Whistleblowing Management System Policy

Introduction

Value Retail Management Italy S.r.l. (“VRMI” or the “Company”) advocates the establishment of a culture of transparency, ethics and zero tolerance against any conduct that may contravene the applicable legislation, its Code of Conduct, or other internal regulations.

The purpose of this policy (the “Policy”) is to define the fundamental principles upheld, promoted, and embraced by VRMI in the management of complaints. Additionally, the policy outlines the essential components that constitute the System and provides information about other “external” information channels through which informants may alternatively communicate with relevant regulatory authorities.

This Policy will be made accessible to the public on VRMI website, in a dedicated and easily locatable section.

Scope of Application

This Policy is applicable to the activities that VRMI carries out anywhere and with other entities as long as it has effective control or occupies positions in their managing bodies. Also, it applies to its Board of Directors, management positions and control bodies.

The result of this Policy is applicable to VRMI entire staff, suppliers, distributors, franchises, consultants, licensees, agents, investee companies clients, tenants or consumers and any other individual or legal entity using VALUE RETAIL brand or that may have a relationship with VRMI.

Applicable Regulation

This Policy is adapted to the following regulations:

• Italian Legislative Decree No. 24/2023 (so-called “Whistleblowing Decree”).
• Italian Privacy Code and GDPR.
• Italian Civil Code, Italian Criminal Code and Italian Criminal Procedure Code, where relevant.

This Policy will be adapted to the legislative changes that may occur in Italy and in the countries in which VRMI has activity of any kind, as well as the criteria established in the rulings of the Supreme Court, Constitutional Court, Court of Justice of the European Union and European Court of Human Rights and will also take into account the indications established in the guides, reports and resolutions of the national or European public administration.

Applicable Compliance Standards

The Policy is adapted to the following national compliance standards:

• ANAC Guidelines pursuant to ANAC’s resolution 12 July 2023, No. 311.
• Confindustria Operational Guidelines for private entities, October 2023.

01 Internal Reporting Channel

VRMI makes the Reporting Channel available to whistleblowers, this being the preferred channel for reporting conduct that may be violations of the law, the Code of Ethics or internal regulations. The Reporting Channel has the following channels for communicating information:

• Speak Up Channel, which allows to made written and/or oral reports. Speak Up is available exclusively to employees and is managed by Value Retail Management Ltd, ensuring that all complaints regarding VRMI, or related to VRMI by any means, will be managed by the Value Retail Global whistleblowing Management System Responsible. The Speak Up Channel may have its own policies, which will be made available to all employees and by which the provisions of this Policy are supplemented.
• Other stakeholders in Italy may use any of the following channels, managed by the Value Retail Global whistleblowing Management System Responsible and therefore under its control: Concerns@ValueRetail.com

An in-person meeting can be requested to the System Responsible Concerns@ValueRetail.com both form employees and other stakeholders to be arranged within a reasonable time and documented. The whistleblower may indicate an address, e-mail or safe place for the purpose of receiving notifications and be contacted. The reporter will receive:

• an acknowledgement of receipt of the report within No. 7 days of its submission
• feedback on the report within No. 3 months of the expiration of the above deadline, informing on the status of the report, activities performed or in progress, and actions taken by the company.

02 External Reporting Channel

Under certain conditions, it is possible to lodge an External Reporting to ANAC.

The Whistleblower may submit an External Report if, at the time of its submission, one of the following conditions is met:

(a) the Internal Reporting channel provided by the Whistleblowing Procedure is not active;

(b) the Whistleblower has already made an Internal Report and it has not been followed up;

(c) the Whistleblower has well-founded reasons to believe that if he or she made an Internal Report, it would not be effectively followed up or could result in the risk of retaliation;

(d) the Whistleblower has reasonable grounds to believe that the violation may pose an imminent or obvious danger to the public interest.

For External Reporting, it is necessary to access the dedicated "whistleblowing" service on ANAC's institutional website (https://www.anticorruzione.it/-/whistleblowing), which provides the possibility of:

1. make a Whistleblowing Report through ANAC's dedicated IT platform;
2. make an Oral Report, using the service with a specialized operator;
3. request an in-person meeting with ANAC staff within a reasonable time.

