Organization, Management and Control Model

Directors
Members of the Board of Directors of Selecta S.p.A.

Activities at Risk of Offense or Sensitive Activities
These refer to processes, operations, or acts, or sets of operations and acts, during which, in relation to the types of Predicate Offenses, it is theoretically possible for individuals acting on behalf of the Company to commit an offense falling under those categories.

Areas at Risk of Offense
Functions, offices, and/or departments within which the Predicate Offenses may theoretically be committed.

CCNL (National Collective Labor Agreements)
National Collective Labor Agreements (CCNL) applied by Selecta S.p.A.

Decree or Legislative Decree 231/01 or Decree 231/01
Refers to Legislative Decree No. 231 of 8 June 2001 and subsequent amendments and additions.

Collaborators
Refers to any individual engaged in collaboration agreements, including those with authority but without a subordinate relationship, agency, representation, and/or other non-subordinate professional relationships.

Consultants
Individuals acting in the name and/or on behalf of Selecta S.p.A. by virtue of a mandate contract or other contractual relationship of professional collaboration.

Recipients
These are the subjects required to comply with the provisions of this Model pursuant to the Decree, including, but not limited to, the Corporate Bodies, Directors, Employees, Consultants, agents, as well as those operating under a mandate from the Company, and all those who, directly or indirectly, permanently or temporarily, establish, in any capacity, even de facto, contractual or collaborative relationships, acting in the interest of the Company itself.

Employees
All individuals engaged in a subordinate or semi-subordinate employment relationship with Selecta S.p.A., including managers.

Entity
Term used by Legislative Decree No. 231/2001 to indicate the legal entity responsible under the provisions of the Decree.

Suppliers
Suppliers of goods and services to Selecta S.p.A. who do not fall under the definition of Partners.

Appointee of a Public Service
An individual who “in any capacity provides a public service,” meaning an activity governed by the same forms as a public function but characterized by the absence of the typical powers of the latter (Article 358 of the Penal Code).

Guidelines
Refers to the “Guidelines for the construction of Organization, Management, and Control Models pursuant to Legislative Decree 231/2001,” approved by Confindustria on March 7, 2002, and updated in June 2021.

Model, Organizational Model, or MOGC
Organization, Management, and Control Model referred to in this document. The Model consists of the General Section, the Special Sections, and the Annexes.

Corporate Bodies
The Board of Directors of Selecta S.p.A., the Shareholders’ Meeting, as well as the Board of Statutory Auditors.

Supervisory Body or OdV
Refers to the single-member Supervisory Body responsible for monitoring the functioning and compliance with the Model, as provided for in Article 6 of Legislative Decree 231/01.

Partner
Contractual counterparty (including clients) with whom Selecta S.p.A. has established a contractually regulated relationship, intended to cooperate with Selecta S.p.A. within the scope of the Risk Activities.

General Section
The section of the Model containing, among other things, the description of the functions of the Model and the Supervisory Body, as well as a description of the organization and structure of Selecta S.p.A.

Special Section or Special Sections
The sections of the Model expressly dedicated to each Process identified as relevant to the activities of Selecta S.p.A., which describe the specifics of the Offenses, the Areas and Activities at Risk of Offense, and the main features of the control and prevention system for them.

Personnel
All individuals who have an employment relationship with the Company, including employees, temporary workers, project collaborators, interns, and freelance professionals who have received an assignment from the Company.

Public Administration or P.A.
Refers to the set of public entities and bodies (State, Ministries, Regions, Provinces, Municipalities, etc.), and sometimes public law organizations, concessionaires, contracting authorities, mixed joint-stock companies, etc., as well as all other figures that in some way perform a public function in the interest of the community and thus in the public interest.

Public Official
An individual who “exercises a legislative, judicial, or administrative public function” (Article 357 of the Penal Code).

Predicate Offenses or Offenses
The types of offenses relevant under Legislative Decree 231/01.

Company or Selecta
Selecta S.p.A., Registered Office Via del Sapere, 1 Occhiobello (RO) Tax Code: 00867840290 – REA RO – 1000600

Top Management or Senior Management
The subjects referred to in Article 5, paragraph 1, letter a) of the Decree, namely, those who hold representation, administrative, or management functions of the Company or of one of its organizational units with functional and financial autonomy; in particular, members of the Board of Directors, the President, the CEO, and the General Manager.

Individuals subject to the direction of others
These are individuals subject to the direction and supervision of Top Management, as identified in Article 5, paragraph 1, letter b) of Legislative Decree 231/2001.

Consolidated Safety Act (TUS)
Consolidated Safety Act, referred to in Legislative Decree No. 81 of April 9, 2008, and subsequent amendments and additions.

Scope of Application and Nature of Liability of Entities

Legislative Decree No. 231 of 8 June 2001 (hereinafter referred to, for brevity, as the “Decree”) introduced for the first time into our legal system the possibility for companies and entities to be directly held accountable for crimes committed in their interest or to their advantage by executives, employees, and all those who act in the name and on behalf of the company.
The range of entities affected includes both those with legal personality (partnerships and corporations) and companies and associations without legal personality. Excluded from the scope of entities affected by the regulation are the State, territorial public entities, other non-economic public entities, and entities performing functions of constitutional significance.
Article 27 of the Constitution – which establishes the personal nature of criminal liability and the rehabilitative purpose of punishment – would exclude companies from being considered liable entities, as they are not physical persons and therefore lack the capacity for self-determination necessary to form and execute a criminal intent characterized at least by negligence.
The legislator addressed this obstacle by introducing administrative liability for companies, which is independent of the criminal liability of the individual who acted in the name and interest of the company, thereby defining a dualistic liability based on the following concepts:
– liability of the company in cases of its own acts of omission;
– liability of the company for negligence, understood as “organizational fault and/or corporate policy fault”;
– absence of negligence if the company has implemented an organizational and management system suitable to prevent the commission of crimes.
The company may therefore be exempted from liability only by adopting an appropriate Model capable, through a set of rules and procedures, of preventing the commission of the crimes provided for in the Decree. The liability of companies and entities results in their subjection to severe monetary and prohibitory sanctions. However, it is necessary to make certain distinctions:
– the penalties provided for apply only in specific cases and to well-defined categories of offenses;
– no entity may be held liable for offenses committed by individuals acting in the company’s interest prior to the entry into force of the Decree or in cases of offenses not expressly provided for by the legislator;
– the liability borne by the entity is not criminal but administrative. It is an extra-criminal administrative and autonomous liability, therefore not jointly liable with the perpetrator of the offense;
– the liability of the company arises from the connection between the agent and the entity and from the direct benefit derived by the entity from the commission of the offense;
– the liability of the company exists even if the perpetrator cannot be identified: it is sufficient that the act originates from the company and was carried out by individuals with directive powers or by individuals under their supervision;
– the liability of the company does not exist if the perpetrator is not included among the individuals authorized to act in the name and on behalf of the company;
– only the company is liable for the payment of the sanction with its own assets, even in cases where the offense is extinguished for reasons other than amnesty or the perpetrator cannot be identified.

Categories of Offenses and Unlawful Acts

The liability of the company arises only for offenses specifically listed in the Decree, its subsequent amendments, and the laws that explicitly reference the provisions of the Decree (so-called “Predicate Offenses”).

The following are the categories of offenses from which the administrative liability of the company may arise (refer to Annex D for the catalog of Predicate Offenses):

a) unlawful receipt of funds, fraud against the State, a public entity, or the European Union, or for obtaining public funds, computer fraud against the State or a public entity, and fraud in public procurement (Art. 24 of the Decree);

b) computer crimes and unlawful processing of data (Art. 24-bis of the Decree);

c) organized crime offenses (Art. 24-ter of the Decree);

d) embezzlement, extortion, undue inducement to give or promise benefits, corruption, and abuse of office (Art. 25 of the Decree);

e) counterfeiting of currency, public credit notes, revenue stamps, and instruments or identification marks (Art. 25-bis of the Decree);

f) offenses against industry and commerce (Art. 25-bis.1 of the Decree);

g) corporate crimes (Art. 25-ter of the Decree);

h) crimes for purposes of terrorism or subversion of the democratic order (Art. 25-quater of the Decree);

i) practices of female genital mutilation (Art. 25-quater.1 of the Decree);

j) crimes against individual personality (Art. 25-quinquies of the Decree);

k) market abuse (Art. 25-sexies of the Decree);

l) manslaughter or serious or very serious injuries committed in violation of health and safety regulations in the workplace (Art. 25-septies of the Decree);

m) receiving stolen goods, money laundering, and the use of money, goods, or benefits of illicit origin, as well as self-laundering (Art. 25-octies of the Decree);

n) offenses related to non-cash payment instruments and fraudulent transfer of values (Art. 25-octies.1 of the Decree);

o) offenses related to copyright infringement (Art. 25-novies of the Decree);

p) inducement not to make statements or to make false statements to the judicial authority (Art. 25-decies of the Decree);

q) environmental crimes (Art. 25-undecies of the Decree);

r) employment of third-country nationals whose residence status is irregular (Art. 25-duodecies of the Decree);

s) racism and xenophobia (Art. 25-terdecies of the Decree);

t) fraud in sports competitions and unlawful exercise of gaming or betting and gambling conducted through prohibited devices (Art. 25-quaterdecies of the Decree);

u) tax crimes (Art. 25-quinquiesdecies of the Decree);

v) smuggling (Art. 25-sexiesdecies of the Decree);

w) crimes against cultural heritage (Art. 25-septiesdecies of the Decree);

x) laundering of cultural assets and devastation and looting of cultural and landscape assets (Art. 25-duodevicies of the Decree);

It should also be noted that Article 10 of Law No. 146 of March 16, 2006 (Ratification and implementation of the United Nations Convention and Protocols against Transnational Organized Crime, adopted by the General Assembly on November 15, 2000, and May 31, 2001) has provided for the liability of collective entities for a series of offenses if their transnational nature is recognized.

