법적 고지 사항

Privacy notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 regarding the processing of personal data within the system for reporting alleged misconduct (Whistleblowing)

In implementation of the applicable legislation (Italian Legislative Decree No. 24/2023, implementing Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law and laying down provisions concerning the protection of persons who report breaches of national law), SOLUTIA VET & PET S.R.L. (hereinafter also the “Company”) has implemented a system for receiving and managing reports of alleged misconduct. The system allows the Company to manage reports (“Reports”) submitted through its dedicated reporting channels.

The system is intended for the receipt and management of Reports, including anonymous Reports, submitted to the Company by employees and/or third parties concerning possible breaches of national or European Union law, breaches of internal rules (including the rules of conduct set out in the Code of Ethics, the Model pursuant to Legislative Decree 231/2001 and, more generally, the Company’s internal regulatory framework), unlawful conduct and irregularities in the conduct of the Company’s business activities.

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”), the Company provides this notice concerning the processing of personal data/information (“Data”) relating to you as the reporting person (“Whistleblower”), obtained directly or otherwise in connection with the Report you submitted, as well as the processing of data/information relating to persons concerned by the Report (the “Whistleblowing procedure”).

This Notice is made available to potential data subjects through publication on the Company’s institutional website. The Company reserves the right, at its discretion, to change, amend, add or remove any part of this Notice at any time.

With the above in mind, the Company provides below information on the processing of personal data carried out in connection with the management of Reports governed by the “Reporting Procedure” of SOLUTIA VET & PET S.R.L.

1. Data Controller

The Data Controller is SOLUTIA VET & PET S.R.L., VAT No. 04021940129, whose contact details are:
- Registered office: Via Celeste Milani 24/26, Origgio (VA), 21040
- Operational headquarters: Via Saronnino 70/24, Origgio (VA), 21040
- Email address: info@solutiavetpet.com
- Certified email address (PEC): solutiavetepet@legalmail.it

The Data Controller has established a Supervisory Body, appointed pursuant to Article 6(1)(b) of Italian Legislative Decree No. 231/2001 and vested with independent powers of initiative and control. The Supervisory Body is also responsible for the report management process governed by the “Reporting Procedure”. Its members have been appointed as persons authorised to process personal data and have received appropriate operating instructions.

To follow up on Reports, the Supervisory Body may use the support of personnel internal or external to the Company. Such persons will be identified and appointed as persons authorised to process personal data and will receive appropriate operating instructions.

2. Purposes, legal basis and mandatory or optional nature of the processing

Personal Data is processed exclusively to investigate and verify the facts covered by a Report and to adopt any resulting measures, in accordance with Italian Legislative Decree No. 24/2023.

The Personal Data collected is limited to what is necessary and relevant to achieve the purposes described above, in accordance with the data minimisation principle.

Providing this Data is voluntary. Data subjects are requested to provide only the data necessary to describe the facts covered by the Report, without communicating redundant personal data or any data beyond what is necessary for the purposes described above. If such data is provided, the Data Controller will refrain from using it and will delete it.

Personal Data is processed on the legal basis of compliance with a legal obligation, pursuant to Article 6(1)(b) GDPR (Italian Legislative Decree No. 24/2023 and Legislative Decree No. 231/2001), and the legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR, provided that the interests or fundamental rights and freedoms of the data subject do not prevail. These legal bases apply to managing reports of misconduct learned by the Whistleblower for work-related reasons, within their working context or for other reasons, and to protecting the internal and external data subjects involved in the Whistleblowing procedure.

3. Types of data processed

Within the Whistleblowing procedure, the personal data/information processed includes the Data of the Whistleblower (or data subject), the person reported and the persons involved in and/or connected with the facts covered by the Report, such as any witnesses (collectively, the “Data Subjects”).

The Data collected and processed by the Data Controller includes ordinary personal data relating to the Whistleblower and other Data Subjects, such as identification data, the position held within the relevant organisation, and contact details including email address, postal address and telephone number; any other information contained in the Report; and, where necessary, data falling within the special categories under Article 9 GDPR or data relating to criminal convictions and offences under Article 10 GDPR, for reasons of substantial public interest under the Whistleblowing Decree and within the limits permitted by applicable law.