03 Public Disclosure

By Public Disclosure, information subject to Reporting is placed in the public domain through the press or electronic or broadcasting media capable of reaching a large number of people.

A Public Disclosure may be made, while still benefiting from the protections provided by the regulations, if at least one of the following conditions is met:

(a) an Internal Report to which the administration/entity has not provided a response within the prescribed timeframe has been followed by an External Report to ANAC which, in turn, has not provided a response to the Whistleblower within a reasonable timeframe;

(b) the Whistleblower has already directly made an External Report to ANAC which, however, has not provided feedback to the Whistleblower within reasonable terms;

(c) the Reporting Party has reasonable grounds to believe, based on concrete circumstances and thus, not on mere inferences, that the violation may pose an imminent or obvious danger to the public interest; (d) the Whistleblower has reasonable grounds to believe that the External Report may pose a risk of retaliation or may not be effectively followed up.

04 Complaint to Judicial Authorities

The applicable regulations also allow for protected persons to turn to the judicial authorities to file a report of unlawful conduct of which they have become aware in a public or private work context relevant to the application of the Whistleblowing Decree.

It should be noted that if the whistleblower holds the title of public official or person in charge of a public service, even where the same has made a Report through the internal or external channels provided for by the Whistleblowing Decree, this does not exempt him or her from the obligation – by virtue of the combined provisions of Article 331 of the Code of Criminal Procedure and Articles 361 and 362 of the Criminal Code – to report to the competent judicial authority the criminally relevant facts and hypotheses of tax damage.

05 Violations to which The Whistleblowing Regulations Apply

Pursuant to Articles 2 and 3 of the Whistleblowing Decree for private sector entities, such as the Company, violations subject to Whistleblowing refer to behaviors, acts or omissions that harm the public interest or the integrity of the public administration or private entity and consist of:

(a) offenses that fall within the scope of the European Union or national acts indicated in the annex to the Whistleblowing Decree or national acts that constitute implementation of the European Union acts indicated in the annex to the Whistleblowing Directive, although not indicated in the annex to the Whistleblowing Decree, relating to the following sectors: public procurement; financial services, products and markets and prevention of money laundering and financing of terrorism; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; privacy and protection of personal data and security of networks and information systems;

(b) acts or omissions affecting the financial interests of the Union referred to in Article 325 of the Treaty on the Functioning of the EU specified in relevant secondary legislation of the European Union;

(c) acts or omissions affecting the internal market, as referred to in Article 26(2) of the Treaty on the Functioning of the European Union, including violations of the Union's competition and state aid rules, as well as violations affecting the internal market related to acts that violate corporate tax rules or mechanisms whose purpose is to obtain a tax advantage that frustrates the object or purpose of the applicable corporate tax law; and

(d) acts or conduct that frustrates the object or purpose of the provisions of Union Acts in the areas indicated in (a), (b) and (c).

Therefore, whistleblowing regulations do not apply to the followings cases:

1. disputes, claims or demands related to a personal interest of the Reporting person or the person who has filed a Complaint with the Judicial Authority, which pertain exclusively to his or her individual working relationships, including with hierarchically subordinate figures;
2. reports of violations where already mandatorily regulated by the European Union or national acts indicated in Part II of the Annex to the Whistleblowing Decree, or those national acts that constitute implementation of the European Union acts indicated in Part II of the Annex to Directive (EU) 2019/1937, although not indicated in Part II of the Annex to the Whistleblowing Decree; and
3. reports of breaches in the area of national security, as well as procurement related to defense or national security aspects, unless such aspects fall under relevant secondary law of the European Union.

06 Contents of the Report

Reports must be detailed and based on precise and consistent facts.

The reporting person shall provide all possible elements within his or her knowledge, which are useful to enable the persons in charge to proceed to the due and appropriate verifications to corroborate the reported facts, although it is not essential that the reporting person has sufficient evidence to prove the reported fact.

In particular, the reporting person is required to fill out the report, with information regarding:

(a) the circumstances of time and place in which the fact that is the subject of the Report occurred;

(b) the description of the fact that is the subject of the Report, and

(c) the personal details or other elements that allow for the identification of the person to whom the reported facts are attributed, with an indication of the position or function held within the Company, or in any case of the relationship that binds him/her to it.

