Kineo Energy & Facility S.r.l.

 

 

 

 

Whistleblowing Policy

Operational protocol pursuant to Legislative Decree No. 24 of March 10, 2023, on "Implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019, on the protection of persons who report breaches of Union law and on provisions concerning the protection of persons who report breaches of national laws"

 

 

 

 

 

 

 

Edition 01 - [07/31/2023]

 

 

 

INDEX

SECTION I _3

OBJECTIVE SCOPE_3

The violations being reported_3

Violations not subject to reporting protections_4

SUBJECTIVE SCOPE OF APPLICATION_4

Private law entities required to prepare and implement whistleblower protection measures_4

Reporting subjects_5

SIGN_7

Elements of the report_7

Ordinary reports or reports made to a non-competent party_9

Reporting of retaliation to ANAC_9

External reporting to ANAC_10

Public Disclosure_11

Complaint to judicial authority_12

Processing of personal data_12

 

SECTION II_14

PROTECTIONS FOR THE REPORTER_14

The protection of the confidentiality of the reporter_14

Protection from retaliation_15

The ban on waivers and settlements_16

The conditions for the application of protection from retaliation_17

Protection from retaliation_17

Limitations of liability for those who report, whistleblow or make public disclosures_18

Offenses that cannot be committed if the exculpatory factor operates in cases of dissemination of information_19

Lawful/illegal means of access to reported information or documents containing it_19

Conditions for the forfeiture to also operate in cases of engaging in conduct, acts or omissions_19

Support measures_19

Final Provisions_20

 

SECTION I

 

1. OBJECTIVE SCOPE OF APPLICATION

Legislative Decree 24/2023 (hereinafter the "Decree") regulates the protection of persons who report violations of national or European Union regulatory provisions that harm the public interest or the integrity of the public administration or private entity, of which they have become aware in a public or private employment context.

 

1. 1. The violations being reported:

 

Under Article 2 of the Decree, "violations" are to be considered those behaviors, acts or omissions that harm the public interest or integrity of the public administration or private entity and consist of:

• Administrative, accounting, civil or criminal offenses that do not fall under (3), (4), (5) and (6);
• illegal conduct relevant under Legislative Decree 231/2001, or violations of the organization and management models provided therein, which do not fall under numbers 3), 4), 5) and 6);
• offenses that fall within the scope of application of the European Union or national acts indicated in the Annex to the Decree or national acts that constitute implementation of the European Union acts indicated in the Annex to Directive (EU) 2019/1937, although not indicated in the Annex to the Decree, related to the following areas: public procurement; financial services, products and markets and prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; privacy and data protection; and network and information system security;
• acts or omissions that harm the financial interests of the Union referred to in Article 325 T.F.U.E. specified in the relevant secondary legislation of the European Union;
• acts or omissions concerning the internal market, as referred to in Article 26(2) of the T.F.U.E., including violations of European Union competition and state aid rules, as well as violations concerning the internal market related to acts that violate corporate tax rules or mechanisms whose purpose is to obtain a tax advantage that frustrates the object or purpose of the applicable corporate tax law;
• Acts or conduct that frustrate the object or purpose of the provisions set forth in Union Acts in the areas indicated in (3), (4) and (5);
• communications to ANAC of retaliation that those who have made reports, complaints or public disclosures believe they have suffered in their work context.

 

Information on violations that harm the public interest or integrity of the public administration or private entity is subject to reporting, public disclosure, or whistleblowing. The information may concern:

• the violations committed;
• violations that have not yet been committed, which the whistlebower reasonably believes could be committed based on factual evidence;
• the elements involving conduct aimed at concealing violations (e.g., concealment or destruction of evidence about the commission of the violation).

