Information Notice on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 679/2016 (“GDPR”)

This Information Notice on the processing of personal data is provided, pursuant to and for the purposes of Articles 13 and 14 of the GDPR, to all persons who report incidents of which they have become aware or to which they have witnessed, in the context of their relationship with Siryo S.p.A., as well as to other persons involved in any way in the report. The Information Notice therefore applies whenever a report is made using one of the methods indicated in the Whistleblowing Procedure adopted by the Data Controller and updated from time to time.

1. Data Controller

The data controller is Siryo S.p.A., VAT number 08335170729, with registered office in Piazza Massari n. 19 – 70122 Bari, e-mail: info@siryo.it (hereinafter also referred to as the ‘Data Controller‘).

2. Categories of personal data and collection thereof

In the context of receiving and evaluating reports, the Data Controller may process the following data:

1. Common personal data of the reporting parties and, where applicable, of the reported parties (for example, name, surname, contact information);
2. Personal data contained in reports (including, where applicable, data belonging to special categories pursuant to Article 9 of the GDPR and personal data relating to criminal convictions and offences pursuant to Article 10 of the GDPR).
3. Personal data of the persons reported and any third parties involved.

As explained in the Whistleblowing Procedure, whistleblowers may also submit reports anonymously (through the platform identified by the Data Controller and the methods made available by the latter to ensure anonymity): in this case, only the data provided in the report itself will be processed.

3. Origin of the data

The data subject to processing is collected by the Data Controller through the report and through any subsequent contacts between the whistleblower and the Data Controller, or may be collected by the Data Controller itself from third parties – internal or external – from public databases, other freely accessible sources, online and offline, and in general from any other source to enable the Data Controller to carry out the necessary checks for the management of the report, in accordance with the Whistleblowing Procedure adopted by the Data Controller.

4. Purpose and legal basis of the processing
   Purpose 1: to implement the Whistleblowing Procedure and, therefore, to carry out the necessary preliminary investigations to verify the validity of the reported fact and to take the appropriate measures. Furthermore, the adoption of an internal IT reporting channel is an obligation for the Data Controller pursuant to Legislative Decree no. 24 of 10 March 2023, which transposes and implements Directive (EU) 2019/1937 in Italy. Legal basis for processing: processing is necessary for compliance with legal obligations. Data retention period: for the time necessary to process the report. In any case, the data is retained for the time necessary to process the reports and in any case for no longer than 5 years from the date of communication of the final outcome of the reporting procedure in compliance with the confidentiality obligations set out in Article 12 of Legislative Decree No. 24/23. Data collected that is manifestly unnecessary or excessive for the processing of the report will be immediately deleted by the Data Controller.
   Purpose 2: legal protection purposes, to prevent or prosecute offences. Legal basis for processing: the legitimate interest of the Data Controller in protecting its rights and preventing offences. Data retention period: without prejudice to the above, in the event of legal proceedings, the data may be processed for defensive purposes until the judgment becomes final/the proceedings are terminated. Any data collected that is clearly unnecessary or excessive for the processing of the report will be immediately deleted by the Data Controller.

5. Obligation to provide data and consequences of refusal

The provision of the whistleblower’s data is optional, as reports can be sent completely anonymously. However, the provision of the data contained in the report is necessary in order for the report to be received, verified and processed.

6. Communication of personal data

For one or more of the above purposes, we may share data with the following recipients:

• service providers
• Judicial authorities or administrative bodies.

With the exception of judicial authorities and administrative bodies, all of the above recipients process data under a specific agreement on the processing of personal data pursuant to Article 28 of the GDPR, in their capacity as data processors. You can obtain an up-to-date list of data processors at any time by contacting the Data Protection Officer at the address below.

7. Transfer of personal data to a third country

The data will be processed and stored at the offices of the Data Controller, at the systems of the latter’s suppliers, who operate as data processors in accordance with agreements compliant with Article 28 of the GDPR, in Italy and within the European Union.

Rights of the data subject

We inform you that, as a data subject, pursuant to Articles 15 to 22 of the GDPR, you have the right to:

1. Request the access, the rectification, the erasure and the restriction of the data concerning you;
2. object to the processing of your data;
3. obtain data portability, i.e. to receive the data from the Data Controller in a structured, commonly used and machine-readable format and to transmit it without hindrance to another data controller, including through direct transmission of the data, if technically feasible;
4. withdraw consent to the processing of data, if this constitutes the legal basis for the processing. In this case, the processing of data carried out prior to the withdrawal remains lawful;
5. lodge a complaint with the competent supervisory authority;
6. request information regarding: the purposes of the processing; the categories of data; the recipients or categories of recipients to whom the data have been or will be disclosed, in particular if the data are transferred to recipients in third countries or international organisations; the period for which the data will be stored; if the data are not collected from the data subject, all available information on their origin.

You may exercise the above rights by contacting the Data Controller at the addresses indicated above.

The exercise of these rights may be subject to limitations in the cases provided for in Article 2-undecies of Legislative Decree 196/2003, as last amended by Legislative Decree 24/2023.

We also inform you that, as a data subject, you have the right to lodge a complaint pursuant to Article 77 of the GDPR with the Data Protection Authority, as the supervisory authority.

Version updated on 31/07/2025