It is also desirable that the reporting person attach documents capable of providing elements of substantiation of the facts subject to Reporting, as well as other persons potentially aware of the circumstances reported. It also remains desirable that the Reports contain the following elements:

• if known, the personal details or in any case other elements that make it possible to identify the person to whom the reported conduct is ascribed (e.g., qualification, sphere or sector in which the activity is carried out);
• the indication of any other individuals who may report on the facts that are the subject of the report;
• any documents that may confirm the validity of the reported facts; and
• any other information that may provide feedback as to the existence of the reported facts.

The possibility of submitting Anonymous Reports is allowed, bearing in mind, however, that where further information is needed to verify the reported violations, the condition of anonymity could result in the impossibility of establishing contact with the (anonymous) reporting person and, where it is not possible to independently verify the facts, lead to the dismiss of the verification. In any case, the protections provided by the legislation against retaliatory measures are extended, when the conditions are met, also to anonymous Whistleblowers whose identity has nevertheless emerged because of the reporting.

07 Responsible for the Whistleblowing System

Value Retail Global Whistleblowing Management System Responsible (“System Responsible”) will be the recipient and responsible for the management of communications received through the Reporting Channel, and will be in charge of the investigations that, if applicable, are carried out.

The System Responsible may share relevant information relating any complain received with VRMI, when needed or necessary, ensuring that all information will be always processed according to this policy and any other global policy applicable, taking every precaution and measure to ensure the confidentiality, and where required, anonymity, of the reporting person.

If a complaint is made against the System Responsible and/or any of the members participating in an investigation, this person will be excluded or will refrain from participating in the investigation.

08 Guarantees of the Reporting Channel and of the Investigation Process

All complaints received through the Reporting Channel will be governed by the following guarantees:

(a) Security measures: the Reporting Channel will have the appropriate technical and organizational security measures to avoid risk of disclosure, unavailability and loss or destruction of information, that is: the confidentiality, availability and integrity of the inquiries and complaints received will be guaranteed.

(b) Confidentiality: the confidentiality of the identity of the whistleblower, the reported person and any third party mentioned in the communication, as well as the facts mentioned, will be guaranteed, with only authorized staff having access to the communication.

(c) Privacy: the processing of personal data will be carried out in accordance with current legislation on data protection, including the Legislative Decree No. 24/2023 relevant provisions.

(d) Diligent and reasoned response: complaints will be answered respecting the established deadlines and will always be sufficiently reasoned and provide a response to the different questions raised

09 Duty of Confidentiality

Reports (and the information contained therein) may not be used beyond what is necessary to adequately follow up on them.

The identity of the reporting person and any other information from which such identity may be inferred, directly or indirectly, may not be disclosed, without the express consent of the reporting person himself or herself, to persons other than those competent to receive or follow up on the reports, who are expressly authorized to process such data pursuant to Articles 29 and 32(4) of the GDPR and Article 2-quaterdecies of the Privacy Code.

The Company adopts the same protection methods provided to guarantee the privacy of the reporting party also for the alleged perpetrator of the violation, without prejudice to any further form of liability provided for by the law that imposes the obligation to disclose the name of the Reporting Party (e.g., requests by judicial authorities, etc.).

Within the framework of disciplinary proceedings, the identity of the reporting person may not be disclosed, where the contestation of the disciplinary charge is based on investigations separate and additional to the report, even if consequent to it. If the charge is based, in whole or in part, on the report and the knowledge of the identity of the reporting person is indispensable for the defense of the accused, the report will be usable for the purposes of disciplinary proceedings only in the presence of the express consent of the reporting person to the disclosure of his or her identity. In the latter case, notice shall be given to the reporting person by written communication of the reasons for the disclosure of the confidential data when the disclosure of the identity of the reporting person and/or the information from which it can be derived is also indispensable for the defense of the person involved.

The System Responsible shall also protect the identity of the persons involved and the persons mentioned in the report until the conclusion of the proceedings initiated on account of the report, subject to the same guarantees provided in favor of the reporting person.

10 Protections Provided for Whistleblowers and Other People Involved in the Process

To encourage the possible reporting of wrongdoing, the Company guarantees the necessary confidentiality to the Whistleblower to preserve him/her from any internal retaliation or discriminatory acts. In particular, the Company guarantees that the identity of the Whistleblower cannot be revealed without his or her express consent and that all persons involved in the management of the Report are required to protect its confidentiality, except in the following cases:

• if the Reporting Party incurs liability for libel or slander under the provisions of the Criminal Code;
• the Whistleblower incurs civil liability under Article 2043 of the Civil Code;
• in cases where anonymity is not enforceable by law.

