The purpose of this procedure is to regulate the process for reporting violations concerning whistleblowing, in compliance with the provisions of Legislative Decree No. 24 of March 10, 2023, which implements Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019, on the protection of persons who report breaches of Union law and contains provisions on the protection of persons who report breaches of national legal provisions.
1. Purpose of this procedure
The purpose of this procedure is to provide specific information on the applicability of whistleblowing legislation at CloudFire srl, detailing its scope, methods, and responsibilities. This procedure aims to offer whistleblowers, or reporting persons, clear operational guidance on the subject, content, recipients, and submission methods for reports, as well as the protections afforded to them by current legislation.
The objectives of this procedure are:
- To comply with the regulatory obligations set forth by Legislative Decree No. 24 of March 10, 2023, known as the Whistleblowing Decree;
- To manage and process reports according to precise procedures and timelines;
- To identify the individuals, roles, and responsibilities within the whistleblowing framework;
- To promote and disseminate a culture of corporate transparency by increasing the awareness of internal and external stakeholders regarding the perception of wrongdoing.
CloudFire srl makes this procedure available to its employees, collaborators, and external stakeholders by publishing it on its website in the “Whistleblowing” section.
Specific training and information activities regarding this procedure are provided to all employees and collaborators.
2. Subject of the Report
Given the broad range of situations that can be reported, publicly disclosed, or denounced, the legislator has specified the types of wrongdoing that can be reported, disclosed, or denounced, detailing what qualifies as a whistleblowing report.
Specifically, a whistleblowing report may concern:
- Information regarding violations of National and European Union Regulations;
- Actions or omissions, whether committed or attempted, that constitute criminal offenses (including predicate offenses for the application of Legislative Decree 231/2001);
- Activities or omissions carried out in violation of Codes of Conduct or other internal company provisions that may also be subject to disciplinary action;
- Conduct likely to cause financial harm to the company/private entity;
- Conduct likely to cause harm to the health or safety of employees of the company/private entity;
- Conduct likely to cause harm to the health or safety of citizens or to cause environmental damage;
- Actions or omissions that could cause harm to users or employees or other individuals who carry out their activities at the company/private entity.
It should be noted that whistleblowing does not concern personal grievances of the whistleblower or claims/requests related to employment relationships or relationships with direct superiors or colleagues, for which reference should be made to the regulations and procedures of the Human Resources Area/Department.
Reports of violations are also excluded if they are already mandatorily regulated by European Union or National acts specified in Part II of the annex to the decree, or by national acts implementing European Union acts specified in Part II of the annex to Directive (EU) 2019/1937. Furthermore, reports of violations concerning national security, as well as procurement related to defense or national security aspects, are excluded, unless such aspects fall within relevant derived European Union law.
3. Scope of Application
This document has been adopted by CloudFire srl, as it falls within the scope of entities that, pursuant to Legislative Decree no. 231 of June 8, 2001, adopt the organization and management models provided therein, even if, in the last year, they have not reached an average of 50 employees.
4. Regulatory References
- European Directive no. 2019/1937;
- Law no. 179 of November 30, 2017;
- Legislative Decree 231 of June 8, 2001, as amended;
- Legislative Decree no. 24 of March 10, 2023;
- EU Regulation 2016/679 (GDPR);
- Legislative Decree 196/2003, as amended;
- Confindustria Operational Guide of October 27, 2023;
- ANAC Guidelines of 26/11/2025 adopted with resolution no. 478.
5. Definitions
A whistleblower is a person who reports violations of national or European Union regulatory provisions that harm the public interest or the integrity of the private entity, of which they became aware in a public or private work context.
The whistleblower can report unlawful acts, fraud, or misconduct within an organization, whether public or private, with the aim of preventing or stopping behavior harmful to the company, employees, or the community.
Report means: the written or oral communication of information about violations.
Internal report means: the written or oral communication of information about violations, submitted through the internal reporting channel identified by CloudFire srl
External report means: the written or oral communication of information about violations, submitted through the external reporting channel, i.e., via the Anac platform.
Anac means: the National Anti-Corruption Authority.
