Whistleblowing

Whistleblowing management policy

WHISTLEBLOWING MANAGEMENT POLICY

Contents

Part I - GENERAL PRINCIPLES

1. Purpose

2. Scope of Application

3. General Principles

4. Definitions

Part II – REPORTING PROCESS

5. Roles and Responsibilities

6. Reporting

7. Whistleblower

8. Whistleblowing Channels

9. Whistleblowing Management

a. Receipt of Reports

b. Evaluation of the admissibility of the report

c. Investigation

d. Closure of the case

10. Prohibition of Retaliation

PART III – FINAL PROVISIONS

11. Confidentiality

12. Measures of support and measures for the protection of Persons Concerned

13. Continuous Improvement Process

14. Record Keeping and traceability

15. Training and Communication

16. Disciplinary Measures

17. Rules and Regulations and Privacy

Part I - GENERAL PRINCIPLES

1. Purpose

OTB SpA (hereinafter also referred to as "OTB" or "the Company") and its subsidiaries (hereinafter also referred to as the “OTB Group” or the “Group”) are committed to supporting their own values, to adhere to the ethical standards outlined in the Group's Ethical Code and to demonstrate their commitment to comply with and be in accordance with prevailing regulations. In order to pursue these principles, OTB has implemented a comprehensive system for the reporting and consistent management of potential/suspected violations (Whistleblowing Reports), defined as Whistleblowing Management System.

The purpose of the Whistleblowing Management Policy (hereinafter also referred to as “Policy”) is to outline the procedures for managing Whistleblowing Reports, including the phases related to the reception, analysis, and resolution of such reports. This procedure defines the subject of the reports, the parties authorized to make the reports and the organizational structure, the roles and responsibilities that the Whistleblowers and the Group must comply with during the reporting and management process.

The Policy has been written in compliance with the Italian Whistleblowing Law, EU Directive 2019/1937 and all applicable Whistleblowing Laws, in the countries where the Group operates. With reference to the Group's Italian Companies, the Policy is to be understood as fully referred to in the Organizational Management Models for the purposes of Italian Legislative Decree 231/01 and also includes the procedures for reporting potential Violations of the Group's Code of Ethics.

2. Scope of Application

This procedure applies to the OTB Group, including all individuals envisaged by the Directive (EU) 2019/1937 of the European Parliament and of the Council, of October 23, 2019, on the protection of persons who report breaches of Union law (hereinafter also referred to as the “EU Whistleblowing Directive”) and all other applicable Whistleblowing Laws,, i.e., those who operate in the name and on behalf of OTB Group, such as executives, managers, collaborators and contractors under fixed-term contracts, or contingent workers, temporary workers, volunteers and trainees, shareholders as well as third parties such as example self-employed workers, freelancers, consultants and candidates.

3. General Principles

The persons involved in the activities regulated by this procedure must operate in compliance with the regulatory, organizational and power system based on the following principles:

Confidentiality

The identity of the Whistleblower, as well as that of the person reported and any other parties involved, as well as the content of the report and the related documents, must not be revealed to people not directly involved in the management of the report, unless prior consent has been obtained from such parties. Disclosure may only be allowed if strictly necessary for the management of the report and must be limited to the authorized personnel responsible for the management of the report, as described in this procedure. In these cases, the Whistleblower must be promptly informed and provide his/her express consent.

Confidentiality and anonymity are also respected through the adoption of a dedicated whistleblowing tool that guarantees encryption systems.

Transparency

The activities regulated by this procedure must ensure transparency in the performance of their duties and provide complete and truthful information.

Autonomy, Impartiality, Independence and Professionalism

Whistleblowing Reports must be managed in a way that ensures respect for the principles of autonomy, impartiality, independence and professionalism.

Truthfulness and Validity

The reports must concern information that the Whistleblower reasonably believes to be true.

Prohibition of Retaliation to protect Whistleblowers and Other Parties Involved

Retaliation is strictly forbidden when the Whistleblower submits a report in good faith and on the basis of well-founded reasons. This principle is governed by Article n. 19 of the EU Whistleblowing Directive and by all other applicable Whistleblowing Laws, which not only regulate but prevent any form of Retaliation against those who report potential violations. The primary objective of these provisions is to protect all individuals involved in the report from any form of unfair or harmful treatment.

The prohibition of Retaliation is valid when the Whistleblower has submitted the Whistleblowing Report based on well-founded reasons.

4. Definitions

OTB Group:

OTB SpA and all directly and indirectly controlled Companies.

Facilitator:

The person who assists the Whistleblower in the reporting process and who can operate both within and outside the work context and whose assistance must be kept confidential. For example, it could be the Whistleblowing Manager, the direct supervisor of the Whistleblower, the Human Resources Manager, a colleague, a third party or any other figure within or outside the organization. Like the Whistleblower, the Facilitator is protected under the paragraph “11. Confidentiality” of this procedure.

Primary Whistleblowing Manager:

Whistleblowing Manager who assumes the role of Internal Channel Manager.

Deputy Whistleblowing:

Manager Whistleblowing Manager who assumes the role of Internal Channel Manager in case of conflict of interest with the Primary Whistleblowing Manager.

