EN
Whistleblowing Privacy Policy

PRIVACY POLICY NOTICE PURSUANT TO ARTICLE 13 OF EU REGULATION 2016/679

For ‘reporting persons’ and any ‘facilitators’ within the meaning of Legislative Decree No. 24 of 2023 (implementing the so-called ‘Whistleblowing Directive’)

“on the protection of persons reporting breaches of Union law and laying down provisions on the protection of persons reporting breaches of national law”

 

For Tamburi Investment Partners S.p.A., data protection is a matter of the utmost importance; we therefore wish to inform you of the ways in which your data is processed and the rights you may exercise under current data protection legislation, in particular EU Regulation 2016/679 (hereinafter also referred to as the “GDPR”).

1. Data Controller and DPO

Data Controller

Tamburi Investment Partners S.p.A.

Registered office: Via Pontaccio 10

20121 Milan (MI)

Telephone contact details: 02 8858801

E-mail contact details: TIP@tamburi.it

Data Protection Officer (DPO)

Vera Cantoni, Solicitor

Registered address for the role: Via Turati 26, 20121 Milan (MI)

Telephone contact details: +39 02 7003 9991

E-mail contact details: dpo@tamburi.it

2. Categories of data subject to processing

The categories of ‘personal data’ (pursuant to Article 4(1) of the GDPR) processed by the Data Controller may include, by way of example but certainly not limited to:

  • Biographic and identifying details (name, date of birth, place of birth, nationality, occupation/profession, etc.), where provided by the data subject (i.e. where the report is not made anonymously or where the data subject decides to provide them at a later stage of the report’s processing);
  • contact details (address, email address, telephone number and similar details), where provided by the data subject, as set out in the previous point;
  • data relating to any audio recordings made by the Reporter and/or the ‘facilitator’, arising from the manner in which the report was made;
  • information obtained as a result of the report, including, by way of example only and without limitation, information on the work and/or professional activities carried out, work or professional relationships – including indirect ones – with the person reported or those involved, and the circumstances and reasons why the Data Subject became aware of the suspected breaches of regulatory obligations;
  • any specific data relating to the reporting of certain types of offences or breaches, where the Data Subject is the victim of such offences or is an aggrieved party in this context (by way of example and without limitation: health-related data in the case of reports of criminal offences and other offences related to accidents at work, where the Data Subject has also provided their identifying details and is the victim of the accident themselves);
  • with regard to the ‘facilitator’, the processing will relate exclusively to identification, personal and contact details, as well as data relating to the relationship with the Reporting Person, in relation to employment relationships, and data relating to the assistance provided to the latter.

 3. Lawfulness and purposes of processing

The processing of personal data is carried out in accordance with the provisions of the General Data Protection Regulation (GDPR) and any other applicable data protection legislation. Details are provided below:

3.1 Purposes relating to compliance with a legal obligation (pursuant to Article 6(1)(c) of the GDPR and Article 9(2)(b) of the GDPR)

  1. Compliance with obligations laid down by laws, regulations and EU legislation, with particular reference to those set out in Legislative Decree No. 24 of 2023 and, more generally, in relation to the protection of individuals who report breaches of EU law and national regulatory provisions (so-called ‘whistleblowing’ legislation).

The retention period for personal data, in relation to the purposes set out in this section, is:

For purpose (a): for the time necessary to process the report and, in any event, for no longer than 5 years from the date of notification of the final outcome of the reporting procedure.

These timeframes may be extended in the event of litigation, investigations by public or judicial authorities, or any special legal provisions.

3.2 Purposes covered by the data subject’s consent (pursuant to Article 6(1)(a) of the GDPR and Article 9(2)(a) of the GDPR)

  1. Where a recorded telephone line or other recorded voice messaging system (such as, for example, a recorded voicemail message) is used, the report shall be documented by recording it on a device suitable for storage and playback, or by subsequently transcribing it in full, in accordance with the provisions of Article 14(2) of Legislative Decree No. 24/2023 (the so-called ‘Whistleblowing’ legislation) and within the limits set out therein.

The retention period for personal data, in relation to the purposes set out in this section, is:

For purpose (a): for the time necessary to process the report and, in any event, for no longer than 5 years from the date of notification of the final outcome of the reporting procedure.

With regard to the limitations on the exercise of the data subject’s rights (including the right to erasure) and the withdrawal of consent, as well as the consequences of providing data, please refer to the section entitled ‘Rights of the Data Subject’ and the section entitled ‘Possible consequences of failure to provide data and the nature of data provision’. In this regard, it is hereby specified that, following the collection or documentation of the report through registration (even if these stages or processing operations are based on the data subject’s consent), the data contained therein will be processed for purposes based on a legal obligation and not on such consent (and therefore in accordance with purpose 3.1(a)), with all the related consequences set out in this notice for the latter purpose, which are detailed in the sections of the notice referred to above.

These timeframes may be extended in the event of litigation, investigations by public or judicial authorities, or any special legal provisions.

