeting set within a reasonable time.

The Report, if made via a meeting, telephone line or other unrecorded voice messaging system, will be documented in writing by means of a detailed account of the conversation by the relevant personnel, with subsequent verification, rectification and confirmation by the Reporting Person, with his/her signature.

b) Report to the Manager in written form

The written Report can be made using the Form specifically prepared and available by clicking here , which must be sent, even anonymously, via email to [email protected] or by ordinary mail to the Manager's office, always indicating the wording "confidential documentation", at the following address:

Reporting Manager Le Sac Srl

c/o Campa Avvocati STA Srl

Via G. Anghileri n. 2

23900 - Lecco (LC)

2. Content of the Report

Reports must concern Violations relevant for the purposes of this Regulation, as defined in Section 3, and must: i) be detailed and based on precise and consistent elements, ii) describe facts that are verifiable and known directly by the person reporting (therefore not de relato or by mere hearsay ) and iii) contain all the information necessary to unequivocally identify the perpetrators of the illicit conduct.

Reports cannot therefore concern generic suspicions, lacking factual and/or documentary evidence, nor information merely reported by third parties, if the Reporter has not taken note of the reported conduct, even personally.

The Reporting Party is therefore required to indicate all elements useful for ascertaining the validity of the reported facts, in order to allow for adequate checks in relation to the Report.

In particular, the Report must indicate:

the personal details of the person making the Report, indicating their qualification or professional position (if the Reporter does not wish to remain anonymous);

a clear and complete description of the facts which are the subject of the Report and the methods by which they were discovered;

the date and place where the event occurred;

the name and/or role (qualification, professional position or service in which the activity is carried out) of the Subject/Subjects who carried out the reported conduct;

the possible presence of other subjects involved;

the nature of the damage (e.g. corruption, environmental damage, etc.);

the names and roles of any other individuals who may report on the facts which are the subject of the Report;

any documents that can confirm the validity of the reported facts;

the possible presence of witnesses;

any other information that may provide useful evidence regarding the existence of the reported facts.

Anonymous Reports are accepted only if they are adequately detailed and capable of bringing to light specific facts and situations that can be verified. They will be taken into consideration only if they are duly detailed and do not appear irrelevant or unfounded.

3 Receiving Reports

The Manager, once the Report has been received, promptly fills in the REPORT REGISTER , where the following must be reported:

the progressive identification number that allows for unique identification;

the date of receipt;

the Reporting Channel used;

the classification of the Report, based on the preliminary evaluation of its content (Relevant and Pertinent, Deficient, Not Pertinent);

the findings and related conclusions.

The Reports must be preliminarily classified by the Manager using the following criteria:

Relevant and Pertinent : Reports meeting the requirements set out in the Regulation, such as to allow the start of follow-up investigations. In particular, reports that are detailed and based on precise factual elements and not susceptible to different interpretations, as well as consistent and converging in the same direction, are considered Relevant. Reports must be considered Pertinent when they concern actions or omissions, committed or attempted: i) in violation of national or European Union regulatory provisions, as provided for by art. 1 of Legislative Decree no. 24/2023; ii) relevant pursuant to Legislative Decree no. 231/2001 (refer to the catalogue of predicate offences referred to in the aforementioned Decree).

- Deficient : Reports of insufficient content to initiate investigations, as they do not meet the requirements set out in the Regulation. In such cases, the Manager may ask the Reporting Party, at its sole discretion, for additional information necessary to initiate investigations into the reported facts, possibly reclassifying the Report as Relevant, if elements are acquired that allow the requirements set out in the Regulation to be satisfied;

- Not Relevant : Reports not relevant to the scope of the legislation on whistleblowing (Law no. 179/2017 and Legislative Decree no. 24/2023), as they relate to: i) Reported parties not having relationships with the Company; ii) facts, actions or omissions that do not concern relevant Violations pursuant to the Regulation; iii) disputes, claims or requests related to a purely personal interest of the Reporting Party.

In the event that the Report is submitted to a person other than the Manager, it must be forwarded to him/her by the person who received it within 7 (seven) days of receipt; the Manager will inform the Reporting Person of its receipt.

4 Abstention from managing the Report due to potential conflict of interest

In the event that the Reported Party coincides with the Manager, or if he has an interest connected to the Report such as to compromise his impartiality and independence of judgment, he must promptly communicate this to the Board of Directors of the Company and must abstain from the Report Management process.

In the event of Reports concerning members of the Board of Directors, the Manager shall immediately notify the Supervisory Body.

5 Activities to verify the validity of the Report

As part of the management of the Reporting Channels, the Manager carries out the following activities:

a) issues the Reporting Party with acknowledgment of receipt of the Report within 7 (seven) days of the date of receipt;

b) maintains discussions with the Reporting Party and may request additions from the latter, if necessary;

c) diligently follows up on the Reports received;

d) provides feedback to the Report within 3 (three) months from the date of the acknowledgement of receipt or, in the absence of such acknowledgement, within 3 (three) months from the expiry of the 7 (seven) day period from receipt of the Report.

The verification of the validity of the circumstances represented in the Report is entrusted to the Manager, who proceeds in compliance with the principles of impartiality and confidentiality, carrying out any activity deemed appropriate, including the personal hearing of the Reporter and any other subjects who can report on the facts.