Finally, it should be noted that, since its original approval, the Decree has undergone several amendments and modifications and is continuously evolving; consequently, the Predicate Offenses may be further expanded or modified in the future.

Criteria for Attributing Liability to the Company

In order for administrative liability of the Company for Predicate Offenses to be recognized, two requirements identified in Article 5 of the Decree must be met. It is necessary that:

i) the offense is committed by a person functionally connected to the Company (so-called “subjective requirement”), namely by:

• • persons who perform functions of representation, administration, or management of the Company or one of its organizational units with financial and functional autonomy, as well as persons who, even de facto, exercise management and control (so-called “top management”);
  • persons under the direction or supervision of one of the aforementioned top management individuals (so-called “individuals under the direction of others”).

Top management refers to those who have autonomous authority to make decisions in the name and on behalf of the Company. For Selecta, this includes the legal representative and CEO, the Board of Directors, department heads, as well as those who “even de facto” perform management activities. In this context, the structure of the delegation system for powers and functions becomes particularly important, as referenced in Paragraph 2.3 – “The internal control system and organizational processes of Selecta”.

Individuals under the direction of others refer to employees as well as individuals not part of the Company’s staff, who have been assigned a task to be carried out under the direction and supervision of top management, such as agents, collaborators, and consultants.

ii) the offense is committed, even partially, in the interest or to the advantage of the Company (so-called “objective requirement”).

Interest exists when the perpetrator of the offense acted with the intent of benefiting the Company, regardless of whether this objective was actually achieved. Advantage exists when the Company has derived, or could have derived, a positive outcome from the offense, whether economic or otherwise.

The Company is not liable, however, if the offense was committed independently of or against its interest, or in the exclusive interest of the perpetrator or third parties.

Exemption from Liability

The existence of the requirements mentioned in the previous paragraph is a necessary but not sufficient condition for establishing the liability of the Company. The Decree states that the Company is not punishable if, before the commission of the offense:

• it has adopted and effectively implemented an “Organization and Management Model” (hereinafter referred to as the “Model”), capable of preventing the commission of Predicate Offenses of the type that has been committed;
• it has entrusted a body with autonomous powers of initiative and control (so-called “Supervisory Body”) with the task of monitoring the functioning and compliance with the Model and ensuring its updating;
• the Supervisory Body has been diligent in performing its control duties over the Model.

The Model thus serves as grounds for the non-punishability of the Company in the event of the commission of a Predicate Offense – provided the subjective and objective requirements outlined above are met – whether committed by a top management individual or a subordinate, with the following distinctions:

• for offenses committed by a top management individual, the Company must demonstrate that the offense was committed by “fraudulently circumventing” the Model. The Company must therefore prove that the Model was effective and that the top management individual intentionally violated it by circumventing it;
• for offenses committed by subordinates, however, the Company may only be sanctioned if it is established that the commission of the offense was made possible “by a failure to comply with management or supervisory obligations.” The failure to comply with management or supervisory obligations does not apply if the Company, prior to the commission of the offense, adopted and effectively implemented a Model capable of preventing offenses of the type that occurred.

It is worth noting that the preparation of the Models and the establishment of the supervisory body are not mandatory, but constitute a necessary precaution to allow the Company to benefit from exemptions from liability.

In any case, the organizational models established by Legislative Decree 231/2001 are tools not only suited to avoiding the heavy sanctions provided by law against companies but also to improving organizational, administrative, and control functions within corporate governance, as well as enhancing the company’s image of efficiency, transparency, and commercial ethics in the market.

Characteristics of the Model

The Company’s liability can be attributed to the failure to adopt or comply with certain organizational standards that have been adopted. It will be the burden of the Company, if challenged by the Judicial Authority, to prove that it adopted and implemented the Model, in which case the Judicial Authority will need to prove its ineffectiveness.

The law does not provide a detailed description of the nature and characteristics of the Model but identifies some general principles and essential content. Therefore, no standard organizational model is prescribed, as in practice, each organizational structure has its own distinctive characteristics. Consequently, the organizational and management models must be adequate concerning the nature and size of the organization and the type of activities carried out, as well as suitable for ensuring compliance with the law and for identifying and promptly eliminating risk situations.

The better the decision-making processes are understood, the greater the chances of preparing models that align with the intent of the Decree. Therefore, it will be essential, during the design phase, to identify:

• within the Company’s organization, the Top Management and the individuals under their direction, as well as the activities at risk of offense and their corresponding degree of risk;
• the improvement actions;
• the situations in which such individuals might have an interest in fraudulently circumventing the models to commit offenses;
• the methods through which the fraudulent circumvention of the Model might occur;
• the identification and establishment of general and specific principles of conduct, as well as corporate procedures aimed at detailing the operational methods of performing activities in areas at risk of offense;
• the identification of the Supervisory Body, with the assignment of specific supervisory tasks regarding the effective and correct functioning of the Model, as well as the establishment of an appropriate disciplinary sanction system;

The Model indeed serves as grounds for non-punishability only if it is:

i) effective, meaning reasonably capable of preventing the offense or offenses committed. The Decree specifies, in this regard, that the Model must meet the following minimum requirements:

• the activities of the Company within which offenses may be committed must be identified;
• specific protocols and procedures must be established to make the operational methods of conducting activities in areas at risk of offense objective and traceable, as well as a procedure regarding the obligation of Information Flows to the Supervisory Body;
• the methods of managing financial resources suitable for preventing the commission of offenses must be identified;
• a disciplinary system capable of sanctioning non-compliance with the measures indicated in the Model must be introduced;
• obligations to provide information to the Supervisory Body must be established;

ii) adopted in advance by the governing body of the Company, which must assign the monitoring of the functioning and compliance of the Model, as well as the verification of its adequacy, to a body within the Company endowed with autonomous powers of initiative and control;

iii) effectively implemented, meaning that its content a) is effectively applied within the corporate procedures and internal control system. The Decree requires, in this regard, periodic verification and updating of the Model, whether significant violations of its provisions occur, organizational or operational changes in the Company take place, or legislative updates on Predicate Offenses are introduced b) the Model is made the subject of an appropriate training plan by the Company and is adequately disseminated to all Recipients.

In the event that, despite the adoption of a model with the aforementioned characteristics, fraudulent circumvention of the system and the commission of the offense occur, such facts shall be considered “reasonably unforeseeable events” by the Company. Consequently, the commission of the offense will not be sufficient to demonstrate ex post the inadequacy of the Model implemented.

The Decree further provides that organizational and management models may be adopted based on codes of conduct drafted by representative trade associations. In March 2002, Confindustria approved the first “Guidelines for the construction of organization, management, and control models pursuant to Legislative Decree 231/2001,” initially addressing only offenses against the Public Administration and subsequently expanded to include the various categories of Predicate Offenses progressively introduced into the Decree.

An essential element for the proper functioning of the Model is the establishment of a communication process toward the Supervisory Body, providing useful information to promptly understand: the effective functioning of the Model, the scope and characteristics of relevant facts/transactions concerning risk areas, and the emergence of potential risk elements regarding sensitive processes.

Sanctions

The determination of the Company’s administrative liability is closely tied to criminal law; therefore, it is up to the criminal court to ascertain liability and impose sanctions. In most cases, the proceeding for the administrative offense is joined with the criminal proceeding initiated against the material perpetrator of the offense, and, where applicable, the procedural rules governing the offenses on which the administrative violation depends are applied.

Article 9, paragraph 1, of the Decree identifies the sanctions that may be imposed on an entity found liable for committing one of the Predicate Offenses, namely:

i) monetary sanction, consisting of a sum of money quantified based on the seriousness of the offense, the degree of the Company’s responsibility, the measures taken to mitigate the consequences of the act, and the actions undertaken to prevent further offenses. In the event of a conviction of the Company, the monetary sanction is always applied, and the payment is borne solely by the Company using its assets;

ii) prohibitory sanctions, which entail an “obligation not to act” and include:

• temporary or permanent disqualification from conducting business activities;
• suspension or revocation of authorizations, licenses, or concessions that facilitated the commission of the offense;
• prohibition from entering into contracts with the public administration, except to obtain public services;
• exclusion from benefits, financing, contributions, or subsidies, and the potential revocation of those already granted;
• temporary or permanent prohibition on advertising goods or services.

