{"id":5134,"date":"2024-02-01T09:17:19","date_gmt":"2024-02-01T09:17:19","guid":{"rendered":"https:\/\/bdfdigital.com\/?page_id=5134"},"modified":"2024-06-21T09:47:39","modified_gmt":"2024-06-21T09:47:39","slug":"policy-whistleblowing","status":"publish","type":"page","link":"https:\/\/bdfdigital.com\/en\/policy-whistleblowing\/","title":{"rendered":"Policy Whistleblowing"},"content":{"rendered":"

[vc_row height_ratio=”40″ padding_top_multiplier=”” padding_bottom_multiplier=”” rc_heading_color=”white” rc_link_color=”white” rc_link_hover_color=”white” rc_bg_type=”color” rc_font_color=”#ffffff” rc_bg_color=”#113565″][vc_column vertical_content_position=”bottom”]

Whistleblowing<\/span><\/span>Policy<\/span><\/span><\/h1>
<\/div>[\/vc_column][\/vc_row][vc_row padding_top_multiplier=”3x” padding_bottom_multiplier=”” rc_bg_type=”color” rc_bg_color=”#ffffff” section_id=”posizioniaperte”][vc_column column_sticky=”yes” tablet_sm_width=”1″]
<\/div>

DISCLOSURE ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTS. 13-14 OF REGULATION (EU) 2016\/679 AS PART OF THE WHISTLEBLOWING POLICY<\/span><\/span><\/h3>
<\/div>[vc_column_text animation=”fade-in-up”]With this disclosure BDF DIGITAL S.P.A. <\/strong>(hereinafter the “Company”) intends to provide the indications provided for in articles 13 and 14 of Regulation (EU) 2016\/679 (or “General Data Protection Regulation<\/em>” \u2212 “GDPR<\/em>“), regarding the processing of personal data performed by the Company within the framework of its “Whistleblowing Policy” adopted in accordance with Italian Legislative Decree 10 March 2023 no. 241 <\/sup>and, in particular, and regarding all the activities and obligations related to the operation of the company system for the management of whistleblowing <\/em>reports.<\/p>\n

The following information is provided to “whistleblowers” and to all other potentially “interested parties”, such as, for example, the persons indicated as being possibly responsible for illegal conduct, any “facilitators” (as defined by the relevant legislation), as well as any other person in a different capacity involved in the “Whistleblowing Policy”.[\/vc_column_text]

<\/div>

1. Data Controller<\/span><\/span><\/h2>[vc_column_text animation=”fade-in-up”]The Data Controller of personal data is BDF DIGITAL S.P.A. (Via dell’Oreficeria 41, Vicenza). The Data Controller has appointed San Marco Informatica S.p.A. as Data Protection Officer for the Signalethic platform, which the data subject may contact directly.[\/vc_column_text]
<\/div>

2. Categories of personal data processed and purposes of processing<\/span><\/span><\/h2>[vc_column_text animation=”fade-in-up”]According to the setting of the regulations in question, personal data may be acquired by the Company as they are contained in whistleblowing <\/em>reports, or in the forms and documents attached thereto, received by the Company through the channels provided for in the afore-mentioned Policy.
\nThe receipt and management of such reports may result, depending on their content, in the processing of the following categories of personal data:<\/p>\n

a) common personal data referred to in art. 4, point 1, of the GDPR, including, for example, master data (first name, surname, date and place of birth), contact data (fixed and\/or mobile telephone number, postal\/e-mail address), job role\/task;<\/p>\n

b) “special” personal data pursuant to art. 9 of the GDPR, including, for example, information relating to health conditions, political opinions, religious or philosophical beliefs, sexual orientation or trade union membership;<\/p>\n

c) “judicial” personal data pursuant to art. 10 of the GDPR, relating to criminal convictions and crimes, or related security measures.[\/vc_column_text]

<\/div>

3. Legal bases for the processing of personal data<\/span><\/span><\/h2>[vc_column_text animation=”fade-in-up”]With regard to the afore-mentioned categories of personal data, it is important that the reports sent contain no information that is manifestly irrelevant for the purposes of the reference regulation<\/strong>, inviting in particular the reporting subjects to refrain from using personal data of a “particular” and “judicial” nature if not deemed necessary and essential <\/strong>for the purposes of the same, in compliance with art. 5 of the GDPR.<\/p>\n

