Civitanavi S p A : Whistelblowing Procedure

Whistleblowing Procedure

Version	Date of approval
I edition	15 December 2023
II edition	22 December 2023

1

This is an English translation of the original Italian document. In cases of conflict between the English language document and the Italian
document, the interpretation of the Italian language document prevails.
Sommario
1. INTRODUCTION AND LEGAL BACKGROUND	4
2. OBJECT AND PURPOSE	5
3. DEFINITIONS	5
4. RECIPIENTS	6
5. ACTIVITIES	6
5.1 REPORTING THE VIOLATION	6
5.1.1 Who can report misconduct and violations	6
5.1.2 Subject of the reports	7
5.1.3 Reports not protected by whistleblowing regulations	7
5.1.4 Unfounded reports	8
5.1.5 Form and minimum content of internal reports	8
5.2 SAFEGUARDS	8
5.2.1 Content of the safeguards and subjective scope of application	8
5.2.2 Confidentiality	9
5.2.3 Prohibition of retaliatory or discriminatory acts	9
6. INTERNAL REPORTING CHANNELS	10
6.1 I INTERNAL REPORTING CHANNELS	10
6.2 REPORTS TO SB 231	10
6.3 THE PLATFORM FOR INTERNAL WRITTEN REPORTS	10
6.3.1 The Platform	10
6.3.2 Reporting in writing via the Platform	11
6.3.3 Oral reporting through the Platform	11
6.4 THE INTERNAL REPORTING CHANNEL MANAGER ("Whistleblowing manager")	11
6.4.1 Appointment of the person or office to handle reports	11
6.4.2 The activity of the internal reporting channel manager	11
6.4.3 Reports sent to parties other than the appointed reporting manager	11
6.4.4 Reports on 231 sent to the internal reporting channel manager	12
6.5 MANAGEMENT OF CONFLICTS OF INTEREST	12
7. PROTECTION OF PERSONAL DATA	12
7.1 DATA CONTROLLERS AND DATA PROCESSORS	12
7.2 EVALUATION OF IT TOOLS	13
7.3 INFORMATION AND CONSENT	13
7.3.1 Acknowledgment of the privacy policy	13
7.3.2 Express Consent to Data Disclosure	13
7.4 REGISTER OF TREATMENTS	13
7.5 DATA RETENTION	13
7.5.1 Traceability and Storage	13
8. INTERNAL WHISTLEBLOWING MANAGEMENT PROCESS	14
8.1 RECEIPT OF THE REPORT	14
8.2 PRELIMINARY ASSESSMENT OF ADMISSIBILITY OF THE REPORT	14
	2

This is an English translation of the original Italian document. In cases of conflict between the English language document and the Italian
document, the interpretation of the Italian language document prevails.
8.3 INVESTIGATION	15
8.4 CLOSURE OF THE REPORT	16
8.5 REPORTING	16
9. PENALTIES	17
9.1 DISCIPLINARY SYSTEM	17
9.2 LIMITATION OF LIABILITY OF THE REPORTING PERSON	18
10. STORAGE AND UPDATING OF THE PROCEDURE	18
11. INFORMATION AND TRAINING	18
11.1 INFORMATION	18
11.2 TRAINING	18
12. EXTERNAL REPORTING CHANNEL AND PUBLIC DISCLOSURE	19
12.1 REPORTING TO ANAC	19
12.2 PUBLIC DISCLOSURE	19

3

This is an English translation of the original Italian document. In cases of conflict between the English language document and the Italian document, the interpretation of the Italian language document prevails.

1. INTRODUCTION AND LEGAL BACKGROUND

Legislative Decree No. 24/2023, implementing Directive (EU) 2019/1937, repeals the previous regulations on whistleblowing (Legislative Decree 179/2017) and encloses in a single regulatory text - for the public and private sectors

• the protection regime for individuals who report unlawful conduct of which they have become aware in a work context (so-called whistleblower).