Prohibitory sanctions are imposed, together with monetary sanctions, only if expressly provided for that specific category of Predicate Offense by the Decree and have a temporary duration, to be determined by the judge within a range of three months to two years. Prohibitory sanctions may also be applied as a precautionary measure, at the request of the Public Prosecutor, if there are serious indications of the Company’s liability and well-founded and specific elements suggesting a concrete risk of offenses of the same type being committed again;

iii) confiscation, which is always ordered with the conviction sentence, as it automatically follows the determination of the Company’s liability and consists of the State acquiring the price or profit of the offense or an equivalent value;

iv) publication of the conviction sentence, as an accessory sanction to the prohibitory sanction, consisting of the one-time publication of the conviction sentence, either in excerpt or in full, at the Company’s expense, in one or more newspapers indicated by the Judge in the sentence, as well as by posting it in the municipality where the Company has its main office.

Activities Carried Out, Group Affiliation

Based in Occhiobello (Rovigo), Selecta S.p.A. is a company engaged in: wholesale and retail trade, in Italy and abroad; the import, export, and processing of food products of any type and quality; live or dead animals intended for human consumption; as well as equipment and accessories for catering, food processing, and livestock farming; the management of restaurants, hotels, food stores, and supermarkets; and the activity of taking on representations related to the company’s corporate purpose.

It employs approximately 85 staff members.

Corporate Governance

Selecta has a fully paid-up share capital of €120,000.00, divided into 120 ordinary shares. The company Alba di Guido Bruzzo e C. S.A.P.A. holds 80 shares, while the remaining 40 shares are held by the company Sonafi, based in France.

The Company has opted for a traditional administration and control system, as provided by Articles 2380 and subsequent articles of the Italian Civil Code. Consequently, a Board of Directors and an External Audit Firm have been appointed, with the latter entrusted with the statutory audit of the accounts pursuant to Article 2409-ter of the Civil Code. The Shareholders’ Meeting is governed by the provisions of the Civil Code, supplemented by the provisions of the Articles of Association.

The Company is managed by a Board of Directors composed of 5 members and regulated by Article 15 of the Articles of Association. The Board is granted all the broadest powers of ordinary and extraordinary administration and disposition, including the authority to appoint directors and attorneys, determining their powers (including representation), roles, and remuneration, as specified in the Articles of Association.

The Board of Statutory Auditors is composed of 3 regular members and 2 alternates and is governed by legal provisions.
As provided by the Articles of Association, the statutory audit of the accounts has been entrusted to an audit firm registered in the register of Statutory Auditors maintained by the Ministry of Justice. The appointment of the audit firm is entrusted to the Shareholders’ Meeting upon the proposal of the Board of Statutory Auditors.

Summary of the Corporate Structure

The Internal Control System and Organizational Processes of Selecta

The internal control system is the set of rules, procedures, and organizational structures aimed at enabling, through an adequate process of identifying, measuring, managing, and monitoring key risks, sound, proper, and consistent business management in line with predefined objectives.

With reference to the core business activities, specifically:

• processes for the selection of and specialized consulting on products;
• quality control of the products themselves;
• customized processing of products, including for the restaurant sector.

Selecta has obtained voluntary UNI EN ISO 22000:2018 certification to ensure the safety of distributed products. The certification represents a daily commitment to clients and consumers. The presence of an in-house quality and food safety office, collaboration with an external veterinary service, and the sharing of analysis plans with suppliers ensure product traceability and a safe supply chain. All personnel who come into contact with food products receive specific and ongoing training.

Below is a brief description of the activities of the central offices, grouped by department/function of reference:

• Board of Directors and Chief Executive Officer: ensure the achievement of planned business objectives. The following departments report to them as listed below:
• Production Manager: oversees and manages the entire production chain with respective reporting lines, starting from maintenance and supervision, order preparation, laboratory management, warehouse and U.R.M. management, ensuring efficiency and timely delivery through the coordination of all production departments, internal planning, and extending to packaging and shipment of goods.
• Purchasing Office Manager: oversees the entire procurement process.
• Logistics and Shipping Office Manager: manages the entire import and export shipping process.
• Quality and Food Safety Manager: ensures product quality processes.
• Sales Department: ensures the sales process and maintains proper relations with clients.
• Head of Administration, Finance, Control, and Management: ensures the proper management and overall coordination of all financial, administrative, social security, tax, civil, accounting, and financial statement activities of the Company, with particular attention to the preparation of financial statements and compliance with all tax obligations.

Selecta S.p.A., enjoying an excellent reputation in its reference market, interacts with numerous stakeholders.
In this global context, the success of the Company and its recent corporate and organizational evolution are also based on business excellence, consistency with ethical standards, and strict compliance with current regulations. The Company and its Directors strongly believe that compliance with laws and ethical conduct are not only necessary and morally correct but also constitute an effective way to manage business activities.
In light of this, the Company – mindful of the need to ensure conditions of fairness and transparency in conducting business and corporate activities, to protect its own position and image, the expectations of its shareholders, and the work of its employees – has deemed it consistent with its corporate policies to implement the Model provided for by the Decree.
Although the adoption of this Model is an “option” rather than an obligation, the Company has decided to proceed with its implementation, recognizing that such a system represents an opportunity to improve its Corporate Governance, while simultaneously taking the opportunity to conduct (potential risk analysis, evaluation, and adaptation of the existing control system for sensitive processes) to raise awareness among personnel about the control of corporate processes, aimed at the “active” prevention of crimes.

The Company commits to ensuring adequate dissemination of the Model, guaranteeing access to all parties involved in the application of the regulations under the Decree, as well as conducting constant reviews of the content of the Model itself.
Once adopted through a resolution of the Board of Directors, the Model will be promptly modified or supplemented, even upon proposal by the Supervisory Body or suggestions from the heads of corporate functions, when:
– significant changes occur in the regulatory framework, the organization, or the Company’s activities;
– violations or circumventions of its provisions occur, demonstrating its ineffectiveness or inconsistency in preventing Predicate Offenses.
Since the Model is an “act issued by the governing body” – in accordance with the provisions of Article 6, paragraph 1, letter a), of the Decree – its adoption, as well as subsequent modifications and additions, are entrusted to the decision of the Company’s Board of Directors. In particular, this body is tasked with determining whether to integrate the present Model with additional Special Sections related to other types of offenses which, in relation to the Company’s activities and their modalities, may further fall within the scope of application of the Decree.

Preparation of the Model

The drafting of the present Model was preceded by a series of preparatory activities divided into different phases, all aimed at establishing a system for the prevention and management of specific risks related to the predicate offenses under Legislative Decree 231/01, in line with the provisions of the Decree and the Guidelines:

1. identification of sensitive activities/processes (as-is analysis) – through the examination of corporate documentation (organization chart, delegation of powers and formalized proxies, activities performed, governance system, organizational provisions, etc.) and a series of interviews and discussions with individuals responsible for various sectors of the Company’s activities, the processes and activities subject to the risk of potential commission of offenses indicated by the Decree were identified. Simultaneously, the current state of the Company’s internal control system was analyzed to verify its adequacy in preventing relevant Predicate Offenses in risk areas;
2. identification of improvement actions (gap analysis): based on the existing situation as determined above, the necessary actions were identified and subsequently implemented to improve the internal control system and the essential organizational requirements for preparing the Model;
3. definition and formalization of the Model: based on the results of the analysis phases, the elements of the Model were defined and formalized, including:

• the identification and preparation of general and specific principles of conduct and corporate procedures aimed at detailing the operational methods for carrying out activities in areas at risk of offenses, as well as establishing a communication process requiring the obligation to provide the Supervisory Body with useful information on the scope and characteristics of relevant facts/transactions in risk areas and/or the emergence of potential risk elements regarding sensitive processes;
• the identification of the Supervisory Body, with the assignment of specific supervisory tasks to ensure the effective and proper functioning of the Model;
• as well as the establishment of an appropriate disciplinary sanction system.

The Company will be responsible for implementing an appropriate internal training plan and dissemination of the Model to all its Recipients.

With regard to the identification and mapping phase of the areas and activities at risk of offense, this phase consisted of identifying the functional areas of the Company in which there was a potential “risk” of committing offenses pursuant to the Decree (so-called “Areas at Risk of Offense” or simply “Risk Areas”). In this context, within each of these “areas,” the specific “Activities at Risk of Offense” were identified, and for each of these, the possible ways offenses could be committed were determined. Among the Activities at Risk of Offense, both activities directly at risk of offense and “instrumental” activities were identified. The latter refers to activities which, while not directly relevant under the Decree, could, in principle, serve as conditions, opportunities, or means for the commission of offenses.

The process of identifying risks and assessing the areas most exposed to the commission of offenses was conducted using a risk-based approach, taking into account the inherent or potential risk of committing offenses (i.e., the risk assumed when the Company has not yet taken action to alter the likelihood and impact of an event The measurement of the level of “inherent risk” was carried out by considering both the likelihood of the offense being committed and the impact of such an event, determined by taking into account factors such as the type and severity of sanctions (monetary or prohibitory) that could be imposed on the Company.