Data may be collected directly from the Data Subject or through other persons involved in the Report, using the dedicated internal reporting channel or the other communication channels described below. Data is provided voluntarily by the Whistleblower, including anonymously, to the Data Controller, which will not process data that is not strictly necessary for the stated purposes. By way of example, Reports may be submitted by employees of the Data Controller and/or third parties who have a relationship with the Data Controller.

4. Methods of processing

Data is collected in compliance with applicable law by electronic, telematic and manual means, using procedures strictly connected with the purposes described above and designed to guarantee the security and confidentiality of the Data. In particular, Data is collected through the following channels:

- the online “internal reporting channel” under Article 4 of Italian Legislative Decree No. 24/2023, provided by a selected external provider using a corporate misconduct reporting system compliant with Directive (EU) 2019/1937. The system guarantees data security and protection and the confidentiality of information through advanced encryption of communications and the database, in accordance with applicable legislation. The platform permits written Reports to be submitted anonymously or non-anonymously, enables communication with the Whistleblower and allows feedback to be provided within the statutory time limits. Reports are promptly managed by the Supervisory Body to ensure that reported cases are handled in accordance with applicable law;
- a sealed envelope containing the Whistleblower’s identification data and the Report, sent to the Supervisory Body;
- orally, through a direct meeting with the Supervisory Body.

Data collected by electronic or telematic means will not be subject to fully automated decision-making within the meaning of Article 22 GDPR. Specific security measures are applied to prevent loss of data, unlawful or improper use and unauthorised access. Technical and organisational measures, including encryption, are also adopted pursuant to Article 32 GDPR to protect the identity of Data Subjects, preserve the possible anonymity of the Whistleblower and ensure fully anonymous access to the platform without logging.

5. Data retention period

Personal Data will be retained only for the time necessary to achieve the purposes for which it is collected, in compliance with the data minimisation principle under Article 5(1)(c) GDPR. In particular, it will be retained for the investigation, completion of the Report assessment process and adoption of any resulting measures where the facts are established, and in any event for no longer than five years from the date on which the final outcome of the reporting procedure is communicated, in accordance with Article 14(1) of Italian Legislative Decree No. 24/2023 and Article 5(1) GDPR.

6. Recipients of the Data

Where necessary for investigation purposes, information connected with a Report may be processed by internal Company functions that receive specific instructions and are responsible for carrying out checks where their knowledge is essential to understand the reported facts and/or conduct the relevant investigation or handling activities.

Personal Data connected with a Report may be disclosed to ANAC, judicial authorities, other competent bodies or organisations in relation to the reported matter, as well as external parties such as consulting firms, auditors, law firms or service providers supporting the purposes described above, limited to the information necessary for their assigned functions. It may also be disclosed to the provider responsible for operating and maintaining the reporting platform, appointed as Data Processor pursuant to Article 28 GDPR. Personal Data will never be publicly disclosed.

7. Rights of Data Subjects

Articles 15 to 22 GDPR grant Data Subjects specific rights, including the rights of access, rectification, erasure and restriction of processing. These rights may be exercised without formalities by submitting a request to the Data Controller at its certified email address (PEC).

Data Subjects may lodge a complaint with the Italian Data Protection Authority pursuant to Article 57(f) GDPR. Where the exercise of rights by the person reported may cause actual and specific harm to the protection and confidentiality of the Whistleblower’s personal data, the Data Controller may restrict, delay or exclude the exercise of those rights pursuant to Article 2-undecies(1)(f) of the Italian Privacy Code (Legislative Decree No. 196/2003). In such cases, the Data Subject’s rights may be exercised through the Italian Data Protection Authority in accordance with Article 2-undecies(3) and the procedures under Article 160 of the Italian Privacy Code.

8. Possible transfer of Personal Data to countries outside the European Union

Personal Data relating to the Whistleblower, the person reported or third parties is not transferred to countries outside the European Union.

9. How to submit Reports

Reports of alleged misconduct may be submitted through the channels described in this Notice.

In particular, the Company provides a dedicated and secure online channel available at:
https://whistleblowersoftware.com/secure/SOLUTIAVETPET

Origgio, 7 March 2025