Pursuant to and to the intents and purposes of article 13 of Regulation (EU) 679/2016/UE (the “GDPR”), Ceramica Flaminia S.p.A. (the “Company”) hereby informs on the processing of personal data in connection with the handling of reports of criminal offences or irregularities in the workplace (“whistleblowing”).

By “whistleblowing” it is meant that an employee, known as a “whistle-blower”, may make a report (even anonymously) about an offence or an irregularity committed within the Company that he or she has witnessed in the course of his or her work. 

The regulations on this matter protect the whistle-blower by preventing any form of retaliation, discrimination or any direct or indirect penalization as may arise as a result of the reports submitted.

A report is a communication submitted through the designated channels concerning any violation (be it an act or an omission), which is, even potentially, contrary to the statutory regulations or the internal rules of a Company.

The channels made available by the Company for such reports are as follows:

1. An IT platform for whistle-blower reports accessible via the corporate website. Reports may be submitted either anonymously (the identity of the whistle-blower will remain anonymous), or without concealing one’s identity, which will still remain confidential;
2. Verbally, via a statement issued by the whistle-blower during a special meeting requested by the Supervisory Board and held in person or by telephone. The report is recorded in the minutes of the meeting and signed by the whistle-blower;
3. Via ordinary or registered mail through the postal service, addressed to the Supervisory Body at Ceramica Flaminia S.p.A., or via internal mail by placing the report in a sealed envelope marked “confidential/personal” for the Supervisory Body.

Anonymity may not always be guaranteed in the case of verbal reports or reports sent by post or via e-mail. Confidentiality will, however, be guaranteed.

Data Controller

The Data Controller is Company Ceramica Flaminia S.p.A. (hereinafter, the “Data Controller”) with registered office in Civita Castellana (VT) at Via Flaminia Km 54.630, VAT no. 00061720561, in its capacity as Data Controller pursuant to arts. 4(7) and 24 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (hereinafter, the “GDPR”).

Purposes and legal basis of the processing

Data processing is carried out for the purposes of collecting reports and carrying out the necessary investigative activities aimed at verifying the factual basis of the report and defining the measures to be taken.

The legal basis for such processing is set out in article 6(1)(c) of the GDPR (“compliance with a legal obligation to which the controller is subject”).

Purpose of processing and type of data processed

Personal data and information included in the report, as well as any documentation attached thereto, are processed in order to identify the alleged offences, committed by persons interacting with the Company in various capacities, of which the reporting party has become aware. Within the framework of the reports, data relating to the person reported on, or to other persons involved in the report, may also be processed, and may concern general and/or specific data and data relating to offences and/or criminal convictions.

For example:

• Personal data of the whistle-blower, if he/she decides not to remain anonymous, e.g., personal details; professional qualification; contact data.
• Data belonging to special categories, i.e., sensitive data that may reveal, for instance, a person’s racial and ethnic origin, data concerning a person’s health and sex life, if the whistle-blower freely decides to include them as characteristic elements of the report.
• Additional data and information on the person reported on, or on other persons involved in the report, or relating to the reported offence, such as:
• circumstances, time and place where the facts that are the subject of the report occurred;
• description of the offence in question;
• details of the perpetrators of the offence or indications of use to identify the person the reported facts can be attributed to;
• supporting documentation providing evidence of the wrongdoing reported.

Nature of data provision

The provision of personal data is optional. The provision of general data, such as personal data or contact details, by the whistle-blower is voluntary, as “anonymous reporting” is always possible. If the whistle-blower wants to submit an anonymous report, his/her report will only be taken into consideration if it is well substantiated and presented in great detail to bring to light facts and situations associated with a specific context.

Data processing methods

The data reported are processed in electronic and paper form, adopting appropriate technical and organisational measures to protect them from unauthorised or unlawful access, destruction, loss of integrity and loss of confidentiality. Such measures guarantee the confidentiality of the identity of the whistle-blower, and that of any other person mentioned in the report, the content of the reports and the relative documentation.

Scope of communication, dissemination and transfer of the data

The reports submitted are received and processed by the Supervisory Body of the Company in charge of receiving and following up the reports and, should it be required by the preliminary investigation, by other Company personnel who may be involved, for the ends in view, in their role as persons authorised to process data pursuant to specific instructions concerning the purposes and methods of the processing. All those who receive the reports or are involved in the management thereof are required at all times to protect the confidentiality of the information received, also in terms of the identity of the whistle-blower and the person(s) reported on.

In the instances provided for by the Regulation, personal data may be communicated to the Authorities in charges (e.g., Public Authorities and/or Institutions; Judicial Authorities and Police Bodies) that have made a formal request, or when a Company intends to proceed against the whistle-blower for slander or defamation.  Data are not disseminated and are not transferred to countries outside the European Union or to international organisations.

Data retention period

Personal data are retained for 5 years from the date of collection and, in any event, for the entire duration of any disciplinary proceedings. In the case of legal proceedings, personal data will be retained for the entire duration thereof, until the time limit for appeals has expired.

Rights of the data subjects

In the circumstances provided for by the Regulation, data subjects have the right of access to their personal data and the right to rectify or complete their data, the right to erasure, to restrict processing and the right to object to the processing (arts. 15 et seq. of the Regulation). Requests may be submitted via e-mail to the following address “privacy@ceramicaflaminia.it”. Data subjects who believe their personal data are processed in violation of the provisions of the GDPR have the right to lodge a complaint with the Supervisory Authority for the Protection of Personal Data, as provided for in art. 77 of the GDPR, or bring proceedings before a court (article 79 of the GDPR).