Whistleblowing Procedure – Vinext S.p.A.

Pursuant to and for the purposes of Legislative Decree no. 24/2023 on the protection of persons who report violations of national or European Union regulatory provisions that harm the public interest or the integrity of the Company.

Whistleblowing, which means the reporting of unlawful behaviors, acts, or omissions, constitutes a fundamental tool for preventing corruption and promoting corporate transparency, introduced in accordance with current legislation on the protection of whistleblowers.

The platform adopted by Vinext S.p.A. allows for the submission of reports in a secure, confidential, and, where applicable, anonymous manner, guaranteeing high standards of protection for the data and information transmitted. The solution used is provided in SaaS mode and designed to ensure the confidentiality of the whistleblower’s identity and the content of the reports.

Duties of the Report Manager

The Report Manager is required to:

• assess the admissibility of the report by verifying the presence of the essential requirements provided for by law;
• request any additional information from the whistleblower if the report appears incomplete or insufficiently detailed;
• maintain the utmost confidentiality regarding the identity of the whistleblower, the persons involved, and the content of the report;
• issue an acknowledgment of receipt of the report to the whistleblower within 7 days of receipt;
• maintain constant dialogue with the whistleblower, also through the tools made available by the platform;
• properly follow up on the report received by conducting the appropriate verifications;
• provide feedback to the whistleblower within the terms set by the applicable regulations.

Confidentiality and Data Security Protection

Vinext S.p.A. guarantees that the data and information transmitted through the whistleblowing system are processed in compliance with the principles of lawfulness, fairness, transparency, and data minimization set out in Regulation (EU) 2016/679 (“GDPR”).

The Company processes the collected personal data in accordance with the “Information Notice on the processing of personal data pursuant to art. 13 of Regulation (EU) 2016/679”, prepared for whistleblowers and for persons involved in the reports.

The platform adopted includes data protection and encryption systems designed to prevent access to sensitive information by unauthorized parties.

Eligible Reporting Subjects

A report can be made by all persons indicated by Legislative Decree 24/2023 as worthy of protection against potential retaliatory acts, including:

• employees;
• collaborators;
• consultants;
• self-employed workers;
• suppliers;
• shareholders;
• members of corporate bodies;
• candidates and former workers, in the cases provided for by law.

Methods for Submitting Reports

Reports can be transmitted through the corporate portal dedicated to whistleblowing, accessible via the designated area on the Vinext S.p.A. website.

The system allows for:

• the submission of written reports;
• the potential anonymity of the whistleblower;
• the secure management of communications between the whistleblower and the manager;
• the traceability of the activities carried out in compliance with confidentiality.

The system must be used exclusively for the purposes provided for by current regulations and in compliance with the principles of good faith, fairness, and truthfulness of the information provided.