Whistleblowing procedure

In accordance with Legislative Decree of 10 March 2023, No. 24 (implementing Directive (EU) 2019/1937 on whistleblowing), Value Partners has established a dedicated channel for whistleblowing reports (whistleblowing), in order to enable employees and collaborators to report, in a secure, confidential, and anonymous manner, potential violations of laws, regulations, or ethical standards identified in the workplace context.

This channel is intended to safeguard the public interest and the integrity of the company. The protection measures provided for under Legislative Decree No. 24/2023 apply not only to the reporting person, but are also extended to “facilitators” (persons who assist the reporting person during the reporting process), to colleagues and relatives of the reporting person, as well as to legal entities owned by or employing the reporting person, protecting them against any form of direct or indirect retaliation or discrimination, as guaranteed by applicable law.

There is no legal obligation to submit a report; however, anyone who responsibly decides to report is protected by law: the identity of the reporting person will be kept confidential (and will not be disclosed beyond the personnel authorized to manage the report), and any punitive or retaliatory measures taken as a consequence of the report are expressly prohibited. Furthermore, the law provides for severe sanctions against anyone who obstructs reporting, breaches confidentiality obligations, or carries out retaliatory actions, as well as legal safeguards for the reporting person in the event of retaliation (including reversal of the burden of proof, nullity of discriminatory acts, etc.).

At the same time, the reporting person is required to use the channel responsibly. It is understood that protection is not guaranteed where the criminal liability of the reporting person for the offences of false criminal accusation or defamation, or civil liability on the same grounds in cases of intent or gross negligence, is established, including by a first-instance judgment. In such cases, disciplinary sanctions may be imposed on the author of the false report.

The sole purpose of the channel is to bring to light unlawful conduct or relevant irregularities. Matters related to the reporting person’s personal interests that are not connected to violations of laws or regulations (e.g. purely individual employment-related grievances) must not be reported through this channel.

Reporting channel

Value Partners makes available to potential whistleblowers a dedicated email address: segnalazioni_vp@protonmail.com.

This is an email account external to the organization, protected and encrypted on the ProtonMail platform, selected in order to ensure the highest level of security and confidentiality. ProtonMail is an end-to-end encrypted email service that protects both the content of communications and the identity of the sender; moreover, it does not require the use of the company’s internal servers, thereby avoiding any form of tracking on IT infrastructures under the control of Value Partners.

This solution complies with whistleblowing best practices. Indeed, the ANAC Guidelines on Legislative Decree No. 24/2023 discourage the use of ordinary email or certified email (PEC) as reporting channels, as they are considered unsuitable for guaranteeing the necessary level of confidentiality. By adopting ProtonMail, a secure and anonymous email system, Value Partners complies with these guidelines, ensuring that reports are received in a protected environment.

Access to the mailbox segnalazioni_vp@protonmail.com is strictly limited to the persons appointed to manage the channel (designated by the company in accordance with Article 4 of Legislative Decree No. 24/2023). The operational management of the whistleblowing service is therefore carried out in full compliance with the law, through specifically designated personnel with adequate autonomy and training. This ensures a professional and independent handling of each whistleblowing report.

Method for submitting a report

To submit a report, the user may send an email to segnalazioni_vp@protonmail.com, clearly and in detail describing the facts to be reported. No predefined forms are required; what matters is providing all useful information to allow the report to be properly understood and assessed.

In particular, the report should include: an accurate description of the facts (what happened or is happening, including time and place); the reasons why such facts are considered unlawful or irregular (e.g. violation of specific laws or internal regulations);where possible, supporting evidence or indications (such as documents, emails, photographs, or other relevant files, which may be attached).

In addition, the persons involved or aware of the facts should be indicated, such as the names of individuals who allegedly committed the misconduct or witnessed it, as well as any other entities or companies involved. The more complete and detailed the report, the greater the likelihood that effective verification can be carried out.

The reporting person may decide whether or not to disclose their identity. Reports may also be submitted anonymously (by omitting name and personal details). The company accepts and processes anonymous whistleblowing reports; however, it should be noted that anonymity entails certain limitations. In the absence of the reporting person’s identity, on the one hand the company will not be able to directly activate the protective measures provided to safeguard them against retaliation, and on the other hand the outcome of the investigation may not result in formal disciplinary action against the responsible parties, unless the evidence collected is sufficient to independently support such proceedings (anonymousreports cannot in themselves be used as a basis for disciplinary action, except where objective findings are obtained through investigation).