4. Recipients or categories of recipients of personal data (pursuant to Article 13(1)(e) of the GDPR) *

Within the scope of the aforementioned purposes, the Data Controller may disclose your data to:

  • internal departments and functions of the Data Controller itself, specifically tasked with managing the report, as well as, in relation to and limited to the Reporting Person, any departments that may be involved for the purpose of taking appropriate disciplinary measures against the person reported, subject to the Reporting Person having given their specific and freely given consent;
  • any external parties entrusted with the management of the reporting channel;
  • companies and professional service providers offering IT services, including, for example, software and cloud management;
  • the Data Controller’s supervisory and regulatory bodies, where necessary for the performance of their supervisory duties;
  • regarding the Reporting Person, any law firm, should the follow-up to the report lead to the initiation of legal proceedings in which it is necessary to disclose the Reporting Person’s identity, subject to the Reporting Person’s consent;
  • in relation to the Reporting Person, the persons involved, in the context of disciplinary or reporting proceedings, where this is essential, respectively, for the defense of the accused or the person involved, subject, in the latter case, to the provision of specific and freely given consent by the Data Subject;
  • judicial authorities and/or public supervisory authorities;
  • other public administrations and public authorities.

* Further information on the Recipients (pursuant to Article 4(9) of the GDPR) is available from the Data Controller at the contact details provided above.

5. Recipients or categories of recipients of personal data (pursuant to Article 13(1)(f) of the GDPR) * and transfer of data to countries outside the EU

The Data Controller informs you that it does not intend to transfer your data to countries outside the EU and the EEA for the purposes indicated above.

* Further information on recipients (pursuant to Article 4(9) of the GDPR) is available from the Data Controller at the contact details provided above.

6. Rights of the Data Subject (pursuant to Article 13(2)(b) of the GDPR)

The data subject may exercise the following rights, noting that these may not be exercised where doing so would result in actual and concrete harm to the confidentiality of the identity of reporting persons and facilitators, as provided for in Article 2-undecies(1)(f) of the Privacy Code; and that, in any event, they may be exercised only in cases where they do not conflict with the Data Controller’s obligations regarding the requirements set out in Legislative Decree No. 24 of 2023, referred to above (hereinafter also the ‘Decree’):

  • the data subject’s right of access [Article 15 of the EU Regulation] (the right to be informed about the processing carried out on their Personal Data and, where applicable, to receive a copy thereof), within the limits set out in the EU Regulation and applicable legislation, including those set out above;
  • the right to rectification of one’s Personal Data, where the Data Subject provides their personal data, and without prejudice to the right to verify, rectify and confirm any complete transcriptions in the cases indicated in the second paragraph of Article 14 of the aforementioned Decree [Article 16 of the EU Regulation] (the Data Subject has the right to have inaccurate personal data concerning them rectified);
  • the right to have one’s Personal Data erased without undue delay (‘right to be forgotten’) [Article 17 of the EU Regulation] (the Data Subject has, and will continue to have, the right to have their data erased), in the cases provided for by the GDPR and limited to any residual circumstances that might arise in the context of the processing in question, bearing in mind that the Data Controller is required to retain the data in question for the time necessary to manage the report and, in any event, for no longer than 5 years. Therefore, with the exception of any residual cases that might theoretically arise – such as, for example, instances of retention for a period exceeding the respective maximum time limit indicated above for both the purposes set out above, where such retention is not justified – the right to erasure may be restricted or not fully exercisable for the entire duration of the retention period required by law);
  • the right to restrict the processing of one’s Personal Data in the cases provided for in Article 18 of the EU Regulation, including in the event of unlawful processing or where the Data Subject disputes the accuracy of the Personal Data [Article 18 of the EU Regulation];
  • the right to data portability [Article 20 of the EU Regulation]; the data subject may request their Personal Data in a structured format in order to transmit it to another data controller, in the cases provided for in that Article;
  • the right to object to the processing of their Personal Data [Article 21 of the EU Regulation] (the Data Subject has, and will continue to have, the right to object to the processing of their personal data);
  • the right not to be subject to automated decision-making [Article 22 of the EU Regulation] (the Data Subject has, and will continue to have, the right not to be subject to a decision based solely on automated processing).

Further information regarding the data subject’s rights may be obtained by requesting a full extract of the articles referred to above from the Data Controller at the contact details provided above.

With regard to the purposes for which consent has been requested, the Data Subject may withdraw their consent at any time, and the withdrawal shall take effect from the moment it is made, subject to the time limits laid down by law. In general terms, the withdrawal of consent applies only to future processing.

The aforementioned rights may be exercised in accordance with the provisions of the Regulation, including by sending an email to the following address: TIP@tamburi.it. It should be noted that the data subject may exercise the right of access, as referred to in Article 15, solely in respect of their own personal data and, therefore, personal data relating to the subjects reported or to the persons involved, without prejudice to the provisions set out at regarding the obligation to respond to the report, in accordance with the aforementioned Legislative Decree, containing the notification regarding the follow-up to the report itself.

