Anti-Money Laundering Whistleblowing

INFORMATION DOCUMENT pursuant to article 13 of Regulation (UE) 2016/679 of the European Parliament and Council dated 27 April 2016. The company implementing the “Anti-money laundering Whistleblowing ” policy, B.T.V. S.p.A, BTV Mondialpol S.p.A. or Rangers s.r.l., is hereinafter referred to as the “Company part of the Battistolli Group”. The Company part of the Battistolli Group, in compliance with Legislative Decree 21 November 2007 and subsequent amendments and integrations (Anti-Money Laundering Regulation), has implemented procedures for employees, or anyone in a comparable position, to report potential or actual violations of the provisions to prevent money laundering and terrorism financing. The procedures ensure the confidentiality of the identity of reporting agents and of the alleged violators, without prejudice to the provisions applicable to the investigations and procedures initiated by judicial authorities in relation to the facts reported. The reporting system (“Anti-Money Laundering Whistleblowing” form) does not require the personal details of the reporting agent. However, should the reporting agent provide their personal details, pursuant to article 13 of the General Data Protection Regulation - Regulation (UE) 2016/679 of the European Parliament and Council, dated 27 April 2016, on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereafter "GDPR"), the data will be processed as follows.

Data Controller
The Company part of the Battistolli Group (hereinafter the “Data Controller”)
Data Protection Officer (hereafter "DPO")
The DPO contact details are available on the Data Controller's website or at their registered offices. In order to exercise your rights and for all communications, issues and/or requests for clarifications regarding the protection of your personal data, you may contact the DPO.

Discretionary purposes for which processing does not require your consent
Purposes
Managing the legal obligations in article 48 of Legislative Decree 21 November 2007 and subsequent amendments and integrations (Procedures for Internal Reporting – so-called AntiMoney Laundering Regulation)
Legal basis for processing
(Article 6, paragraph 1, letter c), GDPR)
Processing is necessary to fulfil a legal obligation to which the Data Controller is subject

Recipients of personal data
To achieve the above-mentioned purposes, your personal data may be communicated exclusively to employees and/or collaborators of the Data Controller, authorised subject trained to handle such data, and to specifically appointed data controllers/data processors/joint controllers. The list of individuals identified as data controllers, processors or joint controllers and their up-to-date information is available at the company’s head office.

Period of retention of personal data
The following criteria are applied to determine the personal data retention period.
Personal data and documents
Records and documents relating to the reported violations
Period of retention, or determining criteria
For the time required to achieve the processing purposes and, subsequently, within the limits allowed by the law and to exercise or protect the rights of the Data Controller, where necessary

Rights of the Data Subject
Under the GDPR the Data Subject may exercise the following rights in relation to their personal data and the way they are processed: right to revoke consent, when required for processing, without prejudice to the processing carried out before the consent was revoked (art. 13, paragraph 2, letter c); right to access data (art. 15); right to rectify data (art. 16); right to be forgotten (art. 17) right to restrict processing (art. 18); right to data portability (art. 20); right to object to processing (art. 21); right to complain with the Supervisory Authority (art. 77).

Pursuant to art. 2 of Legislative Decree 196/2003, the rights set by article 15-22 of the GDPR (hereinafter the “Rights”) cannot be exercised sending a request to the Data Controller or making a complaint pursuant to article 77 of the GDPR if the exercise of such rights may cause real and actual prejudice to the interests protected by the anti-money laundering provisions (paragraph 1, letter a) and to the confidentiality of the identity of the subject reporting the violation pursuant to Law no. 179, of 30.11.2017 of which they have become aware in the performance of their duties (paragraph 1, letter c) (hereinafter, jointly the “Interests”). In these cases, the Rights are exercised in compliance with the laws and regulations applicable to the sector, which must at least include provisions in the fields referred to in article 23, paragraph 2, of the GDPR. In any case, the exercise of these rights may be postponed, limited or excluded with a motivated communication duly notified to the Data Subject, unless the communication may compromise the purpose of the limitation, for the time and as long as the measure is necessary and proportionate, taking into consideration the fundamental and legitimate interests of the Data Subject, in order to preserve the Interests. In these cases, the Data Subject rights can be exercises via the Supervisory Authority in compliance with article 160. In this case, the Supervisory Authority informs the Data Subject that a review and all the necessary checks have been carried out and that they have the right to take legal action.

The forms to exercise the Rights is available on the website or at the company’s head office.

The personal data submitted may be processed by the data controller with or without the use electronic means.

Amendments and updates
This information document may be subject to amendments and/or integration, even as a consequence of the applicability of the GDPR and of any future regulatory amendments and/or updates. An updated version of the document is available at any time at the company’s head office.

I have read the Anti-Money Laundering Whistleblowing Policy with regard to the processing of my personal data.