WHISTLEBLOWING PROCEDURE
1. Introduction
Whistleblowing is a tool, originating in Anglo-Saxon countries, through which employees or collaborators of an organization report to specific individuals or bodies a crime, an offense, or any unlawful conduct committed by other individuals belonging to the organization.
In this context, whistleblowing is an act of disclosure through which the whistleblower contributes to the emergence and prevention of risks and situations that are detrimental to the organization to which they belong.
In this regard, it should be noted that Article 6, paragraph 2-bis of Legislative Decree 231/2001, as amended by Law 179/2017, makes whistleblowing protection mandatory for companies that have adopted an Organization, Management, and Control Model pursuant to Legislative Decree 231/2001 (hereinafter “MOG 231”). In particular, this provision requires that MOG 231 meet four requirements:
one or more channels enabling the persons referred to in Article 5, paragraph 1, letters a) and b), to submit, in order to protect the integrity of the entity, detailed reports of unlawful conduct, relevant under this decree and based on precise and consistent factual elements, or violations of the entity's organizational and management model, of which they have become aware in the course of their duties; these channels guarantee the confidentiality of the identity of the reporting person in the management of the report;
At least one alternative reporting channel, suitable for ensuring, through electronic means, the confidentiality of the whistleblower’s identity;
the prohibition of direct or indirect retaliation or discrimination against the whistleblower for reasons directly or indirectly related to the report;
in the disciplinary system adopted pursuant to paragraph 2, letter e), sanctions against those who violate the measures to protect the whistleblower, as well as those who make reports that prove to be unfounded with intent or gross negligencee.
In order to comply with current legislation, Sugarmusic S.p.A. a Socio Unico (hereinafter referred to as the “Company”) has deemed it necessary to adopt this Whistleblowing Procedure with the aim of providing clear operational guidelines on the subject matter, content, recipients, and methods of transmission of Reports, as well as on the forms of protection offered to those who make Reports.
No negative consequences will arise for anyone who has made a Report in good faith, and the confidentiality of the identity of the Reporter is guaranteed, without prejudice to any local legal obligations that may arise from the Report.
2. References
• Legislative Decree 231/2001 (hereinafter “MOG 231”);
• Legislative Decree No. 24 of March 10, 2023;
• Regulation (EU) No. 2016/679 (hereinafter also “GDPR”);
• Legislative Decree No. 196 of June 30, 2003, as amended and supplemented, including Legislative Decree No. 101 of August 10, 2018;
• Directive (EU) 2019/19373.
3. The Recipients
The Recipients of the Procedure are:
• the members of the CdA;
• the members of the Board of Statutory Auditors;
• the Supervisory Body;
• the Shareholders;
• Employees;
• Third parties (external collaborators, freelancers, interns, volunteers, all individuals working under the supervision and direction of contractors, subcontractors, and suppliers, as well as so-called facilitators (i.e., those who assist the whistleblower in the reporting process), colleagues, and even relatives of the whistleblower).
4. Definitions
ANAC: The National Anti-Corruption Authority, abbreviated to ANAC, is an independent Italian administrative authority responsible for protecting the integrity of public administration, combating illegality, fighting corruption, implementing transparency, and monitoring public contracts.
SHAREHOLDERS: refers to the Company's shareholders.
CDA: refers to the Company's Board of Directors.
CODE OF ETHICS: refers to the Company's Code of Ethics.
BOARD OF STATUTORY AUDITORS: refers to the Company's Board of Statutory Auditors.
UNLAWFUL CONDUCT: refers to conduct (or suspected conduct) of any nature, whether active or passive, attributed to Company Employees or Third Parties, acting alone or in conjunction with third parties who have any kind of relationship with the Company, which is, or may be: (i) contrary to the principles contained in Model 231 or in the Code of Ethics adopted by the Company, and/or (ii) in violation of other internal rules of the Company (such as company procedures and protocols of conduct or control, the system of powers and proxies, etc.), (iii) and/or aimed at committing one or more crimes also provided for by Legislative Decree 231/2001, and/or (iv) in violation of the Law, and/or (v) in any case likely to cause damage to the Company.
RECIPIENTS: refers to all recipients as defined in paragraph 2 of the Procedure.
EMPLOYEES: refers to the Company's employees (including middle managers and executives) on fixed-term or permanent contracts.
LEGISLATIVE DECREE 231/2001: refers to Legislative Decree No. 231 of June 8, 2001, concerning the “Regulation of the administrative liability of legal entities, companies, and associations, including those without legal personality,” and subsequent amendments and additions, as well as the laws that refer to it (such as Law 146/2006).
