Privacy Notice on the Processing of Personal Data within the Reporting Procedure: Reported person and Third parties
Premise and limitations on the rights of the data subject
The following information is provided for the purpose of transparency towards those who have been the subject of a report or who have been named in a whistleblowing procedure (hereinafter, the "Reported") to inform them about the processing of their data in the context of the aforementioned procedure, in accordance with Articles 13 and 14 of the European Parliament and Council Regulation (EU) 2016/679 of April 27, 2016 (hereinafter, the "Regulation").
Data Controller ("Controller") and Data Protection Officer ("DPO")
The data controller is the Engineering Group company involved in the report at any given time or providing you with this information (hereinafter the “Controller”), and can be contacted at the addresses provided at the end of this document. In managing the whistleblowing platform, Engineering Ingegneria Informatica S.p.A. also operates on behalf of its subsidiaries, following an explicit appointment as data processor pursuant to Article 28 of Regulation (EU) 2016/679.
Read more
All personal data will be processed in accordance with the applicable data protection laws, meaning the Regulation, Legislative Decree no. 196/2003 as amended by Legislative Decree no. 101/2018 (“Privacy Code”), as well as any other applicable data protection regulations in Italy, including provisions from the Italian Data Protection Authority (Garante) (hereinafter, collectively with the Regulation, the “Privacy Legislation”), in full respect of the rights and fundamental freedoms, particularly with regard to the confidentiality of the identities of the subjects involved and the security of processing.
The Data Protection Officer (“Data Protection Officer” or “DPO”), for all matters concerning the processing of personal data and the exercise of the rights of the data subject, can be contacted at the following email address:
The purpose and legal basis of the processing – Nature of the provision
The reporting channel is to be understood as an internal channel pursuant to Article 4 of Legislative Decree 24/2023, allowing the submission of reports in both written and oral form (hereinafter, the “Whistleblowing Portal”).
Through the Whistleblowing Portal, accessible from the Data Controller's website, the individual who is the victim of a corporate wrongdoing, or a third party aware of an already occurred or potentially occurring corporate wrongdoing, may submit their case either completely anonymously or, at their discretion, in a non-anonymous form.
Read more
Personal data is collected and processed for purposes strictly related to managing reports of unlawful conduct, conducting subsequent investigations, and all activities connected thereto.
Therefore, the legal basis for processing is the necessity to fulfill a legal obligation to which the Data Controller is subject, with reference to the provisions in Legislative Decree No. 24/2023 implementing Directive 2019/1937, as well as the ANAC guidelines on the matter. It is also possible that the Data Controller may need to conduct investigations for their legitimate interest in protecting corporate assets. In this case, the legal basis is the legitimate interest pursuant to Article 6, letter f) of the Regulation.
Personal data related to the Subject of the Report is collected through the report and related documentation provided by the whistleblower and during the corresponding investigation. The personal data related to the Subject of the Report may fall into the following categories:
- Personal data (e.g., name, surname, place and date of birth);
- Contact data (e.g., email address, phone number, postal address);
- Professional data (e.g., hierarchical level, business area, job role, type of relationship with companies in the Engineering Group or other third parties, profession);
- Any other information regarding the subject of the report that the whistleblower decides to share with the Data Controller to better detail their report, including any data belonging to special categories as per Articles 9 and 10 of the Regulation, related to:
- Relevant unlawful conduct;
- Irregularities and/or unlawful behaviors, either committed or omitted, that constitute or may constitute a violation of the principles established in the Code of Ethics, corporate policies and rules, and/or that may result in fraud or potential damage to colleagues, shareholders, and stakeholders in general, or constitute unlawful acts detrimental to the company’s interests and reputation.
With specific regard to the data that the Data Controller may receive through the reports, it is specified that such processing takes place in strict observance of the minimization principle and that, pursuant to Article 13, paragraph 2, of Legislative Decree 24/2023, “personal data that are manifestly not useful for processing a specific report are not collected or, if collected accidentally, are immediately deleted.”
