Whistleblowing

Procedure for Reporting Whistleblowing through Internal Company Channels

Intré has established internal communication channels for reporting violations of national or European Union regulations, learned in the workplace context of the reporting individual, also known as “whistleblowing reports,” in implementation of the provisions of Legislative Decree No. 24 of March 10, 2023, which transposes EU Directive 2019/1937 of the European Parliament and the Council of October 23, 2019.

Who is it addressed to?

The internal whistleblowing channel is available to all individuals (natural persons) working within the context of Intré S.r.l., including:

permanent or fixed-term employees;
holders of collaboration agreements;
volunteers or interns, with or without compensation;
freelancers and professionals;
individuals holding administrative, managerial, supervisory, or representative functions;
suppliers of goods or services and those carrying out work at their premises.

What is meant by Whistleblowing Report?

A whistleblowing report is a communication regarding a violation (criminal, civil, administrative) of European Union regulations and all national provisions implementing them in the following sectors or areas:

public procurement, services, products, and financial markets, and prevention of money laundering and terrorist financing; product safety and compliance, transport safety;
environmental protection;
radiation protection and nuclear safety;
food and feed safety, and animal health and welfare;
public health;
consumer protection;
protection of privacy, personal data security, and information system security;
financial interests of the European Union and the free movement of goods, persons, services, and capital within the internal market, or the subject and objectives of EU provisions in the previously mentioned sectors.

The report may also concern well-founded suspicions that one of the above violations has occurred or is being concealed in the workplace of Intré S.r.l.

The following are excluded:

mere irregularities (but these may constitute concrete elements to be evaluated as symptomatic indicators, if they reasonably lead the reporter to believe that one of the violations outlined in Legislative Decree No. 24/2023 may occur);
reports clearly without basis;
information already entirely in the public domain;
information acquired solely based on unreliable rumors or hearsay (so-called “gossip”).

The internal channels cannot be used for disputes, claims, or requests related to a personal interest of the reporter solely related to their individual employment relationship or concerning their relationship with hierarchical superiors.

Whistleblowing reports may also be made when the legal relationship has not yet started if the information about the violations was acquired during the selection process or in other pre-contractual stages; during a probationary period, if applicable; or after the termination of the legal relationship if the information about the violations was acquired during the course of the relationship.

What are the internal channels used for?

The regulatory framework set out by Legislative Decree No. 24 of March 10, 2023, has the general objective of promoting the principles of legality, economic initiative freedom, and free competition (Article 41 of the Constitution), with the main aim of protecting the whistleblower and others who, according to the law, may be at risk of retaliation.

What are the channels?

To facilitate reporting, the following channels have been defined:

Electronic Channel
This is a reporting channel designed to guarantee, through electronic means, the confidentiality of the reporter’s identity, in compliance with the regulations. Intré has chosen to use My Whistleblowing, a software by My Governance, available at the following link.
Through this electronic channel and the software, the reporter will be guided through each phase of the report and required to complete several mandatory fields to best specify the report in accordance with the necessary requirements.
Paper Channel
The reporter can send a registered letter to the following address:
Whistleblowing Office
Intré S.r.l.
Via Gaslini, 2
20900 Monza (MB)
The envelope must be marked as “Confidential.”
It is recommended to use the form provided for this purpose, but in any case, all reports will be processed, even if submitted in a different format, as long as they are detailed.
Verbal Channel
It is possible to call the number 039/28.45.774 during working hours and ask to speak with the individuals responsible for the whistleblowing service.

Management Procedure

Details of the management procedure, regulatory references, and examples of violations can be further explored in this document.

Data Protection Notice – Whistleblowing

Pursuant to Article 13 of European Regulation No. 679/2016 (hereinafter also referred to as the “GDPR”) and in relation to the reporting service according to Legislative Decree 24/2023, we provide you with this notice.

Data Controller

The data controller is Francesco Rigillo for the company INTRE’ srl, located at Via G. Gaslini 2, Monza, email francesco.rigillo@intre.it.

Location of Data Processing

The data processing activities take place within the EU, and there is no transfer or dissemination of data to non-EU countries.

Data Processed, Legal Basis, Nature, and Purpose of the Processing

The data processed in managing the report are:

contact details, identification information, or contact details provided by the reporter;
Information (identification data, professional data, financial data) about the reported person contained in the report or acquired during the investigation;
Information (identification data, professional data, financial data) about third parties that may be included in the report and in any attached documents or acquired during the investigation.

The provided data will be processed for the following purposes:

Management of reports (investigation of the facts reported). The legal basis for the processing is the legal obligation under Legislative Decree No. 24 of March 10, 2023.
Management of any disciplinary proceedings based entirely or partially on the report. To ensure the right of defense of the reported person, the information in the report may be used, together with any external corroborative elements, in the disciplinary procedure initiated against the reported individual. The identity of the reporting person cannot be revealed if the disciplinary charge is based on separate and additional findings, even if subsequent to the report. If the charge is based, in whole or in part, on the report and the knowledge of the reporting person’s identity is necessary for the defense of the accused, the report will be used for the disciplinary procedure only with the explicit consent of the reporting person to disclose their identity. Therefore, in this case, failure to provide consent will result in the inability to proceed against the reported person.

The reporting person’s personal identification data are processed and stored in a way that they are visible exclusively to the entity responsible for managing the report. The company adopts all legal safeguards to protect the confidentiality of the reporting person’s identity, so that it is not disclosed to third parties without their express consent, except in cases of malicious or defamatory reports.

Recipients of the Data

The data may be shared with:

the Supervisory Body, if present, of the company for the reporter’s data only;
internal employees of the Data Controller or subjects, entities, or authorities to whom the data must be communicated under legal provisions or orders from authorities for the data subject to the report;
subjects typically acting as data processors pursuant to Article 28 GDPR, i.e., those cooperating with the Company to achieve the above purposes.

Data Retention Period

The personal data related to reports and the corresponding documentation are kept for the period necessary to complete the verification of the facts reported and for 5 years following the closure of the report, unless there are any proceedings arising from the management of the report (disciplinary, criminal, accounting) against the reported person or the reporting person (malicious, false, or defamatory statements). In this case, data will be retained for the entire duration of the procedure and until the appeal period of the relevant decision expires. Personal data that are clearly not useful for processing a specific report will not be collected, or if collected accidentally, will be immediately deleted.

Methods of Processing

Personal data are processed both through automated tools and manually, for the purposes indicated above. Specific security measures are taken to prevent data loss, unlawful or incorrect use, and unauthorized access.

Data Subject Rights

Data subjects may at any time request to know the origin, purpose, and methods of the processing, obtain access to the data, update, rectify, integrate, erase, anonymize, or limit the processing, block data processed unlawfully, and receive a copy of the data in a structured, commonly used, and machine-readable format, or transmit such data to another data controller without hindrance. Data subjects may also file a complaint with the Supervisory Authority, represented in Italy by the Personal Data Protection Authority. For information, you may consult the Authority’s website at www.gpdp.it.

To exercise their rights, data subjects can write to the Data Controller’s contact details.

This Notice was last updated on 17/Dec/2023