REPORT MANAGEMENT: indicates the receipt, screening, investigation of the Report and any other activity carried out in accordance with this Procedure.
LAW: refers to constitutional, primary, and secondary legislation in force in Italy (including legislation originating from the European Union).
MODEL 231: refers to the organization, management, and control model adopted by the Company pursuant to Legislative Decree 231/2001.
SUPERVISORY BODY OR ODV: the internal control body appointed by the CdA, whose tasks include receiving, analyzing, and verifying Reports.
PERSONS INVOLVED: persons mentioned in the Report as co-authors of the Unlawful Conduct or whose names emerge during the Management of the Report.
PROCEDURE: refers to this procedure.
FINAL REPORT: indicates the final report summarizing the investigation and containing the additional elements provided for in this Procedure.
WHISTLEBLOWER: refers to any person who makes a Report pursuant to this Procedure.
REPORTED: indicates any person whom the Reporter indicates to have engaged in Unlawful Conduct or who is believed to have committed Unlawful Conduct during the investigation relating to the Report.
REPORT: refers to any complaint concerning alleged Unlawful Conduct based on the above Procedure.
REPORT IN BAD FAITH: refers to any Report which, at the end of the investigation phase, proves to be unfounded and made in bad faith and in any case for the sole purpose of defaming or causing any damage to the offended person.
TRADE UNION: In labour law, a trade union is an organisation that represents a category of workers or employers within an employment relationship.
COMPANY: refers to Sugarmusic S.p.A. a Socio Unico
RECIPIENT: refers jointly to the Supervisory Body (ODV) and the Legal & Business Affairs Director, who are responsible for managing the report.
THIRD PARTIES: refers to those who, although external to the Company, work directly or indirectly for it under a contractual relationship (e.g., attorneys, agents, collaborators in any capacity, consultants, suppliers, business partners), and also those who, although not falling within the category of Employees in the strict sense, have contractual relationships with the Company, in any capacity, even occasional and/or only temporary, but comparable to employment (e.g., temporary workers, seconded from other companies, etc.).
VIOLATION: corresponds to any action contrary to: (i) laws and regulations; (ii) principles enshrined in the Code of Ethics; (iii) company regulations and procedures; (iv) principles, rules, and activities provided for in Model 231.
5. Purpose and scope
This document (hereinafter referred to as the “Procedure”) is intended to regulate the process of receiving, analyzing, and handling Reports, whether sent or transmitted by anyone, including anonymously.
The Procedure does not replace, but rather supplements any existing procedures referring to similar cases.
This Procedure must be carried out in compliance with any legal obligations that may arise from the Report, in particular with regard to the obligation to report to the Judicial Authorities or Supervisory Authorities and with regard to the processing of personal data and the protection of privacy
6. Persons who can activate the reporting system (Reporters).
The Reporting System can be activated by all Recipients of this Procedure.
7. Subject of Reports
Unlawful Conduct is subject to Reporting.
Only Reports concerning facts directly observed by the Whistleblower will be taken into consideration, not those based on rumors or hearsay.
The Report must not concern personal complaints. The Whistleblower must not use this Procedure for purely personal or retaliatory purposes, or for claims or complaints against hierarchical superiors, which, if anything, fall within the more general discipline of the employment/collaboration relationship or relationships with hierarchical superiors or colleagues, for which reference should be made to the procedures of the relevant company structures.
Reports can be of three types:
Open: the Whistleblower openly raises an issue without any restrictions related to their confidentiality;
Confidential: the Whistleblower's name is known, but the organization treats the report confidentially without revealing the whistleblower's identity without their explicit consent;
Anonymous: the Whistleblower's personal details are not disclosed and cannot be identified in any other way. In this case, the report will still be taken into consideration, but anonymity could significantly complicate the investigation and could prevent the necessary measures from being taken
8. Content of Reports
Regardless of the above types, Reports must be detailed and based on specific elements, must concern verifiable facts known directly by the Reporter and, where possible, must contain information useful for identifying the person who committed the Unlawful Conduct.
The Whistleblower is required to clearly and completely report all information useful for carrying out the checks and investigations necessary to assess the validity and objectivity of the Report, indicating, by way of example and without limitation:
• any useful reference to the course of events and/or any information that may provide valid confirmation of the existence of the reported facts;
• any other information that may provide useful confirmation of the existence of the reported facts;
• any documents that may confirm the validity of the reported facts;
• personal details or other elements that allow the identification of the person who committed the reported act;
• personal details of any other persons who may report on the facts covered by the Report;
• any private interests related to the Report.
