Whistleblowing Procedure

EU Directive 2019/1937 on whistleblowing was also transposed into Italian law in the Official Gazette of March 15, 2023, with the publication of Legislative Decree No. 24 of March 10, 2023. “Implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019, on the protection of persons who report breaches of Union law and laying down provisions on the protection of persons who report breaches of national law.”

In light of the above, Terme di Margherita di Savoia S.r.l., hereinafter referred to simply as Terme, has decided to update and better regulate the rules governing the Company's Internal System for Reporting Violations.

This document, addressed to all Company Employees and the other parties indicated below, describes the procedures for safely and confidentially reporting acts or omissions that could harm the interests or integrity of the Company, which may come to light in the course of or as a result of work activities or the position held.

1. SCOPE OF APPLICATION AND PERSONS AUTHORIZED TO REPORT

The following applies to all employees, directors, and managers of Terme di Margherita di Savoia S.r.l. (“Employees”), as well as third parties (such as business partners, suppliers, agents, etc.).

The reporting entities are, specifically:

• company employees: fixed-term and permanent workers in accordance with the applicable national collective labor agreement (white-collar workers, middle managers, and executives);
• persons in a comparable position: “collaborators,” meaning those who work for the Company on the basis of a collaborative relationship that does not constitute an employment relationship (including, but not limited to: interns, project-based workers, temporary workers);
• freelancers, consultants, and, in general, the Company's suppliers: individuals who provide services, whether consulting or otherwise, and who, in the course of or in connection with the performance of their duties, may find themselves reporting unlawful conduct;
• shareholders and persons with administrative, control, supervisory, or representative functions.

Please note that the legislation also applies to:

• to whistleblowers if they report or disclose information about violations acquired in the context of an employment relationship that has since ended;
• to whistleblowers whose employment relationship has not yet begun (e.g., information regarding a violation acquired during the selection process or at other stages of pre-contractual negotiations).

These guidelines are not intended to override local laws and regulations. In the event of conflict or inconsistency with external provisions, the most stringent rule shall apply.

The tools described here cannot be used in the following cases:

• to report situations that pose an immediate threat to life or property;
• for any complaints regarding working conditions, except as specifically indicated below;
• for safety reports, as well as for complaints relating to products/services and for all other matters that do not involve potential misconduct or irregular conduct and that are subject to other policies and procedures;
• to resolve personal or legal disputes;
• to make accusations that are known to be

2. INTERNAL REPORTING

Employees and third parties are encouraged to report, in good faith, any concerns or issues regarding suspected or actual:

• violations of national and European provisions consisting of offenses relating to the following areas: public procurement; services, products, and financial markets; prevention of money laundering and terrorist financing; product safety and compliance; environmental protection; consumer protection; privacy and personal data protection; and security of networks and information systems;
• violations of European provisions consisting of: i) acts or omissions that harm the financial interests of the Union; ii) acts and omissions concerning the internal market; iii) acts and behaviors that undermine the object or purpose of the provisions of Union acts in the above-mentioned areas;
• violations of national provisions consisting of: i) administrative, accounting, civil, or criminal offenses; ii) unlawful conduct pursuant to Legislative Decree 231/2001 or violations of organizational and management models. Such offenses and conduct must not fall within the categories of violations of national and European provisions and violations of provisions

3. HOW TO SUBMIT AN INTERNAL REPORT

a) Written form

The Whistleblower must send their report, which must contain the elements listed below, signed, with a copy of their identification document and any supporting documentation. The envelope must be marked “Confidential to the Report Manager” and addressed to: Dr. Sebastiano Zingaro c/o Via Bologna 28, 76123 – Andria (BT). Due to the confidential registration of the report by the Manager, the report must be placed in three sealed envelopes: the first containing the reporter's identification details together with a copy of their identification document; the second containing the report and related attachments. Both will be placed in a third envelope, which will then be sent. The latter is then subject to confidential registration by the Manager, using a separate register.

b) Oral form

You can report the matter to Dr. Sebastiano Zingaro, in his capacity as Reporting Manager, also by calling the following telephone number: 0883. 596106.

The whistleblower may request a face-to-face meeting, which will be held within a reasonable time at a location specified by the report manager.

4. CONTENT OF THE INTERNAL REPORT

The report must be as comprehensive as possible and contain the following information:

1. identifying details of the reporting person (first name, last name, place and date of birth);
2. the contact details of the person making the report;
3. date, place, and accurate description of the facts reported;
4. personal details of the person reported (first name, last name, company position) or other information that allows the identification of the person who committed the reported acts;
5. personal details (first name, last name, job title) or other information that may help identify other individuals who could provide information on the facts reported;
6. any documentation proving the occurrence of the reported events;
7. specification of any interest related to the report held by the reporting person, either on their own behalf or on behalf of third parties, or a declaration that they do not hold any interest, either on their own behalf or on behalf of third parties, in relation to the report;
8. any other information that may provide useful feedback regarding the existence of the facts

The report must include only facts and events and not opinions and/or assessments by the reporter regarding the circumstances or the individuals potentially involved.

Anonymous reports, where detailed, are treated in the same way as ordinary reports.

5. PRINCIPLES OF INTERNAL REPORTING

a) Confidentiality

Terme guarantees that all reports will be handled confidentially and that particular care will be taken to ensure that the identity of the person making the report is not disclosed.

b) Prohibition of retaliatory actions

Terme shall take the necessary and appropriate measures to safeguard the interests and protect the whistleblower from retaliation (such as dismissal, suspension, or equivalent measures; demotion or failure to promote, change of duties, change of workplace, reduction in salary, change in working hours, etc.) and anyone who participates in or provides support to the investigation.

