How to report a violation
To submit a report securely and anonymously, please use the dedicated form available at the following link:

Report Form

This procedure governs the methods for submitting detailed reports of unlawful conduct relevant pursuant to Legislative Decree 231/01 or violations of the entity’s organizational and management model, ensuring the protection of the reporting person’s confidentiality;

Approved by: Board of Directors on 07.07.2025.

Introduction

Paragraph 2-bis of Article 6 of Legislative Decree no. 231/2001, as amended by Article 2 of Law no. 179 of 30 November 2017, provides for the need to establish:

a) one or more channels allowing the subjects referred to in Article 5, paragraph 1, letters a) and b), to submit, in order to protect the integrity of the entity, detailed reports of unlawful conduct relevant pursuant to the aforementioned decree and based on precise and consistent factual elements, or violations of the entity’s organizational and management model, of which they have become aware in the course of their duties; such channels guarantee the confidentiality of the reporting person’s identity during the management of the report;

b) at least one alternative reporting channel suitable to guarantee, through IT-based methods, the confidentiality of the reporting person’s identity;

c) the prohibition of any acts of retaliation or discrimination, direct or indirect, against the reporting person for reasons connected, directly or indirectly, to the report;

d) sanctions against anyone who violates the measures protecting the reporting person, as well as against anyone who, with intent or gross negligence, submits reports that prove to be unfounded, within the disciplinary system adopted pursuant to paragraph 2, letter e).

It should also be noted that the adoption of discriminatory measures against persons submitting reports pursuant to paragraph 2-bis may be reported to the National Labour Inspectorate, for measures within its competence, not only by the reporting person but also by the trade union organization indicated by the latter.

Retaliatory or discriminatory dismissal of the reporting person is null and void, as is any change of duties pursuant to Article 2103 of the Italian Civil Code, as well as any other retaliatory or discriminatory measure adopted against the reporting person.

In the event of disputes relating to the imposition of disciplinary sanctions, demotion, dismissal, transfer, or the submission of the reporting person to any other organizational measure having negative effects, direct or indirect, on working conditions following the submission of a report, it is the employer’s responsibility to demonstrate that such measures are based on reasons unrelated to the report itself.

1. Definition of internal procedures

In light of the above, the Internal Reporting (Whistleblowing) Procedures are defined below. These consist of the identification of one or more channels allowing the subjects referred to in Article 5, paragraph 1, letters a) and b), to submit, in order to protect the integrity of the entity, detailed reports of unlawful conduct relevant pursuant to Legislative Decree no. 231/2001, based on precise and consistent factual elements, or violations of the entity’s organizational and management model, of which they have become aware in the course of their duties.

Reporting is an act that expresses a sense of belonging to the company, through which the whistleblower (the employee who reports) contributes to the emergence and prevention of risks and situations detrimental to Intarget Group S.r.l. – Società Benefit and, consequently, to the interests of all employees. Whistleblowing is the procedure designed to encourage reporting and to protect the whistleblower, in light of its social function, with the primary aim of preventing or resolving an issue internally and promptly.

1.1 Subject of the report

All acts or facts that may constitute violations of offences relevant pursuant to Legislative Decree 231/2001, based on precise and consistent factual elements, or violations of the entity’s organizational and management model, of which the reporting person has become aware in the course of their duties, are considered relevant.

Reports may not, under any circumstances, concern personal grievances of the reporting person or claims and requests relating to the regulation of the employment relationship or relationships with superiors or colleagues, for which the ordinary procedures provided for by human resources regulations apply.

1.2 Personal scope of reporting

Reports must be submitted by the subjects referred to in Article 5, paragraph 1, letters a) and b) of Legislative Decree no. 231/2001, namely:

a) persons who hold representative, administrative, or management functions within the entity or one of its organizational units with financial and functional autonomy, as well as persons who exercise, even de facto, the management and control thereof;

b) persons subject to the direction or supervision of one of the subjects referred to in letter a).

By way of example, this definition includes, in addition to directors and the general manager, all persons employed by the company under an employment contract (open-ended or fixed-term, full-time or part-time, apprenticeship), coordinated and continuous collaborators, temporary agency workers, and seconded workers.

