WHISTLE BLOWING

ESTABLISHMENT OF THE INTERNAL WHISTLEBLOWING CHANNEL

ATAM S.p.A (the “Company”) has adopted the internal reporting system (so-called whistleblowing) in implementation of Italian Legislative Decree 24 of 10 March 2023 (hereinafter: “Decree”).

The objective pursued is to facilitate the reporting of breaches of national or European Union regulations that have occurred in the workplace and to protect the whistleblower (the "Whistleblower") both in terms of confidentiality, potential retaliation and liability for unfounded reports.

The operating methods of the internal whistleblowing channel established by ATAM S.p.A and Whistleblowing management are illustrated below.

1. WHAT CAN BE REPORTED

Information - acquired in the context of the employment relationship with the Company - relating to behaviours, acts and omissions that harm the public interest or the integrity of the Company and that consist of:

1. offences falling within the scope of the European Union or national acts set out in Part I of the Annex to the Decree or national acts constituting implementation of the European Union acts set out in the Annex to Directive (EU) 2019/1937, although not set out in the Annex to the Decree, relating to the following areas: public procurement/ services, financial products and markets and prevention of money laundering and terrorist financing/product safety and compliance/transport safety/environmental protection/radiation protection and nuclear safety/food and feed safety and animal health and welfare/public health/consumer protection/privacy and personal data protection and security of networks and information systems;
2. in acts or omissions that harm the financial interests of the European Union;
3. in acts or omissions concerning the internal market, including the breach of rules on competition and State Aid, corporate tax or mechanisms whose purpose is to obtain a tax advantage that defeats the object or purpose of the applicable legislation on corporate tax;
4. in the acts or conduct that defeat the scope or purpose of the provisions set out in the EU documents in the areas indicated in points (i) to (iii) above;
5. in the conduct aimed at concealing the breaches indicated above;
6. in unlawful activities that have not yet taken place, but which the Whistleblower reasonably believes may take place in the presence of concrete, precise and concordant elements.

The following are excluded from the scope of possible reports:

• disputes, claims or requests related to a personal interest of the Whistleblower that exclusively relate to their individual employment relationship, or inherent to their employment relationships with hierarchically superior figures;
• reports of breaches of national security, as well as of contracts relating to defence or national security aspects, unless such aspects fall within the relevant secondary legislation of the European Union;
• issues governed by (European and national) regulatory provisions on: classified information; legal and medical professional secrecy; secrecy of court deliberations; criminal procedure; autonomy and independence of the judiciary; legal position of members of the judiciary; national defence and public order and security; exercise of the right of workers to consult their representatives and trade union bodies and protection of such consultations; autonomy of social partners and the right to enter into collective agreements and repression of anti-union conduct;
• untrue information and mere suppositions, unreliable indiscretions (so-called "rumours"), as well as news in the public domain, incorrect information (with the exception of genuine error), and information that is manifestly unfounded or misleading; on the other hand, it is not necessary for the reporting party to be certain of the actual occurrence of the reported facts and the identity of the author thereof, but there must be serious grounds for believing that such facts exist.

2. WHO CAN MAKE A REPORT

The Report can be made by each of the following persons:

• the Company's employees;
• self-employed workers, professionals, consultants, collaborators, volunteers and trainees (even unpaid) who carry out their activity in favour of the Company;
• the Shareholders of the Company;
• persons exercising functions of administration, management, control, supervision or representation of the Company, even if the relevant activities are performed de facto and not de jure;
• providers of services to third parties for any reason (regardless of the nature of such activities) including in the absence of consideration.

The Whistleblower may make Reports during the course of the relationship and in relation to known breaches:

• when the employment relationship has not yet begun, i.e. in the selection or pre-contractual negotiation phase;
• during the trial period;
• after the dissolution of the relationship, in relation to the information acquired before the termination of the relationship.

3. HOW TO MAKE A REPORT

3.1 Contents of the Report

It is necessary for the Report to be as detailed as possible, in order to enable the persons in charge of receiving and handling the Report to analyse the facts.