 

1. 2. Violations not subject to reporting protections:

 

Pursuant to Art. 1, c. 2, the Decree does not apply:

• to objections, claims or demands related to a personal interest of the reporting person or the person making a complaint to the judicial or accounting authority that pertain exclusively to his or her individual labor or public employment relationships, or inherent in his or her labor or public employment relationships with hierarchically subordinate figures;
• to reports of violations where already mandatorily regulated by the acts of the European Union or national acts indicated in Part II of the Annex to the Decree or by national acts that constitute implementation of the acts of the European Union indicated in Part II of the Annex to Directive (EU) 2019/1937, although not indicated in Part II of the said Annex;
• to reports of national security breaches, as well as procurement related to defense or national security aspects, unless such aspects are covered by relevant EU secondary legislation;
• news that is patently unsubstantiated, information that is already totally in the public domain, as well as information acquired solely on the basis of poorly reliable indiscretions or rumors (socalled rumors);
• irregularities in the management or organization of the activity.

 

2. SUBJECTIVE SCOPE OF APPLICATION

 

1. 1. Private law entities required to prepare and implement whistleblower protection measures:

 

The Decree includes private-law entities among those required to prepare and implement protective measures for those who report, make a public disclosure or denounce wrongdoing: this is a broad category of entities specifically identified with reference to several criteria, relating to the size of the staff, whether or not they have adopted the Organizational and Management Model pursuant to Legislative Decree 231/2001, as well as whether or not they carry out activities in sectors governed by EU law.

The types of private sector entities required to comply with the whistleblower protection regulations are detailed below:

• Subjects who have employed an average of at least fifty employees with permanent or fixedterm employment contracts in the last year (Art. 2(q)(1));
• Subjects that although they have not employed in the last year an average of at least fifty employees with permanent or fixedterm employment contracts, however, fall within the scope of Union acts (see parts I.B and II of Annex 1 of the Decree), in the field of services, financial products and markets and prevention of money laundering and financing of terrorism, environmental protection and transport safety (Art. 2, co. 1, para. q), no. 2);
• Other private law entities that, other than those indicated in the aforementioned Art. 2, co. 1, letter q) no. 2, fall within the scope of application of Legislative Decree no. 231/2001 and adopt organization and management models provided therein, if in the last year they have employed an average of at least fifty subordinate workers with permanent or fixedterm employment contracts;
• Other privatesector entities that, other than those indicated in the aforementioned Art. 2, para. 1(q) No. 2, fall under the scope of Legislative Decree No. 231/2001, adopt organization and management models provided therein, but in the last year have not reached an average of at least fifty employees with permanent or fixedterm employment contracts. Such entities are required to comply with the Whistleblowing provisions, even if they employ fewer than fifty employees, but only if they adopt the organization and management models already provided for in Article 6 of Legislative Decree No. 231/2001.

 

It is worth pointing out that for the calculation of the average annual number of workers employed in private sector entities, reference should be made to the last calendar year preceding the year in which the reporting, public disclosure or denunciation takes place.

 

Kineo Energy & Facility S.r.l. falls within the subjective scope of application of the Decree, as a private entity falling under the hypotheses of nos. 1) and 3).

 

2.2. Reporting subjects:

 

The categories of private sector workers who are granted the protections under the new regulations are detailed below:

