INFORMATION ON THE PROCESSING OF PERSONAL DATA OF PERSONS REPORTING VIOLATIONS OF EUROPEAN UNION LAW OR NATIONAL REGULATORY PROVISIONS, PERSONS INVOLVED, PERSONS MENTIONED, AND FACILITATORS

INCRESO S.r.l., as the owner of the processing of personal data (hereinafter "INCRESO"), issues this notice to the Reporting Person, the Involved or Mentioned Persons and the Facilitators in compliance with the European and Italian regulations on the protection of personal data.

INCRESO has appointed a data protection officer (DPO), who can be contacted by writing to the following address: dpo@increso.it.

PURPOSE AND LEGAL BASIS OF PROCESSING.

INCRESO processes personal data for the purpose of carrying out the necessary investigative activities aimed at verifying the merits of the reported fact and taking the consequent measures.

Consent is not required because the processing is necessary for the fulfillment of INCRESO's regulatory obligations under the provisions of Legislative Decree No. 24 of March 10, 2023.

DATA CATEGORIES AND THEIR SOURCES.

INCRESO processes data of a common nature (first name, last name, qualification, etc.), data of a special nature (data relating to health, union membership, etc.) and/or data relating to criminal convictions, crimes and security measures: this information may be collected directly from the person to whom it relates (hereinafter "Data Subject") and/or from third parties (e.g., when the Reporting Person provides information on the person involved and/or other persons mentioned and/or the facilitator, or when additional information/documents are collected from other structures of INCRESO during the course of the investigation). when the Reporting Person provides information about the person involved and/or other persons mentioned and/or the facilitator, or when additional information/documents are acquired ex officio from other INCRESO facilities in the course of the investigation).

RETENTION PERIOD OF THE COLLECTED DATA.

The collected data are kept for the time necessary for the processing of the report and for the period necessary for the completion of the related administrative procedure or any judgment established, and in any case not more than 5 years from the date of the communication of the final outcome of the reporting procedure.

NATURE OF DATA PROVISION AND CONSEQUENCES IN CASE OF REFUSAL.

The provision of personal data is optional, but necessary for the handling of reports and related activities, with the consequence that any refusal prevents proceeding in this regard.

CATEGORIES OF RECIPIENTS.

When handling the report, personal data may be processed by internal figures specifically authorized for the purposes indicated, as well as to service providers or other external parties (e.g., managers of platforms used for handling reports), who will process the data as data controllers on behalf of INCRESO.

If there is a need, personal data may be transmitted to third parties to whom communication is required by law (e.g. Judicial Authority, National Anti-Corruption Authority, etc.).

Under no circumstances will personal data be disseminated.

DATA TRANSFER TO A THIRD COUNTRY AND/OR INTERNATIONAL ORGANIZATION

Personal data are not transferred either to non-European third countries or to international organizations.

RIGHTS OF DATA SUBJECTS.

The Interested Parties have the right to obtain access to their personal data, the updating (or rectification, if inaccurate), the cancellation of the same or the limitation of the processing that concerns them, when the respective prerequisites are met and in particular within the limits of the provisions of Article 2-undecies of Legislative Decree no. 196/2003.

To exercise their rights, the Data Subject may use the form available at the link https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/1089924 and forward it to the entity in charge of handling the report, by contacting it through the channel used for the report, i.e. at INCRESO, with registered office in Via Monte Asolone, 8, 00195 Rome. The Data Subject also has the right to lodge a complaint with the relevant supervisory authority, Garante per la protezione dei dati personali (www.garanteprivacy.it).