WHISTLEBLOWING POLICY

Introduction

The European Union, through Directive (EU) 2019/1937, has renewed the regulatory framework for the protection of persons who report breaches of Union law, with the aim of establishing a minimum standard for the protection of whistleblowers' rights across all Member States. Italy implemented the European Directive through Legislative Decree No. 24 of 10 March 2023 (hereinafter the "Decree").

By adopting this Policy, CALZATURIFICIO FRAU SPA (hereinafter the "Company") intends to comply with the above regulatory requirements, as well as with the guidance provided in this regard by ANAC (the Italian National Anti-Corruption Authority).

The purpose of this Policy is to provide whistleblowers — i.e. those who report breaches — with clear operational guidance regarding the subject matter, content, recipients and methods of submitting reports.

The report-handling procedure guarantees the confidentiality of the reporting person's identity from the moment the report is received and at every subsequent stage of contact. Pursuant to Article 5, paragraph 1, letter e) of the Decree, this Policy therefore provides information on the channels, procedures and conditions for making internal and external reports.

Reporting persons

Reports may be made by the following persons:

• employees, including those who carry out:
  • part-time, intermittent, fixed-term, agency, apprenticeship, or occasional ancillary work (whose employment relationship is governed by Legislative Decree No. 81/2015);
  • occasional services (pursuant to Article 54-bis of Decree-Law No. 50/2017, converted into Law No. 96/2017);
• self-employed workers:
  • with a contract for work (Article 2222 of the Italian Civil Code);
  • with a collaboration relationship (pursuant to Article 409 of the Italian Code of Civil Procedure), such as agency relationships, commercial representation and other collaboration relationships involving continuous and coordinated, predominantly personal work, even if not of a subordinate nature;
  • with a collaboration relationship consisting exclusively of personal, continuous work whose performance is organised by the engaging party;
• collaborators who carry out their work activity for entities that supply goods or services, or carry out works, for the Company;
• freelance professionals and consultants who provide their services to the Company;
• volunteers and trainees, whether paid or unpaid, who carry out their activity at the Company;
• shareholders and persons holding administrative, management, control, supervisory or representative functions, including where such functions are exercised on a purely de facto basis within the Company (e.g. members of the Board of Directors or of the Supervisory Body).

The protection of reporting persons (Article 6 of this Policy) also applies where the report, the complaint to the judicial or accounting authority, or the public disclosure of information occurs in the following cases:

• when the legal relationship described above has not yet begun, if information on the breaches was acquired during the recruitment process or at another pre-contractual stage;
• during the probationary period;
• after the termination of the legal relationship, if the information on the breaches was acquired during the course of that relationship.

Subject matter of reports and excluded reports

The following reports may be made, as indicated in the table below:

More specifically, the breaches listed in the table above may concern:

a) breaches of national or European provisions constituting offences in the following areas: public procurement; financial services, products and markets, and prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; protection of privacy and personal data, and security of network and information systems;

b) breaches of European provisions consisting of: i) acts or omissions harming the Union's financial interests; ii) acts and omissions relating to the internal market; iii) acts and conduct that defeat the object or purpose of the provisions of Union acts in the areas referred to above.

Reporting channels: internal, external, public disclosure

The Company has established an internal reporting channel that guarantees the confidentiality of the identity of the reporting person, the person involved, and any person otherwise mentioned in the report, as well as the confidentiality of the content of the report and its supporting documentation.

Please note that the internal channel must be used first to submit a whistleblowing report.

Reporting through the external channel, established and managed by ANAC, may only be used under certain conditions, and public disclosure under even stricter conditions, without prejudice to the possibility of filing a complaint with the judicial authority at any time.

Content and methods of submitting reports

A whistleblowing report may be made when the following conditions are met:

• the reporting person has information, including well-founded suspicions, regarding breaches that have been committed or that, based on concrete evidence, may be committed, of national or European Union regulatory provisions that harm the public interest or the integrity of the Company, as well as regarding conduct intended to conceal such breaches;

and

• such information was acquired, or such suspicions arose, in a work-related context.