More generally, the regulatory framework is as follows:

• Directive (EU) 2019/1937
• Legislative Decree 24/2023
• ANAC Whistleblowing Guidelines of 12/7/2023
• Legislative Decree 196/2003
• Regulation 2016/679 (GDPR)
• Legislative Decree 231/2001
• Code of Ethics of Civitanavi Systems Spa
• Organizational Model 231 of Civitanavi Systems Spa.

4

This is an English translation of the original Italian document. In cases of conflict between the English language document and the Italian document, the interpretation of the Italian language document prevails.

2. OBJECT AND PURPOSE

In light of the provisions of Legislative Decree 24/2023 and the regulatory context in force, Civitanavi Systems Spa (hereinafter also referred to as "Civitanavi" or the "Company") has activated its own internal reporting channels. The main objective of this procedure (hereinafter also the "Procedure") is to define:

• the scope of the whistleblowing system;
• the entities that can make reports;
• the scope of the conduct, events or actions that may be reported;
• the channels (written and/or oral) through which reports are made;
• the principles and general rules that govern the reporting process, including the safeguards for the reporting party, the person involved (the so-called reported party) and any subjects mentioned, as well as the consequences of any abuses in the use of the established channels;
• the process of managing Reports in its various phases, with the identification of roles, responsibilities and operating methods.

3. DEFINITIONS

For the purposes of this Procedure, unless expressly and/or otherwise provided, the terminological definitions referred to in art. 2 of Legislative Decree 24/2023, and in particular:

• "violation" or "violations": conduct, acts or omissions that harm the public interest or the integrity of the public administration or private entity, as specified in art. 2, letter a) of Legislative Decree 24/20231;
• 'information on violations' means information, including well-founded suspicions, concerning infringements committed or which, on the basis of concrete evidence, may be committed in the organisation with which the reporting person or the person making a complaint to the judicial or accounting authority has a relevant legal relationship, as well2 as elements concerning conduct aimed at concealing such violations;
• "Reporting Person" or "Whistleblower" means a natural person who reports or publicly discloses information about violations acquired in the context of his or her work;3

1Art. 2 comma became 1. (a) D.Lgs 24/2023:

"1. For the purposes of this Decree, the following definitions shall apply:

1. 'infringements' means conduct, acts or omissions which are detrimental to the public interest or the integrity of the public administration or private entity and which consist of:
2. 1. administrative, accounting, civil or criminal offences that do not fall under numbers 3), 4), 5) and 6);
   2. unlawful conduct pursuant to Legislative Decree no. 231 of 8 June 2001, or violations of the organisational and management models provided for therein, which do not fall under numbers 3), 4), 5) and 6);
   3. offences falling within the scope of the European Union or national acts referred to in the annex to Decree 24/2023 or the

national acts implementing the European Union acts referred to in the annex to Directive (EU) 2019/1937, even if not indicated in the annex to Decree 24/2023, relating to the following areas: public procurement; financial services, products and markets and the prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; protection of privacy and protection of personal data and security of networks and information systems;

1. acts or omissions affecting the financial interests of the Union as referred to in Article 325 of the Treaty on the Functioning of the European Union as specified in the relevant secondary legislation of the European Union;
2. acts or omissions concerning the internal market, as referred to in art. Article 26(2) of the Treaty on the Functioning of the European Union, including infringements of the European Union competition and State aid rules, as well as infringements concerning the internal market linked to acts infringing corporate tax rules or mechanisms the purpose of which is to obtain a tax advantage which defeats the object or purpose of the applicable corporate tax legislation;
3. acts or conduct which frustrate the object or purpose of the provisions laid down in Union acts in the areas referred to in

points (3), (4) and (5);

1. Pursuant to art. 3 paragraphs 1-2 of Legislative Decree 24/2023.
2. In addition to the company's direct full-time employee, the following are also included:
3. • part-timeemployee;
   • worker with intermittent employment contract, apprenticeship contract, ancillary work, work supply contract,
   • provision of occasional work;
   • coordinated and continuous collaborators;
   • self-employed;
   • interns, volunteers, and trainees, paid and unpaid;
   • shareholders and persons with administrative, managerial, controlling, supervisory or representative functions;
   • Suppliers;

5

This is an English translation of the original Italian document. In cases of conflict between the English language document and the Italian document, the interpretation of the Italian language document prevails.

