MARR

Legislative Decree No. 231/2001 introduced into our legal system a new profile of administrative liability for companies for specific offences committed by any person operating within the company, whether a director, executive, manager, employee or worker.

The Company is held liable because of the advantage it obtains, or the interest it derives, as a result of the commission by one of its members of one of the offences expressly referred to in Decree 231, and may be sentenced to fines or disqualifications, up to and including suspension from carrying on business activities, depending on the seriousness of the offence and the effective adoption of appropriate preventive measures.

The Company's liability is additional to that of the natural persons who materially committed the offence.

Decree 231 provides that the Company may not incur this type of liability where, among other things, it proves that it has adopted and effectively implemented an Organisation and Management Model suitable for preventing offences of the same type as the one that has occurred, and has appointed a Supervisory Board responsible for monitoring the implementation and updating of the Model.

The Coswell Group, in compliance with Decree 231, has appointed a Supervisory Board consisting of two independent members, who monitor the proper application of the Model and the Code of Ethics.

In order to encourage the detection and prevention of potential irregularities or non-compliance with company policies, with a view to promoting a transparent and ethical working environment, the Coswell Group, in compliance with the provisions of Legislative Decree 24/2023, has set up additional channels for reporting violations of national or European Union regulations that may occur within the company context.

Whistleblowers may be:
- employees even during the probationary period;
- self-employed persons, sole proprietors, independent contractors with whom the company has relations for the provision of services, the execution of works, or the supply of goods;
- holders of agency, sales representation and other continuous and coordinated independent contractor relationships, in accordance with the laws in force at the time, who work for the company;
- workers or independent contractors, who work for legal entities, supply goods or services or perform works for the company;
- freelancers and consultants working for the company;
- volunteers and paid and unpaid trainees working for the company;
- the representatives of the company's shareholder and the Group;
- directors, statutory auditors, the auditing firm, or any person with administrative, management, control, supervisory functions exercised on a de facto basis.

Alerts can be made/forwarded through the following, alternative channels:
- by filling in the form on the reporting portal, which can be reached via the following link : www.whistleblowingfacile.it;
- by writing by post to Winger S.r.l. - Ufficio Segnalazioni D. Lgs 24/2023 - Via Piccard 16 - 42124 Reggio Emilia, to the kind attention of the Management Body of the Coswell Group;
- by making an appointment with one of the members of the Management Body through one of the channels indicated above.

Subjects of reporting may be:
- unlawful conduct pursuant to Legislative Decree 231 2001 or violations of Model 231 or the Code of Ethics;
- offences relating to acts of the European Union in the following areas public procurement services, products and financial markets and prevention of money laundering and financing of terrorism product safety and compliance transport safety environmental protection radiation protection and nuclear safety food and feed safety and animal health and welfare public health consumer protection privacy and protection of personal data and security of networks and information systems) also include acts or conduct that undermine the interests protected by the European Union in these areas;
- acts or omissions that harm or otherwise compromise the financial interests of the European Union;
- acts or omissions relating to the protection of the internal market of the European Union in the field of competition and State aid, as well as infringements relating to the internal market related to acts in breach of corporate tax rules or mechanisms whose purpose is to obtain a tax advantage that frustrates the subject or purpose of the applicable corporate tax law (and thus, the use of avoidance mechanisms).

The reporting must be well-founded and contain the following elements:- general details of the reporting party (anonymous reporting is still possible);
- any contact details of the whistleblower where the latter can be contacted “confidentially”;
- the perpetrators of the reported conduct and any other persons involved and any element useful for their identification;
- a clear and complete description of the facts being reported;
- any other persons who can usefully report on the reported facts;
- any other information, observations or comments to help in the investigation of the reported facts.

The above-mentioned reporting channels must not be used for forwarding:
- complaints, claims, requests of a personal nature or to report disputes between colleagues, internal organisational issues and similar situations.
- complaints, disputes or requests for additional information on marketed products from consumers, for which we invite you to use the appropriate section at the following link: https://coswell.freshdesk.com/it/support/home.

All relevant reports, including anonymous ones, are carefully examined and managed by the Management Body, whose composition coincides with that of the Supervisory Board, to guarantee its third party status and independence. Where possible, appropriate feedback is provided to the whistleblower within the statutory deadlines.

The undersigned Company guarantees the confidentiality of the identity of the whistleblower and of the reported perpetrator of the violation in the manner provided for by the applicable legislation.

No retaliatory action may be taken against whistleblowers who, at the time of the report, had reasonable grounds to believe that the information on the reported violations was true.