OTB Group Internal Audit:

The Internal Audit function of the OTB Group that acts as the Primary Whistleblowing Manager, as further detailed in paragraph “5. Roles and Responsibilities” of this procedure.

Supervisory Body:

Autonomous body responsible for supervising and monitoring unlawful behaviors under Italian Legislative Decree n. 231/2001.

President of the Supervisory Body:

The President of the Supervisory Body appointed under Art. 6 of Italian Legislative Decree n. 231/2001. For details, see the paragraph "5. Roles and Responsibilities” of this procedure.

Local Legal Offices:

Specialized legal division within the Company of the OTB Group, where it does not exist, carried out by the Finance Function, which deals with specific legal issues of a particular geographic region or operational area. For details, see the paragraph "5. Roles and Responsibilities” of this procedure.

OTB Group Legal Office:

The central legal division of the OTB Group that manages legal issues, problems and affairs on a global or international scale. For details, see the paragraph "5. Roles and Responsibilities” of this procedure.

Person Concerned:

An individual or legal entity or a corporate body referred to in the Whistleblower's Report to which the alleged violation can be attributed or as a person otherwise involved.

Retaliation:

Any conduct, act or omission, even if only attempted or threatened, committed against a person who has submitted a report and which can cause him/her, directly or indirectly, unfair damage.

Whistleblower:

Anyone who reports a suspected violation or illegal practice they have become aware of in the course of their work activities.

Whistleblowing Report:

A communication, made in written or oral form, related to a suspected violation, as better specified in paragraphs 6, 7 and 8 of this procedure.

Italian Whistleblowing Law:

Italian Legislative Decree of March 10, 2023, No. 24, which implements Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019, concerning the protection of individuals reporting violations of Union law and containing provisions regarding the protection of individuals reporting violations of national legal provisions.

EU Whistleblowing Directive:

Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019, concerning the protection of persons reporting breaches of Union law.

French Whistleblowing Law:

Loi n° 2022-401 du 21 mars 2022 visant à améliorer la protection des lanceurs d’alerte.

Spanish Whistleblowing Law:

Ley 2/2023, de 20 de febrero, reguladora de la protección de las personas que informen sobre infracciones normativas y de lucha contra la corrupción.

English Whistleblowing Law:

s.43K of the Employment Rights Act 1996.

German Whistleblowing Law:

Whistleblower Protection Act (Hinweisgeberschutzgesetz).

Dutch Whistleblowing Law:

Dutch Whistleblowing Protection Act.

Other Whistleblowing Laws:

All other laws governing the protection of individuals making reports of violations of current laws in the countries where the OTB Group Companies are based.

Third Parties:

• Self-employed and temporary workers, collaborators, freelancers, consultants
• people whose employment relationship has yet to begin and who have acquired information about violations during the hiring process;
• former employees or partners of OTB or its subsidiaries who became aware of violations during their employment relationship with the Company.

Violations under the EU Whistleblowing Directive:

Behaviors, acts or omissions that harm the company and may consist of:

• illegal activities that fall within the scope of application of European Union or national acts;
• violations that harm the financial interests of the European Union;
• violations concerning the internal market, as referred to in Article 26(2) TFEU including violations of EU regulations on competition and state aid;
• acts or behaviors that frustrate the purpose or objective of the provisions of the Union's acts in the sectors indicated in the previous points;
• violations of local regulations on corporate responsibility, for example, in Italy under Legislative Decree n. 231/2001. For all violations not explicitly mentioned here, reference should be made to the local regulations (i.e. Italian Whistleblowing Law, French Whistleblowing Law, Dutch Whistleblowing Law, English Whistleblowing Law, German Whistleblowing Law, Spanish Whistleblowing Law and all other laws governing the protection of individuals making reports of violations of current laws in the countries where the OTB Group Companies are based).

Part II – REPORTING PROCESS

5. Roles and Responsibilities

Primary and Deputy Whistleblowing Manager

The Whistleblowing Manager assumes the role of Internal Channel Manager under the EU Whistleblowing Directive.

The Whistleblowing Manager is responsible for the following activities:

a) issuing the Whistleblower the receipt of the report within seven days from the date of receipt;

b) maintaining interactions with the Whistleblower and, if necessary, asking for additional information;

c) diligently following up on the received reports;

d) providing feedback on the report within 3 months from the receipt notice or, if no notice has been sent, within 3 months from the expiration of the seven-day period from the report;

e) providing clear information on the channel, procedures and methods for making internal reports, as well as on the channel, procedures and methods for making external reports.

In particular, the Whistleblowing Manager, in carrying out his or her functions, deals with:

• monitoring the whistleblowing process, ensuring periodic updates on its status and that of the reporting channels, where appropriate;
• diligently following up on the received reports, coordinating all the actors involved in the whistleblowing management process;
• evaluating the admissibility of the report, also with the support of external consultants, for reports under the EU Whistleblowing Directive and all other applicable Whistleblowing Laws, and for the Italian Companies, with the support of the Supervisory Body for reports under Italian Legislative Decree n. 231/2001, in order to verify that it does not have a manifest unfoundedness or a generic content;
• initiating the internal investigation, in case of admissible reports, with the support of managers of other internal functions and/or external consultants, identifying the subjects in charge of conducting the investigations, assessing the correctness and reliability of the reported facts;
• providing feedback to the Whistleblower as provided by EU Whistleblowing Directive and all other applicable Whistleblowing Laws.