The “inherent risk” was then classified, with reference to the Activities at Risk of Offense, according to the following scale of severity and relevance:

Once the “inherent risk” (and its relevance) was defined within the context of Sensitive Activities, the current Internal Control System of the Company was evaluated to determine its level of “adequacy” in reducing the risk to an “acceptable level”.

The conceptual threshold of “risk acceptability” for intentional offenses cannot be expressed merely by the cost-benefit ratio as taught in business doctrine (whereby a risk is deemed acceptable when the additional controls “cost” more than the resource being protected). Indeed, as highlighted in the Guidelines, economic logic in the crime prevention system outlined by Decree 231/01 cannot be the sole definition of an acceptable risk level. Rather, the threshold of risk acceptability must be represented by the existence of a prevention system that cannot be circumvented except through fraud, noting that fraud does not necessarily require deceit and trickery, but can also consist of merely violating the provisions of the Model or circumventing the security measures it establishes. With regard to negligent offenses, and in particular offenses committed in violation of health and safety regulations in the workplace, the conceptual threshold of reliability must be defined even more rigorously, as occupational risks to workers’ health and safety must be fully eliminated or minimized as much as possible through the adoption of available prevention measures in relation to the knowledge acquired based on technological progress.

The assessment of the control and monitoring measures of the Company’s Internal Control System was based on verifying the existence of the following criteria and requirements (as indicated in the Guidelines):

1) existence and formalization of written corporate procedures and manuals;

2) definition of roles and responsibilities in the management of corporate processes;

3) compliance with the “segregation of duties” principle;

4) traceability of corporate processes;

5) communication, training, and effective knowledge of corporate procedures.

As a result of this verification activity – carried out based on the documentation collected and the evidence obtained during interviews with the Company’s management and staff – the Company’s Control System was evaluated (in the context of individual Activities at Risk of Offense):

• “Adequate” where it was deemed that the system of preventive controls adopted by the Company is overall suitable to reduce the risk to an acceptable level (possibly requiring only some minor adjustments);
• “Improvable/to be updated,” where it was deemed that the system of preventive controls adopted by the Company is not entirely suitable to reduce the risk to an acceptable level and, therefore, it is necessary to implement changes/modifications to the existing processes;
• “Inadequate/Nonexistent,” where it was deemed that the system of preventive controls adopted by the Company is not suitable to reduce the risk to an acceptable level and, therefore, the Company must adopt new and/or different controls and procedures with immediate action.

The evaluation of the adequacy of the internal control system thus allowed for the determination—always with regard to each Sensitive Activity considered—of the “residual risk,” determined based on the level of “inherent risk” and the effectiveness/adequacy of the control system adopted by the Company, using the following scale of severity and relevance:

Following the mapping of Risk Areas and Activities at Risk of Offense, and in general, the risk assessment, a report was shared by management—kept on file by the Company—highlighting the various phases in which the risk assessment was conducted, namely:

1. the verification, within the Risk Areas and with reference to specific Activities at Risk of Offense, of the existing preventive control systems (e.g., formalized procedures, operational practices, segregation systems, financial resource management systems, etc.) within the company and the assessment of their suitability to ensure that the risks of committing offenses are reduced to an “acceptable level” (“as-is analysis”);
2. the identification, within the existing control system, of any deficiencies or critical issues and the corresponding corrective actions necessary to improve the system (“gap analysis”).

The activities of mapping Risk Areas and Sensitive Activities, and generally of risk assessment, have made it possible to establish that Selecta has an Internal Control System generally characterized by:

i) formalized procedures aimed at:

• ensuring that the conduct of corporate activities complies with applicable laws and regulations and, in general, safeguards the integrity of the company’s assets;
• defining and regulating the methods and timelines for carrying out those activities;
• ensuring, where necessary, the “standardization” of decision-making processes and limiting corporate decisions based on subjective choices;
• clear and formalized assignment of powers and responsibilities, with explicit indication of their limits and in alignment with the tasks assigned and positions held within the organizational structure;

ii) segregation of duties, through the proper distribution of responsibilities and the establishment of appropriate authorization levels, to avoid functional overlaps or operational assignments that concentrate critical activities on a single individual;

iii) adoption of tools designed to ensure the traceability of acts, operations, and transactions through adequate documentation supporting their characteristics and rationale, and identifying the individuals involved in various capacities in the operation (authorization, execution, recording, verification of the operation);

iv) implementation of information and training activities for employees regarding existing formalized procedures, including in the event of modifications/integrations, to ensure adequate awareness and effective implementation

v) establishment, execution, and documentation of monitoring and oversight activities on processes and Activities at Risk of Offense;

vi) existence of security mechanisms that ensure adequate protection of information from physical or logical access to data and the tools of the corporate information system, particularly concerning management and accounting systems.

Structure of the Model

This Model consists of the present “General Section,” which includes a brief examination of the essential components of the Model, including the identification of the categories of offenses relevant to the Company, the identification of the Model’s recipients, the main characteristics, the functions and powers of the Supervisory Body, the sanction system for violations of the prescriptions contained in the Model, as well as the Model’s training and communication system, and a “Special Section,” divided into different sections referring to the various Activities at Risk–Predicate Offense considered relevant to the Company and accompanied by control protocols addressing the offense risks identified therein

Considering the socioeconomic context in which the Company operates, its history, and the type of activities performed, the following categories of Predicate Offenses have emerged as potentially involving aspects of possible liability for the Company:

A) Offenses against the Public Administration (Art. 24 and 25 of the Decree);

B) Computer crimes (Art. 24-bis of the Decree);

C) Crimes against industry and commerce (Art. 25-1 of the Decree);

D) Corporate crimes (Art. 25-ter of the Decree);

E) Crimes against individual personality (Art. 25-quinquies of the Decree);

F) Manslaughter and serious or very serious bodily injuries committed in violation of workplace safety regulations (Art. 25-septies of the Decree);

G) Receiving stolen goods, money laundering, and use of money, goods, or benefits of illicit origin, as well as self-laundering (Art. 25-octies of the Decree);

H) Crimes related to non-cash payment instruments (Art. 25-octies.1 of the Decree);

I) Employment of third-country nationals whose residence status is irregular (Art. 25-duodecies of the Decree);

L) Environmental crimes (Art. 25-undecies of the Decree);

M) Tax crimes (Art. 25-quinquiesdecies of the Decree);

N) Smuggling (Art. 25-sexiesdecies of the Decree);

O) Transnational crimes (Art. 10 of Law 146/2006).

Regarding the remaining categories of Predicate Offenses provided by the Decree, it has been deemed that, in light of the Company’s main activities, the socioeconomic context in which it operates, and the legal and economic relationships it typically establishes with third parties, there are no risk profiles that reasonably justify the possibility of their commission in the interest or to the advantage of the Company. The Company is, in any case, committed to continuously assessing the relevance of any additional offenses, currently provided by the Decree or introduced through subsequent amendments to it, in relation to its corporate activities.

The “Statute of the Supervisory Body” (Annex E to the minutes of the Board of Directors meeting of 10/12/2024), as well as the comprehensive body of principles, norms, and rules (contained and regulated in the procedures, documents related to the organizational system, the system of powers, etc.) – which is an integral part of the broader internal control system – aimed at preventing offenses pursuant to Legislative Decree no. 231/01 for the Company, also form an integral part of this document.

Purpose of the Model

The Model developed by the Company, based on the identification of areas of potential risk in corporate activities where the likelihood of offenses being committed is considered higher, aims to achieve the following objectives:

• establish a structured and systematic set of procedures and control activities aimed at reducing the risk of offenses by identifying sensitive processes and subsequently formalizing them into procedures;
• instill in all those who operate with, in the name of, on behalf of, and in the interest of the Company within areas of activity at risk, the awareness that engaging in conduct non-compliant with the provisions of the Organizational Model, corporate rules and procedures, or the law may result in criminal or administrative penalties, applicable not only to themselves but also to the Company;
• censure any form of unlawful behavior as it contradicts not only legal provisions but also the ethical principles adopted by the Company, through the constant oversight activity of the Supervisory Body on the actions of the Model’s Recipients concerning sensitive processes, and the imposition of disciplinary or contractual penalties;
• ensure that the Company, through monitoring corporate activities in risk areas, has the concrete and effective ability to intervene promptly to prevent the commission of offenses.

The Model further aims to:

• raise awareness and disseminate the rules of conduct and protocols at all corporate levels for planning the training and implementation of the Company’s decisions, in order to manage and consequently mitigate the risk of offenses being committed;
• identify in advance the risk areas associated with the Company’s activities, i.e., the corporate areas involved in potential cases of offenses under the Decree;
• equip the Supervisory Body with specific tasks and adequate powers to effectively monitor the actual implementation and continuous functioning of the Model, as well as evaluate the long-term maintenance of the Model’s solidity and functionality;
• accurately record all Company operations within the activities identified as at risk for committing offenses relevant under the Decree, in order to enable the verification of decision-making, authorization processes, and their execution within the Company, ensuring their prior identification and traceability in all relevant components;
• ensure the effective compliance with the principle of separation of corporate functions, as well as define and delineate responsibilities in the formulation and implementation of the Company’s decisions;
• establish authorization powers assigned consistently with the organizational and managerial responsibilities granted, ensuring that delegations of authority, responsibilities, and tasks within the Company are clearly communicated, and that the acts conferring powers, delegations, and autonomy are compatible with the principles of preventive control;
• evaluate the activities of all individuals interacting with the Company in areas at risk of offenses, as well as the functioning of the Model, ensuring its necessary periodic and dynamic updates if the analyses and evaluations performed require corrections and adjustments.