In accordance with Article 19 of the EU Regulation, the Data Controller shall inform the recipients to whom the personal data have been disclosed of any rectifications, erasures or restrictions on processing requested, where this is possible.

To enable a prompter response to your requests made in the exercise of the aforementioned rights, these may be addressed to the Data Controller using the contact details set out in point 1.

7. Right to lodge a complaint (pursuant to Article 13(2)(d) of the GDPR)

If the data subject considers that their rights have been infringed, they have the right to lodge a complaint with the Data Protection Authority, in accordance with the procedures set out by that Authority at the following web address: http://www.garanteprivacy.it or by sending a written communication to the Italian Data Protection Authority.

8. Possible consequences of failure to provide data and the nature of the provision of data (pursuant to Article 13(2)(e) of the GDPR)

8.1 In the case of compliance with legal or contractual obligations

Please note that, with regard to the purpose set out above, unlike other processing purposes where the legal basis is a legal obligation, the data subject provides their personal data freely and voluntarily.

Therefore, with regard to the processing operations set out above, it is specified that the provision of personal data will be free, optional and voluntary, following a spontaneous initiative by the data subject; however, such provision of data – at least in anonymous form – may remain necessary in order for the Data Controller to process any reports and fulfil the related legal obligations to which it is subject (therefore, in this regard, it is by no means necessary to provide the Reporter’s identifying details or any other information that, even indirectly, reveals their identity, nor is it necessary to make the report via a voice channel without so-called ‘voice masking’). We therefore also inform you that, once the report has been submitted and the related data provided, the Data Subject may not revoke such provision and/or request the cessation of the related processing (by way of example and without limitation, they may not request the erasure of the data collected and stored, subject to the provisions set out in section 6 above). For the sake of completeness, please note that only the administrators or recipients of the reports have the right to assess whether the data provided in the reports is irrelevant or incorrect, and that this right does not lie with the Reporting Person, with the consequent implications for the exercise of the right to erasure. The Reporting Person may, however, provide any information and comments they deem appropriate in order to highlight the aforementioned errors and/or to assist in such disclosures.

Furthermore, to avoid any misunderstanding, it is reiterated – as stated above and in other documents issued by the Data Controller – that the information and data sent with the report may or may not contain any data identifying the Reporting Person (if made in writing or by voice with voice masking), nor any other information that could be used to identify them; and, therefore, in such cases, this will not entail any provision or processing of the data subject’s personal data (until such time as the Reporting Person themselves may subsequently disclose such information).

8.2 In the event of the data subject’s consent

For the purpose set out above, for which consent is required, the data subject may withdraw their consent at any time, and the effects will take effect from the moment of withdrawal, subject to the time limits provided for by law. In general terms, the withdrawal of consent takes effect only for the future. Therefore, any processing carried out prior to the withdrawal of consent will not be affected and will remain lawful.

With particular reference to the aforementioned purpose (namely, the documentation of reports received via recorded oral channels), it should be noted that the data subject’s exercise of the right to withdraw consent may apply only to future recordings or to the continuation thereof, and not to material that has already been recorded and/or transcribed. It is specified that, following the collection or documentation of the report, the data contained therein will be processed for purposes based on a legal obligation and not on consent; therefore, the withdrawal of consent may have the sole effect of interrupting any recording in progress or preventing new recordings from being made, but, as already stated, it will have no effect on the recordings already collected and the related documentation produced.

Therefore, from the moment the report is received or documented, with regard to the provision of data and the possible consequences, please refer to section 8.1 above, which is incorporated in full.

Failure to give consent, or giving only partial consent, may mean that the relevant activities cannot be carried out, in relation to the specific purposes for which consent is withheld.

When the data are no longer required, taking into account the retention periods set out above, they are duly deleted.

9. Existence of automated decision-making (including profiling)

The use of purely automated decision-making processes, as detailed in Article 22 of the GDPR, is currently excluded. Should a decision be taken in future to implement such processes for individual cases, the Data Subject will be notified separately where required by law or via an update to this policy.

10. Methods of processing

Personal data will be processed primarily, if not exclusively, by computerized and electronic means and stored in the specific section of the dedicated platform for managing reports, to which those responsible for managing reports – expressly designated by the Data Controller as Data Processors or Authorized Persons for the processing of personal data – will have access and may therefore become aware of the data; such persons may, in exceptional circumstances, process the data if they deem it appropriate, including on removable media or in paper form (in accordance with the specific measures laid down by the Data Controller), without prejudice to the use of any additional media required (used by the Data Controller and its legal firms) in the event of disciplinary proceedings and litigation, within the limits set out in paragraph 4, in the aforementioned Decree and in the relevant company policies. These parties may carry out operations involving consultation, use, processing, comparison and any other appropriate operation, including automated processing, in compliance with the legal provisions necessary to ensure, amongst other things, the confidentiality and security of the data, as well as the accuracy, up-to-date nature and relevance of the data in relation to the stated purposes.

 This privacy notice and any subsequent updates are published on the Data Controller’s website on the dedicated platform for managing reports.