The information provided will be sent by EthicsPoint to the relevant functions at CCR Group Headquarters in a totally confidential and secure manner. Reports of violations or suspected violations of the Organizational, Management and Control Models pursuant to Legislative Decree no. 231/2001 will be handled by the Supervisory Body of the relevant CCR Group company which has adopted an Organizational Model 231.

Reports will be subject to verifications and investigations conducted confidentially by the dedicated function at CCR Group Headquarters, and will only be communicated to senior managers at Headquarters and/or local headquarters who have a need to know about them. Reports pursuant to Legislative Decree no. 231/2001 will be communicated to the competent Supervisory Body, which will carry out checks and investigations within the scope of its prerogatives. It is strictly prohibited to disclose the personal information of the reporting person or the contents of the report or to retaliate against the reporting person. The report will be managed and updated on this Hotline so that the reporting person can monitor developments.

After the submission of a report, EthicsPoint will provide the reporting person with an encrypted report code and ask the reporting person to create a password. The report code and password will allow the reporting person to monitor the progress of his or her report and whether additional information is needed from him or her to handle the case, in a manner that ensures the pseudonymization of the reporting person for the purpose of protecting his or her confidentiality and identity.

The National Anticorruption Authority (ANAC) activates an external reporting channel that ensures, including using encryption tools, the confidentiality of the identity of the reporting person, the person involved, and the person mentioned in the report, as well as the content of the report and related documentation.

The same confidentiality is guaranteed even when the report is made through channels other than those indicated in the first period or reaches personnel other than those in charge of processing reports, to whom it is in any case forwarded without delay.

External reports are made in written form through the computer platform prepared by ANAC and accessible at the following address: https://www.anticorruzione.it/-/whistleblowing or orally through telephone lines or voice messaging systems or, at the request of the reporting person, through a face-to-face meeting set within a reasonable time.

The conditions for making external reporting, as stipulated under Article 6, Legislative Decree 24/2023, occur when:

There is no provision within its work context for the mandatory activation of the internal reporting channel or this channel, even if mandatory, is not active or, even if activated, does not comply with the provisions of Article 4 of the Whistleblowing Decree;

The reporting person has already made an internal report under Article 4 and the report has not been followed up;

The reporting person has reasonable grounds to believe that, if he or she made an internal report, the report would not be effectively followed up or that the report itself might result in the risk of retaliation;

The reporting person has reasonable grounds to believe that the violation may pose an imminent or obvious danger to the public interest.

CCR, in encouraging recipients to promptly report possible unlawful conduct or irregularities, guarantees the protection of the confidentiality and identity of the reporter, in relation to the report and the data contained therein, establishes the prohibition of adopting any retaliatory acts against those who make reports as well as preserves the anonymity of the reporter or whoever has sent the report, even in the event that the same should subsequently prove to be erroneous or unfounded.

For the purpose to protect the identity of the reporting person, it is required the express consent of the same, in relation to persons other than those competent to receive or follow up on the reports expressly authorized to process such data pursuant to Articles 29 and 32(4) of Regulation (EU) 2016/679 and Article 2-quaterdecies of the Personal Data Protection Code set forth in Legislative Decree No. 196 of June 30, 2003.

Self-employed workers, partnership holders, freelancers and consultants;

Volunteers and trainees, paid and unpaid;

Shareholders and persons with functions of administration, department, control, supervision, or representation, even if such functions are exercised on a de facto basis.

These measures to protect against acts of retaliation apply extensively to all parties connected, in a broad sense, to the reporting party's organization and/or person, be they:

Facilitators (the people who assist the reporter in the reporting process, operating within the same work environment and whose assistance must be kept confidential);

Persons belonging to the same work environment as the reporter to whom the reporter is related by a stable emotional or kinship link;

Work colleagues of the reporter who are related to him by a usual and current relationship;

Entities owned by the whistleblower or for which the protected persons work, as well as entities that operate in the same work environment as the above-mentioned persons.