"WHISTLEBLOWING" REPORTS

Lyreco Italia has provided an internal reporting channel (so-called Whistleblowing) for violations of national or European Union regulatory provisions that harm the public interest or the integrity of the company (including civil, criminal and accounting offences, as well as relevant unlawful conduct pursuant to Legislative Decree 231/2001 or violations of organisational and management models), as well as for violations of Lyreco's Code of Ethics, which became known in the workplace (in implementation of Italian legislation - Legislative Decree 24/2023, in transposition of EU Directive 2019/1837).

1. WHAT YOU CAN REPORT

• administrative, accounting, civil or criminal offences;
• significant unlawful conduct pursuant to Legislative Decree 231/2001, or violations of the organisational and management models provided for therein;
• offences falling within the scope of European Union or national acts relating to the following areas: public procurement; financial services, products and markets and the prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; privacy and personal data protection and security of network and information systems;
• acts or omissions affecting the financial interests of the Union;
• acts or omissions concerning the internal market;
• acts or conduct which frustrate the object or purpose of the provisions referred to in acts of the Union
• violations of Lyreco's Code of Ethics.

On the other hand, the violations to be reported through this channel do not include claims or requests related to a personal interest of the reporting person that relate exclusively to their individual employment relationships, or inherent to their employment relationships with hierarchically superior figures. Furthermore, reports that do not fall within the cases provided for by the legislation, as well as reports relating to unverifiable facts, cannot be taken into account.

2. WHO CAN REPORT AND WHEN

The following can make the report:

• employees;
• self-employed workers who carry out their work at Lyreco;
• collaborators, freelancers and consultants who work at Lyreco;
• volunteers and trainees, paid and unpaid;
• shareholders and persons with administrative, managerial, control, supervisory or representative functions, even if such functions are exercised on a purely de facto basis, at Lyreco;
• third parties who operate or collaborate with Lyreco.

The report can be sent:

• when the legal relationship between the parties has not yet begun, if information on the violations has been acquired during the selection process or at other pre-contractual stages;
• during the probationary period;
• when the legal relationship is ongoing;
• after the dissolution of the legal relationship between the parties if information on violations was acquired during the course of the relationship itself.

3. INTERNAL REPORTING METHODS

3.1 Lyreco Internal Signaling Channel

Lyreco has appointed and trained an internal whistleblowing team, consisting of:

• People&Culture Director
• Finance Director
• Compliance & Sustainability Manager
• Legal Advisor

Anyone who wishes to file a report has several internal reporting channels:

• in writing:
  • preferentially, by sending a report through the "Raise your concern" platform which can be reached by clicking on the following address: https://lyreco.whispli.com/pages/
  • by sending a report by post, to the following address: Via Papa Giovanni Paolo II, snc, 20040, Cambiago (MI). The report must be placed in two sealed envelopes, in order to separate the identification data of the whistleblower from the report:
    • the first containing the identification data of the whistleblower and a copy of the identification document;
    • the second containing the description of the report.

Both must then be placed in a third sealed envelope with the address Via Papa Giovanni Paolo II, snc, 20040, Cambiago (MI) and bearing the words "confidential-report" on the outside.

• in oral form:
  • by requesting a direct meeting with the Team or one of its members, using the channels described above, or by contacting the Team members directly.

Attention: do not send reports by e-mail or certified email, as they are not suitable channels to guarantee the confidentiality and protections provided for by the legislation.

In addition, we recommend that you make a report that is as precise and clear as possible, indicating, in particular:

• the circumstances of time and place in which the reported event occurred;
• the description of the fact;
• the personal details or other elements that allow the identification of the person to whom the reported facts are attributed, also attaching any documentation that may be useful in support of the report and indicating any third parties potentially aware of the facts.

It is also possible to make anonymous reports, as long as they contain the essential elements to be able to start an investigation. In this case, we recommend that you use the Raise your concern platform.

At the time of reporting, you must have reasonable and reasonable grounds to believe that the information about the violations you report is true and within the scope of the law, and is information about behavior, acts, or omissions that you have become aware of in the context of employment.

In the event that there is a conflict of interest with a member of the Whistleblowing Team, this person will be excluded from any further step relating to the management of the report and the appropriate segregation measures will be adopted. The whistleblower may also contact the parent company Lyreco SAS directly by selecting this company from the Raise your concern tool, or may make an external report pursuant to Article 4 below. 