Public disclosure means: making information about violations public through the press or electronic means, or in any case through dissemination channels capable of reaching a large number of people;
For Whistleblower: the individual who makes a report or public disclosure of information about violations acquired within the work context;
"OdV" means: the Supervisory Body appointed pursuant to Legislative Decree no. 231/2001.
"Whistleblowing Report Manager-Receiver" means: the entity that manages the internal reporting channel, recipient of the report, identified by the Data Controller as the person competent to handle it.
"Facilitator" means: an individual who assists a reporting person in the reporting process, operating within the same work context, and whose identity must be kept confidential;
"Work Context" means: the set of current or past work or professional activities carried out within the scope of legal relationships with the company, regardless of their nature or qualification. In this context, an individual may acquire information relating to violations and, as a result of reporting, public disclosure, or denunciation to the judicial or accounting authority, could be exposed to the risk of retaliation;
"Involved Person" means: the natural or legal person mentioned in the internal or external report or in the public disclosure as the person to whom the violation is attributed or as a person otherwise involved in the violation reported or publicly disclosed;
"Retaliation" means: any conduct, act, or omission, even if only attempted or threatened, carried out in response to a report, a complaint to the judicial or accounting authority, or public disclosure, and which causes or may cause, directly or indirectly, unjust harm to the reporting person or the person who made the complaint;
Investigation means: the action taken by the entity responsible for managing the reporting channel to assess the existence of the reported facts, the outcome of the investigations, and any measures adopted;
Anonymous reports mean: reports lacking elements that allow the identification of the reporting person.
Feedback means: the communication from the recipient/manager of the report to the reporting person of information regarding the follow-up action taken or intended to be taken on the report.
6. Content of Reports
6.1 Who can report
CloudFire srl has implemented an internal reporting system as required by Legislative Decree 24/2023.
Reports can be made by individuals who work in, or for CloudFire srl, as:
- employees;
- self-employed individuals;
- collaborators, freelancers, consultants;
- volunteers, paid and unpaid interns;
- individuals holding administrative, managerial, control, oversight, or corporate representation roles (e.g., Board members, members of the Board of Statutory Auditors, Auditors, Supervisory Body, etc.).
6.2 When to report
Reports can be made:
- while the legal-contractual relationship is ongoing;
- when the legal-contractual relationship has not yet commenced, if information about violations was acquired, e.g., during the selection process or other pre-contractual stages;
- after the legal-contractual relationship has ended, if information about violations was acquired before the relationship's termination.
6.3 What can be reported
Behaviors, acts, or omissions that harm the public interest or the integrity of the private entity can be reported. These include:
- Violation of national regulatory provisions
- administrative, accounting, civil, or criminal offenses;
- unlawful conduct relevant under Legislative Decree No. 231 of June 8, 2001 [SITO UFFICIALE] - Reati Presupposto 231 - Agg. Febbraio 2026, or violations of the organization and management models provided therein;
- unlawful conduct because it conflicts with what is stipulated by: Codes of Conduct, codes of conduct, or other internal company provisions.
- Violations of European regulatory provisions
- offenses falling within the scope of European Union acts relating to the following sectors: public procurement; financial services, products and markets, and prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiological protection and nuclear safety; food and feed safety, and animal health and welfare; public health; consumer protection; protection of privacy and personal data, and security of network and information systems;
- acts or omissions harming the financial interests of the Union;
- acts or omissions concerning the internal market (for example: violations regarding competition and state aid);
- acts or conduct that defeat the object or purpose of the provisions of Union acts
6.4 Subject of Reports
- Information relating to conduct aimed at concealing the aforementioned violations;
- Unlawful activities not yet committed but which the whistleblower reasonably believes may occur based on specific and consistent concrete evidence;
- Well-founded suspicions.
The reported violations must affect the entity's interests.
Whistleblowing reports cannot concern disputes, claims, or requests related to the personal interest of the reporting person that exclusively pertain to their individual employment relationships.
All reports falling outside the scope of the Whistleblowing regulations will be forwarded by the Report Receiver/Manager to the relevant internal departments of CloudFire srl, and the reporting person will be notified of this transfer via messaging on the platform or by other means, depending on the information provided by the reporting person; it is specified that in these cases, reporting persons will not be entitled to the protections provided by the Whistleblowing regulations.