Below are the details of the individuals designated as Whistleblowing Manager for the different types of OTB Group companies.

5.1 OTB S.p.A. and Italian Subsidiaries of the OTB Group

The OTB Group Internal Audit function (Primary Whistleblowing Manager) and the OTB Group Legal Office (Deputy Whistleblowing Manager) assume the role of Whistleblowing Manager (Internal Channel Manager) for the Italian subsidiaries of the Group. If the report is relevant for the purposes of Italian Legislative Decree n. 231/2001, the Whistleblowing Manager notifies the President of the Supervisory Body of the company concerned by the report, so that he can assist the Whistleblowing Manager in carrying out the necessary investigations.

In case of a conflict of interest, i.e. if the report concerns the Primary Whistleblowing Manager or one of his/her collaborators, the function responsible for managing the Internal Channel is represented by the other Whistleblowing Manager not in conflict (Deputy Whistleblowing Manager).

5.2 European Companies of the OTB Group

The OTB Group Internal Audit function (Primary Whistleblowing Manager) and the Local Legal Office of the company concerned by the report (Deputy Whistleblowing Manager) assume the role of Whistleblowing Manager (Internal Channel Manager) for the European companies of the Group.

In case of a conflict of interest, i.e. if the report concerns the Primary Whistleblowing Manager or one of his/her collaborators, the function responsible for managing the Internal Channel, along with the other Whistleblowing Manager not in conflict, is represented by the OTB Group Legal Office (Deputy Whistleblowing Manager).

5.3 Non-European Companies of the OTB Group (USA, APAC, JP and KOREA)

The OTB Group Internal Audit function (Primary Whistleblowing Manager) and the Local Legal Office of the company concerned by the report (Deputy Whistleblowing Manager) assume the role of Whistleblowing Manager (Internal Channel Manager) for the companies located in Regions outside the European Union.

In the event of a conflict of interest, i.e. if the report concerns the Primary Whistleblowing Manager or one of his/her collaborators, the function responsible for managing the Internal Channel, together with the other Whistleblowing Manager not in conflict, is represented by the Human Resources (HR Regional Officer) manager of the interested Region (Deputy Whistleblowing Manager), with consequent reporting to the Chief People & Organization Officer of the OTB Group.

6. Reporting

The following violations can be reported in accordance with the EU Whistleblowing Directive:

1) significant illegal conduct pursuant to Italian Legislative Decree 8 June 2001, n. 231, or violations of the Organizational, Management and Control Model adopted by the company in compliance with the aforementioned legislation, which do not fall under numbers 3), 4), 5) and 6) or in the case of violations of foreign laws concerning the administrative liability of entities or the prevention of offenses, as well as violations of OTB's Organizational Model or Code of Ethics and/or internal norms/procedures, codes of conduct, and organizational models adopted by other companies within the OTB Group;

2) offences that fall within the scope of the acts of the European Union or national acts or of the national acts that constitute implementation of the acts of the European Union indicated in the annex to EU Whistleblowing Directive, relating to the following sectors: public procurement; services, products and financial markets and prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radioprotection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; privacy protection and personal data protection and network and information systems security;

3) acts or omissions that harm the financial interests of the Union referred to in Article 325 of the Treaty on the Functioning of the European Union specified in the relevant derived law of the European Union; consider, by way of example, the case where a company of the OTB Group commits tax fraud in order to evade taxes;

4) acts or omissions concerning the internal market, referred to in Article 26, paragraph 2, of the Treaty on the Functioning of the European Union, including violations of European Union rules on competition and state aid, as well as violations concerning the internal market related to acts that violate the rules on corporate tax or mechanisms whose purpose is to obtain a tax advantage that undermines the object or purpose of the applicable legislation on corporate tax;

5) acts or behaviors that undermine the object or purpose of the provisions of the acts of the Union in the sectors indicated in numbers 2), 3) and 4);

6) violations of the Group's Ethical Code; in such cases, vision of the aforementioned document is recommended in order to understand in detail the areas of possible reports and their respective modalities.

For all violations not explicitly mentioned here, reference should be made to the local regulations (i.e. Italian Whistleblowing Law, French Whistleblowing Law, Dutch Whistleblowing Law, English Whistleblowing Law, German Whistleblowing Law, Spanish Whistleblowing Law and all other laws governing the protection of individuals making reports of violations of current laws in the countries where the OTB Group Companies are based).

The information related to violations must concern behaviors, acts or omissions that the Whistleblower has become aware of in the course of his/her work activity.

Not included among the violations that must be reported through the established channels are:

• complaints, disputes or requests related to a personal interest of the Whistleblower, such as matters exclusively concerning their personal employment relationship with colleagues;
• information clearly lacking foundation;
• information that is already available and in the public domain;
• information obtained based on speculations or unreliable gossip (e.g. "rumors");
• violations already regulated by other European Union or National Acts;
• violations in matters of national security and contracts related to defense or national security, unless these aspects fall within the relevant derived law of the European Union.

To be admissible, the report must not only meet the aforementioned objective requirements, but must also be as precise and detailed as possible.

