Who can report?

BEFED is committed to operating in an ethical and responsible manner and demands of the people with whom it establishes or has established relations in the context of its activities, and specifically

• BEFED employees;
• self-employed persons, including those referred to in Chapter I of the law no. 81/2017, as well as holders of a collaboration relationship referred to in’ 409 of the Code of Civil Procedure and to the’Article 2 of Legislative Decree 81/2015, who perform their work for BEFED;
• workers and collaborators of companies supplying goods or services and carrying out works for BEFED;
• self-employed professionals and consultants working for BEFED;
• paid and unpaid volunteers and trainees working at BEFED;
• customers, potential customers of BEFED;
• shareholders (natural persons) shareholders and persons with administrative, management, control, supervisory or representative functions in favour of BEFED, even if such functions are exercised on a de facto basis. to behave similarly.

To this end, BEFED has implemented specific rules, a whistleblowing process and appointed an Internal Whistleblowing Management Body.

BEFED therefore wishes to provide potential whistleblowers with secure channels that guarantee the confidentiality of their identity and the content of the report, without prejudice to any legal obligations, and their protection from retaliation. Similarly, facilitators, family members and colleagues of the whistleblower and related companies/entities are also protected from retaliation.

Any person who engages in retaliatory, discriminatory, unfair or improper conduct towards the whistleblower and other persons involved in the report may be subject to disciplinary proceedings, where applicable, and/or reported to the judicial authorities if his or her conduct can be deemed to constitute a criminal offence.

The protection of reporting persons applies in the following cases:

• when the legal relationship between BEFED or the organisation to which it belongs and the reporter is ongoing;
• when the legal relationship between BEFED and the reporter, or the organisation of which the reporter is a member, has not yet begun, if information on violations has been acquired during the selection process or in other pre-contractual stages;
• during the probationary period for employees;
• after the termination of the legal relationship if the information on violations was acquired in the course of that relationship.

What to report?

BEFED encourages all those in business relationships, as set out in the preceding point, to report any improper, dishonest or potentially illegal activity already committed, likely to be committed or potentially committed, as well as conduct that may cause damage or harm, including to BEFED's image.

What not to report?

Reports other than those described above, and in particular those linked to personal interests, information that is manifestly unfounded, information that is already fully in the public domain, and information acquired only on the basis of indiscretions or rumours that are not very reliable (so-called “rumours”), will not be dealt with.

Any reports on HR issues (e.g. harassment, bullying, equal opportunities, gender diversity) will be handled in accordance with the relevant internal regulations.

If the report proves to be unfounded and no judicial or disciplinary action is taken, the personal data will be deleted or anonymised within the timeframe indicated in the notice.

In the event of unfounded, bad faith or negligent reports, BEFED reserves the right to act in defence of its own interests or of the aggrieved parties that are the subject of the report. Thereafter, personal data will be deleted/destroyed or anonymised within the timeframe indicated in the information notice.

How to report?

In implementation of the legislation, BEFED provides the following ways to make an internal report:

• Written form
• Confidential meeting

Reporting in writing by registered/registered mail
For whistleblowers who prefer to report in writing by registered mail (preferred) or by ordinary mail, it is advisable for the report to be placed in two sealed envelopes: the first with the whistleblower's identification data together with a photocopy of the identification document, if the whistleblower does not wish to remain anonymous; the second with the report, so as to separate the whistleblower's identification data from the report.

It is recommended, as far as possible, that the whistleblower indicate a contact reference (e.g. a mailbox with a name not necessarily traceable to the whistleblower and not on BEFED's corporate domain) so that he/she can be contacted later for any further investigation and to give feedback that his/her report has been received and taken care of). Both envelopes shall then be placed in a third closed envelope marked “confidential” on the outside and addressed to “Reporting Management Body” at BEFED FRANCHISING BERGAMO. The report shall then be subject to confidential registration, by means of an independent register, by BEFED.

If the reporter does not use a single envelope, his report will still be taken into account.

Confidential meeting

Finally, should the whistleblower wish to have a confidential meeting with the SB or with a member of the Management Body of the internal reporting channel, he may request it by means of a written report (in accordance with the procedures indicated above), preferably indicating the place where he wishes the meeting to be organised, which will be minuted and signed by the whistleblower only with his consent. Where requested by the reporter, a meeting can also be organised via a remote platform (e.g. teams).

The whistleblower, if he/she deems it appropriate, may also resort to the support, by requesting one or more meetings, of a facilitator(s) who may also play the role of mediator.

The reporter may use the EXTERNAL CHANNEL PROVIDED BY ANAC https://whistleblowing.anticorruzione.it/#/ if at least one of the following circumstances applies:

1. the internal channel made available to the company does not appear suitable to protect the confidentiality of the persons and the content of the report;
2. the company did not follow up on a report made through the internal channel;
3. there is a clear likelihood that any report would not be followed up or would result in a concrete risk of retaliation against the reporter or other persons;
4. there is a concrete imminent or obvious danger to the public interest (e.g. a situation of emergency or risk of irreversible harm, including to the physical safety of one or more persons) that requires the breach to be disclosed promptly and have a wide resonance to prevent its possible effects).

Cases 3 and 4 must be based on well-founded reasons and not mere inferences.

In addition, a whistleblower who believes that he has suffered retaliation as a result of a report made may communicate the incident to the ANAC in accordance with Article 19 of Legislative Decree 24/2023, in order to allow the latter to carry out the investigations provided for by the legislation and possibly impose a sanction on the person who implemented the retaliatory measure.