• 'facilitator' means a natural person who assists a reporting person in the reporting process, operating within the same work context and whose assistance must be kept confidential;
• "work context": the work or professional activities, present or past, carried out in the context of the relationships referred to in art. 3, paragraphs 3 or 4, through which, regardless of the nature of such activities, a person acquires information on violations and in the context of which he or she could risk suffering retaliation in the event of a report or public disclosure or complaint to the judicial or accounting authority;
• "Reported" or "Affected Person" means the natural or legal person named in the internal or external report or public disclosure as the person to whom the violation is attributed or as a person otherwise implicated in the reported or publicly disclosed violation;
• "retaliation(s)" means any conduct, act or omission, even if only attempted or threatened, carried out by reason of the report, the complaint to the judicial or accounting authority or the public disclosure and which causes or may cause unjust damage to the reporting person or to the person who filed the complaint, directly or indirectly;
• "Whistleblowing manager" or "Reporting manager": person/office/internal/external body composed of personnel specifically trained for the management of the internal reporting channel in line with the provisions of art. 4 of Legislative Decree 24/2023 and specifically appointed/appointed by the Company;
• "Recipients": for the purposes of this Procedure, the following are understood, as better identified below: the Company's employees; all the Company's stakeholders; the reporting person; the person reported; the manager of the report and the company functions that may be involved in the consequent activities;
• "Employee(s)": the natural person who works for the Company on the basis of an employment contract or by reason of the role held (including the company's directors);
• "Stakeholder" means a person or organization that may influence, be influenced, or perceive itself as being influenced, directly or indirectly, by a decision or activity of the Company. The stakeholder may be internal or external to the Company and include, by way of example, employees (including workers hired for the purpose of leasing) and collaborators, candidates, third parties (customers, suppliers, consultants and professionals), investors, regulators;
• "Model 231": the Organizational Model adopted by the Company pursuant to Legislative Decree 231/2001.
• "Supervisory Body" (also "SB"): pursuant to Article 6, paragraph 1 letter b) of Legislative Decree 231/2001, the body responsible for monitoring and regularly verifying the effectiveness of the Company's Model 231, for reporting any deficiencies and/or need for updating.
• "Platform": the software for the creation and management of the Company's internal reporting channel pursuant to Legislative Decree 24/2023.

4. RECIPIENTS

This Procedure applies to all Recipients (as defined above), who intend to report information relating to relevant violations pursuant to Legislative Decree 24/2023 through the Company's internal channels.

5. ACTIVITIES

5.1 REPORTING THE VIOLATION

5.1.1 Who can report misconduct and violations

Anyone in the context of their work who becomes aware of (or has a well-founded suspicion that unlawful conduct and/or a violation has occurred or may occur), may report it in accordance with this Procedure, refraining from taking independent in-depth and/or investigative initiatives. In particular, reports can be made by all the subjects defined above as "Reporting person" or "Whistleblower".

• workers or collaborators of suppliers;
• freelancers and consultants;
• third parties;
• probationary workers;
• candidates (if the information about the violation was acquired during the selection process);
• former employees (if the information about the violation was acquired during the employment relationship).

6

This is an English translation of the original Italian document. In cases of conflict between the English language document and the Italian document, the interpretation of the Italian language document prevails.

5.1.2 Subject of the reports

The following are reported:

• information on violations of which the Whistleblower has become aware in the context of his/her work context, during the performance of his/her work duties or in any case due to the existing or past relationship with the Company;
• information relating to conduct aimed at concealing the violation4;
• information on violations that have not yet been committed, but that the Whistleblower believes can be verified in the presence of precise and consistent concrete elements.