Violation of the obligation of confidentiality is a source of disciplinary liability, without prejudice to any further form of liability provided by law. The Whistleblowing Decree provides, for the protection of the Whistleblower, the prohibition of retaliation defined as "any conduct, act or omission, even if only attempted or threatened, put in place by reason of the report, the report to the judicial authority or public disclosure and which causes or may cause the reporting person or the person who made the report, directly or indirectly, unjust damage." This is thus a broad definition of the concept of retaliation, which can consist of both acts or measures and behaviors or omissions that occur in the work context and cause harm to the protected persons. Retaliation can also be "merely attempted or threatened."

The protection measures under the Whistleblowing Decree also apply:

• To facilitators who assisted the Whistleblower in the whistleblowing process;
• to persons in the same work environment as the Whistleblower, the person who made a complaint to the judicial or accounting authority, or the person who made a public disclosure and who are related to them by a stable affective/relative relationship within the fourth degree;
• to co-workers of the Whistleblower or the person who made a complaint to the judicial or accounting authority or made a Public Disclosure, who work in the same work environment as the Whistleblower and who have a habitual and current relationship with said person;
• to entities owned by the Whistleblower or the person who filed a complaint with the judicial or accounting authorities or made a Public Disclosure or for which the same persons work, as well as entities that work in the same work context as the aforementioned persons.

More specifically, with specific reference to the content of protection, Articles 17 et seq Legislative Decree No. 24/2023 provide that:

(a) in the context of judicial or administrative proceedings or, in any case, extrajudicial disputes having as their object the ascertainment of the conduct, acts or omissions prohibited under this article with respect to the Whistleblowers (and/or by the other persons, related to them, to whom the protection regime is extended), it shall be presumed that the same have been put in place as a result of the Whistleblowing, Public Disclosure or complaint to the judicial or accounting authorities. The burden of proving that such conduct or acts are motivated by reasons unrelated to the Reporting, Public Disclosure or Complaint is on the person who carried them out;

(b) in the event of a claim for damages filed with the judicial authority by the Whistleblowers (and/or other persons to whom the protection regime is extended) if they prove that they made, pursuant to the Whistleblowing Decree, a Whistleblowing Report, Public Disclosure or complaint to the judicial or accounting authority and suffered damage, it shall be presumed, unless proven otherwise, that the damage is a consequence of the Whistleblowing Report, Public Disclosure or complaint to the authority;

(c) waivers and settlements, in whole or in part, which have as their object the rights and protections provided for in the Whistleblowing Decree are not valid, unless they are made in the form and manner referred to in Article 2113, fourth paragraph, of the Civil Code.

Any retaliatory measures or acts suffered by Whistleblowers (and/or other persons, related to them, to whom the protection regime is extended) may be reported by the interested parties to ANAC which, if it finds them, may apply the sanctions provided for in Article 21 of the Whistleblowing Decree.

11 Disciplinary Sanctions and Other Measures

The Company will sanction any unlawful conduct in line with the provisions of the Whistleblowing Decree, attributable to Company personnel, that may emerge because of verification activities of reports, conducted in accordance with the provisions of the Policy, to prevent any conduct that violates the law and/or this document by the same Company personnel.

Disciplinary measures, as provided for by the law and applicable collective agreements, will be proportionate to the extent and seriousness of the unlawful conduct ascertained and may go as far as termination of employment. The followings are examples of some of the conduct that may be subject to disciplinary proceedings:

(a) retaliatory conduct against the whistleblower and/or facilitator;

(b) conduct that obstructs or attempts to obstruct the reporting;

(c) violation of the obligation of confidentiality set forth in Article 12 of the Whistleblowing Decree;

(d) failure to verify and analyze the Reports received;

(e) defamation and/or slander carried out by the Whistleblower, detected even with a first-degree judgment, or reported to the judicial or accounting authorities (also in the case of civil liability, for the same title, in cases of malice or gross negligence);

(f) in general, violations of the Policy and the Whistleblowing Decree.