INFORMATION ON THE PROTECTION OF PERSONAL DATA PURSUANT TO ART. 13

EU REGULATION 679/2016 AND LEGISLATIVE DECREE 196/2003 AS AMENDED BY LEGISLATIVE DECREE 101/2018 IN RELATION TO WHISTLEBLOWING REPORTS

Our Company has always been very attentive to personal data protection and respect for the principles of privacy and human dignity.

This disclosure concerns the provisions of Legislative Decree No. 24 of 10 March 2023, which, in implementation of Directive (EU) 2019/1937, aims to protect individuals who report violations of European Union law and national regulations. The regulation pursues the objective of combating and preventing illegal activities in public and private organizations, encouraging the emergence of prejudicial conduct—of which the whistleblower has become aware in the context of their work—that harms or could harm the public interest or the integrity of the organization.

public or private.

This privacy policy concerns the processing of personal data contained in reports submitted by the reporting party to the Company through the internal reporting channel. In this regard, please read the following privacy policy. Cooperativa Luigi Morelli, Via di Sottomonte 27, 55060 Guamo – Capannori (LU), tax code and VAT number 00130460462, in its capacity as Data Controller, represented by its legal representative pro tempore, pursuant to and for the purposes of EU Regulation 2016/679, hereby informs the data subject that the personal data concerning him or her, acquired by the Data Controller or subsequently requested and/or disclosed by third parties, are necessary and will be used for the purposes indicated below.

PURPOSE AND LEGALITY OF THE PROCESSING

  • The purposes for which the data is collected are as follows:
  • Carrying out the correct and complete management and archiving of the reports received;
  • Carrying out the necessary investigative activities aimed at verifying the validity of the reported fact and adopting the consequent measures;
  • Provide feedback to the whistleblower or to a request received from the judicial authority or an authority assimilated to it;
  • Legal protection of a right of the Data Controller.

LEGAL BASIS FOR THE PROCESSING

Processing is lawful under the following conditions:

  • Pursuant to Article 6, paragraph 1, letter c) of EU Regulation 679/2016, processing is necessary for compliance with a legal obligation to which the data controller is subject and, specifically, the whistleblowing obligations set forth in Legislative Decree no. 24 of 10 March 2023.
  • The express consent (Article 6, paragraph 1, letter a) of EU Regulation 679/2016) of the reporting person is not necessary, except in the following cases:
  • For the purpose of disclosing the identity of the reporting person and any other information from which such identity may be deduced, directly or indirectly, to persons other than those competent to receive or follow up on the reports, expressly authorised to process such personal data.
  • In the event that the report is collected orally (direct meeting), for the purpose of possible recording (e.g. mp3).

Providing the reporting person's data is not mandatory; however, an anonymous report cannot be followed up if it is not sufficiently detailed and substantiated to allow for its follow-up.

PROCESSING METHODS AND CONFIDENTIALITY OBLIGATION

Data processing is performed using IT tools (dedicated platform) and/or paper-based media by parties committed to confidentiality, using procedures related to the purposes and in any case ensuring data security and confidentiality. The collected data will not be disclosed or distributed to third parties in accordance with the law.

COMMUNICATION TO THIRD PARTIES

Your personal data may be disclosed to third parties known to us solely and exclusively for the aforementioned purposes and, in particular, to the following categories of subjects:

  • Third-party companies that perform services on our behalf;
  • Institutions and public administrations for legal compliance;
  • Professionals who can assist you with legal compliance.

These entities will process personal data as Data Processors or independent data controllers.

STORAGE PERIODS

Pursuant to Article 5 of EU Regulation 679/2016, "Principles relating to the processing of personal data," personal data are retained in a form that permits identification of data subjects for no longer than is necessary for the purposes for which they are processed and, in any case, no longer than five years from the date of communication of the final outcome of the reporting procedure.

The personal data of interested parties may also be retained for longer periods in compliance with applicable laws and, in any case, by applying any technical and organizational measures necessary to activate data anonymization mechanisms.

RIGHTS OF THE INTERESTED PARTY

Pursuant to current legislation, the interested party may assert their rights towards the Data Controller, as expressed in Article 15 et seq. of EU Regulation 679/2016.

In addition to these rights, the interested party has the right to lodge a complaint with the Supervisory Authority where required by law.

For further information on how to exercise these rights, please read the "Data Subject Rights Procedure" at the link www.coopmorelli.it.

OWNER AND PRIVACY COMMUNICATIONS

The owner is Cooperativa Luigi Morelli, Via di Sottomonte 27, 55060 Guamo – Capannori (LU), tax code and VAT number 00130460462.

The DPO is Dr. Lorenzo Giannini (lorenzo@privacysolving.it).

For any communications pursuant to the above-mentioned articles of EU Regulation 679/2016, you can contact the internal channel manager by registered mail, addressed to the Cooperative's Supervisory Body 231, at the Cooperative's registered office in Via di Sottomonte 27, 55060 Guamo – Capannori (LU).