Needc to report an abuse? Click here.
REPORTS MANAGEMENT
Contents
1. Purpose
This procedure defines which information channels must be used for the receipt, analysis, and processing of reports, including anonymous ones, relating to:
- violation of principles and illicit behaviors concerning administrative liability pursuant to Legislative Decree 231/2001;
- violation of any national or European legislation, or the commission of any offense even if not a predicate offense under Legislative Decree 231/2001;
- violation of any Management System rule or current legislation that could harm the integrity of beSharp;
- violations of principles established by UNI/PdR 125, with particular reference to incidents of harassment and/or mobbing.
2. Scope of application
This procedure applies to:
- all personnel who, in various capacities, collaborate with the organization;
- any external companies, properly contracted, appointed to perform activities on behalf of beSharp;
- shareholders and persons with administration, management, control, supervisory, or representation functions within the Company;
- any other person or entity that interacts with beSharp and wishes to make a report.
3. Operating procedures
The activities regarding the management of reports described below are carried out by:
- the Supervisory Body (OdV) concerning Legislative Decree 231/2001 and whistleblowing;
- the Internal Representative for Gender Equality and the HR Manager, both members of the Steering Committee for Gender Equality under UNI/PdR 125.
Each scope corresponds to a separate information flow within the platform and a distinct Report Manager, with their own access credentials. No Manager can access the flows under another’s jurisdiction.
Jurisdiction is divided as follows:
- reports concerning the Organization, Management and Control Model, the Code of Ethics, and relevant conduct pursuant to Legislative Decree 231/2001, including whistleblowing reports pursuant to Legislative Decree 24/2023: the Report Manager is the Supervisory Body (OdV);
- reports concerning gender-based discrimination, harassment, mobbing, all forms of violence, and violations of the principles of UNI/PdR 125:2022: the Report Manager is the Steering Committee for Gender Equality, represented by the Internal Representative and the HR Manager.
When a report covers multiple areas, the Manager who received it shall inform the other competent Manager without delay, transmitting only the necessary elements and obscuring the identity of the reporting person and other involved persons, unless their knowledge is essential for the investigation and the reporting person has consented. The Managers conduct the investigation in coordination, and each makes the determinations within their competence.
The exchange of information between Managers is not limited to individual reports. The Steering Committee for Gender Equality transmits the minutes of its meetings and the outcomes of handled reports to the Supervisory Body in an anonymized format, informing it without delay when the examined facts may be relevant for the purposes of Model 231. The Supervisory Body, in turn, informs the Committee of facts learned that fall within the latter’s competence. Under no circumstances does the exchange involve disclosing the identity of the reporting or reported person.
The individuals serving as Report Managers are specifically trained in managing the channel and are bound to maintain the confidentiality of the reporting person’s identity even toward other Managers, corporate bodies, and Management.
No other corporate role has access to the content of the reports.
A Manager who finds themselves in a conflict of interest regarding a report—particularly when the report concerns their own conduct, that of a person hierarchically linked to them, or a procedure in which they were involved—must recuse themselves and provide immediate notice. In such cases, the report is managed: by the Supervisory Body, if the conflict involves a member of the Steering Committee; by the Steering Committee, if it involves the Supervisory Body and the matter is not under its exclusive jurisdiction; in all other cases, by the Board of Directors, which may possibly appoint a third party. The recusal and its justification are recorded in the platform without revealing the reporting person’s identity.
3.1. Subject of the report
The subjects of reporting are potential violations, suspected or confirmed, of beSharp’s management system and/or Italian or European legislation, as well as the principles referred to in the Code of Ethics and the Integrated Management System Policy Document.
The thematic areas for collecting reports are briefly indicated below, each through a separate information flow:
- Whistleblowing: reports regarding the hypothetical violation of any anti-corruption law by the company, a colleague, a collaborator, or a third party, including requests or offers of undue payments received by them;
- Legislative Decree 231/2001: reports concerning acts or facts that may constitute the commission of crimes pursuant to the aforementioned decree on the administrative liability of entities;
- UNI/PdR 125: reports concerning alleged gender-based discrimination, incidents of mobbing, harassment, or violence, including verbal, digital, and physical violence in all forms.
3.2. Methods for submitting reports
The channels identified by beSharp for collecting reports are digital, and the communication methods include both oral and written forms. Specifically:
- The Report Manager handles reports via an IT platform called “Ananda Whistleblowing”, which all reporting persons can access via a hyperlink on the beSharp website; upon submission, the reporting person selects the scope of the report, which determines its routing to the competent Manager;
- Verbal deposition made directly to the Report Manager.