For these reasons, the legislation encourages confidential (non-anonymous) reporting, ensuring full confidentiality of identity and protection against retaliation. In any case, the choice remains with the reporting person: should they wish to remain anonymous, they are not required to disclose personal data and the report will nevertheless be considered and handled with the utmost seriousness. Conversely, by reporting with their full name, the reporting person benefits from all statutory protections, without prejudice to confidentiality vis-à-vis third parties.

In the text of the report, it is advisable to indicate a contact detail for subsequent communications, such as an email address (which may be the same used to submit the report, or a different address created specifically to maintain anonymity). Alternatively or additionally, a personal telephone number may be provided. These contact details will be used exclusively to send acknowledgements and updates relating to the handling of the report (see the following section on the management procedure) and will also be processed confidentially.

If the reporting person prefers to submit the report orally (for example through a verbal interview), they may request this by sending a simple email to segnalazioni_vp@protonmail.com, indicating their wish to be heard orally. They will then be promptly contacted, through a secure channel, to arrange an in-person meeting under appropriate security conditions within a reasonable timeframe. In the case of oral reporting (by telephone or meeting), subject to the reporting person’s consent, the report will be documented by recording or by written record. The reporting person has the right to review, amend, and confirm the content of the written record by signing it.

Alternatively, it is also possible to submit a recorded voice report, for example by recording an audio file describing the facts and sending it as an attachment via ProtonMail. Regardless of the method chosen (written, audio, or meeting), it is essential that the report is submitted through the designated channel (i.e. by contacting segnalazioni_vp@protonmail.com as the initial point of entry), in order to ensure that it is properly registered and handled by the competent body in accordance with the procedure.

Security, confidentiality, and data processing safeguards

All reports received through the ProtonMail channel will be handled with the utmost confidentiality, in compliance with Legislative Decree No. 24/2023 (Articles 12 and 14) and applicable data protection legislation (Regulation (EU) 2016/679 – GDPR). In particular, the identity of the reporting person (where provided) will be kept confidential throughout the entire process and may only be known to personnel strictly authorized to manage the report.

It will not be disclosed to third parties without the explicit prior consent of the data subject, except where required by law (e.g. upon request by judicial authorities).

Even where a report leads to internal disciplinary proceedings, the reporting person’s identity will remain confidential and may be disclosed only where the disciplinary charge cannot otherwise be substantiated without revealing such identity, and in any case only with the reporting person’s consent. Similar safeguards apply to the identity of any third parties mentioned and to the content of the report itself, which will be protected and accessible only to those involved in the investigation.

Any personal data contained in the report will be processed in accordance with the principles of lawfulness, fairness, data minimization, and storage limitation. This means that such data will be collected and used solely for the purposes of verifying and managing reports and will be deleted when no longer necessary. In any event, reports and related documentation are retained for the time necessary to process the report and in any case no longer than five years from the date on which the final outcome of the reporting procedure is communicated, in compliance with confidentiality obligations. After this period, all information will be securely deleted.

Value Partners has also adopted appropriate technical and organizational measures to ensure the IT security of the ProtonMail channel and the protection of processed data. Email communications are encrypted and protected against unauthorized access, and all persons involved in the process are bound by strict confidentiality obligations.

Finally, it is noted that the reporting person, where personal data are provided, may exercise the rights set out in Articles 15–22 of the GDPR, without prejudice to Article 2-undecies of Italian Legislative Decree No. 196/2003 (Italian Data Protection Code), which allows the limitation or postponement of the exercise of such rights where this could result in a concrete and effective prejudice to the confidentiality of the reporting person’s identity or to the conduct of defensive investigations. The details of the full privacy notice relating to the processing of data in the context of whistleblowing are available to the data subject in the dedicated section of the website Whistleblowing Privacy Policy.

Report management procedure

Once a report has been submitted to the dedicated address, it will be taken in charge by the Internal Channel Manager (a role appointed by Value Partners pursuant to Article 4 of Legislative Decree No. 24/2023). The Manager will first verify that the report falls within the scope of the whistleblowing legislation (i.e. that it concerns a violation of laws or irregularities of public or corporate interest, and not disputes, claims, or requests relating to the reporting person’s personal interests that pertain exclusively to their individual employment relationship or to relationships with hierarchical superiors, pursuant to Article 1 of Legislative Decree No. 24/2023).

Reports that are manifestly unfounded or outside the scope (for example, purely individual employment grievances not relating to unlawful conduct) will not be processed under this procedure. All relevant reports, however, will be subject to a specific handling protocol in accordance with the phases and timelines established by law.

Within 7 days of receipt of the report, the Manager will send an acknowledgement of receipt to the reporting person, confirming that the report has been properly received and will be examined. This acknowledgement will be sent to the contact details provided by the reporting person, typically by email to the same address from which the report was submitted, unless otherwise specified.