At the time of publication of this instruction, access to the reporting channel is available on ANAC's institutional website at the page https://www.anticorruzione.it/-/whistleblowing

It is advisable to visit the authorities' websites directly to check any additional conditions for external reporting and updates on reporting channels.

Finally, the reporter may decide to make a public disclosure, i.e. making information about violations publicly available through the press or electronic media or otherwise through means of dissemination capable of reaching a large number of people.

How can the reporter be further protected?

In order to protect the whistleblower, it is possible to apply further measures in addition to those indicated, in particular it is suggested that the whistleblower:

• to provide only information relevant to the alert;
• to the mailbox (if he favoured this channel) from a non-business connection (e.g. from his home);
• use a browser in anonymous browsing and subsequently delete the browser's browsing history. The reporter can thus maximise confidentiality (reducing the risk of indiscreet observations).

What should be the content of the report?

The report should contain information concerning the name of the person(s) or reference(s) of the structure(s) allegedly responsible for the violation and a brief description of the alleged violation, with an indication of the circumstances of time and place in which the fact(s) occurred, also highlighting any third parties involved, with knowledge of the facts (witnesses) or potentially harmed.

The report also:

• must indicate the identity of the reporter where the reporter does not wish to remain anonymous;
• must indicate an address of the reporter to whom updates should be communicated (e.g., as indicated above, an e-mail box with a name not necessarily traceable to the reporter and not on BEFED's corporate domain).

To facilitate the handling of the report, all available supporting documentation should be attached.

If a whistleblower is involved, he/she will have to specify this, as he/she may be treated differently from other persons, subject to the applicable legislation.

No personal data other than strictly necessary and/or irrelevant to proceed with the investigation should be included in the report.

Is it possible to make anonymous reports?

Recrui Srl encourages whistleblowers to give preference to non-anonymous reports in order to streamline investigations and make them more efficient; moreover, in the case of anonymous reports, the Management Body of the internal reporting channel may not be able to effectively investigate the report and/or to contact the whistleblower to acknowledge receipt of the report. Therefore, it is recommended, where the whistleblower intends to use this method, that the report be adequately detailed and made with a wealth of details and in any case such as to bring to light facts and situations relating them to specific contexts (e.g., indication of particular names or qualifications, mention of specific offices, proceedings or particular events, etc.).

It should be noted that, if the reporter opts for public disclosure, the information on violations is placed in the public domain and cannot be protected by BEFED. Therefore, if the reporter voluntarily discloses his or her identity, confidentiality protection will not be relevant. If, on the other hand, the reporter does not disclose his or her identity, BEFED will treat the disclosure in the same way as an anonymous report.

What does BEFED do after receiving the alert?

The Whistleblowing process consists of the following steps:

• receipt of the alert;
• preliminary assessment by the Management Body of the internal reporting channel;
• investigation;
• closure of the signalling.

The Management Body of the internal reporting channel checks the report received to ascertain what is described and within a maximum of 7 days notifies the reporting person. The results of the investigation may include several steps and in-depth investigations and may involve other persons who are authorised to process the personal data of the whistleblower and of the other persons involved in the report. Under no circumstances will any of the persons involved in the report take part in this activity. However, in the event that reports are reported to the authorities, the obligation to keep the identity of the persons involved or mentioned in the report confidential may lapse in the manner and under the conditions provided for by the applicable legislation. The identity of the whistleblower and any other information from which it could be inferred may be disclosed to persons other than those competent to handle the report only with the whistleblower's consent, or when compulsory or legitimate under the applicable legislation, or when disclosure of the identity is indispensable (e.g. in the context of investigations brought before the judicial authorities); in the latter two cases, the whistleblower will be informed by BEFED of the reasons for such disclosure.

Upon completion of the investigation (and no later than three months after the report), the sole administrator is informed of the results of the investigation and, where appropriate, proposed preventive, mitigating, penalising measures to be taken by the latter.

In some cases, the management body of the internal reporting channel does not process the report, in which case it provides the reporter with an adequate justification. Such conditions are met:

• if the report relates to facts that - although concerning BEFED - turn out to be “non inherent reports”, such as but not limited to: commercial complaints, commercial proposals, marketing activities;
• if the reported facts are known to be under investigation by public authorities (e.g. judicial authorities and administrative bodies);
• where the report relates to facts already known and fully ascertained beforehand and where the new report has added or allows further elements or aspects to be added to what is already known (so-called outdated reports), or where documentation is merely produced in the absence of the report of unlawful conduct or irregularities;
• if the Management Body of the internal reporting channel manifests incompetence on the reported issues.

In all such cases, the Management Authority of the internal reporting channel will file the report by acknowledging it to the whistleblower and, if necessary, directing him/her to another entity to which the report should be forwarded.

In some cases, it may be necessary, with the consent of the reporting person, to disclose his data to authorised third parties; while the sole administrator reserves the right to disclose the subject of the report to the Judicial Authority without first requesting the reporting person's consent (Article 12(3) of Legislative Decree 24/2023 “In criminal proceedings, the identity of the reporting person is covered by secrecy in the manner and within the limits provided for in Article 329 of the Code of Criminal Procedure”).

Who is the Management Body of the internal reporting channel composed of?

The Management Body of the internal reporting channel is composed of independent, non-executive members who have been chosen and appointed on the basis of their expertise and who are bound to complete confidentiality of the information they may become aware of.