In particular, it must be clear:

• the circumstances of time and place where the reported fact occurred;
• the description of the fact;
• the generalities or other elements that allow identifying the subject to whom the reported fact can be attributed.

It is also useful to attach any documentation that can provide elements of the foundation of the facts subject of the report.

7. Whistleblower

Violations referred to the EU Whistleblowing Directive and to the other applicable Whistleblowing Laws can be reported by:

• all collaborators of the OTB Group, as well as temporary workers or those performing occasional services, volunteers and interns;
• staff with representative, administrative or managerial functions, or who exercise the management and control of business activities;
• subordinate workers, autonomous workers, outsourced workers, collaborators, freelancers, suppliers of goods and services, consultants;
• individuals whose employment relationship with the Company or the Group has yet to begin and who have become aware of information on violations during the hiring process;
• former collaborators or partners of the OTB Group who have become aware of violations during their previous employment relationship with the Company/Group.

Those who make a report under the EU Whistleblowing Directive and the other applicable Whistleblowing Laws, as described in this document, are granted the protection rights provided by said legislation and illustrated in Part III of this procedure.

8. Whistleblowing Channels

The OTB Group has established an internal reporting system for the submission of reports related to violations under EU Whistleblowing Directive and all other applicable Whistleblowing Laws, including violations referred to in Italian Legislative Decree n. 231/2001, where applicable. Reports can be submitted using the digital reporting platform available from a computer or mobile phone at the links listed in the table below (Table 1), through the following methods:

• written form;
• in oral form, by recording an audio note. The platform allows the Whistleblower's voice to be disguised in case they wish to remain anonymous.

In both cases, the channel is suitable to ensure the confidentiality of the sources and of the information obtained, as well as to guarantee the anonymity of the report.

Table 1- Links to the whistleblowing management platform

Company / Tool access link:

OTB SpA, BVX Srl, OTB Foundation / https://OTB.integrityline.com

Diesel SpA, Diesel Italia Srl / https://Diesel.integrityline.com

Marni Group Srl / https://Marni.integrityline.com

Jil Sander SpA / https://Jil-Sander.integrityline.com

Margiela SAS Italian branch / https://Margiela.integrityline.com

Staff International SpA, Props Vigevano Srl Frassineti Srl / https://STAFF INTERNATIONAL.integrityline.com

Brave KID Srl / https://Brave Kid.integrityline.com

With reference to the Group's foreign companies, please refer to the reporting channel provided in the Group’s Ethical Code available on the web site of OTB.

The Whistleblower may choose to submit the report either anonymously or by voluntarily providing his/her personal data. If the Whistleblower decides to proceed with the report in an anonymous form, in order to ensure his/her anonymity, the Whistleblower must remember the ID code of the report generated by the system at the time of submission and the password, as the platform does not record the login. In case of loss of credentials, it will not be possible to recover the report's flow. In such case, it will be up to the Whistleblower to regularly access the platform to view updates related to his/her report. The Whistleblowing Manager may need to obtain information about the identity of the Whistleblower to conduct appropriate investigations, in which case he/she can ask the Whistleblower to provide his/her data. If the Whistleblower decides to remain anonymous, the report will not be followed up and will not be considered by the Whistleblowing Manager. This decision will be communicated to the Whistleblower through a closure notice of the report.

With regard to reports related to violations involving OTB Group, the Whistleblower may also submit his/her report through External Reporting Channels established by Public Authorities designated by the respective Member States of the European Union. Access to External Reporting Channels is, however, allowed only for the Relevant Violations and under the conditions provided by the Italian Whistleblowing Law, French Whistleblowing Law, Dutch Whistleblowing Law, English Whistleblowing Law, German Whistleblowing Law, Spanish Whistleblowing Law and Other Whistleblowing Laws, as described below:

• the internal channel is not active or does not guarantee the confidentiality of the Whistleblower;
• the report made through the internal channel has not been followed up by the Whistleblowing Manager within the prescribed terms or has not been adequately addressed;
• the Whistleblower has reasonable grounds to believe that the report made through the internal channel will not be effectively followed up or will pose a risk of Retaliation;
• the Whistleblower has reasonable grounds to believe that the violation may constitute an imminent or manifest danger to the public interest (e.g., health and safety or environmental danger).

Public disclosure (through the press or electronic media or otherwise by means accessible to the public that can reach a large number of people) may only be used in the following cases:

• the Whistleblower has already made an internal or external report that has not been followed up within the prescribed period;
• the Whistleblower has reasonable grounds to believe that the violation may constitute an imminent or manifest danger to the public interest;
• the Whistleblower has reasonable grounds to believe that, in the event of an external report, there is a risk of retaliation or that the report may not be effectively followed up due to specific circumstances, such as those where evidence can be concealed or destroyed, or where the people who received the report may be colluding with the author of the violation or involved in the violation.

When the above-mentioned reporting channels are used, the Whistleblowers have the opportunity to avail themselves of the support of a designated person who assists them during the process, who assumes the role of Facilitator. In particular, the Whistleblowers have the autonomy to appoint a Facilitator, who can be chosen from internal and/or external individuals to the company, as deemed useful by the Whistleblower. By way of example, but not exhaustively, the role of Facilitator can be assigned to the Whistleblowing Manager, the direct supervisor, the Human Resources manager, a colleague, a third party, or any other internal or external individual to the company.