The Recipients of the Company’s Model are:

• those who perform, even de facto, administrative, managerial, executive, or supervisory functions within the Company or its organizational units with financial or functional autonomy;
• the employees of the Company;
• those who collaborate with the Company under a quasi-subordinate, temporary, or interim employment relationship (project collaborators, agents, representatives, etc.);
• those who, while not belonging to the Company, act on its behalf or mandate (consultants, experts, etc.);
• suppliers of goods, service providers, including those outsourced, and third parties operating with the Company in so-called “sensitive” activity areas”.

The Model is implemented and maintained effectively by the Company with respect to the Recipients. The Company also ensures that the contracts regulating relationships with third parties (suppliers and consultants) include specific clauses outlining clear responsibilities regarding non-compliance with the Company’s corporate policies and the principles of the Decree, as well as, when necessary, the obligation to comply with requests for information or document submission by the Company’s Supervisory Body. These clauses must also provide the Company with the option to terminate such contractual relationships in the event of violations by third parties of the obligations indicated above.

Appointment and Term of Office

To ensure the practical implementation of the Model, the task of monitoring its functioning and compliance, as well as overseeing its updates, must be entrusted to a body endowed with autonomous powers of initiative and control. The Board of Directors of Selecta is responsible for appointing the single-member Supervisory Body (Odv). This Body will serve a term of three years. The Odv may be re-elected, is revocable only for just cause, and ceases to hold office if it no longer meets the independence requirements described below.

Tasks of the Supervisory Body (OdV)

The role and responsibilities of the Supervisory Body and the expected characteristics of its operation are only minimally addressed in the relevant legislative provisions. Legislative Decree 231/2001 establishes, for the purposes of assessing the adequacy of the Model, the requirement that “the task of monitoring the functioning and compliance” of the Model, as well as overseeing its updates, be entrusted to a “body of the entity endowed with autonomous powers of initiative and control” for which “information obligations” are defined, and that there has been no “omission or insufficient supervision” by the Supervisory Body. However, the law does not provide further provisions regarding the expected methods for carrying out these activities. In this regard, the codes of conduct (“Guidelines”) issued by trade associations have, over time, contributed to defining the tasks of the Supervisory Body and consequently framing the objectives of supervisory activities, which can be summarized as follows:

a) monitoring the effectiveness of the Model, which entails verifying the consistency between the established Model and actual behaviors;

b) assessing the adequacy of the Model, i.e., its actual ability to prevent undesirable behaviors and, in particular, the commission of Predicate Offenses;

c) analyzing whether the Model maintains its robustness and functionality over time;

d) ensuring the necessary dynamic updating of the Model by formulating specific suggestions and recommendations for adjustments to the Model (if analyses show that corrections are necessary or advisable), as well as conducting subsequent checks on the implementation and actual functionality of the proposed solutions (follow-up).

The key aspects of the Supervisory Body’s monitoring activities can be summarized as follows:

• conducting in-depth analyses and verifications upon accepting the appointment and taking office, as well as planning monitoring activities;
• performing (and documenting) the verification activities planned in advance, concerning information flows, risk activity areas, and Model components, while noting that responsibility for control activities primarily lies with operational personnel and is considered an integral part of every process (“line control”);
• carrying out (and documenting) unscheduled verifications, primarily related to handling reports of non-compliance with the Model and/or the commission of unlawful acts;
• reviewing corporate activities to identify any need to update the mapping of risk activity areas within the corporate context;
• assessing the need to update the Model;
• collecting, evaluating, and storing information regarding the implementation of the Model, as well as updating the list of information that must be mandatorily transmitted to the Supervisory Body or kept available to it;
• notifying the competent bodies regarding the adoption of any disciplinary measures, assessing the adequacy of training programs and the content of periodic communications to Recipients aimed at raising their awareness and providing them with the basic knowledge of the regulations set forth in Legislative Decree 231/2001;
• submitting periodic reports to the Corporate Bodies regarding the effectiveness and adequacy of the Model.

Composition

The Decree does not include specific provisions regarding the composition of the Body, merely providing a concise definition of it as an “entity body endowed with autonomous powers of initiative and control.” Pursuant to paragraph 4 bis of Article 6 of Legislative Decree 231/01¹, in joint-stock companies, the functions of the Supervisory Body may also be carried out by the Board of Statutory Auditors. The Legislator leaves all decisions regarding the composition of the Supervisory Body to the individual entities (i.e., companies) that intend to comply with the Decree’s provisions, with the choice needing to be suitable for the specific corporate reality. Doctrine and practice have developed various and diverse solutions regarding the possible structure and composition of the Supervisory Body, also considering the size characteristics of the entity, its Corporate Governance rules, and the need to strike a fair balance between costs and benefits. In this regard, the Board of Directors analyzed the solutions proposed by trade associations and its consultants, to identify and compare the strengths and potential criticalities of the various proposed solutions and opted for the appointment of a single-member Supervisory Body.

The Requirement of Professionalism

Compliance with this requirement must be ensured by the personal experience of the individual members of the Body, who must possess technical and specialist skills to ensure the timely and correct performance of the functions legally assigned to the Body. In particular, the required skills can be identified as follows:

• criminal legal expertise: mastery of the interpretation of legal provisions with specific training in analyzing the offense scenarios identifiable within corporate operations and in identifying potential sanctionable behaviors;
• organizational expertise: specific training in analyzing corporate organizational processes and procedures; knowledge of the general principles of compliance legislation and related controls;
• expertise in analysis and control: experience in internal control systems gained in a corporate environment;
• expertise in the monitoring of financial flows.

The Requirement of Independence

If the Supervisory Body is composed of a single member, the requirement of independence is met if there are no ongoing collaboration or consultancy assignments between the individual and the Company. If the Supervisory Body is organized collegially, the requirement of independence is ensured when the majority of its members are external individuals who do not hold operational roles due to subordinate employment relationships with the Company, do not maintain significant business relationships with the Company and/or its parent or subsidiary companies, or with its executive directors, and do not have significant direct and/or indirect shareholdings that would allow control over the Company’s voting rights. The internal member cannot be a director of Selecta and, exclusively in the performance of the functions as a member of the Supervisory Body, is exempt from the ordinary hierarchical reporting lines.

Effectiveness and Continuity of Action

This requirement is necessary to ensure that the Body has full knowledge of the Company’s activities, ongoing operational processes, and any changes that may occur during the Company’s lifecycle. With reference to this requirement, the Supervisory Body is required to constantly monitor compliance with the Model by the Recipients through its investigative powers, ensure its implementation and updating, and serve as a constant point of reference for all Selecta personnel. The Body must meet to carry out its verification activities at least four times during each fiscal year.

Reporting Lines

The Supervisory Body will report directly to the Chief Executive Officer (CEO). The Supervisory Body will submit to the Board of Directors, unless specific needs arise, at least one annual report on the Organizational and Management Model, containing:

• its observations on the effectiveness and efficiency of the Model, indicating any integrations and/or modifications deemed necessary;
• any recommendations to update the Model following legislative changes or changes in the corporate and organizational structure;
• a summary of the findings and corrective/preventive actions to be implemented.

The Supervisory Body may request to be heard by the Board of Directors whenever it deems necessary.

Information Obligations to the Supervisory Body

Article 6 requires that the adopted Model include obligations to provide information to the Supervisory Body. These obligations, assigned to corporate functions at risk of offenses, will be implemented as a tool to facilitate its supervisory activity and will pertain to anomalies identified within their respective functions. Failure to comply with the obligation to provide information must be regarded as a specific disciplinary offense.

Financial Autonomy

To ensure the necessary financial autonomy for the Supervisory Body, the Board of Directors approves the annual expenditure budget based on a simple request from the Supervisory Body. The allocated budget must be sufficient to ensure the execution of control, verification, and updating activities for the Model, including, if necessary, obtaining consultancy services. For expenses exceeding the defined budget and extraordinary expenses, the Body must request written authorization for the expenditure from the Board of Directors on a case-by-case basis. The Board of Directors undertakes to provide, upon a justified request from the Supervisory Body, the financial resources necessary to effectively fulfill its function.

Statute of the Supervisory Body

The Board of Directors establishes and sets the principles governing the operation of the Supervisory Body through a specific Statute (Annex E).

The Supervisory Body may adopt an operational regulation governing its activities, provided that such regulation does not conflict with the Model.

Information Flows and Whistleblowing

To facilitate the monitoring of the effectiveness of the Model adopted by the Company, all Recipients are required to bring to the attention of the Supervisory Body any information or reports, of any kind, including those from third parties, regarding the implementation of the Model and all the principles of conduct and procedures referenced therein.