6.5 Who receives and manages whistleblowing reports
CloudFire srl has designated the ODV (Supervisory Body), specifically Attorney Carmen Pisanello of the Reggio Emilia Bar, with an office in Reggio Emilia, Viale Timavo no. 16, as the receiver and manager of whistleblowing reports.
6.6 Report Content
The whistleblower must provide all useful information to allow for the necessary and appropriate checks and investigations to verify the factual basis of the reported events.
To this end, the report should preferably contain the following elements:
- Personal details of the reporting person, including a statement of their role and function (unless the report is made anonymously);
- A clear and complete description of the reported events;
- The time and place circumstances in which the events occurred (if known);
- The personal details or other elements (roles, qualifications) that allow identification of the individual who committed the reported acts (if known);
- Indication of any other individuals who can provide information about the reported facts;
- Indication of any documents that can confirm the occurrence of the reported facts;
- Any other information that can confirm the truthfulness and existence of the reported facts.
Anonymous reports, meaning those lacking elements that allow identification of their author, will only be considered if they are adequately detailed and provided with a wealth of particulars. This means they must bring to light facts and situations by relating them to specific contexts (e.g., indications of specific names or qualifications, mention of specific roles or duties, particular procedures or events, etc.). Please note that if the report is submitted via the web platform, the anonymous whistleblower (who does not intend to reveal their identity) will receive a unique code allowing them to re-access the platform to check the progress of their report. Even in the case of an anonymous report, the recipient-manager of the report can communicate with the whistleblower, request information, and additional documentation to support the truthfulness of the report. They can also communicate and provide feedback to the whistleblower on the outcome of the investigation within the timeframes stipulated by regulations. Within the "comments" section, the whistleblower, even if anonymous, can supplement their report and interact with the Supervisory Body (OdV). In the same "comments" section, the OdV can notify the whistleblower, even if anonymous, of any updates regarding the investigation, management, and conclusion of the submitted report.
Please note that the unique code is known exclusively by the whistleblower; therefore, if it is lost, it will no longer be possible to access the report submitted via the whistleblowing platform.
6.7 How to report
The following reporting methods can be used:
- Internal reporting channel: written and oral;
- External channel (managed by ANAC);
- Public disclosure;
- Report to the public authority.
The choice of reporting channel is not at the discretion of the whistleblower, as the internal channel must be used as a priority. Only when one of the conditions outlined in point b) of this paragraph is met is it possible to make a report through the external channel.
- Internal Channel
The internal reporting channel identified by CloudFire srl is designed to ensure the confidentiality of the identity of the whistleblower and involved parties (reported party, facilitator, any other third parties), the content of the report, and related documentation; the internal channel is both WRITTEN and ORAL:
- written form using IT methods; the whistleblower can submit a report through the Globaleaks web platform by connecting to the link https://whistleblowing.cloudfire.it and completing the relevant form; the whistleblower can access the aforementioned link, also via Tor Onion Service to maximize their anonymity; once the report is submitted, the whistleblower will receive a unique code with which they can re-access the platform and check the status of their report. It is specified that it is the whistleblower's responsibility to save the CODE/KEY CODE and keep it carefully to prevent it from being lost (in which case it will no longer be possible to access their report and follow its status/progress) and to prevent unauthorized third parties from obtaining it;
- oral form, via a dedicated telephone line (number 05221753480) using a voicemail system (dedicated voice messaging) answered solely and exclusively by the recipient/report manager; it is specified that this channel allows the whistleblower to record the report directly in voicemail, with subsequent automatic forwarding of the message to the authorized recipient.
The whistleblower can request a direct meeting with the report manager, either through the digital written report or the oral form, and the manager must arrange the appointment within a reasonable timeframe.
In the event of a direct meeting, the recipient-report manager, with the whistleblower's prior consent, can record the conversation with the whistleblower on a suitable medium for recording and storage, or transcribe the content of the conversation into a specific report, again with the whistleblower's prior consent; this report must be signed by the whistleblower for confirmation.