Referring to the specific definition of "violation" in the "Definitions" paragraph above, it is specified here that the information on violations that can be reported through the Company's internal channels may concern:

1. relevant unlawful conduct pursuant to Legislative Decree 231/2001 and violations of Model 231 and/or the Company's Code of Ethics;
2. offences that fall within the scope of European or national legislation referred to in the Annex to the Decree or of the national legislation implementing the European Union acts indicated in the Annex to Directive (EU) 2019/1937 (although not present in the Annex to the Decree), relating to the following sectors: public procurement; financial services, products and markets and the prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; protection of privacy and protection of personal data and security of networks and information systems;
3. acts or omissions affecting the EU's financial interests5;
4. acts or omissions relating to the internal market6;
5. acts or conduct which defeat the object or purpose of the provisions laid down in EU acts.

5.1.3 Reports not protected by whistleblowing regulations Whistleblowing protections do not apply to:

• anonymous (see below);
• consisting of disputes, claims or requests related to a personal interest of the whistleblower or of the person who has filed a complaint with the judicial authority that relate exclusively to their individual employment relationships or inherent to their employment relationships with hierarchically superior figures or with colleagues7;
• based on mere suspicions or rumours, unless the Whistleblower, although not certain of the actual occurrence of the facts reported and of the author of the same, considers it highly probable, based on his knowledge, that the reported unlawful act has actually occurred;
• infringements already compulsorily regulated by EU or national acts concerning financial services, products and markets and the prevention of money laundering and terrorist financing, transport security and environmental protection8;
• violations of national security, as well as procurement relating to defence or national security aspects, unless such aspects fall within the scope of secondary EU law;

1. For example, concealment or destruction of evidence about the commission of the violation.
2. By way of example: fraud, corruption and any other illegal activity related to the expenses of the European Union.
3. Examples include: infringements of competition and state aid.
4. In such circumstances, you can contact your HR department and/or your reporting manager.
5. As indicated in art. 1, par. 2, lett. b), of Legislative Decree no. No. 24/2023. By way of example, in the "financial services and prevention of money laundering and terrorist financing" sector, the application of Article 52-ter of the Consolidated Law on Banking and Articles 4-undecies and 4-duodecies of the Consolidated Law on Finance remain unaffected, respectively. In addition to specific internal communication channels, these provisions also include an external channel, addressed to the Bank of Italy or Consob, depending on the supervisory division. In the field of anti-money laundering and terrorist financing, Legislative Decree no. 231/2007 as amended by Legislative Decree no. 90/2017 which introduced art. Amendment No 48 on internal breach reporting systems.
   In addition, in the area of transport safety, the application of the rules on the monitoring of occurrences in the field of civil aviation, flag State responsibility for compliance with the Maritime Labour Convention, as well as international standards for ship safety, pollution prevention and living and working conditions on board for ships calling at Community ports and sailing in waters under the jurisdiction of the Member States remains unaffected. Member States; Finally, with reference to the "environmental protection" sector, the special rules on the safety of offshore oil and gas operations will continue to apply.

7

This is an English translation of the original Italian document. In cases of conflict between the English language document and the Italian document, the interpretation of the Italian language document prevails.

• facts or circumstances falling within the scope of national or European Union provisions on classified information, legal or medical secrecy and the secrecy of court decisions, or falling within the scope of national provisions on criminal procedure, the autonomy and independence of the judiciary, the provisions on the functions and powers of the Superior Council of the Judiciary, in the field of national defence and public order and security, as well as in the exercise and protection of the right of workers to consult their representatives or trade unions, protection against unlawful conduct or acts carried out as a result of such consultations, the autonomy of management and labour and their right to enter into collective agreements, as well as the repression of anti-union conduct;
• consisting of commercial complaints;
• requests to exercise the rights regarding the protection of personal data against the Company (so-called privacy rights) pursuant to art. 15-22 of EU Regulation 2016/679 (so-called "GDPR") for which please refer to the procedure in use by the Company. If these circumstances are also relevant pursuant to the 231 Organizational Model, they must be reported, as provided for in this Procedure.