For all channels not explicitly mentioned here, reference should be made to the local regulations (i.e. Italian Whistleblowing Law, French Whistleblowing Law, Dutch Whistleblowing Law, English Whistleblowing Law, German Whistleblowing Law, Spanish Whistleblowing Law and all other laws governing the protection of individuals making reports of violations of current laws in the countries where the OTB Group Companies are based).

9. Whistleblowing Management

The internal reports received through the channels described in the previous paragraph will be managed as described below.

a. Receipt of Reports

This activity is carried out and coordinated by the Whistleblowing Manager, who must communicate to the Whistleblower, within 7 days from receipt, the successful receipt of the report.

This information is accessible by the Whistleblower via an automatic notification email - sent through the digital reporting platform- which is sent at every update of the report status. The Whistleblower can access through the direct link to the digital platform received with the notification email to the report and check its progress status. This procedure is applicable if the Whistleblower voluntarily provides his/her personal data. If the Whistleblower decides to proceed with the report in an anonymous form it will be up to the Whistleblower to regularly access the platform to view updates related to his/her report. In this last case, the Whistleblower can independently access the platform at any time, by entering the ID code of the report generated by the system at the time of sending the report and the chosen password, in order to monitor the progress of the report and interact with the Whistleblowing Manager to provide further details/information. It is specified that, in case of loss of the report ID code, it will not be possible to recover it and it will be necessary to open a new report. Therefore, it is recommended to memorize and carefully keep this code.

If the report is received from a subject external to the identified and authorized reporting channels, who will be identified as Facilitator, the same must transmit it within 7 days to the competent subject through the reporting channels indicated in this document, giving simultaneous communication to the Whistleblower.

b. Evaluation of the admissibility of the report

This task is carried out by the Whistleblowing Manager, also in collaboration, where deemed appropriate, with external consultants, for reports falling within the EU Whistleblowing Directive and the other applicable Whistleblowing Laws and with the involvement of the Supervisory Body of the company concerned by the report for the reports falling within the Italian Legislative Decree n. 231/2001.

This phase aims to:

1. verify that the report has been submitted in accordance with the provisions of this document;
2. evaluate the content of the report to verify whether the requirements are met to fall into one of the cases governed by this document (violations under the EU Whistleblowing Directive and the other applicable Whistleblowing Laws, the Italian Legislative Decree n. 231/2001, etc.);
3. establish a dialogue with the Whistleblower and, where deemed necessary, request additional information or clarifications.

Therefore, the Whistleblowing Manager, with the support of the Supervisory Body in the case of significant reports under the Italian Legislative Decree n. 231/2001, evaluates the admissibility of the report based on its alignment with the guidelines indicated in this document, subsequently informing the Whistleblower. The Whistleblower can stay informed through automatic notifications sent by email from the digital whistleblowing platform, which provides updates on the status of the report. By accessing the link provided in the automatic response email, the Whistleblower can check the current status of the report. If the Whistleblower decides to proceed with the report in an anonymous form it will be up to theWhistleblower to regularly access the platform to view updates related to his/her report. In this case, the Whistleblower can access the platform independently and at any time, entering the ID code of the report generated by the system at the time of sending the report and the chosen password, in order to monitor the progress of the report and interact with the Whistleblowing Manager to provide additional details/information.

Following the verification of the suitability of the report, the Whistleblowing Manager identifies the subjects who must participate in the subsequent investigative phase and provides them with essential information to initiate the investigation process.

In this regard, it is specified that:

• in the event that the report concerns a violation of Italian Legislative Decree n. 231/2001, the report will be managed by the Supervisory Body of the company affected by the report with the support of the OTB Group Internal Audit function (Primary Whistleblowing Manager) or the OTB Group Legal Office function (Deputy Whistleblowing Manager) in case of conflict of interest;
• if the report concerns a violation under the EU Whistleblowing Directive and other applicable Whistleblowing Laws, the report will be managed by the Whistleblowing Manager (who can be identified as a different person depending on the region where the company is located, as reported in paragraph 5 of this document), in line with the provisions referred to in the paragraphs "Investigation" and Closure of the case” in this document.

c. Investigation

This phase is carried out and coordinated by various subjects, depending on the nature of the report:

• in the case of reports that could concern a case governed by Italian Legislative Decree n. 231/2001, supervision of the investigation is entrusted to the Supervisory Body of the company affected by the report, while the Whistleblowing Manager has the task of activating the investigative process and ensuring compliance with the expected times;
• for reports potentially falling within the scope of the EU Whistleblowing Directive and the other applicable Whistleblowing Laws, the Whistleblowing Manager, as identified in paragraph 5 "Roles and Responsibilities", supervises the investigation. It is up to the Whistleblowing Manager to start the investigation procedure and ensure its timely conclusion, involving and coordinating any collaborators and consultants for the conduct of the activity.

The subject responsible for the investigative phase is obliged to ensure the execution of inspection activities. In this phase, following the consent obtained from the Whistleblower (1), itis possible to rely on the operational and technical support of functions and/or external consultants previously identified.