Reports concerning exclusively the following will not be considered:

• disputes, claims or requests relating to a personal interest of the reporting person;
• the reporting person's individual employment or collaboration relationships with the Company, or with hierarchically superior figures;
• aspects of the private life of the person reported, with no direct or indirect connection to the Company's business and/or professional activity.

Furthermore, the following reports are not permitted:

• reports that are pretextual, defamatory, slanderous, or made solely with the intent to harm the reported person;
• reports of breaches which the reporting person knows to be unfounded.

Content of the report

To be admissible, the report must contain:

1. the identifying details of the reporting person, as well as contact information for receiving subsequent updates;
2. a clear, complete and detailed description of the facts that are the subject of the report;
3. the circumstances of time and place in which the reported fact occurred, and therefore a description of the facts subject to the report, specifying the relevant contextual details and, where applicable, how the reporting person became aware of the reported facts;
4. the identifying details or other elements enabling identification of the person(s) believed to be responsible for the reported facts;
5. an indication of any other persons who may have knowledge of the reported facts;
6. an indication of any documents that may confirm the veracity of such facts;
7. any other information that may provide useful confirmation of the reported facts;
8. in the case of use of the analogue channel (see below), an express statement of the intention to benefit from whistleblowing protections, e.g. by including the wording "confidential — for the attention of the report manager".

Reporting methods

Whistleblowing reports may be made in the following ways:

• by calling the following number: 045 7611711, asking for Dr. Paolo Lovato, Chairman of FRAU's Board of Statutory Auditors;
• at the reporting person's request, through a direct meeting with FRAU's Board of Statutory Auditors;
• by ordinary mail, placing the report in two sealed envelopes: the first containing the reporting person's identifying details together with an identity document, and the second containing the subject matter of the report; both envelopes must then be placed inside a third envelope bearing, on the outside, the wording "confidential — for the attention of the report manager" and addressed to FRAU's Board of Statutory Auditors, care of its Chairman: Dr. Paolo Lovato, Via Fogazzaro 9, 37047 San Bonifacio VR.

Anonymous reports

Anonymous reports, i.e. reports from which the identity of the reporting person cannot be determined, will not be considered.

Transmission of reports

Whistleblowing reports must be sent by ordinary mail, marked with the wording "confidential — for the attention of the report manager", to FRAU's Board of Statutory Auditors, care of its Chairman: Dr. Paolo Lovato, Via Fogazzaro 9, 37047 San Bonifacio VR.

Please note that receipt of reports is suspended during the Company's closure periods.

Handling of the report

This procedure governs the process of receiving, analysing and handling reports of unlawful conduct of which the reporting person has become aware in a work-related context.

In managing the internal reporting channel, the report manager (hereinafter also the "manager" or "recipient") operates as follows:

Receipt of the report

If a report is mistakenly sent to or received by a person not authorised to receive it, and it is evident that it is a whistleblowing report, that person is obliged to promptly notify the report manager of its receipt, in any case within 7 (seven) days of such receipt, while simultaneously informing the reporting person of such transmission, without prejudice to all confidentiality obligations set out in this Policy, which also apply to that person (and their consequent liability in the event of a breach thereof).

The recipient issues an acknowledgement of receipt of the report to the reporting person within seven days of the date of receipt. The acknowledgement will be sent to the contact details provided by the reporting person; if none were provided, the report will be filed.

The report manager will archive reports received by ordinary mail using appropriate tools that ensure confidentiality (e.g. in archives protected by security measures).

A report made orally — in the forms indicated in this Policy — with the prior consent of the reporting person, is documented by the report manager by means of a written record, which will be signed by both the manager and the reporting person, a copy of which will be provided to the latter.

In the case of a direct meeting with the reporting person, a specific written record of the meeting will be drawn up, signed by both the manager and the reporting person, a copy of which will be provided to the latter.

Communications with the reporting person and supplementary information

The recipient maintains communication with the reporting person and may, if necessary, request additional information.

In the case of a written record drawn up following a meeting with the reporting person, the reporting person may review, correct and confirm the record of the meeting by signing it.

Examination of the report

The recipient follows up on reports received, assessing whether the reporting person is entitled to report and whether the report falls within the scope of the regulation; this is followed by an assessment of the circumstances of time and place in which the fact occurred.