If the person chooses the oral form and decides to address the Report Manager directly, the content must be transcribed into a written record signed by both the reporting person and the relevant Report Manager, and the record must be uploaded to the platform.
The detailed description of the behavior originating the report must not include information not strictly related to the subject of the report.
“Ananda Whistleblowing” ensures the absolute confidentiality of the identity of the reporting person and the reported persons. The entire content of the platform is, in fact, protected by encryption. Only the Report Manager competent for that scope can access the data of each report using personal credentials; only the reporting persons can access the content of their own report via a unique code associated with the report.
The reporting person may choose not to identify themselves (and remain anonymous), communicating with the Report Manager through the messaging system linked to the report, which allows for secure bidirectional dialogue.
In addition, pursuant to Article 6 of Legislative Decree No. 24 of March 10, 2023, the reporting person may also apply to the National Anti-Corruption Authority (ANAC) using the form available at the link https://whistleblowing.anticorruzione.it/#/.
Involvement of ANAC is allowed only if the reporting person:
- has already used the internal channel and the report was not followed up;
- has reasonable grounds to believe that, by using the internal channel, the report would not be effective or there would be a risk of retaliatory conduct;
- has reasonable grounds to believe that the breach may constitute an imminent or obvious danger to the public interest.
3.3. Privacy notice on reports
Data subjects are duly informed about the methods and purposes of processing their personal data through a notice within the “Ananda Whistleblowing” platform, the text of which is reported below:
“For the management of activities related to reports, the processing of the data of the reported persons and the reporting person is necessary to fulfill the legal obligation pursuant to Legislative Decree 24/2023.
The processing of personal data relating to the receipt and management of reports is carried out by beSharp spa as the Data Controller, with registered office at Via Claudio Treves 3, 27100 Pavia (PV).
The data of non-anonymous reporting persons and reported persons will be managed with a guarantee of absolute confidentiality through this platform and will be accessed and transmitted only to the entity appointed to manage reports, as required by the company procedure made available to reporting persons.
The platform is provided to beSharp spa and the reporting persons, via the internet, by the supplier CentoCinquanta srl. The platform supplier securely stores the data on behalf of beSharp but cannot access the report information because it is fully encrypted.
The content of the reports is accessible exclusively to the persons managing the reports via a private key and to the reporting person (even if anonymous) via a password chosen by them and known only to them.
Personal data that are clearly not useful for processing a specific report will not be collected or, if transmitted to the platform, will be deleted. Data will be retained for five years from the closure of the report, as required by current legislation.
Data subjects, in compliance with the rules established by Legislative Decree 24/2023 on whistleblowing, may exercise their rights of access, rectification, restriction of processing, and request for erasure by directly contacting the person handling the reports, without prejudice to the legal obligations binding beSharp spa as the Data Controller.
Data subjects always have the right to lodge a complaint with the Data Protection Authority (Garante per la Protezione dei Dati Personali) according to the procedures described on the website www.garanteprivacy.it.”
3.4. Receipt of reports
Upon submission of a report, the Report Manager competent for the selected scope receives a notification of the new report and logs into the platform. The Manager shall acknowledge receipt to the reporting person within 7 days, thereby taking charge of the report.
3.5. Investigation and assessment
This phase of the process aims to verify and conduct specific assessments regarding the validity of the reported facts, also for the purpose of formulating any recommendations regarding the adoption of necessary corrective actions on the affected corporate areas and processes, with a view to strengthening the internal control system. All necessary activities, including hearings and/or the acquisition of evidence, are carried out exclusively by the Report Manager who, upon receiving a report:
- Verifies the existence of the prerequisites for the report and, specifically, that the reporting person is authorized to make it and that the subject falls within the scope of the procedure.
A report may be deemed inadmissible (and therefore archived) if:
- it does not contain the data constituting the essential elements of the report;
- there is manifest groundlessness of the factual elements attributable to the violations foreseen by the management system and the legislator;
- the content reports facts so generic that they cannot be understood by the appointed offices or person;
- only supporting documentation is submitted without actual reporting of alleged violations. In the case of reports produced in evident bad faith, the Report Manager reserves the right to archive them, deleting all elements that could allow the identification of the reported subjects.