The Supervisory Body, in exercising its function as an oversight and control body, always has the authority to request from the Recipients data and information relating to corporate activities, the application, and compliance with the rules of conduct and corporate procedures as outlined in the Model, and to review any necessary documents, either on a sampling basis or systematically. The Recipients are required to cooperate with the Supervisory Body and provide it with any data and information it requests.

Recipients who fail to properly fulfill their obligation to provide information to the Supervisory Body, in the terms and manners outlined herein, may be subject to disciplinary sanctions.

The corporate body also informs the Supervisory Body about resolutions that may result in changes to the functionality and structure of the Model, such as changes to the organizational structure, entry into (or exit from) business lines, changes to incentive systems, etc.; similarly, the control bodies provide periodic information on the status of the internal control systems, for which they are responsible, and which form the basis of the offense prevention system under Legislative Decree 231/2001, as well as the auditor’s report required under Article 19 of Legislative Decree 39/2011, regarding any significant deficiencies identified in relation to these internal control systems.

A. Information Flows from Function Managers

Notwithstanding the above, regarding the Supervisory Body’s powers of investigation and verification, Function Managers, within their areas of responsibility, are required to send to the Supervisory Body data and information related to the corporate activities they oversee to enable monitoring of the evolution of the activities under analysis and the functioning of the related control measures, highlighting:

• regarding critical issues, events (identified based on qualitative-quantitative thresholds) that are most significant in terms of potential risk of committing offenses, and any indicators of anomalies;
• regarding design aspects, any potential issues that have arisen in connection with the application of the prevention protocols provided for by the Model.

Reports from Recipients

The Recipients promptly inform the Supervisory Body of any violation or suspected violation of the Model (and the Code of Conduct that serves as its essential reference), its general principles, rules of conduct, and procedures referenced therein, of which they become aware during their work and/or collaboration with the Company. In particular, in the context of their activities (as identified above), the Recipients are specifically required to promptly submit the following reports to the Supervisory Body:

• critical issues, anomalies, or irregularities identified during control activities conducted by the relevant corporate functions;
• any orders received from superiors that are considered to conflict with the law, internal regulations, or the Model;
• any unlawful requests or offers of money, gifts, or other benefits originating from or intended for public officials or individuals tasked with a public service;
• any omissions, negligence, or falsifications in maintaining accounting records or in preserving the documentation on which the accounting entries are based;
• any reports, not promptly addressed by the relevant functions, concerning deficiencies or inadequacies in workplace conditions, work equipment, or protective devices provided by the Company, as well as any other situation posing a risk to the environment, health, or workplace safety.

B. Information Flows Regarding Environment, Health, and Workplace Safety.

The Supervisory Body must be provided with copies of periodic reports on environmental matters and workplace health and safety (including minutes from periodic meetings of the Employer, Prevention and Protection Service Manager [RSPP], Physician, and Worker Safety Representative [RSL] pursuant to Article 35 of the Consolidated Safety Law [TUS], as well as review minutes from “Top Management”).

In the event of a report regarding a violation related to environmental matters, health, and safety in the workplace, the Supervisory Body will promptly inform the Employer and the Company’s Prevention and Protection Service Manager (RSPP) of the findings reported, provided the person making the report has not already done so.

To effectively carry out its functions, the Supervisory Body (OdV) has inspection and control powers that allow it to freely access, without limitations, all areas of corporate activities to request and obtain information, documentation, and data from all employees and managers necessary to fulfill its duties. The OdV may also request relevant information from external collaborators and review or extract copies of corporate books, key contracts, and powers of attorney related to delegations of authority.

Such data and information are processed in compliance with applicable privacy regulations.

C. Information Flows on Corporate Operations.

More generally, beyond the specific information flows mentioned above, the OdV must be constantly informed about corporate management and operations whenever these could lead to changes in the assessments made regarding the functioning of the organizational model. The OdV is required to periodically interact with the administrative body, with which it establishes a relationship of collaboration and cooperation.

The OdV must be able to obtain information primarily regarding:

• the corporate background (i.e., all circumstances existing prior to the establishment of the Body);
• anomalies detected during business activities that reasonably suggest a violation of the obligations contained in the Model;
• the emergence of new risks in the areas under the responsibility of various managers;
• participation in or awarding of public tenders, as well as the request for or receipt of public grants or funding;
• any inspections or audits by public authorities;
• the conclusion of significant commercial or financial transactions based on their economic relevance, execution methods, risk level, involvement of related parties, etc.

For this purpose, the Model provides, pursuant to Article 6, paragraph 2, letter d) of the Decree, specific information obligations for all Recipients of the guidelines it contains. In practice, regarding reporting obligations or the ability to consult the OdV, it is established that:

– top-level managers and department/function heads may communicate directly with the OdV;

– employees who are not department heads and collaborators may communicate with the OdV either through their direct superior or directly, if specific needs or justified reasons require it.

The effectiveness of the activities carried out by the OdV relies fundamentally on a timely, accurate, and comprehensive system of reports and information from the Recipients of the Model, who must therefore ensure full cooperation.

Reports of any anomalies or violations of the Model, as well as illegal conduct that includes not only the entire range of predicate offenses under Legislative Decree 231/2001 but also unlawful behavior that could impact operations, regardless of criminal relevance and indicating a malfunctioning of corporate activities, are worthy

of protection and must be sent directly to the OdV at the following email address: e.g., odv@selectaspa.com, or by ordinary mail to Selecta S.p.A., Via del Sapere 1, 45030 Occhiobello (RO), “Attn: Supervisory Body of Selecta S.p.A.”.

The collection of information by the Supervisory Body (OdV) is carried out using the following methods

• Violation of the Code of Ethics
• Violation of Model 231

Without prejudice to what will later be indicated regarding Whistleblowing, reports addressed to or brought to the attention of the Supervisory Body will also be examined, provided they are sufficiently precise and detailed.

The Supervisory Body’s email inbox is accessible only by the OdV itself. In this regard, the Supervisory Body is bound by a duty of confidentiality concerning the information and reports it receives in the course of its activities. The Supervisory Body acts to protect the authors of information and reports against any form of retaliation, discrimination, penalization, or any other consequence arising from them, ensuring their confidentiality and anonymity regarding their identity: this is subject to legal obligations and the protection of the rights of the Company or persons wrongly and/or maliciously accused.

Selecta, as the data controller under EU Regulation No. 679/2016 and the Privacy Code (Legislative Decree No. 196/2003 as amended), will process the personal data obtained through the information flows for purposes related to compliance with the obligations deriving from Legislative Decree 231/01 and the Organizational Model. The data may be processed in paper form or using electronic tools. The data subject may exercise the rights provided by EU Regulation No. 679/2016 and the Privacy Code (Legislative Decree No. 196/2003 as amended) by contacting the Data Controller/Processor.

In addition to the reports mentioned above, the Company’s personnel, both managerial and non-managerial, as well as all third parties, must obligatorily transmit the following information to the OdV:

• any measures and/or news from judicial police authorities and/or judicial authorities, or any other authorities, indicating the conduct of investigations, even against unknown persons, for offenses under the Decree that may involve the Company and/or its personnel and/or, if known, the Company’s external collaborators;
• requests for legal assistance made by the Company’s employees, whether managerial or not, in the event of legal proceedings initiated against them for the offenses provided for by the Decree;
• all information, including that from managers of business functions other than those directly involved in carrying out Activities at Risk of Offenses, in the exercise of their control duties, from which facts, acts, events, or omissions with critical implications regarding compliance with the provisions of the Decree may emerge;
• all information regarding the application of the Model, with particular reference to completed or ongoing disciplinary proceedings and any sanctions imposed or decisions to close such proceedings, along with the related justifications;
• decisions related to the request, granting, and use of public funding;
• decisions related to the execution of renovations, remediation, or maintenance work on properties owned or managed by the Company, where such operations involve contact with public administrations.

The OdV may propose changes to the above list of required information to the Board of Directors if deemed appropriate. Notwithstanding the above, the Supervisory Body may establish additional information flows to ensure more effective monitoring of the Model’s functioning and compliance.

Whistleblowing Channel

The Company has adopted a specific procedure – available at the link https://selectaspa.it/whistleblowing/ – which implements the Whistleblowing system. This procedure was most recently revised and updated in light of the provisions of Legislative Decree 24/2023 and the related Guidelines published by ANAC on 14 July 2023.

Reports must be made, in free text and in written form, using one of the following alternative channels:

• via email to the following address: violazioni.selectaspa@gmail.com;
• via post to the following address: SELECTA SPA – VIA DEL SAPERE N.1 45030 – OCCHIOBELLO (RO) – in a sealed and closed envelope – to the kind attention of the Whistleblowing Manager;
• by hand delivery to the designated corporate space – in a sealed and closed envelope marked “CONFIDENTIAL” – to the kind attention of the Whistleblowing Manager.

These internal reporting channels, whether written or oral, are managed by specifically appointed individuals who are authorized to process data in accordance with privacy regulations and possess the necessary competence, training, and independence.

To enable the proper handling of a report and to follow it up diligently, it is necessary for the report to be based on precise and consistent factual elements and supported by documentation, where available.

