Whistleblowing procedure

Version of 20.02.2026. This procedure is available on the Company's website.

INTRODUCTION

Colella Group S.r.l. (hereinafter also "Colella Group" or the "Company") intends to ensure that its activities are carried out in compliance with applicable laws and regulations, the Code of Ethics and the Organization, Management and Control Model ex Legislative Decree no. 231/2001 of the Company, as well as the Group's Code of Ethics, Human Rights Policy, and Anti-Corruption Policy.

To this end, this procedure establishes and governs the local system for receiving, analyzing and managing reports of violations or irregularities (hereinafter also "Reporting System" or "Whistleblowing System") pursuant to Legislative Decree no. 24/2023 and EU Directive 1937/2019 concerning the protection of persons who report breaches of Union law and national regulatory provisions, as well as in accordance with the "Whistleblowing Procedure" adopted by the group, where compatible with Italian law.

Therefore, through this procedure, the Company aims to promote a culture of ethics, legality, and transparency within the Company and in its relationships with it, as well as to ensure the protection of persons who report violations (hereinafter also "Whistleblowers") from any form of retaliation or discrimination.

In addition to the whistleblowing system governed by this procedure, the Company also provides other channels through which illicit or irregular conduct in the workplace can be reported (hierarchical line, human resources department, staff representatives, etc.). The use of other channels (so-called ordinary) does not prejudice protection from retaliation or discrimination. Nevertheless, it does not allow one to benefit from the special protection regime provided by this procedure.

The Company guarantees that the rights and the special protection regime provided for in this procedure are not subject to limitations or derogations, in any way, in law or in fact.

WHO CAN SUBMIT A REPORT AND ON WHICH TOPICS?

Any natural person who has an employment and/or professional relationship with Colella Group may submit a report and assume the qualification of "Whistleblower"; in particular:

employees, including all types of employment contracts regulated by Legislative Decree no. 81/2015 (part-time and flexible work; fixed-term work; temporary agency work; apprenticeship; ancillary work) or by art. 54-bis Legislative Decree no. 50/2017, converted with amendments by Law 96/2017 (occasional service contract);
self-employed workers and holders of collaboration agreements (agency, commercial representation agreements and other types of continuous and coordinated collaboration);
suppliers of goods and services;
freelancers and consultants who provide their services to the Company;
volunteers and interns, paid and unpaid, who provide their services to the Company;
shareholders and persons with administrative, management, control, supervision or representation¹ functions.

1 In accordance with art. 3. co. 4. Legislative Decree no. 24/2023, the protection of the Whistleblower is also guaranteed in the following cases: when the legal relationship (i.e. employment) has not yet begun, if the information subject to the report was acquired during the selection process or in other pre-contractual stages;

during the probationary period;
subsequently to the termination of the legal relationship (i.e., employment). if the information subject to the report was acquired during the relationship

itself.

The protections in favor of the Whistleblower also extend to the following figures:

facilitators (persons who assist the whistleblower in the reporting process);
persons belonging to the same work context as the whistleblower who are linked by a stable emotional or family bond;
colleagues of the whistleblower who are linked by a usual and current relationship;
entities owned by the whistleblower or for which the protected persons work.

Through the report, the Whistleblower reports information they became aware of during their work activities, which concern facts that have occurred, or are very likely to have occurred, harming the public interest and/or the integrity of the Company; in particular:

administrative, accounting, civil, and criminal offences;
unlawful conduct relevant under Legislative Decree no. 231/2001;
violations of the Code of Ethics and the Organization, Management and Control Model ex Legislative Decree no. 231/2001 of the Company;
conduct or situations contrary to the Group's Code of Ethics and/or Human Rights Policy and/or Anti-Corruption Policy;
violations of community or national law, in specific sectors, including: (i) public procurement; (ii) financial services; (iii) environment; (iv) public health; (v) privacy; (vi) network and information system security; (vii) competition;
acts or omissions that harm the financial interests of the European Union;
acts or omissions concerning the internal market, as per Art. 26, paragraph 2, TFEU;
violations of EU competition and State aid rules, as well as internal market violations related to acts that violate corporate tax rules.

The Whistleblower may submit a report provided they are in good faith and do not receive, for this purpose, any direct financial consideration.

HOW CAN I SUBMIT A REPORT?