Reports falling within the above types, although excluded from whistleblowing protections, will be handled pursuant to paragraph 8.2 below, as inadmissible reports as "not material".

In the case of anonymous reports, also in the light of ANAC's indications, it is specified that the same, if they are punctual, detailed and supported by appropriate documentation, are processed by the competent company department as indicated in the following paragraph 8.

In any case, anonymous reports must be registered by the Reporting Manager and the documentation received must be kept. In fact, where the anonymous whistleblower is subsequently identified and has suffered retaliation, the whistleblower must be guaranteed the protections provided for the whistleblower.

5.1.4 Unfounded reports

Reports that are unfounded as a result of the activities provided for in this Procedure, if made intentionally with intent or gross negligence, may result in the application of disciplinary sanctions, as provided for by this Procedure, Model 231 and the Company's Disciplinary Code (if any).

5.1.5 Form and minimum content of internal reports

For the purposes of the admissibility of the Report and the activation of the protections provided for by Legislative Decree 24/2023, the Whistleblower must indicate his/her personal details.

In order for a report to be acted upon, it must:

1. be carried out in good faith,
2. be substantiated and based on precise and consistent facts,
3. relate to facts that can be ascertained and known directly by the Whistleblower.

To this end, it is necessary9 that the Whistleblower:

1. provides a detailed description of the (alleged) violation, indicating the circumstances of the time and place in which the facts, conduct and/or omissions described were committed (or could be committed);
2. identifies the perpetrator of the (alleged) unlawful conduct (so-called reported) by specifying any element that allows identification (name/function/company role);
3. indicates any witnesses or persons in any way involved in the circumstance referred to in letter a).

It is the Whistleblower's right, both at the time of sending the report and subsequently, to attach documents and/or circumstances that may further substantiate and/or further substantiate what has been declared.

5.2 SAFEGUARDS

5.2.1 Content of the safeguards and subjective scope of application The safeguards provided by whistleblowing legislation mainly consist of:

9 Mandatory elements for the purpose of the correct management of the report or the verification of its admissibility.

8

This is an English translation of the original Italian document. In cases of conflict between the English language document and the Italian document, the interpretation of the Italian language document prevails.

• guarantee of confidentiality and confidentiality
• the prohibition of retaliatory acts

These safeguards apply:

1. to the Whistleblower;
2. Facilitators;
3. relatives10 who work in the same work context;
4. to the work colleagues of the reporting person or of the person who has filed a complaint with the judicial or accounting authority or made a public disclosure, who work in the same working context as the same person and who have a habitual and current relationship with that person;
5. entities owned by the reporting person or the person who has filed a complaint with the judicial or accounting authority or who has made a public disclosure or for which the same persons work, as well as entities operating in the same working environment as the aforementioned persons.

5.2.2 Confidentiality

From the moment the report is sent, the internal reporting channels adopted by the Company guarantee the confidentiality of:

1. Whistleblower;
2. Facilitators;
3. Reported;
4. Persons other than the Reported but mentioned in the report.

Consequently, without the express consent of the Whistleblower, the following may not be revealed:

• identity of the whistleblower,
• identity of the person reported,
• content of the report,
• any documents attached to the report.

The channel manager and any other parties involved (e.g. SB or HR department) are required to maintain the utmost confidentiality and to manage reports in order to guarantee professionalism, objectivity, impartiality and confidentiality of the activities undertaken to follow up on the report.

To this end, the Company's reporting process requires that:

• personal data that are clearly not useful for the management of a specific report are not collected or, if collected accidentally, are processed in compliance with the principle of data minimization;
• the identity of the Whistleblower and any other information from which it may be inferred, directly or indirectly, may not be revealed, without the express consent of the reporting person himself, to persons other than those competent and/or appointed and/or appointed to receive or follow up on the reports, expressly authorised to process such data11;
• In the context of disciplinary proceedings, the identity of the reporting person cannot be revealed, if the objection to the disciplinary charge is based on separate and additional investigations with respect to the report, even if they are consequent to the same. If the complaint is based, in whole or in part, on the report and knowledge of the identity of the reporting person is indispensable for the defence of the accused, the report will be used for the purposes of disciplinary proceedings only in the presence of the express consent of the reporting person to the disclosure of his or her identity.