The report is inadmissible if it contains generic content that does not allow an understanding of the facts or if it is accompanied by inappropriate or irrelevant documentation that does not clarify the content of the report.

Once the Report has been received, the Whistleblowing Manager will issue the whistleblower a notice of receipt within 7 days.

In any case, the Whistleblowing Manager shall also, within three months of the date of the aforementioned notice, provide the whistleblower with feedback on the report, detailing the actions taken to follow up on it diligently, as well as any disciplinary measures adopted, or the reasons why no action was deemed necessary.

Selecta guarantees and protects whistleblowers, both in terms of confidentiality and with an absolute prohibition of any type of retaliation against them.

Any retaliatory or discriminatory conduct committed against the whistleblower or other individuals specifically identified in Legislative Decree 24/2023, or otherwise intended to violate the prescribed protective measures, is sanctioned according to the methods outlined in the following paragraph.

Without prejudice to the provisions of Article 17, paragraphs 2 and 3, of Legislative Decree 24/2023, the protective measures also apply to:

• facilitators;
• individuals in the same work context as the whistleblower, the person who filed a complaint with the Judicial or Accounting Authority, or the person who made a public disclosure and who are connected to them by a stable emotional bond or kinship up to the fourth degree;
• colleagues of the whistleblower or the person who filed a complaint with the Judicial or Accounting Authority or made a public disclosure, who work in the same work context and have a regular and ongoing relationship with that person;
• entities owned by the whistleblower or the person who filed a complaint with the Judicial or Accounting Authority or made a public disclosure, or for which the same persons work, as well as entities operating in the same work context as those individuals.

The Company adopts all necessary measures to ensure the prohibition of retaliatory or discriminatory acts, whether direct or indirect, against the whistleblower for reasons directly or indirectly related to the report. In particular, the adoption of discriminatory measures against individuals who make reports may be reported to the National Labor Inspectorate, for measures within its competence, not only by the whistleblower but also by the trade union organization designated by them. Furthermore, any retaliatory or discriminatory dismissal of the whistleblower is null and void. Changes in job duties under Article 2103 of the Civil Code, as well as any other retaliatory or discriminatory measures adopted against the whistleblower, are also null and void. In the event of disputes related to the imposition of disciplinary measures, demotions, dismissals, transfers, or the implementation of other organizational measures negatively affecting the whistleblower’s working conditions, directly or indirectly, following the filing of a report, it is the employer’s responsibility to demonstrate that such measures are based on reasons unrelated to the report itself.

Finally, it should be noted that, in cases where a report or complaint is made in accordance with the forms and within the limits of the law, the pursuit of the entity’s integrity, as well as the prevention and repression of misconduct, constitutes just cause for disclosing information covered by confidentiality obligations under Articles 326, 622, and 623 of the Criminal Code and Article 2105 of the Civil Code. (with the exception of cases where the professional secrecy obligation applies to individuals who became aware of the information due to a professional consultancy or assistance relationship with the entity, company, or individual concerned). When information and documents communicated to the authorized body are subject to corporate, professional, or official confidentiality, disclosure beyond what is necessary to eliminate the wrongdoing—particularly disclosure outside the designated communication channel—constitutes a breach of the related confidentiality obligation.

Reporting Obligations of the Supervisory Body (OdV)

The Supervisory Body (OdV) conducts periodic or ad hoc reporting activities aimed at management, which is responsible for adopting the necessary operational decisions. The recipients of periodic reports are the administrative and control bodies; the reports cover the overall functioning of the Model, its updates, and significant findings from monitoring activities. Periodic reports are presented annually and, in summary and by way of example, include:

• the number and dates of meetings held during the period;

• a description of the activities performed;

• the reports received and the subsequent investigations conducted;

• any identified critical issues;

• findings to be submitted to the management body, so that it can implement the necessary actions to ensure the Model’s updates, effectiveness, and efficiency;

• mention, with appropriate guarantees of confidentiality, of the sanctions proposed by the OdV and/or imposed by the company for violations of the Model;

• any request for freely usable financial resources (budget) and a report on their use during the previous period;

• the planning, even if general, of activities planned for the subsequent period.

Information exchanges may be followed by meetings for both informational and planning purposes.

Furthermore, the OdV, if it believes that the behaviors, facts, acts, events, or omissions identified may even abstractly constitute a potential offense relevant to the Decree, must establish ad hoc information flows, regardless of the periodic report, in the presence of significant critical issues. In such cases, the information flow may need to be tailored depending on the individual who committed the violation.

¹  Clause added by paragraph 12 of Article 14, Law No. 183 of November 12, 2011, effective from January 1,
2012, pursuant to the provisions of paragraph 1 of Article 36 of the same Law No. 183/2011.

General Principles

Pursuant to Article 6, paragraph 2, letter e), and Article 7, paragraph 4, letter b), of the Decree, organizational, management, and control models can only be considered effectively implemented if they include a disciplinary system capable of sanctioning non-compliance with the measures they outline.

The application of disciplinary sanctions is independent of the initiation or outcome of any criminal proceedings, as the Model constitutes binding rules for the Recipients, and violations of these rules may be sanctioned regardless of whether a crime is actually committed or punishable.

The disciplinary system is based on the principles of transparency and fairness in the investigative processes for determining violations and ensures the right of defense for the individuals under investigation, as well as the timely and accurate application of sanctions.

Sanctions imposed for violations must, in any case, respect the principles of graduality and proportionality relative to the severity of the violations committed. The determination of the type and severity of the sanction imposed as a result of violations, including offenses relevant under the Decree, must be guided by the assessment of the following:

• the intentionality of the behavior that led to the violation;
• the negligence, imprudence, and inexperience demonstrated by the offender in committing the violation, particularly with regard to the actual foreseeability of the event;
• the significance and possible consequences of the violation or offense;
• the Recipient’s position within the company’s organizational structure, particularly in light of the responsibilities associated with their role;
• any aggravating circumstances (such as previous disciplinary sanctions imposed on the same Recipient within the two years preceding the violation) or mitigating circumstances identified in relation to the Recipient’s conduct;
• the involvement of multiple Recipients, acting in concert, in the commission of the violation or offense.

The Company, aware of the need to comply with legal regulations and the applicable collective bargaining agreements, ensures that sanctions applicable to employees under this disciplinary system conform to the provisions of the national collective labor agreements applicable to the sector The Company also ensures that the procedural steps for contesting the offense and imposing the related sanction comply with the provisions of Article 7 of Law No. 300 of May 30, 1970 (known as the “Workers’ Statute”).

For Recipients bound by contracts other than an employment relationship (such as directors and, in general, third parties), the applicable measures and disciplinary procedures must comply with the law and the contractual terms.

Recipients of the Disciplinary System

The recipients of this disciplinary system, who correspond to the Recipients of the Model itself, are required to align their conduct with the principles and procedures defined in the Model.

By way of example, the following behaviors constitute violations:

• the violation, including through omissive conduct and possibly in concert with others, of the principles, rules, and procedures outlined in this Model or established for its implementation;
• the preparation, possibly in concert with others, of false documentation;
• the facilitation, through omissive conduct, of the preparation of false documentation by others;
• the theft, destruction, or alteration of documentation related to procedures to evade the control system provided for in the Model;
• the obstruction of the Supervisory Body’s monitoring activities or of the individuals it utilizes for such activities;
• obstructing access to information and documentation requested by those responsible for monitoring procedures and decisions;
• engaging in any other conduct capable of circumventing the control system established by the Model;
• failing to report identified violations to the Supervisory Body (OdV).

Any potential violation of the aforementioned provisions constitutes, if verified:

• in the case of employees and managers, a contractual breach with respect to the obligations arising from the employment relationship pursuant to Articles 2104 and 2106 of the Italian Civil Code;
• in the case of directors, a failure to comply with the duties imposed on them by law and by the company bylaws pursuant to Article 2392 of the Italian Civil Code;
• in the case of external parties, a contractual breach that entitles the Company to terminate the contract, without prejudice to the right to claim damages.

The procedure for imposing the sanctions described below therefore takes into account the specificities deriving from the legal status of the individual concerned.

Sanctions Against Non-Managerial Employees

The sanctions and the related process for contesting the violation vary according to the different category of Recipient.

The conduct of employees without managerial roles that violates the provisions of the Model, company protocols, and their updates, as well as company procedures and policies, is considered a disciplinary matter.

The violation of the provisions of the Model, company protocols, and their updates, as well as company procedures and policies, by employees may result in.

With reference to the sanctions applicable to workers, clerks, and middle managers, these fall within those provided by the company’s disciplinary system and the sanctioning system established by the applicable National Collective Labor Agreement (CCNL), in compliance with the procedures outlined in Article 7 of the Workers’ Statute and any applicable special regulations. In particular, based on the principles of proportionality and the criteria linking the violation to the sanction, the following measures may be applied:

• verbal warning;
• written warning;
• a fine not exceeding the equivalent of 3 hours of wages;
• suspension from work and pay for a period not exceeding 3 actual working days;
• dismissal with notice

the employee who:

• does not comply with the procedures set out in the Model and its annexes, as well as with company protocols (including, for example, the obligation to provide information flows to the OdV, the obligation to complete prescribed periodic declarations to monitor the Model’s effectiveness, the obligation to conduct prescribed verifications, etc.) and/or does not adhere to the procedures that will be implemented by the Company from time to time following updates and integrations of the Model, which will be appropriately communicated;
• engages, in the performance of activities at risk of criminal offenses (as defined in the Special Section of the Model), in conduct that does not comply with the provisions of the Model and its annexes, as well as company protocols and their updates.