• Employed workers of Kineo Energy & Facility S.r.l., including workers whose employment relationship is regulated by Legislative Decree No. 81/2015 (e.g., parttime, intermittent, fixed-term, temporary, administration, apprenticeship, ancillary work); and workers who perform occasional services (whose employment relationship is regulated by Article 54bis of Legislative Decree No. 50/2017, converted with amendments by Law No. 96/2017);
• Selfemployed workers who carry out their work activities at Kineo Energy & Facility S.r.l., including selfemployed workers indicated in Chapter I of l. no. 81/2017. These are workers with self-employment relationships governed by Title III of Book V of the Civil Code, including work contracts referred to in Article 2222 of the same Civil Code (e.g., selfemployed workers who exercise the intellectual professions for the exercise of which registration in special registers or lists is required such as psychologists, architects, surveyors, etc.);
• Holders of a collaborative relationship referred to in Article 409 of the Code of Civil Procedure with Kineo Energy & Facility S.r.l., i.e., agency, commercial representation and other collaborative relationships that result in the provision of continuous and coordinated work, predominantly personal, even if not of a subordinate nature (e.g., lawyers, engineers, social workers who provide their work for a private sector entity by organizing it independently);
• Holders of a collaboration relationship referred to in Article 2 of Legislative Decree No. 81/2015 with Kineo Energy & Facility S.r.l. These are collaborations organized by the principal that result in exclusively personal and continuous work services, whose mode of execution is organized by the principal also with reference to "the time and place of work" (socalled "hetero-organization");
• Freelancers and consultants who work for Kineo Energy & Facility S.r.l. and who may be in a privileged position to report violations they witness;
• Paid and unpaid volunteers and interns who serve at Kineo Energy & Facility S.r.l;
• Shareholders individuals who hold shares in Kineo Energy & Facility S.r.l.;
• Persons with functions of administration, management, control, supervision or representation, even if these functions are exercised on a mere de facto basis, at Kineo Energy & Facility S.r.l. These are persons connected in a broad sense to the organization in which the violation occurs and in which they exercise certain functions, even in the absence of regular investiture (e.g. members of the Boards of Directors, even without executive positions, or members of the Supervisory Bodies);
• Workers or collaborators who work for private sector entities that provide goods or services or perform works on behalf of Kineo Energy & Facility S.r.l., but who in fact fall into the types indicated above.
• The protection applies not only if the reporting, whistleblowing or public disclosure occurs during the constancy of the employment or other legal relationship, but also during the probationary period and before (e.g., in the precontractual stage) or after the establishment of the legal relationship.

 

Also subject to the Decree's scope of application are those individuals other than the whistleblower who, however, could be recipients of retaliation, undertaken even indirectly, by reason of the role assumed within the reporting, public disclosure or whistleblowing process and/or the particular relationship that binds them to the whistleblower or whistleblower. These are in detail the following figures:

• Facilitator i.e., the natural person who assists the reporter in the reporting process, operating within the same work context and whose assistance must be kept confidential. The standard, by using the term "assistance," refers to a person who provides advice and support to the reporter. Moreover, it refers to a person operating within the same work context as the reporter (e.g., a colleague from a different office than the reporter's who assists the reporter in the reporting process on a confidential basis, i.e., without disclosing the information learned; a colleague who also holds the title of trade unionist if he or she assists the reporter on his or her behalf, without expensing the trade union's initials. It should be noted that if, on the other hand, he or she assists the reporter by using the union acronym, he or she does not play the role of facilitator. In this case, the provisions on the consultation of union representatives and the repression of antiunion conduct under Law No. 300/1970 remain applicable);
• Persons from the same work environment as the whistleblower or persons linked by a network of relationships that have arisen due to the fact that they work, or have worked in the past, in the same work environment as the whistleblower or complainant (e.g., colleagues, former colleagues, collaborators). A prerequisite for the application of protections in this case is the existence of a stable emotional or kinship link within the fourth degree with the whistleblower himself. While there is no doubt about the kinship bond, which must be within the fourth degree, the definition of stable affective bond appears to be more uncertain: it is believed that this expression could refer primarily to those who have a cohabiting relationship with the whistleblower and, in line with the rationale of extending protection against retaliation as much as possible, it is believed that the notion of stable affective bond could be understood not only as cohabitation in the strict sense, but also as a relationship of an affective nature characterized by a certain stability both in terms of time and in terms of sharing life (e.g. colleague (or former colleague) of the reporter who nevertheless maintains an affective relationship with the reporter even if the same does not take the form of actual sharing of the same dwelling);
• Work colleagues with a usual and current relationship with the reporter i.e., those who work in the same work environment as the reporter, discloser or whistleblower and have a usual and current relationship with said person. In contrast to what has been seen above with reference to persons in the same work context as the reporter, in the case of coworkers the legislature has provided that these are those who, at the time of the report, work with the reporter. Even in such cases, however, in order for the protections to be applicable, it is not sufficient to be working in the same work environment as the reporter. This requirement must be accompanied by having a "usual and current" relationship with the same reporter. The norm therefore refers to relationships that are not merely sporadic, occasional, episodic and exceptional but present, systematic and protracted over time, marked by a certain continuity such as to determine a relationship of "commonality," of friendship between the parties. In such cases, therefore, we refer only to activities that are carried out in the present and not also to past activities;
• Entities owned by whistleblowers, whistleblowers or public disclosures or for which said persons work, and entities that operate in the same work environment as said persons. These are, in particular:

1. entities owned by the reporter, to be understood in a broad sense thus encompassing both cases in which a person owns an entity exclusively and in majority co-partnership with third parties;
2. entities at which the reporter, whistleblower, or person making a public disclosure works, even though he or she does not own the entity (e.g., the situation in which an employee of a company that performs a supply service for an administration/entity reports or denounces a violation that occurred at the latter);
3. entities that operate in the same work environment as the reporter, whistleblower, or public discloser, even if not owned by the same or entities, whether in the public or private sector, that do not have a true direct link with the reporter either in terms of ownership or in that the latter performs work or service there, but rather an indirect link that can be traced in the circumstance whereby such entities fall within the work environment of the same.

 

 

3. REPORTS

 

1. 1. Reporting elements:

 

The report must be as circumstantial as possible, in order to allow the assessment of the facts by those responsible for receiving and handling reports in Kineo Energy & Facility S.r.l. as well as by ANAC.

In particular, it is necessary that it is clear from the report:

• whether it is "ordinary reporting" or "whistleblowing," i.e., reporting for which you intend to keep your identity confidential and benefit from the protections provided by the Decree;
• the details of the reporter, unless anonymous reporting is preferred (see Section 3.2);
• Any contact information for the reporter to be contacted confidentially;
• The circumstances of time and place under which the reported event occurred;
• description of the fact;
• generalities or other elements that would make it possible to identify the person to whom the reported facts are attributed;
• Any other information, observations or comments deemed useful in corroborating the reported facts.

 

It is useful to attach documents that may provide evidence of the facts being reported, as well as an indication of other individuals with potential knowledge of the facts.

 

1. 2. Anonymous reporting:

 

Reports from which the identity of the reporter cannot be determined are considered anonymous.

 

Anonymous reports, where substantiated, for ANAC are equated with ordinary reports and in that case considered in its "ordinary" supervisory procedures. Kineo Energy & Facility S.r.l. considers anonymous reports received through internal channels as ordinary reports.

 

In any case, the anonymous reporter or complainant, subsequently identified, who has notified ANAC that he or she has suffered retaliation may benefit from the protection that the decree guarantees against retaliatory measures. Therefore, Kineo Energy & Facility S.r.l. is required to record the anonymous reports received and keep the related documentation no later than five years from the date of receipt of such reports, thus making it possible to trace them, in the event that the reporter, or whistleblower, communicates to ANAC that he or she has suffered retaliatory measures because of that anonymous report or complaint.

 

1. 3. Internal reporting channel and person entrusted with reporting management tasks:

 

Kineo Energy & Facility S.r.l. has activated special internal channel for the transmission and management of reports. In particular, having heard the trade union representatives referred to in Article 51 of Legislative Decree 81/2015, Kineo Energy & Facility S.r.l. has activated a reporting channel through the "Legality Whistleblowing" platform, accessible at the following web address: https://kineofacility.segnalazioni.net . This internal reporting channel guarantees, through encryption tools, confidentiality:

• Of the reporting person;
• Of the facilitator;
• Of the person involved or otherwise mentioned in the report;
• Of the content of the report and related documentation.

 

The report can also be made directly to the SB by mail (as reported on the institutional website in the section dedicated to whistleblowing reports) for a direct report or a request for an appointment to be scheduled within a reasonable time. This method of reporting is also subject to the protections provided by the Decree. The sealed envelope, indicating that it is a whistleblowing report, must be sent to the attention of Attorney Giovanna Amato, c/o IOOS Studio Legale e Tributario, Largo Adolph Kolping 2, 39100 Bolzano.

 

Kineo Energy & Facility S.r.l.'s internal channel for handling the report is entrusted to the Supervisory Board of Kineo Energy & Facility S.r.l., which handles the report in accordance with the provisions of the Decree. In particular, the Supervisory Board of Kineo Energy & Facility S.r.l.:

• issues the reporter with an acknowledgement of receipt of the report within seven days from the date of receipt;
• Maintains interlocutions with the reporting person;
• Properly follows up on reports received;
• Provides feedback to the reporter.