5.2.3 Prohibition of retaliatory or discriminatory acts

Acts of retaliation or discrimination, direct or indirect, against the Whistleblower and other protected persons (as clarified in the previous paragraphs) are prohibited.

Any violation of this prohibition will result in the application of the measures provided for in Model 231.

By way of example and not limited to, the following constitute retaliatory acts:

1. dismissal, suspension or equivalent measures;

1. Persons linked to the whistleblower by a stable emotional or family bond within the fourth degree.
2. Pursuant to art. 29 and 32, paragraph 4, of the GDPR and art. 2-quaterdecies of the Code regarding the protection of personal data referred to in Legislative Decree no. 196 of 30 June 2003

9

This is an English translation of the original Italian document. In cases of conflict between the English language document and the Italian document, the interpretation of the Italian language document prevails.

1. relegation or non-promotion;
2. change of duties, change of place of work, reduction of salary, modification of working hours;
3. suspension of training or any restriction of access to it;
4. negative merit notes or negative references;
5. the adoption of disciplinary measures or other sanctions, including financial sanctions;
6. coercion, intimidation, harassment or ostracism;
7. discrimination or unfavourable treatment;
8. the failure to convert a fixed-term employment contract into an employment contract of indefinite duration, where the worker had a legitimate expectation of such conversion;
9. non-renewalor early termination of a fixed-term employment contract;
10. damage, including to the person's reputation, in particular on social media, or economic or financial harm, including loss of economic opportunities and loss of income;
11. improper listing on the basis of a formal or informal sectoral or industry agreement, which may result in the person not being able to find employment in the sector or industry in the future;
12. the early termination or cancellation of the contract for the supply of goods or services;
13. the cancellation of a licence or permit;
14. the request to undergo psychiatric or medical examinations.

6. INTERNAL REPORTING CHANNELS

6.1 I INTERNAL REPORTING CHANNELS

The Company fosters and promotes a culture of transparency and communication of reports and to this end has established and made available various internal reporting channels:

• reporting channel to the Supervisory Body 231;
• internal whistleblowing reporting channel in written form, through the Platform;
• internal whistleblowing reporting channel in oral form, through the Platform;
• Whistleblowing internal reporting channel in oral form, through a face-to-face meeting.

6.2 REPORTS TO SB 231

The report of violations of Model 231, of the Code of Ethics and/or of the commission of predicate offences pursuant to Legislative Decree 231/2001 can be made to the SB through the SB's e-mail address ([e-mail]), access to which is reserved only for members of the SB.

6.3 THE PLATFORM FOR INTERNAL WRITTEN REPORTS

6.3.1 The Platform

The Company has adopted an IT platform for whistleblowing reports called "Integrity Line" (the "Platform"), provided by the specialized service provider EQS, VAT 11630410964, with registered office in Corso Vercelli 40, 20145 Milan (MI).

The provider and the service offered by it guarantee confidentiality, confidentiality and anonymity, as required by Legislative Decree 24/2023. The provider has also been qualified for privacy purposes.

The Platform is structured in such a way as to ensure that:

• During the reporting process, the information acquired complies with the principles of personal data protection and maximum confidentiality. This is done through the adoption of encryption techniques and the implementation of technical and organizational security measures defined, evaluated and implemented also in the light of an impact assessment pursuant to Article 35 of the GDPR;
• the relevant information is accessible exclusively to the Whistleblowing Manager, within which the individual components have been authorised, as well as to any persons who have received specific authorisation;
• it is available continuously 24 hours a day, 7 days a week;
• the segregation of the reporting channel is allowed with reference to the company functions and the subjects who can access it for the collection and management of reports.

Access to the Platform is allowed, in general, to "reporting" parties, through:

• Company Website:https://www.civitanavi.com/it/governance/whistleblowing

10