It is specified that the recipient-report manager, as an independent Data Controller for personal data processing, adopts adequate technical, organizational, and operational measures for personal data protection.
- External Channel (Managed by ANAC)
The competent Authority for external reports, including those from the private sector, is ANAC. It is only possible to report to the Authority if one of the following conditions applies:
- the activation of an internal reporting channel is not provided for within the work context, or it is not active or not compliant with the regulations;
- the reporting person has already made an internal report and it has not been followed up;
- the reporting person has reasonable grounds to believe that if they were to make an internal report, it would not be effectively followed up, or that the report itself could lead to a risk of retaliation;
- The reporting person has reasonable grounds to believe that the violation may pose an imminent or obvious danger to the public interest.
- Public Disclosure
Publicly disclosing means making information about violations public through the press, electronic media, or any other means of dissemination capable of reaching a large number of people.
The reporting person who makes a public disclosure benefits from the protection provided by this procedure and current legislation (Legislative Decree 24/2023) if, at the time of the public disclosure, one of the following conditions applies:
- the reporting person has previously made an internal and external report, or has directly made an external report, and no feedback has been provided within the established deadlines regarding the measures planned or adopted to follow up on the reports;
- the reporting person has reasonable grounds to believe that the violation may pose an imminent or obvious danger to the public interest;
- the reporting person has reasonable grounds to believe that the external report may entail a risk of retaliation or may not be effectively followed up due to the specific circumstances of the case, such as when evidence might be concealed or destroyed, or when there is a well-founded fear that the recipient of the report may be colluding with the perpetrator of the violation or involved in the violation itself.
- Formal Complaint
The reporting person proceeds directly to file a formal complaint with the competent judicial or accounting authority, as per current legislation, should they deem it necessary or urgent.
7. Verification of the validity of the report submitted in writing by the reporting person, through the Globalwaks digital platform
The Report Manager, identified by CloudFire srl as the ODV, will notify the Reporting Person, via the platform, within 7 days of receipt, that the report has been taken into consideration. The verification of the validity of the circumstances presented in the report is always entrusted to the recipient/manager of the reports. If the ODV deems the report unfounded, it will proceed to archive it, always through the digital platform, providing feedback to the reporting person and specifying the reasons for archiving. By way of example and not exhaustive, a report will be considered unfounded and thus archived if it: concerns mere suppositions and/or suspicions and/or rumors, and/or opinions of the reporting person; relates to facts that do not fall within the scope of Legislative Decree 24/2023; the content of the report is not precise, detailed, and verifiable; the identity or other elements allowing identification of the reported party are not clear. In confirmed cases of inadmissibility, the Manager will still be required to justify the archiving of the report and communicate it not only to the reporting person, via messaging on the platform or other means based on the information provided by the reporting person, but also to the Board of Directors. If, on the other hand, the ODV deems the report to be founded, it must identify the type of potential violation committed and assess whether to inform and convene the relevant company representatives (e.g., Human Resources, Administration and Finance, Legal, etc.), after evaluating the absence of potential conflicts of interest, for further investigation. Subsequently, the Report Manager, together with the relevant company representative(s), must conduct a preliminary verification to assess the objective and subjective elements characterizing the report, initiating first-level inquiries and checks.
The Case Manager will subsequently report the outcomes of this preliminary verification (e.g., whether an investigation can proceed, request for further information, etc.) within the Platform; the investigation by the case manager must be concluded within three months from the date the acknowledgment of receipt of the report was sent. If, for any reason, the investigation of the report cannot be completed within the aforementioned deadline, the Case Manager must still send an interim communication to the whistleblower within the already mentioned three-month period, via messaging on the platform or by other means based on the information provided by the whistleblower, informing them of the need to continue the necessary verifications.
The Case Manager may, where possible, invite the whistleblower for a direct discussion to assess the truthfulness and validity of the reported information, as well as to conduct the necessary checks and in-depth investigations, potentially even visiting the location concerned to reconstruct the facts and also request any further documentation and clarification from the relevant structures and/or individuals. Once the facts have been reconstructed and the initial investigation concluded, the ODV formalizes the activities and assessments carried out and communicates the results of the investigation to the CDA. Semi-annually, the ODV must submit to the Board of Directors a summary report of the reports handled (archived, under investigation, concluded), including the adoption (or non-adoption) of consequent measures.