 

In particular, properly following up the report implies, while respecting reasonable timeframes and data confidentiality, an assessment of the existence of the essential requirements of the report in order to assess its admissibility and thus be able to grant the reporter the protections provided. In assessing the above requirements, the SB may use the following criteria:

• reporting falling within the cases excluded from the application of the Decree (Art. 1, c. 2);
• manifest unfoundedness due to the absence of factual evidence to justify further investigation;
• ascertained generic content of the report of wrongdoing such that the facts cannot be understood, or report of wrongdoing accompanied by inappropriate or irrelevant documentation.

 

Where what is reported is not adequately substantiated, the SB can always request additional elements from the reporter through the dedicated channel or even in person if the reporter has requested a face-to-face meeting.

 

Having determined the admissibility of the report, the SB shall initiate the internal investigation of the reported facts in order to examine their existence. At the outcome of the investigation, the SB must give feedback on the measures taken or to be taken to follow up the report and the reasons for the choice made. The reporting person must be informed of the outcome of the investigation within three months from the date of the notice of receipt or, in the absence of such notice, within three months from the expiration of the period of seven days from the submission of the report.

 

 

1. 4. Ordinary reports or reports made to a non-competent party:

 

In order to benefit from the protections provided by the Decree, reports must be made using only the internal reporting channel in accordance with the provisions of Section 3.3 of this Procedure. Otherwise, the same must be considered "ordinary reporting."

 

If the internal report is submitted to a person other than the Supervisory Board of Kineo Energy & Facility S.r.l., the report must be forwarded, within seven days of its receipt, to the Body itself, giving simultaneous notice of the transmission to the reporting person.

 

It should be noted that the Supervisory Board of Kineo Energy & Facility S.r.l., as well as any hierarchical superior to whom the ordinary report is addressed, may still consider and evaluate ordinary reports made in a different manner from the provisions of point 3.3. However, in such cases, the reporter will not benefit from the protections provided by the Decree.

 

 

1. 5. Retaliation notifications to ANAC:

 

The whistleblower may notify ANAC of the retaliation he or she believes he or she has suffered as a result of the public report, complaint or disclosure made.

 

Individuals who may notify ANAC include those who having a qualified connection with the whistleblower, whistleblower, or public discloser suffer retaliation because of said connection (e.g., facilitators, people in the same work context, co-workers, and even legal entities in cases where they are entities owned by the whistleblower, whistleblower, public discloser, or entities in which he or she works or entities that operate in the same work context).

 

Excluded from the possibility of reporting to ANAC, are the most representative labor organizations. It remains the case that union representatives benefit, as such, from the possibility of reporting retaliation to ANAC, whether it is a consequence of a report, complaint, public disclosure made by them in their capacity as workers, or if they take on the role of facilitators, not spending the trade union acronym, and thus suffer retaliation for providing advice and support to the person reporting, denounced, or who made a public disclosure.

 

The whistleblower must provide ANAC with objective evidence from which it is possible to deduce the consequentiality between the report, whistleblowing, public disclosure made and the alleged retaliation.

 

Communications of retaliation must be transmitted exclusively to ANAC for the investigations attributed to it by law and for the possible imposition of the administrative sanction on the person responsible. Only in this case do the protections provided by the Decree apply, first and foremost confidentiality.

 

In any case, if Kineo Energy & Facility S.r.l. is by mistake the recipient of a retaliatory communication, it is obliged to ensure the confidentiality of the identity of the person who sent it and to transmit it to ANAC, simultaneously giving notice of such transmission to the person who made the communication.

 

The procedures for submitting retaliation reports to ANAC are governed by the "Guidelines on the Protection of Persons Reporting Violations of Union Law and the Protection of Persons Reporting Violations of National Regulatory Provisions - Procedures for the Submission and Management of External Reports," which can be found on the Authority's website

(https://www.anticorruzione.it /).

