Whistleblowing Policy

In implementation of Legislative Decree no. 24 of 10 March 2023 on Whistleblowing, Gipys has equipped itself with a "Procedure for the management of reports" which incorporates the contents of the Decree and the principles adopted by the company in the Policy on the management of reports.

The Whistleblowing Report may be sent to Gipys by a natural person, also called a "Whistleblower", who, in various capacities, has or has had an employment, collaboration or, more generally, contractual relationship with Gipys.

A Whistleblowing Report means any communication received by Gipys regarding:

-violations of the Code of Ethics adopted by Gipys

-violations of law 231/01

-violations of laws and regulations (national or European Union)

-violations of provisions of the authorities

-violations of company procedures

-human rights violations, including any act of discrimination, harassment or abuse

-behaviors that cause damage or prejudice to Gipys.

The reporter is guaranteed the highest levels of security appropriate to the chosen channel.

The reporting system ensures that messages and their attachments can only be read by the person authorized to receive them.

Access to reports is permitted exclusively by entering a unique identification code, obtained following the report registered on the Platform, which allows the reporter to "dialogue" with Gipys srl while maintaining complete anonymity.

The platform does not allow digital tracking of the whistleblower.

The following are not treated as reports, regardless of the qualification given by the reporting party to the communication transmitted, for example:

-complaints and claims attributable to commercial activities;

- complaints, disputes, claims or requests related to a personal interest of the whistleblower that pertain exclusively to their individual employment relationships (for example: industrial disputes, interpersonal conflicts between the whistleblower and another worker or hierarchically superior figures);

- communications regarding circumstances/facts previously known and discussed and in any case the subject of disputes (judicial, extrajudicial, or administrative) pending between Gipys srl and employees or third parties and monitored by the legal department and/or other competent company functions, except in cases where significant new elements are presented and adequately substantiated;

- news published in the media and public communications made by organizations external to the company, manifestly unfounded news, as well as information acquired solely on the basis of unreliable rumors or hearsay.

To facilitate the receipt of reports and ensure the confidentiality of the whistleblower's identity, Gipys srl has implemented the following reporting channels:

Privacy

Gipys srl manages reports and the related processing of personal data in compliance with applicable laws and in accordance with the provisions of the personal data protection legislation.

The entities authorized to receive reports and process personal data within the scope of the same are trained to this end pursuant to Articles 29 of the GDPR and 2-quaterdecies of the current Privacy Code.

The communication of information useful for the purposes of investigating and processing the report is permitted – within the strictly necessary limits – and in particular:

-only in cases where knowledge of the information is essential for understanding the reported facts and/or for conducting the related investigation activities;

-for reporting purposes as regulated by internal regulations.

Gipys srl adopts specific technical and organizational security measures to ensure the proper storage of processed data.