Whenever a new subject falls within the above scope, the Human Resources Department ensures that the relevant information set out in this paragraph is provided to that subject.

1.3 Reporting methods and recipients

1.3.1 Appointment of the Head of Internal Reporting Systems

The Head of Internal Reporting Systems is responsible for:

• ensuring the proper functioning of the procedures;
• reporting directly and without delay to the Board of Directors and the Board of Statutory Auditors any reported information that is deemed relevant;
• drafting an annual report on the proper functioning of the internal reporting system, containing aggregated information on the outcomes of the activities carried out following the reports received, approved by the Board of Directors and made available to staff.

Intarget Group S.r.l. – Società Benefit assigns the examination and assessment of reports to its Audit Body. The HR Manager is appointed as Head of Internal Reporting Systems, who is responsible, for example, for receiving the reports.

1.3.2 Reporting methods

Reports are sent, containing the information set out in the form attached as an appendix to this procedure, by the reporting person to the designated recipient through one of the following methods:

• by letter, in a double sealed envelope, to the address Intarget Group S.r.l. – Società Benefit, Via Giuntini no. 25, unit 42, 56021 Cascina (Pi) – Loc. Navacchio, addressed to the designated recipient of the report; in this case, both anonymous and non-anonymous reports are allowed;
• by email to the dedicated address chiara.ferroni@intarget.net, attributable to the designated recipient of the report.

In any case, the identity of the reporting person will be known only to the Head of the Reporting Systems and the Auditor, who guarantee its confidentiality, except where the information is required for investigations or proceedings initiated by the judicial authority following the report.

1.4 Content of the report

The reporting person must provide all elements useful for reconstructing the facts and verifying the validity of the report. To this end, the report must include the following elements:

• personal details of the reporting person, including job title, workplace, and contact details (except in the case of anonymous reporting);
• time and place circumstances in which the reported facts occurred;
• clear and complete description of the reported facts;
• personal details or other elements enabling identification of the person(s) who committed the reported acts;
• any other persons who may provide information on the reported facts and any documents that may support their validity;
• any other information that may provide useful evidence regarding the existence of the reported facts;
• a declaration by the reporting person regarding the absence or existence of a private interest connected to the report.

It is in any case essential that the facts are of direct knowledge of the reporting person and have not been reported by others.

1.4.1 Reporting procedure

Once the report has been received, the Head of Internal Reporting Systems, having verified its completeness, informs the reporting person (if not anonymous), using the same method, of the initiation of the review process and forwards the report to the Auditor for subsequent examination.

Following the Auditor’s analysis process:

• if the report is unfounded, the Head of Internal Reporting Systems informs the reporting person (through the same reporting channel) of the reasoned outcome and the conclusion of the procedure;
• if the report is founded, the Head of Internal Reporting Systems informs the reporting person of the positive outcome of the investigations and, at the same time, provides a similar notification (through a separate communication) to the reported person.

During the analysis process, the Auditor assesses the report in terms of relevance and seriousness.

At this stage, the Auditor, in strict compliance with the principles of impartiality and confidentiality, may carry out, including through other control functions, any activity deemed appropriate to further investigate the facts that led to the violation.

Seriousness is presumed where the reported fact is not manifestly unfounded and is potentially capable of producing significant harmful effects, taking into account the significance of the violation and its degree of offensiveness or danger. By way of example (but not exhaustively), criminal or administrative sanctions associated with the violation may be relevant in assessing its seriousness.

The Auditor promptly informs the Board of Directors and the Chief Executive Officer or General Manager in cases where particularly serious violations have occurred, so that they may assess the adoption of any decision-making and disciplinary measures within their respective competence.

At any stage of the procedure – and without waiting for the outcome of the assessment – the Auditor reports directly and without delay any relevant information contained in the report to the corporate bodies, which may adopt the appropriate measures, including urgently where necessary.

The reporting procedure (from the receipt phase to the information phase to corporate bodies) must be completed as quickly as possible, according to criteria that take into account the seriousness of the violation, in order to prevent the continuation of violations from causing further harm.