Following the preliminary review:

• if the requirements are not met, the report is filed, with the reasons stated;
• if the requirements are met, an investigation is initiated.

Investigation

The recipient ensures the investigation is properly conducted through:

• the collection of documents and information;
• the involvement of external parties (where the technical assistance of third-party professionals is required) or of other company functions, which are obliged to cooperate with the report manager;
• the questioning of other internal/external persons where necessary.

The investigation is conducted in accordance with the following principles:

• the necessary measures are adopted to prevent identification of the reporting person and of the persons involved;
• checks are carried out by persons with the necessary expertise, and activities are properly tracked and archived;
• all persons involved in the assessment maintain the confidentiality of the information received, unless otherwise required by law;
• checks are carried out ensuring the adoption of appropriate measures for the collection, use, disclosure and retention of personal information, and ensuring that the needs of the investigation are balanced with the protection of privacy;
• appropriate measures are guaranteed to manage any conflicts of interest where the report concerns the recipient.

Feedback to the reporting person

Within three months of the date of the acknowledgement of receipt, or, in the absence of such acknowledgement, within three months of the expiry of the seven-day period from submission of the report, the recipient provides feedback on the report, communicating either:

• that the report has been filed, stating the reasons for this decision; or
• that the report is well-founded and has been forwarded to the competent internal bodies for the relevant follow-up; or
• the activities carried out and still to be carried out (in the case of reports requiring further verification activities that take longer), and any measures adopted (actions taken or referral to the competent Authority).

Conflict of interest

If the report manager has a conflict of interest, for example as the reported person or the reporting person, the report will be handled by another member of the report management body.

Protection of the reporting person and their liability

Reporting persons may not be subject to any form of retaliation. The law provides that those who make a report may not be sanctioned, demoted, dismissed, transferred, or subjected to any other organisational measure that would, directly or indirectly, have negative effects on their working conditions, or amount to discrimination or retaliation against them.

The reasons that lead a person to report, file a complaint, or publicly disclose information are irrelevant for the purposes of their protection.

In judicial or administrative proceedings, or even in out-of-court proceedings, concerning the determination of prohibited conduct against reporting persons, it is presumed that such conduct was carried out as a result of the report, the public disclosure, or the complaint to the judicial or accounting authority. The burden of proving that such conduct towards reporting persons is motivated by reasons unrelated to the report, the public disclosure or the complaint lies with the person who carried it out.

Furthermore, alleged discriminatory or retaliatory measures suffered must be reported to ANAC, which alone is responsible for determining whether the retaliatory measure is a consequence of the report of wrongdoing and for imposing, in the absence of proof by the Company that the measure taken is unrelated to the report, an administrative fine.

Processing of personal data. Confidentiality

All processing of personal data will be carried out in accordance with Regulation (EU) 2016/679, Legislative Decree No. 196 of 30 June 2003, and Articles 13 and 14 of the Decree; furthermore, failure to comply with confidentiality obligations may result in disciplinary liability, without prejudice to any further liability provided for by law.

The privacy notice relating to the processing of personal data following a whistleblowing report is attached to this Policy.

Internal and external reports and the related documentation are retained for the time necessary to handle the report, and in any event for no longer than 5 years from the date of communication of the final outcome of the reporting procedure, in compliance with confidentiality obligations and personal data protection requirements.

Liability of the reporting person

The Company guarantees the reported person the right to be informed (within a reasonable period of time) of any reports concerning them, guaranteeing the right of defence where disciplinary proceedings are initiated against them.

This procedure is also without prejudice to the criminal and disciplinary liability of the reporting person in the event of a slanderous or defamatory report, pursuant to the Italian Criminal Code and Article 2043 of the Italian Civil Code.

Any form of abuse of the whistleblowing reporting procedure, such as manifestly unfounded reports and/or reports made solely for the purpose of harming the reported person or other individuals, and any other case of improper use or intentional misuse of the procedure, shall also give rise to liability, in disciplinary and other competent proceedings.

Entry into force and amendments

This Policy will enter into force on 17/12/2023.

The Company will provide the necessary publicity by means of a notice on the notice board.

This Policy remains subject to periodic review, whenever deemed necessary.

POLICY WHISTLEBLOWING