The investigative process is aimed at conducting targeted investigations to identify, verify and evaluate all potential elements that may confirm the validity of the reported facts. This investigative phase must remain impartial towards the involved functions, the Whistleblower and the person subject of the report, and must be conducted without bias. In addition, the person subject of the report must have the opportunity to respond and receive assistance.

This phase must respect, among others, by way of example and not exhaustive, the following principles:

• define and document clearly and completely the objective and scope;
• ensure the security and confidentiality of the contents and documentation, as well as of the people involved;
• handle personal data in compliance with data protection regulations (as indicated in paragraph 3 "General Principles" of this document);
• maintain clear and unambiguous communication;
• provide periodic updates to the Whistleblower about the progress of the report;
• in addition, the involvement of Human Resources in the investigation phase is crucial to ensure the implementation of protection measures for both the Whistleblower and the reported subject, and to evaluate the implications from an employment law perspective.

(1) It is specified that the OTB Group for the purposes of managing the report, may need to make use of the operational and technical support of previously identified external functions and/or consultants in order to carry out specialized investigations about its report. It may then also be necessary to communicate to the third party company the name of the reporter and/or additional information from which the identity of that person could be inferred. In addition, under the EU Whistleblowing Directive and the other applicable Whistleblowing Laws, the consent of the whistleblower is required for the disclosure of the identity of the whistleblower, and of any other information from which such identity may be inferred, directly or indirectly, to persons other thanthose competent, according to the law, to receive or follow up on the reports. Failure to give consent will not affect the group's handling of the report, but in that case the effectiveness of investigative activity may be lessened.

d. Closure of the case

This phase is carried out and coordinated by the Whistleblowing Manager, with the support of the Supervisory Body in cases relevant under Italian Legislative Decree n. 231/2001, based on the subject of the report and the managers of the internal functions of the company and/or external consultants involved in the previous phases.

The closure phase determines the conclusion of the process.

A case is closed when no further actions are deemed necessary and it is not necessary to carry out further investigations.

In this phase, the following actions should be taken into consideration:

• conclusion of the reporting process and communication of its outcome;
• actions in response to any reports (for example, disciplinary actions);
• communication to the personnel responsible for the support and protection of the Whistleblower and to the other parties involved;
• identification of possible ongoing protection measures;
• collection of suggestions from the Whistleblower and the other parties involved;
• archiving of all documents collected in the previous phases.

If, during the evaluation phase, the violation is confirmed, the manager of the involved function, involved in the report, may be tasked with formulating an action plan for the areas and processes involved in the report.

Furthermore, the Whistleblowing Manager, with the assistance of the functions and/or consultants involved in the investigation, will proceed to:

• formalize the necessary measures for the resolution of the violation;
• identify the subject responsible for ensuring the correct implementation and monitoring of such measures;
• receive continuous updates on the effectiveness of the monitoring measures;
• involve the competent functions for the determination of disciplinary actions, if necessary;
• involve the competent authorities, if deemed necessary.

At the end of the closing phase, the Whistleblowing Manager, in coordination with the Supervisory Body for relevant reports under the Italian Legislative Decree n. 231/2001 and depending on the nature of the report, will provide feedback on the report, assisted by the competent functions and/or consultants involved. The Whistleblower can access this information through automatic notifications sent by email from the digital reporting platform at each update of the report status. In particular, the Whistleblower can check the status of the report using the link provided by the digital platform. If the Whistleblower decides to proceed with the report in an anonymous form it will be up to the Whistleblower to regularly access the platform to view updates related to his/her report. In this case, the Whistleblower can independently access the platform at any time, by entering the ID code of the report generated by the system at the time of sending the report and the chosen password, in order to monitor the progress of the report and communicate with the Whistleblowing Manager to provide further details/information.

The feedback provided in the aforementioned communication must account for the outcome of the report and, in particular, for example, such communication can be:

• filed due to lack of foundation, sufficient evidence or for other reasons;
• concluded with the adoption of necessary measures to remedy the issue raised;
• referred to a competent authority for further investigation.

The Whistleblowing Manager must provide an initial feedback, even if it's only provisional, to the Whistleblower within 3 months from the receipt of the report (or if no notice has been sent, within 3 months from the expiry of the seven-day period from the submission of the report).

10. Prohibition of Retaliation

The Whistleblower is protected from any Retaliation, direct or indirect, against him/her and from any form of discrimination for reasons directly or indirectly related to the report. The Retaliation can consist of any form of harmful behavior, such as, for example:

a) dismissal, suspension or equivalent measures;

b) demotion or failure to promote;

c) change of functions, change of workplace, salary reduction or change of working hours;

d) suspension of training or any restriction on access to it;

e) negative merit notes or negative references;

f) adoption of disciplinary measures or other sanction, even monetary;

g) coercion, intimidation, harassment or ostracism;

h) discrimination or otherwise unfavorable treatment;

i) failure to convert a fixed-term employment contract into a permanent employment contract, where the worker had a legitimate expectation of such conversion;

l) non-renewal or early termination of a fixed-term employment contract;

m) damages, even to the reputation of the person, in particular on social media, or economic or financial prejudices, including the loss of economic opportunities and loss of income;

n) placement on improper lists based on a formal or informal sectoral or industrial agreement, which may result in the person's inability to find employment in the sector or industry in the future;

o) early termination or cancellation of the contract for the supply of goods or services;

p) cancellation of a license or permit;

q) request for psychiatric or medical examinations.

