Whistleblowing disclosure

CNG FIBER TRADE EUROPE S.R.L. whose address is Via Carlo di Piaggia 382, 55100 Lucca (LU).
P.IVA 01251220461 – Email: infocngfte@cng-inc.com  – T.: +39-0583-46111

The following personal data may be processed:

·   identification and contact data of the reporter (in case of non-anonymous reports);

·   identification data of the reported party and information relating to the report;

·   all other details of the reporter, the reported party and any other third parties which the reporter decides to share to better describe its report in detail.

The personal data will be collected and processed for purposes related to the management of Reports concerning alleged crimes, offences or irregularities, according to the Whistleblowing procedure and in relation to the Organisational and Management Model of the undersigned.

The legal basis for the processing is the legitimate interest of the Data Controller to adopt an Organisation and Management Model and to provide for a procedure for reporting offences in order to protect the integrity of its company, as well as the need to comply with the provisions contained in L. 179/2017 – concerning “Provisions for the protection of the authors of reports of offences or irregularities of which they have become aware in the context of a public or private employment agreement” – and in Article 6, paragraph 2-bis, letter a) of Legislative Decree 231/2001 “Regulations on the administrative liability of legal entities, companies and associations, including those without legal status, pursuant to article 11 of Law no. 300 of 29 September 2000”.

The provision of data is necessary and functional for the management of reports received. The procedure allows for both reports to be made by providing the data of the party making the report and anonymous reports. Please note that the latter will be taken into consideration only if the reports are adequately and finely detailed, i.e. if they are able to bring to light facts and situations relating them to specific contexts.

The collected personal data will be kept for a period of time not exceeding that necessary for the purposes for which they were collected, namely:

– in cases of an unfounded report within two months of its being filed, and in any case no longer than 12 months from its receipt;

– in cases of initiation of judicial and/or disciplinary action until the final conclusion of the judicial and/or disciplinary proceedings.

Subsequently, such data shall be destroyed or stored, in an anonymous form, for statistical purposes or for historical recording.

The personal data shall be processed by the members of the Supervisory Board who, in accordance with the provisions of the relevant legislation in force and the reporting procedure adopted by the Company, are required to ensure the confidentiality of the identity of the reporting person.

In the phase of ascertaining whether the report is well-founded, where necessary for the purposes of the preliminary investigation, personal data may be processed by other departments of the Company to which specific instructions have been given, by professionals and/or third parties who provide services instrumental to the above purposes (e.g. IT and technological services) or to whom the Company has given a specific mandate.

Finally, the data may be transmitted, in the cases provided for, to the Judicial Authority and other Authorities.

In relation to such data, the Data Subject may exercise, in the cases provided for, the rights set out in CHAPTER III of EU Regulation 2016/679 (GDPR). In particular, the right to access the data, rectify them, erase them, supplement incomplete data, restrict processing. These rights may be exercised by writing to the following email addresses:

Certified email: odvcngfibertradeeurope@arubapec.it

EMAIL: odvcngfibertradeeurope@gmail.com

Furthermore, pursuant to Article 77 of the GDPR, the Data Subject has the right to lodge a complaint with the Data Protection Authority if he/she believes that the processing violates the aforementioned Regulation.

Pursuant to article 2-undecies of the Privacy Code (in implementation of article 23 of the GDPR), we inform you that the aforementioned rights may not be exercised by data subjects (by request to the Data Controller or by complaint pursuant to article 77 of the GDPR) if the exercising of such rights could result in actual and concrete prejudice to the confidentiality of the identity of the reporting party.