Updating System for handling Internal Infringement Reports (

(Established pursuant to Legislative Decree No. 24/2023)

ACI Blueteam S.p.A. has adapted to the requirements of Legislative Decree No. 24 of March 10, 2023, "Implementation of Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law and laying down provisions regarding the protection of persons who report breaches of national laws" (so-called whistleblowing).

The aforementioned Decree regulates the protection of persons who report violations of national and European Union regulatory provisions that harm the public interest or the integrity of the public administration or private entity, of which they have become aware in the context of work.

Violations (of which the whistleblower has become aware in the context of employment or employment relationship with the Company) that can be reported, as defined by the aforementioned Legislative Decree, consist of:

Administrative, accounting, civil or criminal offences;
Material unlawful conduct pursuant to the Italian Legislative Decree No. 231/2001 or violations of the Organization, Management and Control Model adopted by the Company (“231 Model”), which do not fall within the violations indicated in the following points;
Offences falling within the scope of legislation relating to: public procurement; services, financial products and markets and the prevention of money laundering and terrorist financing; product security and compliance; transport security; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; privacy protection and personal data protection and network and information system security;
Acts or omissions affecting the commercial interests of the European Union;
Acts or omissions concerning the Italian internal market, including breach of competition and state aid rules and breach of rules in order to obtain a tax advantage for the Company;
In line with the provisions of the Decree, disputes, claims or requests related to a personal interest of the reporting person that relate exclusively to their individual employment or collaboration relationships cannot be reported through the “whistleblowing” system.

The following subjects can make reports:

Employees;
Independent contractors, as well as holders of a working relationship;
Workers or collaborators, who provide goods or services or who carry out works for the benefit of third parties (suppliers);
Freelancers and consultants;
Volunteers and trainees;
Shareholders and persons with functions of administration, management, control, supervision or representation (even if such functions are exercised merely in fact).

The protective measures provided by the aforementioned Decree also apply with reference to:

facilitators;
persons in the same work environment as the reporting person;
co-workers of the reporting person who work in the same work environment and have a usual and current relationship with the reporting person;
entities owned by the reporting person or operating in the same work environment as the reporting person.

To this end, the Company has activated the following channels through which internal Reports can be made:

In written or oral form through the IT platform at https://aciblueteam.segnalazioni.net/;
In written form-paper: it is necessary that the report be placed in two sealed envelopes: the first with the identifying data of the reporter together with a photocopy of the ID; the second with the report, so as to separate the identifying data of the reporter from the report. Both must then be placed in a third closed envelope with the words “reserved for the Corruption Prevention and Transparency Officer” on the outside, to be mailed at the following address: Galleria Caracciolo 14 – 00185 Rome, Italy.

The recipient of the Report is the Head of Prevention of Corruption and Transparency (RPCT, from the Italian title Responsabile della prevenzione della corruzione e della trasparenza), Dr. Fabio Salvetti, in line with the provisions of Article 4 c. 5 of Legislative Decree No. 24/2023.

Verbal reports can also be made following a specific request for a meeting with the person dedicated to handling reports RPCT.

The management of the internal reporting channel will:

Issue to the reporting person acknowledgement of receipt of the alert within 7 days of the date of receipt;
Maintain the conversation with the reporting person from whom it may be requested, if necessary, additions to the report;
Conduct diligent follow-ups on the reports received;
Provide an acknowledgement of the alert within 3 months of the date of the acknowledgement of receipt or, in the absence of such acknowledgement, within three months of the expiry of the period of seven days from the submission of the alert.

Reports must contain a narrative of facts, events or circumstances that may constitute the elements underlying the alleged infringement and be made with sufficient detail to allow, at least in the abstract, the identification of elements useful or decisive for the purpose of verifying the merits of the report.

In compliance with the provisions of Legislative Decree No. 24/2023, the Company ensures the confidentiality of the whistleblower and prohibits any retaliation or discrimination against the whistleblower. The identity of the reporting person and any other information from which this identity may be deduced, directly or indirectly, may not be disclosed, without the express consent of the same reporting person, to persons other than those competent to receive or follow up on alerts, expressly authorized to process such data under the legislation on the protection of personal data.

The information and personal data that are communicated in the context of reports are processed to manage and follow up on the reports themselves, as well as investigate any reported conduct and take the necessary measures in accordance with applicable laws, including legislation on the protection of personal data. It is possible to view the methods and purposes of the processing of personal data, by consulting the extended information pursuant to Article 13 of Regulation (EU) 2016/679 in the annexes section of this page.

Breach of confidentiality is a source of disciplinary liability, without prejudice to any further form of liability provided for by law.

It is emphasized that if the report, proving to be unfounded, was made with malice or gross negligence on the employee's side, disciplinary proceedings may be considered.

For more information on the procedures defined by the Company to file a report and how to manage it, you can consult the “Regulations for the management of infringement reporting – Whistleblowing” below. For other regulatory references, please refer to Legislative Decree No. 24/2023.