A report can be made through the channels listed below, which are to be considered autonomous and independent from each other:

in writing, through the digital platform accessible at https://private.mygovernance.it/mywhistleblowing/colella-group/51283/report (hereinafter the "Platform"), which is able to guarantee, also through encryption tools, the confidentiality of the Whistleblower's identity during the handling of the report;
verbally, through a voice messaging system available on the Platform;
verbally, by means of a direct meeting with the Recipient², at the request of the Whistleblower through the Platform.

The methods, conditions, and procedures for making internal reports are made clear, visible, and easily accessible to all recipients, including those who do not frequent the workplace.

All reports, regardless of the channel used by the Whistleblower, are received and managed by an internal office of the Company, which has specific training and guarantees autonomy, hereinafter also referred to as "Recipient."

If the Whistleblower requests a direct meeting with the Recipient to submit an oral report, the meeting will be arranged, in person or by video conference, within 20 working days of receiving such request. With the Whistleblower's prior consent, the oral report is documented by recording on a suitable device for storage and listening or by minutes. The Whistleblower must verify and confirm the minutes by signing them.

When the report concerns a possible violation of the Organization, Management and Control Model ex Legislative Decree 231/2001, of the Company's Code of Ethics, of the group's Code of Ethics or, in any case, unlawful conduct relevant under Legislative Decree 231/2001, the Recipient promptly informs the Supervisory Body, respecting the confidentiality of the Whistleblower's identity.

Members of the administration, management, or supervisory bodies and/or employees and collaborators of the Company who receive information that can be considered a report under this procedure,

2 For the definition and identification of the "Recipient" subject, see subsequent point 2.3.

or when they have reason to believe that the sender intended to make a report through the whistleblowing system and avail themselves of the special protection regime provided by this procedure and by

Legislative Decree 24/2023, must transmit them to the Recipient without delay and respecting the confidentiality of the persons involved.

Pursuant to Legislative Decree 24/2023, the report can also be made through the external reporting channel, by public disclosure or complaint to the judicial or accounting authority. The external reporting channel introduced and regulated by the Decree is established by the National Anti-Corruption Authority (A.N.AC.)3; for this channel, the same obligations apply as to internal reports in terms of response times, public communication of the existence of the channel, etc.

The process of receiving, analyzing, and managing reports is activated efficiently when clear, detailed, complete, and useful information for ascertaining the facts is present. In particular, the Whistleblower must provide the following information:

if they have a professional relationship with Colella Group and the nature of such relationship;
if the facts have occurred or are likely to occur;
when and how they became aware of the reported facts;
the names, functions, and contact details of the persons who may have participated in the commission of the facts;
the names, functions, and contact details of the persons who can provide further information useful for ascertaining the facts;
an accurate description of the facts subject to the report;
if they have already submitted a report on these facts to another Colella Group company;
if they have already made a report relating to these facts to external authorities and/or in the context of judicial proceedings or similar (arbitration, mediation, injunction, etc.) and/or during a public disclosure;
the identity, function, and contact details of the Whistleblower, if the report is not made anonymously.

The Whistleblower must provide suitable documentation to support the reported facts or other elements useful for ascertaining the report (in any format or medium: documents, emails, photos, videos, etc.), as well as elements supporting the nature of their relationship with the Company (except in the case of an anonymous report).

The Recipient will not consider reports based on suspicions, rumors, or hearsay, incomplete and/or uncircumstantiated/unverifiable reports, as well as complaints and/or claims related to a personal interest of the Whistleblower. Judgments or comments by the Whistleblower that relate exclusively to aspects of the private lives of the persons involved, without any direct or indirect connection with the work/professional activity carried out within the Company or in relations with it, will also not be considered. In the event of facts that are not certain or ascertainable, the Whistleblower must specify that these are presumed facts. If the Whistleblower realizes that they have mistakenly reported a fact, they must declare it by contacting the Recipient.

2.10.The reporting and disclosure of facts, data, or documents, whatever their form or medium, covered by national defense secrecy, medical secrecy, or attorney-client privilege is prohibited, unless these belong to the Whistleblower themselves, such as their communications with their lawyer or their personal medical information. The Whistleblower can only transmit documents and other elements obtained legally.

THE WHISTLEBLOWER'S IDENTITY

Even in the case of anonymous reports, the Whistleblower must provide information that allows the Recipient to assess the admissibility and merits of the report. The anonymous Whistleblower must in any case ensure

3 For further information on channels and procedures for making external reports, please refer to the following ANAC address: https://www.anticorruzione.it/-

/whistleblowing.

a means of communication with the Recipient, in order to be able to transmit, if requested, clarifications and/or additional information about the report.