Within the semi-annual report, the ODV provides the Board of Directors with essential information to assess the possible existence of violations of the Organizational Model under Legislative Decree 231/2001.
8. Verification of reports submitted orally by the whistleblower
The whistleblower may also submit a report orally by contacting the whistleblowing report recipient/manager at the following number 05221753480, through which a voicemail system (dedicated voice messaging) is active.
The system does not provide for responses from operators: the whistleblower does not come into contact with any physical person, but can only record a voice message.
The recorded message is acquired by the voicemail system and automatically transmitted only to the whistleblowing report recipient/manager, identified as the ODV, Lawyer Carmen Pisanello.
The report recipient/manager uses the content of the voice recording for any investigative activities and may assess further investigations based on the information received.
If the whistleblower does not intend to reveal their identity or provide personal contact details, or chooses not to make them available later, the ODV will not be able to provide any feedback on the outcome of the investigative activity carried out, while still managing the report within the limits provided by current legislation.
9. Whistleblower Protection
Whistleblowing regulations protect the good faith of the reporting person at the time of reporting. The law stipulates that the reporting person will benefit from the protections provided by law only if, at the time of reporting, they had reasonable grounds to believe that the information about the reported violations, publicly disclosed or reported, was true.
Confidentiality Protection
The identity of the reporting person cannot be revealed to anyone other than those competent to receive or follow up on reports.
The prohibition against revealing the whistleblower's identity refers not only to the reporter's name but also to all elements of the report from which the reporter's identification can be derived, even indirectly.
The identity of individuals involved and those mentioned in the report is also protected until the conclusion of proceedings initiated due to the report, in compliance with the same guarantees provided for the reporting person.
In criminal proceedings, the identity of the reporting person is covered by secrecy in the manner and within the limits provided by Article 329 of the Code of Criminal Procedure. In proceedings before the Court of Auditors, the identity of the reporting person cannot be revealed until the closure of the preliminary investigation phase. In disciplinary proceedings, the identity of the reporting person cannot be revealed if the disciplinary charge is based on distinct and further investigations compared to the report, even if consequent to it. If the charge is based, in whole or in part, on the report and knowledge of the reporting person's identity is essential for the defense of the accused, the report will be usable for disciplinary proceedings only with the express consent of the reporting person to the disclosure of their identity. The reporting person is notified in writing of the reasons for the disclosure of confidential data, in the hypothesis referred to in paragraph 5, second sentence, of Article 12 of Legislative Decree 24/2023, as well as in internal and external reporting procedures, when the disclosure of the reporting person's identity and information from which such identity can be directly or indirectly inferred is essential for the defense of the involved person (reported party).
Violation of the reporting person's confidentiality obligations entails a breach of the Organizational and Management Model, as well as the imposition of related administrative sanctions by ANAC.
Protection from Retaliation
Any form of retaliation, even attempted or threatened, is prohibited.
Generally, retaliation is defined as: "any behavior, act, or omission, even if only attempted or threatened, carried out because of a report, a complaint to the judicial or accounting authorities, or public disclosure, and which directly or indirectly causes or may cause unjust harm to the reporting person or the person who filed the complaint."
Specifically, retaliation may include:
- dismissal, suspension, or equivalent measures;
- demotion or failure to promote;
- change of duties, change of workplace, salary reduction, modification of working hours;
- suspension of training or any restriction of access to it;
- negative performance reviews or negative references;
- the imposition of disciplinary measures or other sanctions, including financial penalties;
- coercion, intimidation, harassment, or ostracism;
- discrimination or otherwise unfavorable treatment;
- the failure to convert a fixed-term employment contract into an indefinite-term employment contract, where the employee had a legitimate expectation of such conversion;
- the non-renewal or early termination of a fixed-term employment contract;
- damage, including to the person's reputation, particularly on social media, or economic or financial prejudice, including loss of economic opportunities and loss of income;
- inclusion in improper lists based on a formal or informal sectoral or industrial agreement, which may prevent the person from finding employment in the sector or industry in the future;
- the early termination or cancellation of a contract for the supply of goods or services;
- the cancellation of a license or permit;
- the requirement to undergo psychiatric or medical examinations.
