Whistleblowing

MCM SRL IMPLEMENTS A PROCESS FOR THE RECEIPT, ANALYSIS AND HANDLING OF REPORTS (INCLUDING ANONYMOUS ONES).
The process is compliant with the regulatory developments introduced by Legislative Decree No. 24 of March 10, 2023, implementing Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019, concerning the protection of persons who report breaches of Union law, and containing provisions regarding the protection of persons who report breaches of national laws (the so-called “Whistleblowing Decree”).

WHO CAN REPORT

The following individuals may submit a report:

1. Employees, self-employed workers, individuals with a collaboration relationship, volunteers, and interns (even unpaid) working at MCM SRL;

2. Collaborators, freelancers, and consultants working with MCM SRL; shareholders and individuals with administrative, managerial, supervisory, or control functions within MCM SRL.

These individuals may report information on violations of which they have become aware in the context of their work relationship.

Reports can also be submitted:

1. When the legal relationship has not yet started, if the information was acquired during the selection process or other pre-contractual phases;

2. During the probationary period;

3. After the termination of the legal relationship, if the information was acquired during the course of said relationship.

MCM SRL encourages whistleblowers to disclose their identity in their reports (with confidentiality guaranteed under current laws), in order to facilitate fact-checking and to provide feedback on the outcome of the investigation. However, anonymous reports are also accepted.

WHAT TO REPORT

Behaviors, acts, or omissions that harm the public interest or the integrity of MCM SRL, such as:

1. Administrative, accounting, civil, or criminal offenses;

2. Unlawful conduct relevant under Legislative Decree 231/2001, or violations of the organizational and management models provided therein;

3. Offenses falling under EU or national legislation in the following sectors: public procurement; financial services, products, and markets; prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; public health; consumer protection; privacy and personal data protection; security of networks and information systems;

4. Acts or omissions harming the financial interests of the Union;

5. Acts or omissions affecting the internal market;

6. Acts or behaviors that defeat the object or purpose of Union acts.

Reports must concern facts the whistleblower has direct knowledge of and must be made with reasonable belief that the information reported is true at the time of submission. Reports must be made promptly to enable proper verification.

The following do NOT constitute whistleblowing reports:

• Disputes, claims, or requests related to personal interests of the whistleblower, such as individual employment issues or relations with superiors;

• Complaints or communications related to commercial activities.

REPORTING CHANNELS

Reports may be submitted via:

1. The dedicated form available on the MCM SRL website;

2. Verbally, via a statement made by the whistleblower during a specific hearing;

3. ANAC (the Italian National Anti-Corruption Authority) – only in cases where:

   • The internal reporting channel is inactive;

   • An internal report has already been submitted with no follow-up;

   • The whistleblower has reasonable grounds to believe an internal report would not be followed up effectively or might lead to retaliation;

   • The reported violation poses a clear and imminent threat to the public interest.

The form on our website is the preferred reporting tool, as it best ensures confidentiality and data security through IT systems. Anonymous submissions are still allowed.

Via the form, it is possible to:

1. Submit a new report;

2. Submit a correction or addition to a previous report;

3. Receive updates via email on the status of the report (except in the case of anonymous reports).

WHISTLEBLOWER CONFIDENTIALITY PROTECTION

1. The identity of the whistleblower will not be disclosed to individuals other than those responsible for receiving or handling the report;

2. Protection extends not only to the whistleblower’s name but also to all elements of the report from which the identity could be deduced, even indirectly;

3. Confidentiality also covers the identities of the individuals involved or mentioned in the report, until proceedings are concluded, under the same protections granted to the whistleblower.

In compliance with the law, MCM SRL guarantees the confidentiality of the whistleblower’s identity from the moment the report is received and prohibits (and, to the extent allowed, sanctions) any direct or indirect retaliatory or discriminatory actions taken as a consequence of the report.

All parties involved in report handling are legally obliged to maintain confidentiality regarding the existence, content of the report, and related activities, and must ensure the whistleblower’s identity remains confidential under applicable legislation.

REPORT HANDLING PROCEDURE

MCM SRL undertakes to:

1. Acknowledge receipt of the report within 7 days, unless the whistleblower explicitly requests otherwise;

2. Maintain communication with the whistleblower and request additional information if necessary;

3. Carry out investigations, including hearings and document acquisition if needed;

4. Provide a response to the whistleblower within 3 months, or within 6 months for justified reasons, from either the acknowledgment date or the 7-day deadline (if no acknowledgment was sent);

5. Communicate the final outcome of the report to the whistleblower.

PROTECTION OF INVOLVED PARTIES

MCM SRL also safeguards the rights of those involved in reports by:

• Ensuring any communication relating to their identity adheres strictly to the “need to know” principle — meaning that access is granted only to those for whom it is necessary and only to the extent required by their professional role;

• Informing the involved person of the existence and content of the report, and providing a copy of it, except for the whistleblower’s identity, which cannot be disclosed under any circumstances unless specifically allowed by law;

• Granting the involved person the right to be informed of the investigation outcome. Disclosure may be delayed or partially/fully withheld if public authority intervention is pending, or if there is a risk to the whistleblower’s confidentiality.

DATA PROTECTION

All personal data in the reporting process is processed in accordance with current legislation (EU Regulation 679/2016 and Legislative Decree 196/2003, as amended by Legislative Decree 101/2018).

Reporting Form – Whistleblowing