It is specified that, under the EU Whistleblowing Directive and the other applicable Whistleblowing Laws, the protections and protective measures provided for the Whistleblower also apply to:

(a) facilitators;

b) persons in the same work environment as the Whistleblower, the person who has made a complaint to the judicial or accounting authorities, or the person who has made a public disclosure and who are related to them by a stable affective or kinship link within the fourth degree;

(c) to co-workers of the Whistleblower or the person who has made a complaint to the judicial or accounting authority or made a public disclosure, who work in the same work environment as the Whistleblower and who have a usual and current relationship with the said person;

(d) to entities owned by the Whistleblower or the person who made a complaint to the judicial or accounting authority or made a public disclosure, or for which the same persons work, as well as entities working in the same work environment as the Whistleblower.

For anything not explicitly mentioned here, reference should be made to the local regulations (i.e. Italian Whistleblowing Law, French Whistleblowing Law, Dutch Whistleblowing Law, English Whistleblowing Law, German Whistleblowing Law, Spanish Whistleblowing Law and all other laws governing the protection of individuals making reports of violations of current laws in the countries where the OTB Group Companies are based).

PART III – FINAL PROVISIONS

11. Confidentiality

The identity of the Whistleblower and any information that could directly or indirectly reveal his/her identity will not be disclosed to persons other than those in charge of receiving and managing the reports, expressly authorized to process such data, without prior notice and consent obtained from the Whistleblower.

In particular, regarding the disclosure of the identity of the Whistleblower the following confidentiality measures are provided for:

- within the criminal proceeding, the identity of the Whistleblower is covered by secrecy, in the ways and within the limits provided for by the applicable code of criminal procedure;

- in disciplinary proceedings, the identity of the Whistleblower cannot be revealed if the contestation of the disciplinary charge is based on separate and additional findings, even if consequential to the report. If the contestation is based, in whole or in part, on the report and the knowledge of the identity of the Whistleblower is essential for the defense of the accused, the report will be usable for the purposes of the disciplinary procedure only in the presence of the express consent of the Whistleblower to the revelation of his/her own identity;

- the Whistleblower must receive a written communication explaining the reasons for the disclosure of confidential data, in the hypothesis referred to in the last sentence of the preceding paragraph , as well as in the internal and external reporting procedures referred to in this document, when the disclosure of the identity of the Whistleblower and the related information is also essential for the defense of the person involved.

With regard to the specific provisions on the disclosure of the Whistleblower's identity, please refer to local regulations (i.e. Italian Whistleblowing Law, French Whistleblowing Law, Dutch Whistleblowing Law, English Whistleblowing Law, German Whistleblowing Law, Spanish Whistleblowing Law and all other laws governing the protection of individuals making reports of violations of current laws in the countries where the OTB Group Companies are based).

Confidentiality is also guaranteed:

- when the report is made following procedures different from those established by this procedure or is submitted to subjects other than those designated for the management of the reports;

- to the reported and to all other subjects involved in the reporting process.

In any case, it is recommended to always use the dedicated digital platform for the submission of reports, as this tool guarantees the respect and protection of the confidentiality of the reporter, the reported person and all those possibly involved in the report, thanks to the use of dedicated encryption tools.

PART III – FINAL PROVISIONS

11. Confidentiality

The identity of the Whistleblower and any information that could directly or indirectly reveal his/her identity will not be disclosed to persons other than those in charge of receiving and managing the reports, expressly authorized to process such data, without prior notice and consent obtained from the Whistleblower.

In particular, regarding the disclosure of the identity of the Whistleblower the following confidentiality measures are provided for:

• within the criminal proceeding, the identity of the Whistleblower is covered by secrecy, in the ways and within the limits provided for by the applicable code of criminal procedure;
• in disciplinary proceedings, the identity of the Whistleblower cannot be revealed if the contestation of the disciplinary charge is based on separate and additional findings, even if consequential to the report. If the contestation is based, in whole or in part, on the report and the knowledge of the identity of the Whistleblower is essential for the defense of the accused, the report will be usable for the purposes of the disciplinary procedure only in the presence of the express consent of the Whistleblower to the revelation of his/her own identity;
• the Whistleblower must receive a written communication explaining the reasons for the disclosure of confidential data, in the hypothesis referred to in the last sentence of the preceding paragraph , as well as in the internal and external reporting procedures referred to in this document, when the disclosure of the identity of the Whistleblower and the related information is also essential for the defense of the person involved.

With regard to the specific provisions on the disclosure of the Whistleblower's identity, please refer to local regulations (i.e. Italian Whistleblowing Law, French Whistleblowing Law, Dutch Whistleblowing Law, English Whistleblowing Law, German Whistleblowing Law, Spanish Whistleblowing Law and all other laws governing the protection of individuals making reports of violations of current laws in the countries where the OTB Group Companies are based).

Confidentiality is also guaranteed:

• when the report is made following procedures different from those established by this procedure or is submitted to subjects other than those designated for the management of the reports;
• to the reported and to all other subjects involved in the reporting process.

