Dear "Interested Party", we wish to inform you that the "EU Regulation 2016/679 of 27 April 2016, relating to the protection of natural persons with regard to the Processing of Personal Data, as well as the free circulation of such data" (hereinafter "GDPR") provides for the protection of people and other subjects with respect to the processing of personal data.

ESTECO SpA, "Owner" of the processing of personal data, informs you, pursuant to art. 13 of the GDPR, which will process the personal data provided by you in the following ways.

The data provided by you at the time of registration and in reports will be processed according to the principles of correctness, lawfulness, transparency and protection of confidentiality and rights of you and all interested parties, in compliance with the confidentiality obligations imposed by privacy legislation and the whistleblowing law.

The data you provide will be processed in relation to the obligations of Law 179/2017 on Whistleblowing.

The Segnalazioni.net platform of ESTECO SpA collects exclusively your registration data and those communicated in the reports. Among the data provided voluntarily by you, the following personal data may be acquired:

Name, email address, contents of the reports. Your personal data relating to the profile are not directly viewable in the report.

We inform you that, taking into account the purposes of the processing as illustrated above, the provision of your registration data (name and email address) is mandatory and failure to provide them results in the impossibility of creating a whistleblower (reporting subject) recognizable in the system . Please note that the legislation requires the whistleblower to make himself recognizable in order to be able to take advantage of the protection regime granted to him.

Therefore, consent to the processing of data via a specific tick is essential to proceed with registration (if applicable).

As regards the consent of the reported subject or any subjects involved in the report, the processing of personal data is lawful even without the consent of the interested party, as it is necessary for the pursuit of a legitimate interest of the Data Controller, the interest of the latter being considered prevalent. to combat illicit conduct, on the interests and rights of the reported interested party.

The processing will be carried out with IT and telematic tools with organization and processing logic strictly related to the purposes indicated above and in any case in such a way as to guarantee the security, integrity and confidentiality of the data themselves in compliance with the organizational, physical and logical measures envisaged by the current provisions. Please remember that your personal data provided in the registration form (name and email address) are separate from your possible reports and that the association of your identity with the report can be carried out exclusively by the "Manager" responsible for managing the reports (RPCT , Supervisory Board, etc.).

The personal data relating to reports are stored and maintained for as long as necessary to comply with the reporting management procedure and kept in the records.

You may, at any time, exercise the rights:

• access to personal data;
• to obtain rectification or cancellation of the same;
• to revoke consent, where applicable: the revocation of consent does not affect the lawfulness of the processing based on the consent given before the revocation; upon revocation of consent it will be impossible to access your profile, you will still be able to view the reports using their codes; however, revocation is not foreseen in the event that the processing is necessary to fulfill a regulatory obligation to which the data controller is subject;
• to lodge a complaint with the supervisory authority (Privacy Guarantor).

No personal data of users is implicitly acquired by the platform.

No cookies are used to transmit personal information, nor are persistent cookies used to track users.

Only technical cookies are used to the extent strictly necessary for the correct and efficient use of the platform. The use of session cookies (which are not stored permanently on the user's computer and disappear when the browser is closed) is strictly limited to the transmission of session identifiers (consisting of random numbers generated by the server) necessary to allow the safe and efficient exploration of the platform.

The "Data Controller" of data processing is ESTECO SpA dataprotection@esteco.com with a registered office in Loc. Padriciano 99, 34149 Trieste, ITALY