The Manager, in carrying out the activities to ascertain the validity of the Report, may avail of the support of external consultants and/or the collaboration of corporate structures and functions when, due to the nature and complexity of the checks, their involvement is necessary. During the investigation of the Report, the right to confidentiality of the identity of the Reporter is guaranteed, unless this is not possible due to the intrinsic characteristics of the investigations to be carried out. The same duties of conduct, aimed at guaranteeing the confidentiality of the Reporter, also apply to the individual, consultancy or internal, who provides his/her activity in support of the Manager.

Following the investigation, the Manager, if it does not believe that there are grounds for archiving the Report due to its groundlessness, prepares a specific report for the Board of Directors, in which the context, the regulatory and procedural framework of reference, the verification activities carried out, the related results that emerged, the documents or other elements proving the illicit conduct or the Violation committed are formalized, for the purposes of any disciplinary measures adopted by the Company against the Reported Person.

Should the Manager, in the aforementioned report, indicate improvement profiles, corrective actions and/or risk mitigation, these may be communicated, always in compliance with the principle of protection of the confidentiality of the Reporting Person, to the competent company management, so that the necessary corrective and risk mitigation actions are evaluated and implemented or all improvement actions are adopted to protect the Company.

If the Manager, following the relevant investigative activity, instead ascertains the groundlessness of the Report made, he will notify the Company, for the assessment of the possible imposition of disciplinary sanctions against the Reporting Person, when his criminal liability for the crimes of defamation or slander or in any case for the same crimes committed with the report to the judicial or accounting authority or his civil liability, for the same reason, in cases of fraud or gross negligence is ascertained, even with a first-instance sentence.

6 Confidentiality and Prohibition of Retaliation

It is the Manager's duty to ensure the confidentiality of the identity of the Reporting Person and of any other information from which such identity may be directly or indirectly deduced, from the moment the Report is taken into account, even in cases where the Report should subsequently prove to be incorrect or unfounded.

All Reports received, regardless of the Reporting Channel used, are archived and stored by the Manager, to protect the confidentiality of the Reporter. The Report and the attached documentation cannot be viewed or copied by unauthorized applicants.

The identity of the Reporting Person must be protected at every stage following the Report, except when it is not guaranteed when the criminal liability of the Reporting Person for the crimes of defamation or slander or in any case for the same crimes committed with the report to the judicial or accounting authority is ascertained, even by a first-instance judgment, or his civil liability, for the same reason, in cases of fraud or gross negligence, as well as in cases where anonymity is not enforceable by law (summary testimonial information obtained by the Judicial Police, administrative authorities or inspections by supervisory authorities, etc.).

With specific regard to the scope of the disciplinary proceedings against the accused, the identity of the Reporter may be revealed to the person in charge of the company function in charge of the disciplinary proceedings (Employer and/or HR Management) and/or to the accused only in cases where:

there is the express consent of the Reporting Person; or

the contestation of the disciplinary charge is based solely on the Report and knowledge of the identity of the Reporter is absolutely indispensable for the defense of the accused, as requested and motivated in writing by the latter. In this circumstance, it is up to the holder of the disciplinary power (Employer and/or HR Management) to evaluate the request of the accused and whether the condition of absolute indispensability of knowledge of the name of the Reporter for the purposes of the defense exists. If such a requirement is deemed to exist, the holder of the disciplinary power must submit a motivated request to the Manager, containing a clear and precise statement of the reasons why knowledge of the identity of the Reporter is indispensable.

The same duties of conduct, aimed at the confidentiality of the Reporter, as the Manager is required to, weigh on the holder of the disciplinary power.

In the event that the Report is forwarded to other corporate structures/bodies for the purpose of carrying out investigative activities, only the content of the Report must be forwarded, removing - as far as possible - all references from which it is possible to trace, even indirectly, the identity of the Reporting Person.

The Company, pursuant to Law no. 179/2017 and Legislative Decree no. 24/2023, prohibits any act of retaliation or discrimination against the Reporter for reasons related, directly or indirectly, to the Report and intends to pursue within the terms of the law and with the disciplinary sanctions provided for by the CCNL applied in the company:

anyone who violates the measures to protect the Whistleblower by adopting retaliatory and/or discriminatory conduct;

anyone who, in bad faith, fraud or gross negligence, makes Reports which subsequently prove to be unfounded.

The adoption of retaliatory or discriminatory measures against the subjects who make the Reports referred to in the Regulation may be reported to the National Anti-Corruption Authority (ANAC), pursuant to the provisions of Legislative Decree no. 24/2023, to the National Labor Inspectorate, for the measures within its jurisdiction, as well as to the trade union organization indicated by the Reporter.

7 Methods of archiving and storing documentation

The Manager keeps the REGISTER OF REPORTS and all documentation received in compliance with the confidentiality obligations set forth in Legislative Decree 24/2023 and EU Regulation 2016/679, for the time necessary to process the Report and in any case no later than 5 (five) years from the date of communication of the final outcome of the Reporting procedure.

8 External reports.

The Reporting Person may report violations to the ANAC (National Anti-Corruption Authority), through the appropriate channels established by that Authority, exclusively if the following conditions apply:

the activation of the internal reporting channel is not foreseen in your work context or this, even if mandatory, is not active or, even if activated, does not comply with the provisions of art. 4 Legislative Decree no. 24/2023;

the Reporter has already made an internal Report and it has not been followed up;

the reporting person has reasonable grounds to believe that, if he or she were to make an internal Report, it would not be followed up effectively or that the Report itself could give rise to the risk of retaliation;

the Reporting Party has reasonable grounds to believe that the Violation may constitute an imminent or manifest danger to the public interest.