Entities and individuals can report to ANAC any retaliation they believe they have suffered. ANAC publishes the reporting procedures on its institutional website.
Protection measures also apply to:
- the facilitator (a natural person who assists the whistleblower in the reporting process, operating within the same work context, and whose assistance must remain confidential);
- individuals in the same work context as the whistleblower, the person who filed a complaint, or the person who made a public disclosure, and who are linked to them by a stable emotional or family relationship up to the fourth degree;
- colleagues of the whistleblower or the person who filed a complaint or made a public disclosure, who work in the same work context and have a regular and ongoing relationship with that person;
- entities owned by the whistleblower or for which these individuals work, as well as entities operating in the same work context as the aforementioned individuals.
10. Whistleblower Responsibility
This procedure does not alter the criminal liability of the whistleblower in the case of slanderous or defamatory reports. Whistleblower protection does not apply in cases of criminal liability (slander or defamation) or civil liability (unjust harm caused by willful misconduct or negligence).
When the criminal liability of the whistleblower for defamation or slander, or for the same offenses committed through a report to the judicial or accounting authorities, or their civil liability for the same reason in cases of willful misconduct or gross negligence, is ascertained, even by a first-instance judgment, the protections under Legislative Decree No. 24/2023 are not guaranteed, and the whistleblower or reporting person will be subject to disciplinary action where possible.
11. Document Retention
Internal reports and related documentation are retained for the time necessary to process the report and, in any case, for no longer than five years from the date of communication of the final outcome of the reporting procedure, in compliance with the confidentiality obligations prescribed by law.
The 5-year period may be extended if legal proceedings or actions are still pending.
The platform, used as an internal reporting channel, guarantees the confidentiality of the whistleblower's data and the content of the report (and related documentation submitted) through encryption protocols and tools.
As for paper documentation related to the report, it will be collected, used, stored, and archived in compliance with current privacy regulations. Personal data processed in the context of managing reports must be protected with adequate technical and organizational security measures according to the associated risk level. Therefore, suitable technical and organizational measures are implemented to ensure a level of security appropriate to the risk of personal data processing. In this regard, also in relation to the knowledge acquired based on technical and technological progress, the nature of the personal data processed, and the characteristics of the processing operations, particular consideration must be given to the risks arising from the destruction, loss, alteration, unauthorized disclosure, or unauthorized access, even accidental, to personal data.
The archiving and storage of all documentation related to the report, in both electronic and paper format, is the responsibility of the Supervisory Body (OdV), which for privacy purposes is qualified as an independent Data Controller, as well as CloudFire srl and the web platform provider, who is considered an external data processor for whistleblowing, in addition to any sub-suppliers.
Furthermore, personal data not clearly useful for processing a specific report must not be collected or, if collected, must be promptly deleted.
12. Support Measures
ANAC maintains a list of Third Sector entities that provide whistleblowers with free support measures, including information, assistance, and advice on reporting procedures, protection against retaliation, the rights of individuals involved in the report, and the methods and conditions for accessing state-funded legal aid.
13. Processing of Personal Data
All processing of personal data is carried out in accordance with Regulation (EU) 2016/679 (GDPR), Legislative Decree no. 196 of June 30, 2003, as amended, and Legislative Decree no. 51 of May 18, 2018.
“The processing of personal data related to the receipt and management of reports is carried out by the entities referred to in Article 4, as data controllers, in compliance with the principles set out in Articles 5 and 25 of Regulation (EU) 2016/679 or Articles 3 and 16 of Legislative Decree no. 51 of 2018, by providing appropriate information to whistleblowers and involved individuals pursuant to Articles 13 and 14 of the same Regulation (EU) 2016/679 or Article 11 of the aforementioned Legislative Decree no. 51 of 2018, and by adopting appropriate measures to protect the rights and freedoms of data subjects.”