Anonymous reports are only accepted if they are adequately detailed and capable of bringing to light specific facts and situations. They are only taken into consideration if they do not appear prima facie to be irrelevant, unfounded, or unsubstantiated.
9. Persons responsible for receiving Reports
The persons responsible for receiving and examining Reports are the Supervisory Body and the Legal & Business Affairs Director (jointly referred to as the “Receiving Party”), who ensure the proper implementation of this Procedure.
In the event that the entire SB or, in any case, all of its members are the subject of a Report or have a potential interest related to the Report that could compromise their impartiality, the management of the Report will be entrusted entirely to the Legal & Business Affairs Director alone.
10. Dedicated channels
In accordance with Article 6, paragraph 2-bis, of Legislative Decree 231/2001, the Company has established specific communication channels designed to protect the confidentiality of the identity of the Whistleblower and the Reported Party.
Reports can be sent through the following dedicated channels::
For employees:
Directly to the Receiving Party:
by sending an email to the dedicated email address with exclusive access reserved for the Supervisory Body and/or the Legal & Business Affairs Director;
by regular mail sent to the attention of the Company's Supervisory Body and/or the Legal & Business Affairs Director;
orally, upon request for a direct meeting with the Receiving Party forwarded via communication in accordance with points a. and b. above;
via link to the whistleblowing portal: https://sugarmusic.smartleaks.cloud.
For third parties:
Directly to the Receiving Party:
by sending an email to the dedicated email address with exclusive access reserved for the Supervisory Body and/or the Legal & Business Affairs Director;
by regular mail to the Company's Supervisory Body and/or the Legal & Business Affairs Director;
via link to the whistleblowing portal: https://sugarmusic.smartleaks.cloud;
According to European Directive EU 2019/1937 and its implementation through Legislative Decree 10.03.23 No. 24, reports can also be made outside of company channels through ANAC (Whistleblowing - www.anticorruzione.it)
public disclosure through the press, electronic media, or other means of communication capable of reaching a large number of people, reporting to the judicial or accounting authorities, and reporting to the relevant Trade Union.
11. Preliminary analysis
Except in the case of anonymous reports, the Receiving Party (or the Legal & Business Affairs Director alone, if the reported party is the entire Supervisory Body or a member of the Supervisory Body) shall notify the Reporting Party (using the same method used to receive the report) that it has taken charge of the report within 7 (seven) days of receiving it.
For all Reports received, including anonymous ones, the Receiving Party (or the Legal & Business Affairs Director alone, if the reported party is the entire Supervisory Body or a member of the Supervisory Body) shall immediately take action to carry out a preliminary analysis of the conditions of admissibility.
A report is admissible provided that (i) the circumstances of time and place of commission of the act reported and (ii) the personal details or other elements that allow the identification of the person to whom the act is attributed are precise and clear. Therefore, a report may be considered inadmissible when, among other things: (a) the data constituting the essential elements of the report are missing; (b) the facts reported are manifestly unfounded; (c) the presentation of the facts is so generic as to be incomprehensible; (d) supporting documents are attached without indication of the relevant violation.
The Receiving Party (or the Legal & Business Affairs Director alone, if the Reported Party is the entire Supervisory Body or a member of the Supervisory Body) shall therefore evaluate the following alternatives:
proceed with the immediate archiving of Reports that are clearly unfounded or too generic and therefore lack the minimum elements required to initiate any investigation. Such Reports are in any case archived until the expiry of the limitation period for the alleged offense or the right to compensation arising from it, whichever is longer, accompanied by a brief explanatory note on the reasons for the dismissal;
initiate an investigation into Reports that contain reasonably sufficient and detailed elements.
12. Preliminary investigation phase
Once the conditions for admissibility and eligibility have been verified, the Receiving Party shall initiate the preliminary investigation phase.
For the preliminary investigation, the Receiving Party (or the Legal & Business Affairs Director alone if the Reported Party is the entire Supervisory Body or a member of the Supervisory Body) may carry out any preliminary investigation it deems appropriate regarding the reported facts, including conducting checks by summoning the reported party or the reporting party and requesting additional documentation and clarifications from the reporting party. The Receiving Party (or the Legal & Business Affairs Director alone, if the Reported Party is the entire Supervisory Body or a member of the Supervisory Body) may also avail itself of the support and collaboration of company structures and functions and/or external consultants. In the event of the Report being forwarded to other company departments and/or third parties (who are required to comply with this Procedure and the related confidentiality obligations), only the content of the Report may be forwarded, removing all references from which it is possible to trace, even indirectly, the identity of the Reporting Party. Whenever possible without prejudicing the investigation, the name of the Reported Person and/or the Persons Involved must also be removed.