3.2 How internal reporting is handled by Lyreco

Upon receipt of the internal report, the dedicated team:

• issue you with an acknowledgment of receipt of the report within seven days of the date of receipt;
• carry out a confidential preliminary assessment to determine, prior to any investigation, whether the report is admissible and whether it falls within the scope of the applicable legislation;
• he may request additions from you, if necessary;
• carry out the investigation necessary to follow up on the report, including through hearings and the acquisition of documents;
• will provide feedback to the report in compliance with the deadlines provided for by the legislation.

4. EXTERNAL REPORTING METHODS

It is also possible to make an external report to the National Anti-Corruption Authority – ANAC only if one of the following conditions is met:

• there is no internal reporting channel within the whistleblower's company, i.e. this, even if mandatory, is not active or, even if activated, does not comply with the provisions of the law;
• the whistleblower has already made an internal report that has not been followed up;
• the whistleblower has reasonable grounds to believe that, if he or she made an internal report, it would not be followed up effectively or could lead to the risk of retaliation;
• the whistleblower has reasonable grounds to believe that the violation may constitute an imminent or obvious danger to the public interest.

For the operating methods of external reporting, please refer to the https://www.anticorruzione.it/-/whistleblowing website 

5. CONFIDENTIALITY 

Lyreco guarantees confidentiality and that it will not use the information relating to the report beyond what is necessary to adequately follow up on the same, in compliance with the applicable regulations.

The identity of the person making the report, the elements that make it possible to determine it, the identity of the persons involved and the persons mentioned in the report are strictly protected and will be disclosed:

• only to persons competent to receive or follow up on the reports received;
• if necessary or requested, to the judicial authority;
• in cases where the whistleblower gives his or her consent;
• in the cases provided for by the applicable legislation.

Any person who has access to information relating to an ongoing reporting procedure, its processing and any associated investigation, is bound by a strict obligation of confidentiality. 

6. PROTECTION OF WHISTLEBLOWERS

Lyreco does not tolerate retaliation or intimidation against those who make a report. Respect for the individual is a core value at Lyreco.

In the event of retaliation or risk of retaliation, the person making the report should contact the Team. Lyreco will take any action it deems appropriate and provide recommendations on how to resolve the situation. 

In addition to the whistleblower, the protection measures apply to:

• facilitators (i.e. those who assist the whistleblower in the reporting process, operating in the same work context and whose assistance must be kept confidential);
• persons belonging to the same work context as the whistleblower, the person who has filed a complaint with the judicial or accounting authority or has made a public disclosure and who are linked to them by a stable emotional or kinship bond within the fourth degree;
• work colleagues of the whistleblower or of the person who has filed a complaint with the judicial or accounting authority or has made a public disclosure, who perform activities in the same work context and have a habitual and current relationship with the whistleblower;
• entities owned by the reporting person or the person who has filed a complaint with the judicial or accounting authority or who has made a public disclosure or for which the same persons work, as well as to entities operating in the same working context as those persons.

7. PROCESSING OF PERSONAL DATA

The data you provide in the context of a whistleblowing report will be processed by Lyreco Italia S.r.l. pursuant to EU Regulation 679/2016 on the protection of personal data and related applicable legislation, as well as pursuant to Legislative Decree 24/2023. For more information and to exercise your rights, please consult the dedicated section of the privacy policy whistleblowing available at the following address: clicca qui>

EXAMPLE OF USEFUL INFORMATION FOR REPORTING

Below you will find some examples of data that can help you in making the report and that allow Lyreco's dedicated Team to manage it appropriately:

• Your identification and contact details (first name, last name, telephone number, e-mail)
• Identity document (if the report is made by post)
• What relationship do you have with Lyreco? (employee, collaborator, other)
• Description of the facts
• In what work context did the incident occur?
• Which department is involved?
• Name and contact details of each person involved (e.g. alleged perpetrator, victim, other persons)
• On what date did the episode occur or when did you notice it?
• Is what has been reported still in progress?
• Are there witnesses or other persons who are aware of the fact (if yes, please indicate identification data)?
• Any supporting documentation 

We remind you that if you make a written report by post, you must enter your identification and contact details (with a copy of your identification document) in a separate envelope from the other data relating to the report, respecting the procedures described in paragraph 4.1.