When the Whistleblower is not anonymous, their identity and/or the information and elements of the report that could allow their identification are disclosed only to the Recipient. During the report management activities, the Whistleblower's identity will be treated confidentially and may not be disclosed without their prior consent.

In the context of any disciplinary proceedings, if the accusation is based, in whole or in part, on the report and knowledge of the Whistleblower's identity is essential for the defense of the person(s) concerned, the report may be used for the aforementioned disciplinary proceedings only with the Whistleblower's express consent to the disclosure of their identity.

REPORT MANAGEMENT

The phases of managing a report are as follows:

acknowledgement of receipt;
verification of the eligibility of the report;
internal investigation;
decisions on possible measures to be adopted;
feedback to the Reporting Person;
traceability and archiving.

The Recipient is obliged to properly follow up on the reports received and maintains communications with the Reporting Person.

All reports are examined impartially. The means used to verify the accuracy of the information are justified and proportionate to the seriousness and/or scope of the reported violations.

Acknowledgement of receipt

The Recipient shall inform the Reporting Person in writing of the receipt of the report within 7 working days from the actual receipt thereof. The acknowledgement of receipt of the report must indicate the date and, if applicable, the time of receipt of the report, as well as a summary of the information reported and the list of documents provided by the Reporting Person.

Verification of the eligibility of the report

The Recipient must carry out, within reasonable timeframes and respecting data confidentiality, an assessment of whether the essential requirements of the report are met to preliminarily evaluate its admissibility and, in particular, whether the Reporting Person and the subject of the report fall within the scope of this procedure and can therefore be granted the protections provided by this procedure and by Legislative Decree No. 24/2023.

If necessary for the purpose of assessing admissibility, the Recipient may request further information from the Reporting Person.

When the report is deemed admissible, the Recipient initiates the subsequent preliminary investigation phase and informs the Reporting Person of the reasons for the assessment and, where appropriate and as far as possible, of the manner in which the report will be properly followed up.

When the report is deemed inadmissible, the Recipient proceeds to archive the report and informs the Reporting Person of the reasons for the assessment (for example, if the alleged facts do not fall within the scope of this procedure, in case of prohibited reports, manifestly unfounded reports

due to the absence of factual elements suitable to justify investigations, reports with generic content such that it does not allow for the understanding of data, reports of illicit activities accompanied by inappropriate or irrelevant documentation, etc.).

Internal investigation

The objective of the internal investigation activities is to proceed with specific assessments, analyses, and evaluations regarding the validity of the reported facts.

Should the investigation activities prove particularly complex, the Recipient may be assisted by one or more specially identified and appointed persons as Internal Investigation Managers (hereinafter "Investigation Managers").

The Recipient guarantees that the Investigation Managers have the necessary impartiality, independence, competence, and training to conduct the investigation, and that they are subject to a strict confidentiality obligation regarding the contents of the report. The Recipient provides the Investigation Managers with the resources necessary to ascertain the reported facts.

request collaboration and information from members of the administrative, management or supervisory bodies and/or employees and collaborators of the Company; in particular: documents useful for the investigation regardless of their form or medium, such as time records, emails, meeting recordings or video surveillance, written statements;
conduct interviews;
use external providers such as lawyers, accountants, or IT consulting firms;
carry out sample checks.

While respecting the rights of the individuals concerned, the confidentiality regarding the content of the report, the provisions of specific policies adopted by the Company regarding controls on IT devices used by personnel, and to the extent strictly necessary to follow up on the report, the Recipient and the Investigation Managers may ask members of the administrative, management or supervisory bodies and/or employees and collaborators of the Company to adopt certain temporary measures in order to preserve evidence, safeguard the health and safety of the individuals involved, prevent further non-compliance and/or avoid retaliatory measures against the Reporting Person, Facilitators, individuals belonging to the same work context who are linked to them by a stable affective or kinship relationship, colleagues who are linked to them by a habitual and current relationship, and private law entities owned by them or where they work who may be subject to retaliation, discrimination, and other inappropriate behaviours directly or indirectly related to the report, including:

making a copy of the information contained in company computers, phones, and other IT tools, including work emails;
suspending the automatic deletion of e-mails;
temporarily assigning the persons affected by the report to different locations or functions;
asking employees to work from home;
adopting other precautionary measures.

