Civitanavi S p A : L.231 Model

Organization, management and control model

Legislative Decree no. 231/2001

General Part

Version	Approval date
I edition	Resolution of the Board of Directors of the day 04/07/2022

INDEX
A. PURPOSE OF THE ORGANISATION, MANAGEMENT AND CONTROL MODEL	.......4
B. RECIPIENTS OF THE 231 MODEL.............................................................................................	4
C. STRUCTURE OF 231 MODEL 231 .............................................................................................	5
1. THE REGULATORY FRAMEWORK ...........................................................................................	5
1.1 THE RESPONSIBILITY OF THE ENTITIES ......................................................................	5
1.2 THE EXEMPTING CONDUCT .............................................................................................	6
1.3 SANCTIONS............................................................................................................................	7
2. CIVITANAVI SYSTEMS S.p.a. ......................................................................................................	9
3. THE CIVITANAVI SYSTEMS S.p.a. 231 MODEL ...................................................................	10
3.1. REALISATION, IMPLEMENTATION AND MODIFICATION OF THE 231 MODEL .10
3.1.1 Risk assessment ...........................................................................................................	10
3.1.2 Identification of sensitive areas and activities...........................................................	11
3.1.3 Risk Management and Gap Analysis .........................................................................	12
3.1.4 Adoption and amendments of the 231 Model ...........................................................	12
3.1.5 Dissemination of the 231 Model and training of Company's units.........................	13

3.2 THE MANAGEMENT AND CONTROL SYSTEM OF CIVITANAVI SYSTEMS S.P.A.

........................................................................................................................................................13

3.2.1. The Code of Ethics.......................................................................................................	14
3.2.2 Corporate governance.................................................................................................	15
3.2.3 The Company's Organizational Chart........................................................................	15
3.2.4 General principles of control and General principles of conduct ...........................	16
3.2.5 Management systems ..................................................................................................	16
3.2.6 Prevention measures....................................................................................................	17
4.THE SUPERVISORY BODY...........................................................................................................	18
4.1 DEFINITION AND REQUIREMENTS OF THE SUPERVISORY BODY ....................	18
4.2 APPOINTMENT, REVOCATION AND RESIGNATION OF THE MEMBERS OF THE
SUPERVISORY BODY ..............................................................................................................	19
4.3 FUNCTIONS AND POWERS OF THE SUPERVISORY BODY ...................................	20
4.4 INFORMATION FLOWS OF THE SUPERVISORY BODY ...........................................	22
4.4.1 Reporting obligations ....................................................................................................	22
4.4.2 Whistleblowing ...............................................................................................................	22
4.4.3 Information requirements .............................................................................................	23
	2

4.5 REPORTING OF THE SB TO THE OTHER CORPORATE BODIES .........................	24
5. DISCIPLINARY AND SANCTIONING SYSTEM .....................................................................	25
5.1 GENERAL PRINCIPLES .....................................................................................................	25
5.2 VIOLATIONS OF THE MODEL AND THE ETHICAL CODE ........................................	25
5.3 MEASURES WITH REGARD TO THE EMPLOYEES ...................................................	26
5.4 MEASURES WITH REGARD TO THE DIRECTORS.....................................................	27
5.5 MEASURES WITH REGARD TO THE MEMBERS OF THE BOARD OF
STATUTORY AUDITORS..........................................................................................................	27
5.6 MEASURES WITH REGARD TO THE THIRD PARTIES (SUPPLIERS, BUSINESS
PARTNERS, CONSULTANTS, SELF-EMPLOYED WORKERS) .......................................	27
5.7 MEASURES WITH REGARD TO THE SUPERVISORY BODY...................................	27
5.8 COMPENSATION FOR DAMAGES..................................................................................	28

3

INTRODUCTION

A. PURPOSE OF THE ORGANISATION, MANAGEMENT AND CONTROL MODEL

This document describes the Organization, Management and Control Model adopted by CIVITANAVI SYSTEMS S.p.a. (hereinafter "CIVITANAVI") pursuant to Legislative Decree no. 231 of 8 June 2001 (hereinafter also "Legislative Decree 231/01" or "Decree").

