REPORTS OF INFRINGEMENTS

Biffi Boutiques SpA, in compliance with the provisions of Legislative Decree no. 24/2023 on "whistleblowing", has activated an internal channel for reporting illicit activities, which also allows reports to be sent anonymously.

The Company has implemented a platform accessible at the following address: Biffi Boutique SpA – Complaints . This system is available to all interested parties (employees and third parties) to report any illicit behavior of which they have become aware.

Both conduct that constitutes a crime and behavior that may cause harm to the company's interests or to the public interest may be reported.

The reporting party is entitled to provide their identification data. In any case, Biffi undertakes to protect the confidentiality of the content of the reports and the identity of the persons involved, in accordance with current legislation.

We therefore invite you to consult the Information on the processing of personal data, provided pursuant to art. 13 of Regulation (EU) 2016/679 (GDPR), relating to the “Whistleblowing” reporting system.

INFORMATION ON THE PROCESSING OF PERSONAL DATA

For reports made pursuant to Legislative Decree 24/2023

Biffi Boutique SpA (“Biffi”), aware of the importance of protecting personal data, as Data Controller, informs that the data contained in the reports made through the dedicated channel will be processed in compliance with applicable legislation.

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“Regulation”), Biffi provides the following information relating to the processing of personal data:

  1. Types of data processed:
    Identification and contact details of the reporting person (if not anonymous), of the persons mentioned in the report (e.g. witnesses, persons reported, facilitators) and any other personal information contained in the report or acquired during the investigations.
  2. Purposes and legal bases of the processing:
    a. Management of the report and performance of the related investigative activities.
    Legal basis: art. 6(1)(c) and, in case of special data, art. 9(2)(b) of the Regulation.

    b. Protection of rights in court.
    Legal basis: art. 6(1)(f) and, in case of special data, art. 9(2)(f) of the Regulation.
  3. Retention period:
    The data will be stored for the time necessary to manage the report and in any case for a maximum period of 5 years from the communication of the final outcome.
  4. Treatment methods:
    The data will be processed with electronic tools by authorized personnel, using adequate security measures. No automated decision-making processes are envisaged.
  5. Data provision:
    The provision is optional, and the report may be made anonymously. In this case, it will not be possible to provide updates or request clarifications.
  6. Data communication:
    The data may be communicated to:
    • Subjects authorised by national or EU legislation;
    • External data processors (e.g. professional firms, consulting firms) for legal obligations or organizational needs. The updated list is available upon request.
    The data will not be disclosed.
  7. Moving abroad:
    The data will not be transferred outside the European Economic Area or to international organizations.
  8. Rights of the interested party:
    Interested parties may exercise the rights provided for by the Regulation (access, rectification, cancellation, opposition, limitation, portability), within the limits of art. 2-undecies of Legislative Decree 196/2003.
  9. Data controller:
    Biffi Boutique SpA (P. IVA 05935720150), with registered office in Corso Genova 6 – 20123 Milano (MI), legally represented pro tempore.
    Contacts for exercising rights: privacy@biffi.com

Interested parties who believe that the processing of their data violates the law may lodge a complaint with the Personal Data Protection Authority (www.gpdp.it) or with another competent authority.