Information Notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 on the Processing of Personal Data within the Whistleblowing Reporting System

Buzzi, Notaro & Antonielli S.p.A. has introduced, within its internal control system, a specific procedure entitled “Management of Reports of Unlawful Acts and Irregularities”. This procedure, in the context of receiving and handling reports, ensures the application of all necessary measures to protect the parties involved in accordance with Article 6, paragraphs 2-bis and 2-ter of Legislative Decree 231/2001, as well as the applicable privacy legislation (Regulation (EU) 2016/679 – GDPR) and the Privacy Code (Legislative Decree 196/2003).

1. DATA CONTROLLER

For reports concerning Buzzi, Notaro & Antonielli S.p.A., the Data Controller is Buzzi, Notaro & Antonielli S.p.A., with registered office in Turin (TO), Corso Vittorio Emanuele II no. 6, Tax Code and VAT no. 06294960015, which may be contacted at:

• Email: This email address is being protected from spambots. You need JavaScript enabled to view it.
• Mail:
  Buzzi, Notaro & Antonielli d’Oulx S.p.A.
  Administrative Office
  Corso Vittorio Emanuele II no. 6
  10123 – Turin (TO)

2. DATA PROTECTION OFFICER (DPO)

The Data Protection Officer is Mediaform s.c.a r.l., Salita Nuova NS del Monte 3c, 16143 Genoa.

3. PURPOSES AND LEGAL BASIS OF PROCESSING

The Company processes personal data:

• in order to comply with legal obligations under Article 6 of Legislative Decree 231/2001 and Legislative Decree No. 24 of 10 March 2023;
• on the basis of the legitimate interest, pursuant to Article 6(1)(f) of the GDPR, in countering unlawful conduct, including but not limited to violations of the Anti-Mafia Code of Conduct, the Code of Ethics, and the Supplier Code of Conduct.

These purposes constitute the legal basis legitimising the processing of personal data of the parties involved in a report.

4. CATEGORIES OF DATA PROCESSED AND CONSEQUENCES OF FAILURE TO PROVIDE DATA

In accordance with the principle of data minimisation, only personal data strictly necessary to assess and manage the report will be processed. Such data may include, by way of example, identification data (e.g., name, surname), special categories of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, as well as data concerning health, sex life or sexual orientation, and judicial data relating to criminal convictions, offences, or related security measures.

The Data Controller shall process such data solely for purposes directly connected with verifying the authenticity of reports or for compliance with specific legal obligations. Any data not necessary for such purposes will not be processed and, if received, will be permanently deleted.

Providing personal data necessary for the verification of reports or for compliance with legal obligations is mandatory. Refusal, in whole or in part, to provide such data may render it impossible to follow up and manage the report.

5. RECIPIENTS OF PERSONAL DATA

Recipients of personal data include the Whistleblowing Committee and, where applicable, the Supervisory Body, which, in accordance with current legislation and the Company’s Whistleblowing Procedure, are required to ensure the confidentiality of the whistleblower’s identity.

During the verification of the report’s validity, where necessary for investigative purposes, personal data may be disclosed to other Company departments and/or functions. In such cases, the duty to preserve the confidentiality of the whistleblower’s identity shall extend to all persons involved in supporting the Supervisory Body.

Personal data may be disclosed to the manager responsible for disciplinary proceedings and/or to the accused employee solely in the following cases: (i) with the express consent of the whistleblower; or (ii) where the disciplinary charge is based exclusively on the report and disclosure of the whistleblower’s identity is indispensable for the defence of the accused.

6. METHODS OF PROCESSING

Pursuant to Article 5 of Regulation (EU) 2016/679 (GDPR), personal data processed by the Company in the context of the procedure shall be:

• processed lawfully, fairly, and transparently with respect to the data subject;
• collected for specified, explicit, and legitimate purposes and subsequently processed in a manner consistent with such purposes;
• adequate, relevant, and limited to what is necessary for the purposes for which they are processed;
• accurate and, where necessary, kept up to date, with all reasonable measures taken to promptly rectify or erase inaccurate data;
• stored in a form permitting identification of the data subject for no longer than is necessary for the purposes for which the data are processed;
• processed in a manner ensuring appropriate security of personal data, including protection against unauthorised or unlawful processing, accidental loss, destruction, or damage, by means of suitable technical and organisational measures.

7. Data Retention Period

Data shall be retained by the Data Controller for the duration of the report management procedure and, where necessary, for a longer period required for compliance with other legal obligations or for the protection of the legitimate interests of the Data Controller or third parties, as indicated above.

8. DATA SUBJECTS’ RIGHTS

Regulation (EU) 2016/679 (Articles 15 to 23) grants data subjects specific rights, including:

• the right of access to personal data, including the right to obtain a copy thereof;
• the right to data portability, i.e., to receive their personal data in a structured, commonly used, machine-readable and interoperable format;
• the right to rectification, to request the updating, correction, or integration of data;
• the right to erasure, restriction, anonymisation, or blocking of unlawfully processed data, including data unnecessary for the purposes for which they were collected or subsequently processed;
• the right to object, in whole or in part, on legitimate grounds, to the processing of personal data concerning them, even if relevant to the purpose of collection, as well as to processing carried out for purposes provided for by applicable legislation.

Responses, communications, and actions by the Data Controller in relation to the above rights shall be provided free of charge. However, where requests are manifestly unfounded, excessive, or repetitive, the Data Controller reserves the right to charge a reasonable fee reflecting administrative costs incurred or to refuse to act on the request.

9. COMPLAINT

The data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) in accordance with the procedure available on the Authority’s website (www.garanteprivacy.it), in order to report a breach of data protection regulations and request an investigation by the Authority.