13. Final stage of the investigation
Based on the final results of the investigation, the Receiving Party (or the Legal & Business Affairs Director alone if the Reported Party is the entire Supervisory Body or a member of the Supervisory Body) prepares a summary note in which it may alternatively decide to:
record the closure of the case, if the Report is unfounded or there is no reasonable belief that Unlawful Conduct has been committed;
prepare the Final Report, if it considers that there are sufficient elements to positively assess the validity of the reported facts, or that Unlawful Conduct has been ascertained;
The Final Repor must contain at least the following elements:
• a description of the conduct or event found;
• an indication of the provisions of the law, Model 231, the Code of Ethics, or company procedures that have been violated;
• the identification details of the perpetrator of the Unlawful Conduct, when identified;
• the elements, including documentary evidence, proving the Unlawful Conduct;
• a final assessment of the seriousness of the offenses committed for the purposes of applying sanctions, providing adequate guidance in order to comply with the principles of proportionality and adequacy of sanctions in relation to the Unlawful Conduct;
• any recommendations for corrective actions to be taken to ensure that similar incidents do not occur in the future, as well as proposals to initiate disciplinary proceedings and/or proposals for other initiatives to compensate, prevent, avoid, minimize, or remedy the effects of the Unlawful Conduct reported.
The Whistleblower, if not anonymous, is informed by the Receiving Party (or by the Legal & Business Affairs Director alone if the Reported Party is the entire Supervisory Body or a member of the Supervisory Body), through the same method used to receive the Report, of the filing or promotion of disciplinary action and invited to give their consent to the disclosure of their identity to the Reported Party to allow for cross-examination and defense.
14. Recipients of the Receiving Party Final Report
The Receiving Party (except in cases where the Supervisory Body and/or the Legal & Business Affairs Director themselves have been the subject of a Report) shall send the Final Report to the following recipients according to the different circumstances indicated below:
to the CdA: if the Unlawful Conduct was committed: (i) by one or more directors but not by the entire CdA, (ii) by one or more statutory auditors, even if the entire Board of Statutory Auditors is involved, (iii) by an employee with managerial status, or (iv) by a manager with powers in strategic or sensitive areas for the Company;
to the Board of Statutory Auditors: if the Unlawful Conduct was committed by the CdA as a whole or, in any case, by all members of the CdA;
to the HR Manager: if the Unlawful Conduct is committed by an employee who is not a manager and does not have powers in areas that are strategic or sensitive for the Company;
to the competent body based on the system of delegated powers and authorities adopted by the Company: if the Unlawful Conduct is committed by a third party.
In the event that the unlawful conduct was committed by one or more members of the Supervisory Body, including in the event of the involvement of all members of that body, the Legal & Business Affairs Director alone shall send the report to the CdA.
16. Confidentiality, protection, and safeguarding of whistleblowers
It is the responsibility of the Receiving Party (or solely the Legal & Business Affairs Director in the event that the Reported Party is the entire Supervisory Body or a member of the Supervisory Body) to guarantee the confidentiality of the identity of the Reporting Party and the Reported Party, as well as the protection of personal data, from the moment the Report is received, even in cases where it is subsequently found to be incorrect or unfounded. All processing must be carried out in accordance with the GDPR, the Privacy Code, and Legislative Decree No. 51/2018, bearing in mind the main obligations to be fulfilled and principles to be respected. The information on the processing of personal data is available on the whistleblowing portal and on the Company's website. All personal data processed through the portal is stored for the time strictly necessary to manage reports and track subsequent activities and, in any case, for no more than 5 years from the date of communication of the final outcome of the Report by the Receiving Party. Personal data that is clearly unnecessary for the management of a Report is not collected or processed or, if accidentally collected, is promptly deleted. Any original paper documents are stored by the Receiving Party in a secure environment at the Company.
Failure to comply with the obligation of confidentiality, protection, and safeguarding of the Whistleblower constitutes Unlawful Conduct under this Procedure and, consequently, under the Model, and therefore exposes the Receiving Party to liability.
All Reports received are logged with access restricted exclusively to the Receiving Party (or to the Legal & Business Affairs Director alone if the Reported Party is the entire Supervisory Body or a member of the Supervisory Body). Reports and the documentation attached to them may not be viewed or copied by anyone other than the Reporting Party and/or the Reported Party, within the limits of the law and to the extent that such access does not prejudice the right to confidentiality of the Reporting Party's identity as regulated below.