In particular, the Report must contain the following essential elements:

• the identification data of the Whistleblower (name, surname, tax code, place and date of birth) and an address (address of residence or, if different, of domicile) to which subsequent updates on the procedure for handling the Report should be sent;
• the circumstances of time and place in which the facts that are the subject of the Report occurred, with a description of the facts that are the subject of the Report, specifying the details of the circumstantial information and, where present, also the manner in which the Reporting Officer became aware of the facts that are the purpose of the Report;
• details or other elements to identify the person to whom the reported facts are attributed;
• in the case of use of the written form for the Whistleblowing Report, the the clarification of the intention to keep the identity of the Whistleblower confidential and to benefit from the whistleblowing protections, by affixing the wording “CONFIDENTIAL TO THE WHISTLEBLOWING MANAGER” on the outside of the registered letter when sending the Report;
• in the case of the use of the written form for reporting, the possible request for a face-to-face meeting with the person responsible for managing the internal channel.

It is also useful for the Whistleblower to provide documents supporting the validity of the facts reported, as well as the indication of other persons potentially aware of the facts.

3.2 Report in written form

The Report in written form may be sent by registered letter with acknowledgement of receipt (hereinafter "Registered Letter") to the address of the operational headquarters of ATAM S.p.A., via Archimede n. 7, 20864 Agrate Brianza (MB), to the attention of the Whistleblowing Manager (the "Manager"). 

The Registered Letter must be marked "CONFIDENTIAL TO THE WHISTLEBLOWING MANAGER" and inside the envelope the Whistleblower must insert two further separate closed envelopes, containing:

• the first, the identity data of the Whistleblower (name, surname, tax code, place and date of birth) and a postal address of usual residence at which subsequent updates should be communicated, together with a copy of the identity document and
• the second, the purpose of the Report (the circumstances of time and place in which the reported fact occurred, a description of the facts that are the purpose of the Report and specification of the details relating to the circumstantial information and, where present, also the manner in which the Whistleblower became aware of the facts that are the purpose of the Report; generalities or other elements enabling the identification of the person to whom the reported facts are attributed).

3.3 Oral report

The Report in oral form may be made through a voice messaging system (hereinafter "Telephone Reporting"), by contacting the dedicated telephone number 039.60746320 and must be preceded by a declaration by the Whistleblower that the message is to be understood as “CONFIDENTIAL TO THE WHISTLEBLOWING MANAGER” and must specify all the minimum elements of the Report as indicated above.

4. HOW THE REPORT IS HANDLED

Receipt of a Report by Registered Letter or Telephone Report by the Manager initiates the process of handling the Report, which takes place in compliance with the procedure set out in the following steps:

• receipt of the Report phase,in which the Manager will send the Whistleblower an acknowledgement of receipt of the Report within 7 (seven) days of its receipt, confirming that the Report has been taken over; if the Report is erroneously transmitted to a person other than the Manager, the recipient is forbidden to open the envelope of the registered letter or to continue listening to the message in the case of a telephone report, and is required to transmit it to (or inform) the Manager within seven days, notifying the Whistleblower of the transmission and taking any action and conduct necessary to ensure the confidentiality of the data and information contained in the report; failure to comply with the above-mentioned requirements results in the obligation to pay compensation for the related damages;
• preliminary examination phase of the Report, aimed at verifying the acceptability and admissibility of the Report;
• investigation phase, aimed at evaluating the validity of the Report;
• decision phase, at the outcome of which the Manager may order the filing of the Report or declare the possible validity of the Report and, consequently, report the content of the Report and the outcome of the checks carried out to the members of the Board of Directors of the Company, communicating the outcome of the procedure for managing the Report to the Whistleblower within 7 (seven) days from the adoption of the final act.