 

You can find the hyperlink to the Authority's website in order to proceed with the retaliation communication to ANAC directly on the website of Kineo Energy & Facility S.r.l.

 

 

1. 6. External reporting to ANAC:

Upon the occurrence of certain conditions expressly provided for in the Decree, the reporter may contact ANAC using an external reporting channel. ANAC is responsible for activating and managing said channel, guaranteeing - including through the use of encryption tools - the confidentiality of the identity of the reporting person, the person involved and the person mentioned in the report, as well as the content of the report and related documentation.

 

Specifically, the reporting person may make an external report if, at the time of its submission:

• the internal channel despite being mandatory, is not active or, even if activated, does not comply with the provisions of the Decree with reference to the subjects and methods of submission of internal reports that must be able to guarantee the confidentiality of the identity of the reporter and other protected subjects;
• the reporting person has already made an internal report and it has not been followed up by the designated person or office;
• the reporting person has reasonable grounds for believing (based on attached factual circumstances and information that can actually be acquired and, therefore, not on mere inferences), that if he or she made an internal report: i) it would not be effectively followed up; ii) it could result in the risk of retaliation;
• the reporting person has reasonable grounds to believe that the violation may pose an imminent or obvious danger to the public interest.

 

For the transmission to ANAC of external reports made in written form, the whistlebower must make use of the computer platform available on the institutional website of the Authority, filling in the form prepared for this purpose. Alternatively, external reports may be made in oral form through telephone service with an operator made available by the Authority or, at the reasoned request of the reporting person, through a face-to-face meeting set within a reasonable period of time, in accordance with the procedures published on the institutional website as well as in compliance with the guidelines adopted on the matter by ANAC. Oral reports, subject to registration and subsequent entry on the ANAC platform, will have a duration of no more than 15 minutes and may be submitted exclusively on the days and during the time slots established by the Office and made known through publication on the ANAC institutional website.

 

In order to make the external report to ANAC, recipients of this operational protocol are invited to make use of the "Whistleblowing - Form for reporting misconduct under Legislative Decree No. 24/2023" available at the following address: https://whistleblowing.anticorruzione.it/#/

 

 

 

 

 

 

 

 

 

 

 

 

1. 7. Public disclosure:

 

Kineo Energy & Facility S.r.l. informs the recipients of this operating protocol that they may make a report also by public disclosure.

 

With public disclosure, information about violations is brought into the public domain through print or electronic media or otherwise through means of dissemination that can reach a large number of people (e.g., social networks and communication channels such as facebook, twitter, youtube, instagram).

 

As with the reporting provided for in No. 3.6, public disclosure of violations must also take place in compliance with the conditions set forth in the Decree in order for the reporter to benefit from the protections recognized by the Decree. In particular, protection will be recognized if one of the following conditions is met at the time of disclosure:

• an internal report, to which the entity has not provided feedback on the measures planned or taken to follow up the report within the prescribed timeframe (three months from the date of the notice of receipt or, in the absence of such notice, within three months from the expiry of the sevenday period from the submission of the report) followed up with an external report to ANAC which, in turn, failed to provide feedback to the reporter within reasonable time limits (three months or, if there are justified and substantiated reasons, six months from the date of the notice of receipt of the external report or, in the absence of such notice, from the expiration of seven days from receipt);
• the person has already directly made an external report to ANAC, which, however, has not responded to the reporter regarding the measures planned or taken to follow up on the report within a reasonable period of time (three months or, if there are justified and substantiated reasons, six months from the date of the notice of receipt of the external report or, in the absence of such notice, from the expiration of seven days from receipt);
• the person directly makes a public disclosure because, based on reasonable grounds grounded in light of the circumstances of the particular case, he or she believes that the violation may pose an imminent or obvious danger to the public interest;
• the person directly makes a public disclosure because on the basis of reasonable grounds grounded in light of the circumstances of the particular case, he or she believes that the external report may pose a risk of retaliation or may not be effectively followed up (e.g., he or she fears that evidence may be concealed or destroyed or he or she fears that the person who received the report may be colluding with or involved in the perpetrator of the violation).