The Manager will then carry out a confidential investigation into the reported facts and may contact the reporting person anonymously (always via the ProtonMail mailbox, without revealing identity) to request clarifications or additional information where necessary. It is therefore important that the reporting person remains available for subsequent communications, for example by monitoring the email inbox used for the report.

During the investigation, the Manager may collect evidence, hear the persons involved or witnesses where appropriate, and otherwise examine the facts with due diligence. The objective is to verify the substantiation of the report and, where appropriate, to define corrective or preventive measures.

If the report is substantiated, Value Partners will adopt the appropriate follow-up measures. Depending on the nature of the reported violation, this may include internal disciplinary proceedings, reporting the outcome to the competent corporate bodies, activation of the Model 231 (where applicable), or referral of the matter to external authorities (judicial or administrative) where legal violations falling within their competence are identified. If the report is found to be unfounded, it will be closed with a negative outcome, without consequences for the reporting person, except in cases of intent.

In any case, within 3 months from the date of the acknowledgement of receipt (and in any event no later than 3 months and 7 days from the initial receipt), the Manager will provide the reporting person with final feedback on the outcome of the report. This communication will also be sent to the contact details provided, normally via encrypted ProtonMail message. The feedback will summarize the actions taken, within the limits permitted by confidentiality and investigative secrecy.

Throughout the entire process, the reporting person may communicate confidentially with the Manager using the dedicated mailbox. It is recalled that the company’s legal obligation to protect the reporting person continues even after the conclusion of the procedure. Any retaliatory or discriminatory acts suffered as a consequence of the report (such as unjustified dismissal, demotion, harassment, or other undue pressure) will be null and void and subject to legal sanctions. Reporting persons who believe they have suffered retaliation may report it to the competent authorities (Labour Inspectorate for the private sector, ANAC for the public sector, etc.).

Regulatory references and external reporting channels

This reporting system is established in compliance with Legislative Decree No. 24/2023 (“Protection of persons who report violations of the law”, in force since 15 July 2023), which introduced uniform whistleblowing obligations for private entities with at least 50 employees or subject to Model 231. This legislation repeals and replaces previous provisions on whistleblower protection (e.g. Law No. 179/2017 for the private sector) and implements Directive (EU) 2019/1937 in the Italian legal system.

In addition to internal channels, the decree also provides for the possibility of external reporting to the National Anti-Corruption Authority (ANAC) and, as a last resort and under specific conditions, public disclosure (e.g. to the media). ANAC has established an online portal and dedicated service for receiving reports of wrongdoing. This external channel is residual in nature and may only be used in the circumstances set out in Article 6 of Legislative Decree No. 24/2023.

In particular, external reporting to ANAC is permitted only if:

• the entity is not legally required to establish an internal reporting channel (not applicable to Value Partners);
• the mandatory internal channel is not operational or does not comply with legal requirements (not applicable, as Value Partners’ internal channel is compliant);
• the reporting person has already submitted an internal report but has not received feedback within the statutory timeframe, or reasonably believes that the report would not be effectively addressed or could expose them to retaliation if reported internally;
• the reported violation is particularly serious and urgent, posing an imminent risk to the public interest.

Where at least one of these conditions is met, the reporting person may decide to bypass or supplement the internal channel by reporting directly to ANAC. In the absence of such conditions, the internal channel must be used as a priority. In any event, Value Partners provides this information pursuant to Article 5(1)(e) of Legislative Decree No. 24/2023, in order to ensure that all potential reporting persons are aware of the available reporting options and their respective requirements. The possibility of filing criminal complaints with the competent judicial authorities remains unaffected.

Company commitment

Value Partners undertakes to handle every report in a professional, impartial, and timely manner, ensuring full respect for the rights of all parties involved. The company considers whistleblowing a fundamental tool of corporate governance and the promotion of business ethics, in line with Italian and European standards of good administration and transparency.

Through this secure channel, the organization aims to identify and address unlawful or irregular conduct at an early stage, contributing to the creation of a healthy and compliant working environment. All employees, collaborators, consultants, and stakeholders engaged with Value Partners are encouraged to use the whistleblowing channel responsibly whenever they identify reportable situations.

The company confirms that no reporting person acting in good faith will suffer negative consequences for having submitted a report. On the contrary, such acts of responsibility and civic courage are valued and protected. For any questions, information, or clarification regarding the whistleblowing procedure, it is possible to contact the same ProtonMail mailbox (segnalazioni_vp@protonmail.com) on a confidential basis. Requests for information will not be considered formal reports, but will nevertheless be handled confidentially and responded to compatibly with operational requirements.