17. Traceability and document retention
The Receiving Party (or the Legal & Business Affairs Director alone if the Reported Party is the entire Supervisory Body or a member of the Supervisory Body) is required to document the Reports received by storing electronic and/or paper documents, in order to ensure the complete traceability of the actions taken to fulfill its institutional functions. Documents, whether paper or electronic, processed and/or modified by anyone in the context of this Procedure, must always contain information useful for identifying the author of the document and/or modification and the relevant date (Document Log).
Reports made in bad faith shall be archived, taking care to delete names and elements that could allow the identification of the Reported Parties and Persons Involved.
Oral report made during a meeting with the Receiving Party: subject to the Whistleblower’s consent, it shall be documented by the Receiving Party or authorized personnel either by means of a recording on a device suitable for storage and playback, or by means of written minutes
Report transcribed, documented in writing, or recorded: in cases where the Report is transcribed, documented in writing, or recorded, the Whistleblower’ may verify, correct, and confirm the content of the transcription or record by signing it.
Electronic documents are stored in a directory protected by authentication credentials known to the Receiving Party or to parties expressly authorized by it. Paper documents are stored in a designated location to which the Receiving Party or expressly authorized parties have access.
Retention: Internal and external reports and related documentation are stored for the time necessary to process the report and in any case for no longer than 5 years from the date of communication of the final outcome of the reporting procedure.
Reports cannot be used beyond what is necessary to adequately follow up on them.
18. Non-retaliation and guarantees
Reports may not be used for purposes other than those specified in this procedure. No form of retaliation or discriminatory measure directly or indirectly related to the Report is permitted or tolerated against the Whistleblower.
Protection from retaliation is guaranteed to whistleblowers even when they remain anonymous. Furthermore, it is also extended to: (i) categories of whistleblowers who do not fall within the objective or subjective scope of application of the decree; (ii) facilitators, persons who have an emotional or family relationship up to the fourth degree with the whistleblower and who share the same working environment, the whistleblower's work colleagues who have a regular and ongoing relationship with the latter; (iii) entities owned by the whistleblower or for which the whistleblower works, as well as entities operating in the same working environment as the whistleblower.
If an individual believes they have suffered retaliation under the decree, they can report it to ANAC, which has the power to impose sanctions. Furthermore, any retaliatory acts shall be null and void, and retaliatory dismissals entitle the dismissed person to reinstatement in the workplace. By way of example, the decree defines retaliatory measures as: dismissal, suspension, demotion, failure to promote, change of duties, reduction in salary, change in working hours, suspension of training, negative references, etc. Finally, it should be noted that, under the decree, unless proven otherwise, any damage suffered by a protected person following a report is presumed to be a direct consequence of the report. In other words, it is presumed to be retaliation.
19. Violation of whistleblower protection measures
If a Whistleblower believes that they have been the victim of retaliation or discrimination directly or indirectly related to the Report, they may inform the Receiving Party or, in the case of Employees, their line manager or HR Manager. The channels for Reports referred to in this Procedure may also be used. If it is established that a Whistleblower has been the victim of prohibited conduct, appropriate corrective measures will be taken to remedy the situation and/or remedy the negative effects of discrimination or retaliation, and disciplinary proceedings will be initiated against the perpetrator of the discrimination.
20. Reports made in bad faith
Any abuse of this Procedure, such as reports made in bad faith and any other case of improper use or intentional exploitation of the institution covered by this Procedure, shall be subject to disciplinary action and other appropriate measures. The responsibility of the Whistleblower remains unaffected in the event of a slanderous or defamatory Report pursuant to the Criminal Code and/or Article 2043 of the Civil Code.
In the case of Reports in relation to which the bad faith of the Whistleblower and/or the purely defamatory intent are ascertained, also confirmed by the groundlessness of the Report itself, appropriate disciplinary action will be taken against the Whistleblower.
21. Provisions relevant to labor law
The decree mandates the involvement of union representatives in the implementation of internal reporting channels, which provide special and rigorous protection to whistleblowers, prohibiting acts, behaviors, and retaliatory conduct causally related to the aforementioned whistleblowing activities.
The obligation to “consult” workers' associations takes place in two stages: prior notification to the trade union, informing it of the intention to activate the whistleblowing channel and sending a description of its essential elements, and a possible in-depth meeting, to be held if requested by the trade union.