 

In public disclosure, where the person voluntarily discloses his or her identity, the profile of confidentiality protection is not relevant, subject to all other forms of protection provided by the Decree for the whistlebower.

 

Where, on the other hand, the individual discloses violations using, for example, a pseudonym or nickname, which in any case does not allow his or her identification, ANAC will treat the disclosure in the same way as an anonymous report and will take care to record it, for preservation purposes, to ensure that the discloser, in the event of subsequent disclosure of his or her identity, will be afforded the protections provided if he or she has communicated retaliation (see 3.5).

 

 

 

1. 8. Reporting to judicial authorities:

Kineo Energy & Facility S.r.l. informs the recipients of this operational protocol that, as an alternative and/or in addition to reporting, the same can always turn to the competent national authorities, judicial and accounting, to file a complaint of unlawful conduct of which they have become aware in the work context.

 

 

1. 9. Processing of personal data:

Kineo Energy & Facility S.r.l. informs whistleblowers that the acquisition and management of reports is carried out in accordance with the legislation on the protection of personal data. The Company also ensures an equal degree of protection to other persons to whom confidentiality protection applies, such as the facilitator, the person involved, and the person mentioned in the report, as "data subjects" of the data processing.

 

Kineo Energy & Facility S.r.l. informs that the data controller is Kineo Energy & Facility S.r.l., Via dell'Arcoveggio, 70, 40129 Bologna, Italy. On the website of Kineo Energy & Facility S.r.l., in the section dedicated to the Privacy Policy, it is possible to consult the information regarding the processing of personal data.

 

According to the provisions of the legislation on personal data and the Decree, data controllers, data processors and persons authorized by Kineo Energy & Facility S.r.l. to process personal data are required to comply, in particular, with the following fundamental principles:

• Process data in a lawful, fair and transparent manner towards the data subjects ("lawfulness, fairness and transparency");
• collect data only for the purpose of handling and following up on reports from individuals protected by the Decree ("purpose limitation");
• Ensure that data are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimization");
• Ensure that the data are accurate and, if necessary, updated ("accuracy");
• Retain the data in a form that allows the identification of the data subjects for as long as necessary for the processing of the specific report and in any case no longer than five years from the date of the communication of the final outcome of the reporting procedure ("retention limitation");
• carry out processing in a manner that ensures adequate security of personal data, including protection, through appropriate technical and organizational measures, from unauthorized or unlawful processing and accidental loss, destruction or damage ("integrity and confidentiality"). The use of encryption tools is to be considered an appropriate measure to implement, by design and by default, the aforementioned principle of integrity and confidentiality;
• Establish a reporting management model in accordance with the principles of personal data protection. In particular, such measures must ensure that personal data are not made accessible automatically without the intermediary of the data controller or authorized person to an indefinite number of individuals;
• carry out, at the design stage of the reporting channel and thus before processing begins, a data protection impact assessment in cases where the processing of reports may pose a high risk to the rights and freedoms of data subjects, in order to identify and apply the necessary technical measures to avoid such risk;
• Make ex ante disclosures to possible data subjects (e.g., whistleblowers, whistleblowers, data subjects, facilitators, etc.) about the processing of personal data by publishing disclosure documents (e.g., via website, platform);
• Ensure that the register of processing activities is updated, supplementing it with information related to the acquisition and management of reports;
• Ensure the prohibition of tracing channels;
• Ensure, where possible, the tracking of the activity of authorized personnel in compliance with safeguards to protect the reporter, in order to prevent the misuse of reporting data.

 

Kineo Energy & Facility S.r.l. finally, informs the persons involved or mentioned in the report that, with reference to their personal data processed in the context of the report, they may not exercise the rights that the GDPR recognizes to data subjects (the right to access personal data, the right to rectify them, the right to obtain their deletion or so-called right to be forgotten, the right to restriction of processing, the right to portability of personal data, to object to processing and to complain to the Privacy Guarantor): this is because actual and concrete prejudice to the protection of the confidentiality of the reporting person's identity could result from the exercise of these rights.