2. Evaluates the reports by relying, depending on their nature, on the company’s internal structures to carry out in-depth analyses of the reported facts, or on third-party professionals. The Manager may directly interview the reporting person, including via the platform, and the involved persons, taking care to maintain the absolute confidentiality of the reporting person’s identity.
3. In the event that the involvement of other subjects is necessary, any information or data that could lead to the identification of the reporting person or any other involved person is obscured.
4. Takes, at the conclusion of the activity, the consequential, appropriately justified decisions, archiving the report if necessary, or requesting an evaluation for disciplinary and sanctioning purposes based on the findings.
5. Concludes the investigation and communicates the final outcome to the reporting person via the platform within 3 months from the date of the acknowledgment of receipt of the report. The communication contains information on the follow-up given or intended to be given to the report, while respecting the confidentiality of the personal data of the persons involved.
The Report Manager maintains full traceability by documenting in the platform every action necessary for the fulfillment of their institutional duties.
For reports under the jurisdiction of the Supervisory Body, the outcome of the investigation and any recommendations are reported to the Board of Directors according to the information flows required by the Model, with the reporting person’s identity always obscured. For reports under the jurisdiction of the Steering Committee, the outcome is reported to Management as required by the Committee’s appointment documents and the HR procedure, with the same confidentiality guarantees.
Each Manager reports annually, in an aggregated and anonymous form, on the number of reports received, the areas covered, and the outcomes: the Supervisory Body in its report to the Board of Directors, and the Steering Committee within the monitoring indicators of UNI/PdR 125.
3.6. Retention of data and reports
All reports and related documentation are retained in the “Ananda Whistleblowing” platform for a period of 5 years from the date the investigation concludes, as defined by current legislation.
Reports received that are classified as manifestly unfounded or made in bad faith, along with all related identifying data of the involved subjects, are deleted immediately.
Once the retention period has expired, the data is permanently and irreversibly deleted, unless retention is necessary for ongoing litigation.
The processing of personal data connected to the management of reports is governed by the dedicated Data Protection Impact Assessment (DPIA) and the privacy notice provided to data subjects, available on the platform as cited above.
The exercise of rights by the involved person may be delayed or restricted when necessary to avoid jeopardizing the confidentiality and effectiveness of the procedure.
3.7. Protection of the reporting person and disciplinary measures
beSharp will not tolerate retaliation of any kind against a resource who reports suspected incidents of misconduct if they have reasonable grounds to believe the reported information is true at the time of reporting.
Reporting persons are guaranteed against any form of retaliation, discrimination, or penalization, and in all cases, the confidentiality of their identity is ensured, without prejudice to legal obligations and the protection of the rights of beSharp or of persons wrongly accused and/or accused in bad faith.
beSharp provides the internal reporting channel through which reporting persons can report relevant illicit conduct pursuant to Legislative Decree 231/2001 or violations of the Model. Use of the channel is optional: the reporting person, the facilitator, and the involved subjects may not suffer any form of retaliation, direct or indirect, nor any sanction or prejudicial measure due to the report. The confidentiality of the reporting person’s identity and the content of the report is guaranteed. Conversely, retaliatory conduct, obstructing reports, and reports made with malice or gross negligence containing false information are subject to sanctions.
The protection extends beyond the reporting person to facilitators, work colleagues, and relatives of the reporting person.
In case of doubts about the methodology to apply for reporting an event, it is possible to contact the Report Manager for clarification.
The protections provided by Legislative Decree 24/2023 against retaliation apply to reports made through the channels described in this procedure. Informal discussions with the HR Helpdesk provided for in the HR procedure do not constitute a report pursuant to the decree and do not inherently activate such protections: those intending to benefit from them must use the formal channel. HR personnel will inform anyone contacting the Helpdesk of this distinction and will not share the content of the discussion with others without the interested person’s consent.
The recipients of the Model are required to promptly communicate to the Supervisory Body any violations of the Model, the Code of Ethics, and procedures, as well as relevant conduct under Legislative Decree 231/2001, of which they become aware in the course of their duties.
Failure to fulfill this reporting obligation, as well as the communication of knowingly false or unfounded information, constitutes a disciplinary offense and is sanctioned according to the Model’s disciplinary system, in compliance with legal and contractual guarantees. Any disciplinary measure adopted will be taken in compliance with the National Collective Labour Agreement (CCNL) and the provisions of the HR procedure regarding disciplinary proceedings.