Disciplinary proceedings may be initiated, if the conditions are met, or other actions that the Company may decide to take, against any person who has made reports with malice or serious misconduct or which prove to be false, unfounded, defamatory or otherwise made with the sole purpose of harming the Company, the person reported or other persons concerned by the reporting.

The Management Body informs the company management of the content of the relevant reports received, with total guarantee of confidentiality of the whistleblower and the reported person, indicating any corrective actions to be implemented, in order to prevent and/or promptly resolve any possible situation contrary to the law or the ethical principles with which the Coswell Group comply.

We encourage the early identification of any areas of risk, with the aim of constantly improving corporate governance in the promotion of a culture of ethics and legality.

Personal data are processed in accordance with European Regulation 2016/679 and Legislative Decree 196/2003, insofar as still applicable. In this regard, please take careful note of the information below.

Board of Directors

Whereas

1) as a result of your visits to our websites, filling in forms, participation in our competitions, receipt of your requests/questions, preliminary contacts, surveys and market research, possible establishment of business relations, our company will collect and process your personal data;
2) we hereby specify for the sake of clarity, the following definitions given by the European Regulation 2016/679:
Personal Data: any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity.Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, retention, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”; All of the above, pursuant to Article 13 of the European Regulation 2016/679, 
We inform you

that the collection and processing of personal data will be carried out by the undersigned company in accordance with the following:
a) general purposes: the data will be processed to satisfy your requests/questions, for the proper performance of bureaucratic, accounting, tax, commercial, technical tasks and for business activities that are compulsory by law and in any case strictly inherent to the existing relationship;
b) “direct marketing” purposes: your data may be used, only and exclusively subject to your free, optional, specific and explicit consent, which may be revoked at any time, also for sending advertising material/messages by post, e-mail, telephone, fax, sms, mms, whatsapp and similar means; after having given your consent, you are in any case entitled to object, at any time and without charge, to the processing of your data for this purpose;
c) methods: the data will be processed using both paper and electronic/computer/telematic instruments/supports, in full compliance with the law, according to principles of lawfulness and fairness and in such a way as to protect your confidentiality;
d) optional provision of data: the provision of your data is optional and not mandatory;
e) consequences of a possible refusal: refusal to provide data or complete opposition to their processing for the purposes referred to in point a), may however result in the impossibility of fulfilling certain of your requests; refusal to use the data for the purposes referred to in point b), on the other hand, will have no consequences on the recognition of benefits linked to promotions or on existing relationships;
f) subjects or categories of subjects (recipients) to whom the data may be communicated or disseminated: the data may be communicated, subject to your specific and explicit consent, for the proper fulfilment of the purposes referred to in points a) and b) to the companies controlled by our company or connected to it and listed below: Incos Sp.A. . The data may then be communicated, solely for the purposes referred to in point a), to further third parties in order to fulfil any legal or contractual obligations. The data will not be disseminated under any circumstances. 
g) company data processors and persons in charge of processing: the data will only and exclusively be processed by a limited number of specially authorised company representatives from the administrative, marketing, CED and sales areas;
h) automated decision-making processes (e.g. profiling): no automated decision-making processes are operated in any way;
i) rights of the data subject: the user has all the rights provided by the European Regulation 2016/679, such as the right to request access to and rectification of personal data, their erasure, restriction of processing, the right to object to their processing, as well as the right to data portability. It also has the right to lodge a complaint with the supervisory authority;
j) transfers to third countries: Any transfer of personal data to a third country outside the European Union or to an international organisation will take place on the basis of an adequacy decision by the Commission or, in the case of transfers pursuant to Articles 46, 47 or 49(2) of the European Regulation, on the basis of appropriate and adequate safeguards.
k) data retention period: The data will be kept for the period of time strictly necessary to meet the requests of the data subject or as required by the regulations in force or any contractual clauses;
l) data controller: the data controller is Coswell S.p.A., with registered office in Funo (BO), Via P. Gobetti no. 4, in the person of its legal representative pro tempore;
m) data protection officer: the data protection officer is Mr. Juri Torreggiani, with offices in Reggio Emilia, Via Piccard n. 16/G, tel. 0522/30.11.69, fax 0522/38.79.96: any request for clarification or information may be addressed to him. This information policy may be supplemented, either orally or in writing, with further elements and indications, in order to better meet any need for information on “Privacy” matters and to comply with regulatory developments.


Date: 20/04/2018
The data controller
Coswell S.p.A.