In order to avoid interference, the Reporting Person does not carry out their own investigative activities and respects the confidentiality of the identity of the persons involved and the content of the report.

Decisions on possible measures to be adopted

At the end of the preliminary investigation, the Recipient and the Investigation Managers prepare a conclusive written report, detailing the activities carried out, the outcomes of the assessments, the measures adopted or to be adopted to follow up on the report, and the reasons for the choice made. In the report, the confidentiality of the Reporting Person's identity and/or information and elements of the report that could lead to their identification is respected.

If, at the end of the preliminary investigation, it emerges that the facts subject to assessment may be relevant from a disciplinary perspective or, in any case, if there are employment law issues, the conclusive report containing the outcomes of the activities is also sent to the Head of the Human Resources Department for their assessments. The Head of the Legal Department will also carry out relevant assessments if possible criminal or civil liability issues emerge from the preliminary investigation.

Any disciplinary proceedings initiated against persons identified as responsible for the reported facts or conduct will be conducted in accordance with the provisions of the Colella Group's disciplinary system.

The conclusive report is transmitted:

to the Chairman, or if the Report concerns the latter, to the Board of Directors;
to the Sole Director;
to the Supervisory Body when the report concerns a possible violation of the Organization, Management and Control Model pursuant to Legislative Decree 231/2001 and the Company's Code of Ethics or, in any case, unlawful conduct relevant under Legislative Decree 231/2001.

Feedback to the Reporting Person

The Reporting Person is informed of the outcome of their report within three months from the date of the acknowledgement of receipt or, in the absence of such acknowledgement, within 3 months from the expiry of the 7-day period from the submission of the report:

if the report is founded, an account is given of the measures planned or adopted or to be adopted to follow up on the report and the reasons for the decision;
if the information contained in the report is inaccurate or unfounded, an account is given of the archiving of the report and the reasons for the decision.

Traceability and archiving

Reports and related documentation are stored by the Recipient for the time necessary to process the report and in any case for no longer than five years from the date of communication of the final outcome of the reporting procedure.

RIGHTS OF REPORTED PERSONS

During the internal investigation, if necessary, the Recipients and the investigation Managers may ask the reported person to participate in a meeting to provide clarifications, information, documentation, and other elements useful for ascertaining the reported facts.

The meeting is held in compliance with the adversarial principle between the participants, using methods that guarantee the protection of the privacy and reputation of the reported person. The meeting does not constitute a disciplinary hearing.

The identity of the Reporter and any other information from which it can be inferred may not be revealed without the express consent of the latter to persons other than those competent to receive or act on reports, expressly authorised to process such data pursuant to Articles 29 and 32, paragraph

4, of Regulation (EU) 2016/679 (GDPR) and Article 2-quaterdecies of the Personal Data Protection Code pursuant to Legislative Decree 30 June 2003, no. 196.

INTEGRITY AND CONFIDENTIALITY OF INFORMATION

The conditions for the collection and management of reports ensure maximum confidentiality of the identity of the Reporter, the persons affected by the report, any third parties mentioned in the report, and the information collected during the management of the report.

The Reporter, the Recipient, the investigation Managers, as well as any person or third party who needs to know all or part of the information, are subject to a strict confidentiality obligation. To ensure such confidentiality, specific measures are adopted, such as data encryption and written reference to confidentiality rules or the signing of a confidentiality agreement. Access to this information by any other person is prohibited.

Confidentiality must also be ensured in judicial and disciplinary matters. In particular, within the disciplinary procedure activated by the Company against the alleged perpetrator of the violation, the identity of the Reporter cannot be revealed, if the disciplinary charge is based on distinct and further investigations with respect to the report, even if consequential to it. If the Reporter's identity is essential for the defence of the person against whom the disciplinary charge has been brought, it may only be revealed with the Reporter's express consent.

However, the Reporter's confidentiality may not be respected when:

there is the express consent of the Reporter to the disclosure of their identity;
the Reporter's criminal liability for slander or defamation or in any case for crimes committed through the report has been established by a first-instance judgment, or their civil liability for the same reason in cases of wilful misconduct or gross negligence;
anonymity is not enforceable by law and the Reporter's identity is requested by the Judicial Authority in relation to investigations (criminal, tax, or administrative investigations, inspections by supervisory bodies).