The afore-mentioned information will be processed by the Company \u2013 Data Controller \u2013 according to the provisions prescribed by Italian Legislative Decree no. 24\/2023 and, therefore, in general, in order to perform the necessary investigative activities aimed at verifying the substantiation of the facts being reported and the adoption of the consequent measures<\/strong>.
\nIn addition, the data may be used by the Data Controller for purposes related to defence requirements or for the ascertaining of own rights <\/strong>in the context of judicial, administrative or out-of-court proceedings and in the context of civil, administrative or criminal disputes that occur in relation to the report made.[\/vc_column_text]

<\/div>

<\/h2>[vc_column_text animation=”fade-in-up”]The legal basis for the processing of personal data is mainly constituted by the fulfilment of a legal obligation <\/strong>to which the Data Controller is subject – art. 6, para. 1, lett. c) of the GDPR – that, in particular, by virtue of the afore-mentioned legislation, is required to implement and manage information channels dedicated to receiving reports of illegal conduct detrimental to the integrity of the Company and\/or of the public interest.<\/p>\n

The processing of “special<\/strong>” personal data, possibly included in the reports, is based on the fulfilment of obligations and the exercise of specific rights of the Data Controller and of the data subject in the field of labour law<\/strong>, pursuant to art. 9, para. 2, letter b) of the GDPR.
\nAs for the purpose of ascertaining, exercising or defending a right in court, the relative legal basis for the processing of personal data is constituted by the legitimate interest of the Data Controller, <\/strong>in this regard, referred to in art. 6, para. 1, lett. f), of the GDPR; for the same purpose, the processing of personal data of a “particular<\/strong>” nature, if any, is based on art. 9, para. 2, letter f) of the GDPR.[\/vc_column_text]

<\/div>

4. Nature of the provision of personal data<\/span><\/span><\/h2>[vc_column_text animation=”fade-in-up”]The provision of personal data is mandatory as, in accordance with the company’s “Whistleblowing Policy”, anonymous reports are not considered, i.e. reports from which it is not possible to ascertain the identity of the whistleblower. The personal data provided will be processed to manage the report according to the limits and with the guarantees of confidentiality imposed by the relevant legislation.[\/vc_column_text]
<\/div>

5. Processing methods and retention period of personal data<\/span><\/span><\/h2>[vc_column_text animation=”fade-in-up”]The processing of personal data included in the reports submitted in accordance with the “Whistleblowing Policy” will be performed by the subjects “appointed-authorised” by the Company and will be based on the principles of correctness, lawfulness and transparency, referred to in art. 5 of the GDPR.<\/p>\n

The processing of personal data may be performed in analogical and\/or computer\/electronic ways, functional to store, manage and transmit them, in any case in application of adequate measures, of a physical, technical and organisational nature, aimed at guaranteeing their security and confidentiality at every stage of the procedure, including archiving of the report and of the related documents – without prejudice to the provisions of <\/strong>art. 12 of Italian Legislative Decree no. 24\/2023 with particular reference to the identity of the whistleblower, of the persons involved and\/or in any case of anyone mentioned in the reports, the content of the same and the related documentation.<\/p>\n

The reports received by the Company, together with the forms and documents attached, will be kept for the time necessary to manage them and, in any case, as required by law, for a period not exceeding five years from the date of communication of the related final results<\/strong>. After this period, the reports will be deleted from the system, or kept in anonymised form<\/p>\n

Consistent with the indications provided in paragraph 1, the personal data included in the reports that are manifestly irrelevant for the purposes of the same will be immediately deleted.[\/vc_column_text]

<\/div>

6. Areas of communication and transfer of personal data<\/span><\/span><\/h2>[vc_column_text animation=”fade-in-up”]In addition to the afore-mentioned internal figures specifically authorised by the Data Controller, the personal data collected may be processed, within the framework of the “Whistleblowing Policy” and in pursuit of the purposes indicated, also by the following third parties, formally designated as Data Processors if the conditions provided for by art. 28 of the GDPR are met:<\/p>\n