No retaliatory action will be taken against those who report in good faith, regardless of whether the suspicions or allegations reported prove to be unfounded.

However, if intentionally false information is reported, this may result in disciplinary action being taken against the reporter.

Any abuse (maliciously false/slanderous, biased, exaggerated reports, reports characterized by malice in any case) constitutes a serious violation of the code of ethics (meta-principles of fairness/loyalty).

In the case of serious misconduct or minor misconduct, an unfounded report will constitute an intermediate or minor violation of the code of ethics.

Anyone who engages in or attempts to engage in retaliatory actions will be punished. Anyone who believes they have been subjected to retaliation must immediately report the incident.

6. PERSON RESPONSIBLE FOR MANAGING INTERNAL REPORTING

The body responsible for the procedure, i.e., the entity responsible for receiving and examining reports, is the Supervisory Body (SB).

The Supervisory Body shall:

1. after receiving the report, issue the reporting person with an acknowledgment of receipt within seven days of the date of receipt;
2. maintain communication with the reported person, requesting additional information from them where necessary;
3. diligently follow up on reports received;
4. respond to the report within three months of the date of the above acknowledgment of receipt or, in the absence of such acknowledgment, within three months of the expiry of the seven-day period from the submission of the report.

Following the outcome of the verification, the Supervisory Body may proceed with:

• inform the whistleblower that the report has been dismissed, giving reasons for this decision (e.g., in cases of obvious groundlessness or lack of clarity);
• inform the whistleblower that the report has been verified as valid and forwarded to the Administrative Body so that it can take the necessary punitive or disciplinary measures and assess the need to inform the competent public authorities of the reported facts.
• inform the whistleblower of the activities carried out to date and/or the activities it intends to carry out

In the latter case, the Supervisory Body will also inform the reporting person of the final outcome of the investigation into the report.

All reports will be filed in a special register kept by the Chairman of the Supervisory Board.

For any reports of incidents directly involving one of the members of the Supervisory Body, the duties, responsibilities, and powers of the Procedure Manager shall be handled by the Statutory Auditor, who shall manage such reports in accordance with this Procedure.

7. OBJECTIVITY AND INDEPENDENCE OF THE ODV INVESTIGATION

All relevant reports (including anonymous ones) will be treated fairly and investigated appropriately, with respect for confidentiality and integrity, using an objective approach.

The investigator is independent of any party that may have an interest in the case under investigation. The investigation may be carried out:

• directly acquiring the information necessary for the assessments by analyzing the documentation/information received;
• through the involvement of other company departments or even external specialists, depending on the specific technical and professional skills required;
• hearing of any internal/external parties. These tools are the responsibility of the Report Manager.

Confidentiality obligations will be extended to all parties involved in the investigation.

8. PROCESSING OF PERSONAL DATA

Terme undertakes to respect the privacy of all interested parties and to protect personal data from unauthorized access and processing.

Therefore, personal data will be processed in accordance with the principles of fairness, lawfulness, minimization, and transparency of data processing, as required by current privacy legislation.

The data will be processed for the time necessary to achieve the purposes for which it was collected (management of reports, drafting of reports, any legal actions, etc.).

This Procedure is an integral part of Terme's Model 231.

The principles of this Procedure do not prejudice or limit in any way the obligations to report to the Judicial Authorities, nor the obligations to report to the established control bodies or functions.

9. TRANSMISSION OF THE REPORT TO ANAC. THE SO-CALLED “EXTERNAL REPORT”

The Whistleblowing Decree requires ANAC to set up an external reporting channel that guarantees, including through the use of encryption tools, the confidentiality of the identity of the reporting person, the person involved, and the person mentioned in the report, as well as the content of the report and related documentation. The same confidentiality is also guaranteed when the report is made through channels other than those indicated or is received by personnel other than those responsible for processing reports, to whom it is in any case forwarded without delay.

External reports are made in writing via the IT platform or verbally via telephone lines or voice messaging systems or, at the request of the reporting party, through a face-to-face meeting arranged within a reasonable time frame.

The Reporting Party may only make an external report to ANAC if one of the following conditions applies at the time of reporting:

1. the mandatory activation of the internal reporting channel is not provided for in the context of their work, or this channel, even if mandatory, is not active or, even if activated, does not comply with the provisions of Article 4 of the Whistleblowing Decree;
2. The Reporting Party has already made an internal Report and no action has been taken;
3. the Reporting Person has reasonable grounds to believe that, if they were to make an internal Report, it would not be effectively followed up or that it could lead to the risk of retaliation;
4. The Reporting Party has reasonable grounds to believe that the violation may constitute an imminent or obvious danger to the public interest.

The activities carried out by ANAC upon receipt of an external report are described in detail in Articles 7 to 11 of the Whistleblowing Decree, to which reference is made.

10. PUBLIC DISCLOSURES

The reporting person who makes a public disclosure benefits from the protection provided by the legislation if, at the time of the public disclosure, one of the following conditions applies:

1. the reporting party has previously made an internal and external report or has made an external report directly and no response has been received within the specified time frame regarding the measures planned or adopted to follow up on the reports;
2. the reporting entity has reasonable grounds to believe that the violation may constitute an imminent or obvious danger to the public interest;
3. The reporting party has reasonable grounds to believe that the external report may entail the risk of retaliation or may not be effectively followed up due to the specific circumstances of the case, such as those in which evidence may be concealed or destroyed, or where there is a well-founded fear that the recipient of the report may be colluding with the perpetrator of the violation or involved in the violation itself.

This procedure came into effect on December 31, 2023, and was updated on July 31, 2025.