PROTECTION FROM RETALIATION

The Reporter, Facilitators, persons belonging to the same work context linked to them by a stable emotional or family bond, colleagues linked to them by a habitual and current relationship, and private law entities owned by them or where they work, are protected against any form of retaliation, discrimination, and other inappropriate behaviours connected, directly or indirectly, to the report, such as:

suspension, dismissal, or equivalent measures;
demotion or refusal of promotion;
change of duties, change of workplace, reduction of salary, change of working hours;
refusal of training;
negative performance evaluations or work references;
disciplinary actions, reprimands, or other unjustified disciplinary sanctions, including a monetary penalty;
coercion, intimidation, harassment, or ostracism;
discrimination, disadvantageous or unfair treatment;
failure to convert a fixed-term employment contract to an open-ended contract or from a fixed-term contract to an open-ended contract, when the employee legitimately expected to be offered an open-ended position;
failure to renew or early termination of a fixed-term employment contract or of a fixed-term contract;

damages, including damage to the person's reputation, particularly on social media, or financial losses, including loss of business and loss of income;

blacklisting based on a formal or informal agreement at sector or industry level, which may imply that the natural or legal person will not obtain employment or a job opportunity in the sector or industry in the future;
early termination or cancellation of a contract for goods or services;
cancellation of a license or permit;
abusive referral to psychiatric or medical treatment;
any other form of retaliation that leads to intolerable working conditions.

The Reporter or any person listed above who believes they are subject to retaliatory discrimination and other inappropriate behaviours connected, directly or indirectly, to the report must inform the Human Resources Department representative or the Compliance Officer.

SANCTIONS

Colella Group, in order to ensure that the management of reports is in line with this procedure which aims to protect the rights of Reporters and persons involved in the report, may adopt disciplinary sanctions and other measures up to dismissal and/or initiation of legal action in case of:

slanderous or defamatory report;
report, made with wilful misconduct or gross negligence, of untrue facts;
report made with the intention of obtaining financial compensation;
report containing prohibited and/or illegally obtained information;
manifestly opportunistic reports and/or made solely for the purpose of harming the reported party;
obstruction, through actions or omissions, to the submission of a report or its management as provided by this procedure;
violation of confidentiality obligations relating to the receipt, internal investigation, evaluation, or archiving of a report;
violation of the prohibition of discrimination or retaliation against the Reporting Person and other protected persons, including in the form of attempted or threatened acts.

The use of this procedure by recipients is optional, and failure to use it cannot result in any sanctions.

The use of this procedure will not expose the Reporting Person to any sanction if they make a report in good faith, without any intention to harm the reported person, based on information that appears reasonably truthful, complete, and accurate, even if the facts subsequently prove to be inaccurate or do not lead to the adoption of any corrective measures or disciplinary sanctions.

PROCESSING OF PERSONAL DATA

The Company defines its model for receiving and managing internal reports by identifying appropriate technical and organizational measures to ensure a level of security adequate to the specific risks arising from the processing carried out, based on a data protection impact assessment, and regulating the relationship with any external suppliers who process personal data on their behalf. Therefore, the Company has developed the necessary documentation to fully inform data subjects about the characteristics of the processing in question and, where necessary, to obtain the explicit consent of the Reporting Person as provided for in Article 12, paragraph 2 of Legislative Decree 24/2023 and, during the disciplinary procedure, as provided for in Article 12, paragraph 5 of Legislative Decree 24/2023, as well as the documentation for the authorization for the processing of data to be submitted to the reporting subjects, as identified by Article 12, paragraph 2 of Legislative Decree 24/2023, and identifies every data processing and every communication of personal data pursuant to Article 13, paragraph 1 of Legislative Decree 24/2023.

The processing of personal data received through the receipt and management of reports is carried out by the Company, as data controller, in compliance with the principles of Articles 5 and 25 of Regulation (EU) 2016/679 or Articles 3 and 16 of Legislative Decree no. 51 of 2018.

The Company fulfills the obligation to provide adequate information to the reporting subjects and the persons involved in the report, pursuant to and for the purposes of Arts. 13 and 14 of the same Regulation (EU) 2016/679, or Art. 11 of the aforementioned Legislative Decree no. 51 of 2018, as well as adopting appropriate measures to protect the rights and freedoms of the data subjects. The complete privacy policy is available on the Digital Platform.

Whistleblowing procedure

Shipping worldwide

Made easy

Payment Protection

Priority support

SPADA®

INFO

LEGAL