1.5 Decision-making measures

Where reports entail the adoption of decision-making measures, such measures are entrusted to the Board of Directors, after consulting the Audit Body.

Where the reporting person is jointly responsible for the reported violation, the Board of Directors provides preferential treatment compared to other jointly responsible parties, except in cases where the reporting person’s conduct is particularly serious and critical.

1.6 Confidentiality obligations and protection of the reporting person

1.6.1 Protection of anonymity

In order to prevent fear of adverse consequences from discouraging reporting, the identity of the reporting person (whistleblower) may not be disclosed without their explicit consent, and all those who receive or are involved in the management of reports are required to protect the confidentiality of this information.

Exceptions apply where the reporting person may be liable for slander or defamation pursuant to the Italian Criminal Code or Article 2043 of the Civil Code, as well as where anonymity cannot be asserted by law (for example, where information is necessary for criminal, tax, or administrative investigations, or inspections by supervisory authorities).

The whistleblower’s anonymity is also guaranteed in disciplinary proceedings where the charge against the reported person is based on findings that are distinct from and additional to the report (which may occur where the report is only one of the elements revealing the offence, while the disciplinary charge is based on other facts sufficient on their own to justify the initiation of disciplinary proceedings). The reporting person’s identity may instead be disclosed to the Chief Executive Officer and/or General Manager, as well as to the reported person, where the reporting person consents or where the charge is based, in whole or in part, on the report and knowledge of the identity is absolutely indispensable for the defence of the reported person.

Any breach of the confidentiality obligation, including the disclosure of information from which the reporting person’s identity may be inferred, is considered a violation of this regulation and gives rise to disciplinary liability, without prejudice to any further liability provided for by law.

1.6.2 Prohibition of discrimination

Employees who submit a report pursuant to this regulation may not be sanctioned, dismissed, or subjected to any discriminatory measure, direct or indirect, affecting working conditions for reasons connected, even indirectly, to the report. Discriminatory measures include unjustified disciplinary actions, workplace harassment, and any other form of retaliation resulting in intolerable working conditions.

In the most serious cases, and where possible, Intarget Group S.r.l. – Società Benefit may consider transferring the reporting person due to environmental incompatibility, subject to their consent.

Any employee who believes they have suffered discrimination shall provide a detailed report to the Auditor, who, having assessed its validity, reports the alleged discrimination to the General Manager of the employee responsible for the alleged discrimination, in order to enable the adoption of the necessary measures to restore the situation and/or remedy the negative effects of the discrimination.

Any form of retaliation or discrimination affecting the working conditions of those who cooperate in verifying the validity of the report is also prohibited.

1.6.3 Data protection and document archiving

In order to ensure the reconstruction of the various stages of the reporting process, the Auditor ensures:

• traceability of reports and related investigative activities;
• storage of documentation relating to reports and verification activities in dedicated archives (paper/electronic), with appropriate levels of security and confidentiality;
• retention of documentation and reports for a period no longer than necessary for the purposes for which the data were collected or subsequently processed, and in any case in compliance with Intarget’s applicable privacy procedures.

The processing of personal data of persons involved and/or mentioned in reports is protected in accordance with applicable legislation and company privacy procedures.

1.7 Liability of the reporting person

This regulation does not prejudice the criminal and disciplinary liability of the whistleblower in the event of slanderous or defamatory reporting pursuant to the Italian Criminal Code (Articles 368 and 595) and Article 2043 of the Civil Code.

Any abuse of this regulation, such as manifestly opportunistic reports and/or reports made solely for the purpose of harming the reported person and/or others, as well as any other improper use or intentional misuse of the mechanism governed by this regulation, also gives rise to liability in disciplinary and other competent forums.

1.8 Annual report

The Sole Auditor prepares an annual report, in compliance with the protection of reporting persons, on the proper functioning of the internal reporting systems, containing information on the outcomes of activities carried out following the reports received.

This report is approved by the Board of Directors and made available to staff by 17 December of each year.