Furthermore, if investigations are conducted, additional personal data regarding the Subject of the Report may be collected, particularly concerning their use of the Data Controller’s IT resources, including email and other company messaging tools.
The collected data may be processed for all purposes connected to the employment relationship.
Confidentiality and protection of the whistleblower
The Data Controller, in compliance with the provisions of Article 17 of Legislative Decree No. 24/2023, ensures the confidentiality of the identity of the whistleblower and the Reported Party in the management activities of the report and prohibits retaliatory or discriminatory acts, whether direct or indirect, against the whistleblower for reasons related, directly or indirectly, to the report.
Read more
Therefore, except in cases where liability for defamation and slander may be applicable under the provisions of the Criminal Code or Article 2043 of the Civil Code, and in cases where confidentiality cannot be invoked by law (e.g. criminal, tax, or administrative investigations, inspections by supervisory bodies), the identity of the whistleblower will be protected from the moment the report is received and throughout all subsequent phases, in accordance with the applicable provisions of Privacy Legislation.
All those who receive and/or are involved in the management of the reports are required to protect the confidentiality of this information.
Violation of the confidentiality obligation is subject to disciplinary responsibility, without prejudice to any other forms of liability provided for by the law.
Methods of processing, recipients, and retention periods
The Data Controller commits to processing only the data necessary to achieve the essential purposes for the execution of activities related to the report, in a lawful, fair, and transparent manner.
The processing will be excluded and/or limited in cases where the intended purposes can be achieved through anonymization or by means that allow the identification of the data subject only if necessary.
Read more
Reports and the documentation related to their management will be stored for a period not exceeding that necessary to pursue the purposes for which they were collected, in accordance with legal obligations or in any case to allow the Data Controller to protect their own or third-party rights and interests (e.g., defense in court).
The data is automatically deleted from the platform 5 years after the report is closed.
For the pursuit of the aforementioned purposes, the provided personal data may be made accessible only to those within the Data Controller's organization who require access for their role/position in relation to the process of receiving, analyzing, investigating, and managing reports, as well as any subsequent actions.
Data may also be processed by consultants, external companies with technical functions (e.g., the IT platform provider), and/or other parties providing professional services, who act, depending on the case, as independent data controllers or as data processors/sub-processors, and have signed a specific contract. Where these parties qualify as processors/sub-processors, the contract explicitly governs the processing activities assigned to them and their obligations concerning data protection and security of processing.
Finally, personal data may also be transmitted to other independent data controllers, based on legal or regulatory provisions (e.g., Public Authorities, the Data Protection Authority, the Judiciary, the Court of Auditors, and ANAC).
Rights of the data subjects
The Regulation (Articles 15 to 22) grants data subjects the exercise of specific rights.
In particular, in relation to the processing of their personal data subject to this privacy notice, the data subject has the right to request from the Controller access, rectification, deletion, restriction, and objection.
Read more
In the context of whistleblowing procedures, there are limits to the exercise of the data subjects' rights, and therefore the rights of the Whistleblower, although formally provided, may not be practically enforceable as outlined in Article 2 undecies of Legislative Decree 196/2003.
In this regard, it is possible that this privacy notice is only provided to you upon the conclusion of the investigation and that the rights may not be practically exercisable, or they may be carried out only at a later stage, if necessary to protect the individuals involved in the investigation and ensure its successful outcome, in accordance with Legislative Decree 24/2023 on whistleblowing and the same Regulation, Articles 14 and 23. The Controller will evaluate on a case-by-case basis the possibilities for accepting requests and the timing of their execution.
To exercise your rights, you may also contact the Italian Data Protection Authority (the "Garante"), in which case the Garante will inform the data subject that all necessary checks have been carried out or a review has been performed.
Additionally, your right to seek judicial review remains unaffected and unaffected by this process.
To exercise your rights with the Controller, you can contact the Data Protection Officer at the following email address:
Data transfer abroad
The processing is carried out within the territory of the European Union. The Controller does not transfer personal data outside the European Union / European Economic Area.
If a transfer outside the EU/EEA becomes necessary, the processing will be governed in accordance with the safeguard measures set forth in Chapter V of the Regulation.
