Last updated: September 13, 2026
Whistleblowing Reports
What this is, and who it is for
M.C.M. S.r.l. provides a confidential channel for reporting unlawful or irregular conduct encountered in the work context, in accordance with Italian Legislative Decree 24/2023 (implementing EU Directive 2019/1937) and consistently with the ISO 37001 anti-bribery management system adopted by the Company. A report may be submitted by anyone operating in our work context, and in particular: • employees, including those on probation, and agency workers; • collaborators, self-employed workers and professionals working for the Company; • suppliers, subcontractors and their employees; • trainees and volunteers, whether paid or not; • shareholders and persons with administrative, management, control or supervisory functions; • candidates, where the information was acquired during the recruitment process; • former collaborators, for facts learned during the relationship, and persons whose relationship has not yet begun.
What can be reported
You may report breaches of national or European Union law that harm the public interest or the integrity of the Company, which you became aware of by reason of your working or professional relationship. These include in particular: • bribery, extortion or any conduct aimed at obtaining or granting undue advantages; • fraud, accounting or tax offences, undeclared conflicts of interest; • breaches of the Company's Code of Ethics and Conduct and anti-bribery procedures; • breaches concerning occupational safety, environmental protection, product safety, personal data protection and network security. Outside the scope of this procedure are: • complaints, claims or requests linked to a personal interest concerning exclusively your own individual employment relationship (for which the usual company and union channels remain available); • manifestly unfounded reports, or reports based on public-domain information with no supporting evidence; • information acquired solely on the basis of unsubstantiated rumours or hearsay.
How to submit a report (internal channel)
A report may be submitted through the confidential form published at the bottom of this page, or orally. Online form (recommended channel) The form does not ask for your name or email address: you can complete and submit it without identifying yourself. The content is delivered directly to the restricted mailbox segnalazioni@groupmcm.com, accessible exclusively to the internal person specifically designated and trained to handle reports (the Report Manager). No other company function has access to it. Once submitted you are shown a report code: keep it, as it lets you refer to your report later without having to reveal your identity. You may attach supporting documentation (PDF or images, up to 20 MB). If you want to receive feedback The form includes an optional contact field. If you leave it empty the report stays fully anonymous, but we will not be able to send you the acknowledgement of receipt or communicate the outcome: if you would like feedback, you may also provide an email address created specifically for this purpose that cannot be traced back to you. Orally By requesting a direct meeting with the Report Manager, writing to segnalazioni@groupmcm.com: the meeting will be arranged within a reasonable time and, with your consent, minutes may be taken. A note on technical anonymity The form does not record your IP address in the report. As with any website, however, the hosting infrastructure's technical logs record the IP addresses of requests for security purposes. If you require a higher level of anonymity, you can submit the report from a network that cannot be traced back to you. To allow an effective assessment, a report should state the circumstances of time and place, a description of the facts, any persons involved and any document useful to support what is reported.
What happens after a report
In accordance with Article 5 of Legislative Decree 24/2023, the Report Manager: • issues the reporting person an acknowledgement of receipt within 7 days of the date of receipt; • maintains the necessary dialogue and may request additional information; • diligently follows up on the report, carrying out the appropriate checks; • provides feedback within 3 months of the acknowledgement of receipt (or, in the absence of an acknowledgement, of the expiry of the 7-day period). Where a report proves to be well founded, the Company adopts the appropriate corrective and disciplinary measures and, where the conditions are met, informs the competent authorities.
Confidentiality and protection for reporting persons
Confidentiality The identity of the reporting person, that of the person concerned and of anyone mentioned in the report, as well as the content of the report and the related documentation, are subject to an obligation of confidentiality. The identity of the reporting person may not be disclosed to persons other than the Report Manager without their express consent, except in the exhaustive cases provided for by law. Prohibition of retaliation Any retaliation against a reporting person is prohibited, including attempted or threatened retaliation: dismissal, sanctions, demotion, failure to promote, change of duties, transfer, harassment, non-renewal of a contract, or any other act or omission causing unfair detriment. Retaliatory acts are null and void. Who else is protected Protection extends to facilitators (those who assist the reporting person in the process), to colleagues and relatives up to the fourth degree, as well as to entities owned by the reporting person or where they work. Limits of protection Protection does not apply where criminal liability for defamation or slander, or civil liability for wilful misconduct or gross negligence, is established — including by a first-instance judgment — in the case of deliberately false reports. A report made in good faith remains protected even if the subsequent checks show it to be unfounded.
ANAC external channel and public disclosure
In addition to the internal channel, a reporting person may turn to the external channel operated by ANAC (the Italian National Anti-Corruption Authority) where at least one of the following conditions applies: • the internal channel is not active or does not comply with the requirements of the law; • an internal report has already been submitted and was not followed up; • there are reasonable grounds to believe that an internal report would expose the reporter to a risk of retaliation; • there are reasonable grounds to believe that the breach may constitute an imminent or manifest danger to the public interest. The external channel can be reached from the Authority's website: www.anticorruzione.it The possibility of turning to the judicial or accounting authorities also remains, as does public disclosure in the cases provided for by Article 15 of Legislative Decree 24/2023.
Processing of personal data in reports
The data controller is M.C.M. S.r.l., Via Prov.le C.da Castagnara - 89022 Cittanova (RC), Italy, tax code / VAT no. IT01475270805. Purpose and legal basis: handling the report and complying with the obligations laid down by Legislative Decree 24/2023 - Article 6(1)(c) GDPR (legal obligation) and Article 9(2)(g) GDPR for any special categories of data. Access to data: exclusively the Report Manager and, where strictly necessary, expressly authorised persons bound by confidentiality. Retention: reports and the related documentation are kept for as long as necessary to handle them and in any case no longer than 5 years from the communication of the final outcome, as required by Article 14 of Legislative Decree 24/2023. Data subject rights: the rights under Articles 15-22 GDPR may be exercised by writing to info@groupmcm.com. Please note that, under Article 2-undecies of Legislative Decree 196/2003, the exercise of those rights may be restricted where it could cause actual and concrete prejudice to the confidentiality of the reporting person's identity. You may always lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it).