The Organization, Management and Control Model (hereinafter also the "231 Model") represents a coherent set of principles and operating rules that govern the internal functioning of the Company and the ways in which it deals with the outside world and it describes the control system of sensitive activities, in order to prevent the committing of or attempts to commit offenses referred to in Legislative Decree 231/2001.

The adoption of 231 Model therefore allows the Company:

1. • to prevent and fighting against the committing of offenses established by Decree 231 and discipline the Company's units behaviour contrary to the Decree and Company's rules, thanks to monitoring actions on sensitive activities;
   • to bring to the attention of all personnel of the Company and third parties (customers, suppliers, collaborators, partners, etc.) the necessity to adopt, in the conduct of their activities, correct and transparent conduct in line with the ethical andsocial values of the Company in the pursuit of preventing the risk of committing an offense established by Decree 231;
   • to increase the awareness of the above-mentioned actors of the fact that illegal behavior could lead to administrative sanctions against the Company and those who are contrary to the interests of the Company even when it apparently could benefit from such behavior;
   • to verify, rationalize, review and integrate the decision-making and operational processes, as well as the control systems of the Company;
   • to introduce and disseminate the awareness among the personnel of the Company to respect and apply the rules of conduct and preventive protocols explaining that violation of their provisions potentially can be resulted in criminal, civil and disciplinary liability.
2. RECIPIENTS OF THE 231 MODEL

Personnel of the Company are considered to be recipients (hereinafter the "Recipients") of the 231 Model. Recipients undertake to comply with the content of the 231 Model, that applies to , by way of example:

• those who perform, even de facto, representative, managerial administrative, executive and controlling roles in the Company;
• employees and collaborators of the Company, of any degree and under any type of contractual relations.

4

These Recipients, and in particular those who carry out risk activities under the provisions of the 231 Model, must comply with all requirements timely, even in fulfillment of the duties of fairness and diligence arising out from the established legal relations with the Company.

In addition, provisions of the Code of Ethics is binding, based on certain contractual clauses, to all Third Parties, not belonging to the Company's organization, but operating on behalf of or in the interest of the Company.

C. STRUCTURE OF 231 MODEL 231

The CIVITANAVI 231 Model consists of:

• General Part, which describes the function of the 231 Model, the regulatory framework of reference, the structure of the 231 Model adopted by the Company, briefly illustrates the methods of identifying risks and analyzing prevention measures, the Management and Control System introduced in the Company, the functions and activities of the Supervisory Body and the current disciplinary system;
• Special Parts, which identify, in relation to the relevant types of offense, the business processes which are potentially at "risk 231", contain examples of the hypothetical methods of committing offenses and define the behavioral principles to be respected as well as the reference safeguards for risk prevention.

The following are also to be considered integral and substantial parts of the 231 Model:

• the Code of Ethics, which defines the general values and principles of ethics, the Company's personnel must comply with;
• the Management and Control System of the Company, set forth in paragraph 3.2.
  1. THE REGULATORY FRAMEWORK

1.1 THE RESPONSIBILITY OF THE ENTITIES

Legislative Decree no. 231 of 8 June 2001 introduced in Italy the "Discipline of the administrative responsibility of legal persons, companies and associations even without legal personality", which establishes the direct responsibility of the Entities for unlawful acts committed in their interest or to the advantage of the Company's personnel in key positions or their subordinates.

It implies an administrative liability imposed on legal entities in addition to the criminal liability of the natural person belonging to the such entities, who committed the unlawful act.

In particular, legal entities areresponsible for offenses committed in its interest or for its own benefit by:

• top managers: natural persons who hold key positions.
  This concept includes those who have powers of representation, administration or direction of the legal entity or of one of its organizational units endowed with financial and functional autonomy and those who exercise, even de facto, the management and control of such legal entity;
• subordinates: natural persons subject to the direction or supervision by the top management.
  This concept covers employees and, more generally, all workers subject to the supervision of the top management.

5