5. HOW TO PROTECT THE WHISTLEBLOWER

The Whistleblower is granted the protections envisaged by the Decree for Reports made in compliance with the applicable regulations, with particular reference to:

1. the confidentiality obligations of their identity: the identity of the Whistleblower and of the other Protected Persons, as well as any other information and documentation from which such identity may be deduced -directly or indirectly- must be kept confidential and cannot be disclosed, without the express consent of the person concerned, to persons other than the Manager or those who may be appointed to follow up the Reporting, expressly authorised to process such data pursuant to articles 28, 29 and 32(4) of the Regulation and art. 2-quaterdecies of the Data Protection Code pursuant to Italian Legislative Decree 196 of 30 June 2003;
2. prohibition of retaliatory acts against the Whistleblower and the other Protected Persons: any retaliation against the Whistleblower and the other Protected Persons is prohibited, meaning any conduct, act or omission, even if only attempted or threatened, carried out in connection with the Reporting and strictly related to it, and which causes or may cause the Whistleblower or the other Protected Persons, directly or indirectly, unfair damage and
3. the limitation of its liability for the collection or dissemination of certain types of protected information; it should be noted, however, that the limitation of liability operates only if (a) the reasons for the disclosure or dissemination are not based on mere allegations, gossip, revenge, opportunistic or scandalistic purposes; (b) the conduct is related to the Report and strictly necessary to reveal the breach and (c) the information or documents on the basis of which the Report was made have not been unlawfully acquired.

The aforementioned protection measures also apply to the following subjects ("Protected Persons"):

a) the facilitator (i.e. the natural person who assists the Whistleblower in the whistleblowing process operating within the same working context);

b) to persons in the same employment context as the Whistleblower who are linked to the latter by a stable emotional bond or kinship within the fourth degree;

c) to the Whistleblower's co-workers who work in the same context as the same and who have a habitual and current relationship with the Whistleblower;

d) to the entities owned (exclusively or in majority partnership with third parties) by the Whistleblower or for whom the Whistleblower works, as well as to the entities that operate in the same working context as the aforementioned persons (for example, companies in partnership with ATAM S.p.A. whose employee has transmitted a report relating to the same ATAM S.p.A.).

The information regarding the processing of the Whistleblower's personal data is published on the Company's website, which will be carried out on the basis of the impact assessment on data processing carried out by the Company pursuant to art. 13, subsection 6, of the Decree.

6. CONDITIONS FOR THE EXECUTION OF EXTERNAL REPORTS AND FOR PUBLIC DISCLOSURE

Subject to the use of the internal channel for the transmission of the Report, the Whistleblower may transmit the Report through an external channel, established and managed by the ANAC (the only one entitled to receive external reports pursuant to the methods and procedures adopted by the body that can be viewed on the website www.anticorruzione.it, only upon the occurrence of the following conditions:

- in the event that the internal Whistleblowing channel established by the Company does not comply with the regulatory requirements;

- when the Whistleblower has already forwarded a Report through the internal channel and it has not been followed up;

- if the Whistleblower has reasonable grounds to believe that, by submitting a Report through the internal channel established by the Company, it will not be effectively followed up or that it, in itself, will determine retaliation against them;

- in the event that the Whistleblower has a well-founded reason to believe that the breach to be reported may constitute an imminent or obvious danger to the public interest.

On a further residual basis and subject to the transmission of the Report by internal or external channel, the Whistleblower can make a public disclosure (press, electronic means or in any case by means of dissemination capable of reaching a large number of people), only under the following conditions:

- when they have previously made a Report through an internal channel set-up by the Company and through a channel external to the ANAC, or has directly made an external Report without having received feedback within the terms envisaged;

- in the event that they have well-founded reasons to believe that the breach constitutes an imminent or obvious danger to the public interest;

- when they have well-founded reasons to believe that the External Report may involve the risk of retaliation or may not be effectively followed up due to the specific circumstances of the specific case, such as those in which evidence may be concealed or destroyed or in which there is a well-founded fear that the person who received the Report may be in collusion with the perpetrator of the breach or involved in the breach.