In any case, it is recommended to always use the dedicated digital platform for the submission of reports, as this tool guarantees the respect and protection of the confidentiality of the reporter, the reported person and all those possibly involved in the report, thanks to the use of dedicated encryption tools.

• the whistleblowing management system does not replace national legal obligations to report to competent authorities, where appropriate.

Furthermore, to enable Third Parties to be aware of this procedure, a special notice is provided on the website.

The information regarding the channels, procedures and methods for internal or external reports, or for public disclosure, must be clearly shared with

all individuals entitled to make a report.

The above information will be displayed and made clearly visible and accessible in workplaces and on the OTB website and its subsidiaries in a dedicated section.

15. Disciplinary Measures

In accordance with the applicable employment law, including collective labour contracts, as well as, for OTB Group companies that have adopted a Model 231, the sanction system provided therein, OTB reserves the right to initiate disciplinary actions if the Whistleblower is deemed criminally responsible, also, but not only, through a first instance judgement, for having presented false accusations or defamatory reports. This is particularly true in cases where the same crimes are committed in conjunction with the presentation of complaints to judicial or accounting authorities, or for civil liability resulting from the same crimes in case of malice or serious fault.

Furthermore, individuals who find themselves in the aforementioned situations do not have the right to the protections guaranteed by the same legislation.

Finally, if, as a result of the investigation and assessment process, the reported violation is ascertained, OTB reserves the right to initiate disciplinary action against the person reported or otherwise found responsible for the violation, in accordance with the provisions of the applicable labor law, including collective labour contracts, as well as, for OTB Group companies that have adopted a Model 231, the sanction system provided therein.

With regard to other specific provisions on the application of disciplinary measures, please refer to local regulations (i.e. Italian Whistleblowing Law, French Whistleblowing Law, Dutch Whistleblowing Law, English Whistleblowing Law, German Whistleblowing Law, Spanish Whistleblowing Law and all other laws governing the protection of individuals making reports of violations of current laws in the countries where the OTB Group Companies are based).

16. Rules and Regulations and Privacy

The following documents constitute the main regulatory framework and provide the relevant legal references that are the basis of this procedure and its processes:

• EU Directive n. 1937/2019 regarding the protection of persons reporting breaches of Union law and related national transpositions
• Italian Legislative Decree. n. 24/2023 "Implementation of the directive (EU) 2019/1937 of the European Parliament and of the Council, of 23 October 2019, regarding the protection of persons reporting breaches of Union law and containing provisions regarding the protection of persons reporting breaches of national regulatory provisions”;
• Loi n° 2022-401 du 21 mars 2022 visant à améliorer la protection des lanceurs d’alerte;
• Ley 2/2023, de 20 de febrero, reguladora de la protección de las personas que informen sobre infracciones normativas y de lucha contra la corrupción;
• the English s.43K of the Employment Rights Act 1996;
• the German Whistleblower Protection Act (Hinweisgeberschutzgesetz);
• the Dutch Whistleblowing Protection Act
• all other laws governing the protection of individuals making reports of violations of current laws in the countries where the OTB Group Companies are based;
• other Italian laws related to the Organizational, Management and Control Model (pursuant to Italian Legislative Decree n. 231/2001 "Administrative responsibility of legal persons");
• ISO 37002 International "Whistleblowing management systems";
• EU Regulation n. 679/2016 "General Data Protection Regulation - GDPR" and national transpositions.

All personal data that are not useful for the management of a specific report should not be collected. If collected incidentally, such data must be deleted without delay.

The processing of personal data will be managed in compliance with EU Regulation 2016/679 (GDPR), as well as all other applicable laws and regulations.

When the report is not anonymous, the personal data of the Whistleblower will be processed together with that of the interested party/parties and/or any third parties, as well as all further information collected during the investigation, in order to evaluate and verify the validity of the report (2).

The Data Controller will be each company of the OTB Group to which the Whistleblower and/or the Person Concerned belongs, while the controlling company will act as data processor.

If the exercise of the rights granted by Section III of the GDPR could cause actual and tangible harm to the confidentiality of the Whistleblower’s identity and could compromise the ability to effectively verify the validity of the report, or to gather the necessary evidence, it may be possible to limit or delay such exercise, in accordance with applicable legal provisions. In no case can the interested party or third parties exercise the right of access to obtain information about the identity of the Whistleblower.

The OTB Group reserves the right to evaluate, on a case-by-case basis, the circumstances and specific conditions that make it appropriate to duly inform the interested party about the conclusion of the verification procedure, in order to prevent abuses and ensure the protection of the rights of the interested party.

(2) It is specified that the OTB Group for the purposes of managing the report, may need to make use of the operational and technical support of previously identified external functions and/or consultants in order to carry out specialized investigations about its report. It may then also be necessary to communicate to the third party company the name of the reporter and/or additional information from which the identity of that person could be inferred. In addition, under the EU Whistleblowing Directive and the other applicable Whistleblowing Laws, the consent of the whistleblower is required for the disclosure of the identity of the whistleblower, and of any other information from which such identity may be inferred, directly or indirectly, to persons other than those competent, according to the law, to receive or follow up on the reports. Failure to give consent will not affect the group's handling of the report, but in that case the effectiveness of investigative activity may be lessened.