Privacy policy

Information on the processing of data ex art. 13 and 14 Reg. UE 2016/679

WHISTLEBLOWING

This information notice provides information regarding the processing of personal data of which the Companies LOGIMATIC S.r.l., IEMA S.r.l., LACO S.r.l. and SILMAC S.r.l. become aware when receiving, analyzing and managing the Reports of Violations known as “Reports of Violations”. Whistleblowing carried out, pursuant to Legislative Decree 24/23 (the so-called Whistleblowing Decree) through this internal reporting channel.

1. Holders of the Treatment

When submitting a Report, the Reporting Party must compulsorily indicate the company involved in the Report which will process the personal data provided by the Reporting Party as the Data Controller. The Data Controllers, depending on the choice made by the Reporting Officer, are respectively:

• • LOGIMATIC S.r.l., P.I. 02426071201, with registered office in Ozzano dell’Emilia (BO), Via Della Grafica n.35

• • IEMA S.r.l., P.I. 01673831200, with registered office in San Giorgio di Piano (BO), Via XXV Aprile 1945 n.16

• • LA.CO. S.R.L., P.I. 00664351202, with registered office in Ozzano Dell’Emilia (BO), Via Della Grafica 45

• • SIL.MAC. S.r.l., P.I. 01855271209, with registered office in Gaggio Montano (BO), Via Industria n.83

2. Purpose of processing and legal basis

Following the submission of a Report of Violation pursuant to Legislative Decree 24/23, the Data Controller may acquire personal data of the Reporting Party, the Facilitator, the person believed to be responsible for the Violation, as well as third parties involved in various capacities in the alleged illegal conduct.

The processing of personal, contained in the Report and/or in acts and documents attached to it, will be carried out pursuant to and in accordance with Art. 6 par.1 lett c) Reg.EU 2016/679 in compliance with the provisions of Legislative Decree 24/23, for the sole purpose of:

i) follow up on the Whistleblowing Report, carrying out, where deemed appropriate, the relevant investigation aimed at verifying the merits of the reported violation;

ii) take appropriate action to protect a right of the Data Controller;

iii) to comply with a request from the judicial or other Authority.

3. Method of processing and storage period

Personal data provided by the Reporting Party or acquired by each Data Controller in the course of the investigation will be processed by third-party consultants, appointed pursuant to Art.28 Reg.EU 2016/679 Data Processors, and/or by expressly authorized personnel, guaranteeing their security and confidentiality due to the adoption by each Data Controller of appropriate technical and organizational measures pursuant to Art. 32 del Reg.Ue 2016/679.

Personal data acquired by reason of the Report and in the course of the investigation will be processed for as long as necessary to ascertain the Violation and will be retained for a period of 5 years after the conclusion of the investigative activity or proceedings, disciplinary or judicial, acted upon by the Data Controller as a result of the ascertained Violation.

4. Provision of data and communication to third parties

The Whistleblower is entitled to make anonymous Reports, i.e., not to disclose his or her identity and personal data, however, sending an anonymous Report could make the investigation of the reported conduct and interlocutions between the bodies responsible for handling the Report and the Whistleblower more difficult and thus impair the usefulness of the Report.

The personal data of the data subjects will be given access to i) specialized consultants whom the Holder uses for the management of Whistleblowing Reporting; ii) service providers in charge of managing the internal reporting channel; iii) institutions and/or Public Authorities, Judicial Authority, Police Organs.

The Data Controller shall not disclose, to persons other than those authorized to handle the report, the identity of the Reporter and any other information or element from which such identity may be inferred, directly or indirectly, except upon the acquisition of the Reporter’s express consent. It should be noted how, in any case, personal data will not be disseminated or transmitted to third countries (Extra EU). The list of third parties is available upon express request to the Data Controller.

5. Rights of data subjects

In accordance with the provisions of Art. 15 ff of Reg. EU 2016/679, the Reporting Party and the Facilitator, at any time, may exercise, against the Data Controller, the rights to: a) [diritto di accesso] Access their personal data and obtain a copy;b) [diritto di rettifica] obtain the rectification of their data, if they are inaccurate, or the integration of their data, if they are incomplete; c)[diritto alla cancellazione] obtain the cancellation of their data in the cases provided for in Art. 17 Reg.Ue 2016/679; d)[diritto alla limitazione] obtain the limitation of processing in the cases provided for in Art. 18 Reg. Ue 2016/679; e) [diritto alla portabilità] receive in a structured, commonly used and machine-readable format the personal data concerning them and request its transmission, by the Controller, to another Controller; f) [right of objection] To object, at any time, on grounds related to his or her particular situation, to the processing of data concerning him or her carried out pursuant to Art.6 paragraph 1 lett. e) ed f) Reg. EU 2016/679 as well as to object, at any time, to the processing of data carried out for direct marketing purposes;g)[diritto di proporre reclamo] to lodge a complaint with the Data Protection Authority pursuant to Art. 77 Reg.UE 2016/679.

It should be noted how, according to Art. 2- undecies Legislative Decree 196/03, as amended, the aforementioned rights may not be exercised by the Involved Person or the person mentioned in the report if an actual and concrete prejudice to the protection of the confidentiality of the identity of the Reporting Person may result from the exercise of such rights.

For the purposes of exercising their rights, or to receive more information, the data subject may contact the Data Protection Officer of LOGIMATIC S.r.l., IEMA S.r.l., LACO S.r.l. and SILMAC S.r.l by sending an email to the following address dpo@studiolegaledds.it .