PRIVACY NOTICE – POLICY FOR THE MANAGEMENT OF WHISTLEBLOWING REPORTS

DATA CONTROLLER

The Data Controller is Interpump Group S.p.A. with registered offices at Via Fermi 25 – 42049 S. Ilario D’Enza (RE), Italy.

CATEGORY OF PERSONAL DATA

Pursuant and consequent to the provisions of art. 13 of Regulation (EU) 2016/679 on the protection of personal data (hereinafter also “GDPR”), we hereby inform you that the personal data processed by us pursuant to our “Policy for the Management of Whistleblowing Reports” will be, if provided, limited to those of your identity/identification details deemed strictly necessary to verify the truth of the Whistleblowing report and to manage it.

PURPOSES OF PROCESSING

Your personal data will be processed for purposes related to the management of reports on alleged irregularities or unlawful actions that came to your attention in the context of the working relationship, in compliance with our “Policy for the Management of Whistleblowing Reports”.

LAWFULNESS OF PROCESSING

The lawfulness of processing your personal data, provided when reporting alleged irregularities or unlawful actions that came to your attention in the context of the working relationship, in compliance with our “Policy for the Management of Whistleblowing Reports”, is – in relation to Interpump Group S.p.A. which has adopted an Organization and Management Model – founded on the legal obligation arising pursuant to art. 6 of Decree 231/2001, as amended by Law 179/2017 on “Instructions for the protection of persons who report improper or unlawful actions that come to their attention in the course of their working activities in the public or private sector”, and on the version of the Code of Self-Regulation for listed companies approved by the Corporate Governance Committee in July 2015.

The provision of your personal data is not mandatory, but any refusal may make it impossible or extremely difficult to verify the truth of the Whistleblowing report made, if that report is not detailed, founded on precise and mutually-consistent facts, is not supported by verifiable evidence and/or does not contain all the information needed to carry out the above verification work.

AUTHORIZATIONS FOR PROCESSING

The data provided by you will be processed by “Persons in charge of the processing”, authorized by Interpump Group S.p.A. in compliance with the procedures established by the “Data Processors” and the rules established by the “Data Controller”, in accordance with current regulations [Regulation (EU) 2016/679], guaranteeing respect for the principles of lawfulness, propriety and relevance.

The authorizations for processing are monitored by the “Data Protection Officer” (DPO) appointed by Interpump Group S.p.A.

RECIPIENTS/CATEGORIES OF RECIPIENT OF PERSONAL DATA

The recipient of your personal data is the Supervisory Body of Interpump Group S.p.A. which, in compliance with the relevant current regulations and the “Policy for the Management of Whistleblowing Reports” adopted by the Company, is required to guarantee that the identity of the Whistleblower is kept confidential.

Your personal data may be sent to other corporate structures and/or functions during work to verify the truth of the report, should this be necessary in order to carry out the related investigations, having regard for the characteristics of that activity. In that case, the parties involved in support of the Supervisory Body are bound by the same duty to guarantee that the identity of the Whistleblower is kept confidential.

Your personal data may only be revealed to the manager of the business function responsible for the disciplinary proceedings and/or to the accused if:

• you have given your express consent;
• or the disciplinary charge is founded solely on your Whistleblowing report and knowledge of the identity of the Whistleblower is absolutely essential for the defense of the accused.

In the relevant circumstances, your personal data may also be communicated to third parties (e.g. judicial authorities, investigative bodies, etc.).

Your personal data will never be disseminated.

TRANSFER OF DATA TO NON-EU COUNTRIES

Your personal data will not be transferred to non-EU countries.

PROTECTION OF RETENTION OF THE DATA COLLECTED

The personal data collected for the above purposes will be retained by us for the time necessary to verify the truth of the Whistleblowing report and, if necessary, for adoption of the resulting disciplinary measures and/or the completion of any dispute processes that arise from the Whistleblowing report.  Subsequently, your data will be erased (right to be forgotten) or rendered anonymous (pseudonymized), if this is necessary for statistical or record-keeping purposes.

RIGHTS OF THE DATA SUBJECT

With regard to the above data processing, you – as the Whistleblower – may exercise the rights granted in art. 15 et seq. of Regulation (EU) 2016/679, to the extent compatible with the whistleblowing regulation.

You may exercise your rights by sending a request by e-mail to privacy@interpumpgroup.it or by ordinary mail to the registered offices of the Company.

OUR CONTACT PERSONS

FULVIO MONTIPO’

as the Legal Representative of Interpump Group S.p.A., which is the independent “Data Controller” (e-mail address: privacy@interpumpgroup.it)

MAURIZIO MONTANARI

as the “Data Processor” appointed by Interpump Group S.p.A.

FRANCESCO MASIELLO

as the “Data Protection Officer” (DPO) appointed by Interpump Group S.p.A. (e-mail address: dpo@interpumpgroup.it)