A verbal warning and a written warning will be applied for minor offenses, while a fine, suspension from work and pay, and dismissal with notice will be applied for more serious offenses, all in accordance with a principle of proportionality to be assessed on a case-by-case basis.

The employee is also subject to dismissal without notice, but with severance pay, if they:

• are a repeat offender in relation to the offenses indicated in the previous point 1), and have already been subject to the corresponding conservative sanction;
• do not comply with the procedures prescribed by the Model, its annexes, or company protocols and their updates, and engage in conduct, while performing activities at risk of criminal offenses, that does not conform to the provisions contained in these documents, with such conduct being of sufficient gravity to prevent the continuation, even temporarily, of the employment relationship.

In compliance with the provisions of Article 7 of Law No. 300 of 1970, the National Collective Labor Agreement (CCNL), and the Model, the OdV will monitor the application and effectiveness of the disciplinary system described herein.

Sanctions Against Managerial Employees

In cases of:

• violation, by managers, of the provisions of the Model, its annexes, and company protocols and/or procedures implemented by the Company from time to time following updates and integrations, which are appropriately communicated
• adoption, while performing activities at risk of criminal offenses, of conduct that does not comply with the provisions of the Model and its annexes, as well as company protocols and their updates

the disciplinary measures to be adopted will be assessed in accordance with this disciplinary system, taking into account the particular relationship of trust that binds managerial roles to the Company, and, in any case, in compliance with the principles expressed in the National Collective Labor Agreement (CCNL).

The applicable disciplinary sanctions, calibrated based on the severity and possible recurrence of the behavior, may include:

• written warning;
• fine up to the equivalent of one day of base pay;
• suspension from duties and salary for up to a maximum of three days;
• reassignment to another role that does not involve the management of Activities at risk of criminal offenses, consistent with the needs of the company’s organization and in compliance with Article 2103 of the Italian Civil Code;
• dismissal for just cause.

The specific measure of the sanction will be determined by considering the nature and severity of the violation, any recurrence of the same violation, as well as the credibility, validity, and relevance of the explanations provided by the individual concerned.

The same sanctions also apply where, through inexperience or negligence, the manager has hindered or failed to facilitate the detection of violations of the Model or, in more serious cases, the commission of offenses relevant under the Decree, as well as in cases where the manager has failed to oversee compliance with the law, this Model, or company protocols by their subordinates, in accordance with their professional responsibilities and the hierarchical and functional powers corresponding to the nature of their role.

Sanctions Against Directors

In the event of a violation of the Model, company protocols and their updates, as well as company procedures and policies, by one or more Directors, the Board of Directors and the Board of Statutory Auditors must be informed without delay for appropriate assessments and measures.

The sanctions applicable to Directors may include, depending on the seriousness of the behavior:

• written reprimand recorded in the minutes;
• suspension of remuneration;
• removal from office for just cause by the Shareholders’ Meeting.

The same sanctions also apply where, through inexperience or negligence, the Directors have hindered or failed to facilitate the detection of violations of the Model or, in more serious cases, the commission of offenses relevant under the Decree, as well as in cases where they have failed to monitor compliance with the law, this Model, or company protocols by the Company’s personnel, particularly with regard to any delegated responsibilities.

In the event that one or more Directors are committed to trial as alleged perpetrators of the offense giving rise to the Company’s administrative liability, the Chairperson of the Board of Directors must convene the Shareholders’ Meeting to deliberate on the possible revocation of their mandate. The same procedure will apply to any subsequent stages of the trial.

Measures Against Consultants, Collaborators, and Partners

Agreements with Consultants, Collaborators, and Partners must expressly provide for compliance with this Model and, consequently, specify the sanctions in case of any violations.

Specifically, in the event of violations of the Model’s provisions by Consultants, Collaborators, or Partners, the Board of Directors, after consulting with the Supervisory Body (if applicable), will assess whether to terminate the existing contractual relationship and will impose any sanctions provided for in the contract through specific clauses contained therein.

These clauses may specifically include provisions for the termination of the contract and/or the payment of penalties, without prejudice to Selecta’s right to claim compensation for any damages incurred.

Clause added by paragraph 12 of Article 14, Law No. 183 of November 12, 2011, effective from January 1,
2012, pursuant to the provisions of paragraph 1 of Article 36 of the same Law No. 183/2011.

Training

Internal training is an essential and mandatory tool for the effective implementation of the Model and the widespread dissemination of the behavioral and control principles adopted by the Company, to reasonably prevent the offenses that give rise to administrative liability under the Decree.

Training programs are monitored by the Supervisory Body (OdV), which oversees their implementation and evaluates their adequacy. The Company is responsible for the proper training of personnel regarding the application of the Model.

The requirements² that a training program must meet are as follows:

• be appropriate to the position held by the individuals within the organization (e.g., newly hired employees, clerks, middle managers, executives, etc.);
• i the content must vary depending on the activities performed by the individual within the company (e.g., risk activities, control activities, non-risk activities, etc.);
• the frequency of training activities must reflect the changes in the external environment in which the company operates, as well as the staff’s capacity for learning and the level of management’s commitment to enhancing the authority of the training provided;
• the trainer must be competent and authoritative in order to ensure the quality of the content covered, as well as to emphasize the importance of the training for the Company and the strategies it seeks to pursue;
• participation in the training programs must be mandatory, and specific control mechanisms must be defined to monitor attendance;
• mechanisms to verify participants’ level of understanding must be included.

Training can be classified as general or specific. General training must involve all levels of the organization, enabling each individual to become aware of:

• the provisions contained in the Decree regarding the administrative liability of entities, the offenses, and the sanctions provided therein;
• the Disciplinary System;
• the Guidelines and control principles contained in the internal operating procedures and standards of conduct;
• the powers and duties of the Supervisory Body (OdV);
• the internal reporting system concerning the OdV.

Specific training, on the other hand, concerns all individuals whose activities require specific expertise related to the Model, such as personnel operating in areas identified as potentially at risk for the commission of certain offenses under the Decree. Specific training must enable individuals to:

• be aware of the potential risks associated with their activities, as well as the specific control mechanisms to be activated to monitor those activities;
• understand risk assessment techniques related to their activities, as well as the precise methods for carrying out such activities and the procedures governing them, in order to acquire the ability to identify potential anomalies and report them promptly for the implementation of possible corrective actions.

Individuals assigned to internal control, responsible for monitoring activities identified as potentially at risk, will also receive specific training to make them aware of their responsibilities and their role within the internal control system, as well as the sanctions they may face if they fail to fulfill those responsibilities and roles.

In the event of significant changes or updates to the Model, targeted training modules will be organized to inform individuals about the changes made. Additionally, specific modules will be provided for newly hired employees assigned to work in risk areas.

Communication

In accordance with the provisions of the Decree and the Guidelines, the Company will ensure full dissemination of this Model, to guarantee that all personnel, corporate bodies, external collaborators, and contractual counterparties are aware of all its elements.

Communication must be widespread, effective, clear, and detailed, with periodic updates related to changes in the Model, in compliance with the provisions of the Guidelines. In particular, communication must:

• be sufficiently detailed in relation to the hierarchical level of the recipient;
• use the most appropriate and easily accessible communication channels for the recipients, in order to provide timely information, allowing the personnel to utilize the communication effectively and efficiently;
• be high-quality in terms of content, timely, updated, and accessible.

The actual communication plan relating to this Model must be developed, in line with the principles defined above, through the corporate communication tools deemed most appropriate, such as sending emails, publishing on the corporate intranet, or delivering a hard copy of the Model (with an acknowledgment of receipt).

New hires are provided with an informational package containing, in addition to the documents typically provided to new employees, the Model and the Decree, to ensure they acquire knowledge deemed of primary importance.

All external collaborators and contractual counterparties (consultants, suppliers, etc.) must be provided with appropriate information about the Model at the time of contract negotiation. Such dissemination may take different forms, depending on access to company regulations, such as delivering a hard copy of the Model (with acknowledgment of receipt) and possibly distinguishing based on the type of contractual relationship and the type of activity performed in relation to the Predicate Offense risks under the Decree.

²  The training program will be prepared in compliance with the requirements set out in the Confindustria Guidelines, updated on 31 March 2008, in March 2014, and in June 2021.

The Company promotes awareness and compliance with the Model among commercial and financial partners, consultants, collaborators of any kind (even occasional), interns, trainees, agents, clients, suppliers, and, in general, anyone with professional or contractual relationships with the Company (“Third Parties”).

For this purpose, the Company and the relevant functions will define specific information and ensure the dissemination of the content of the Model (General Section) to Third Parties, as they are also required to adopt behavior in compliance with the regulations and not to cause or induce violations of the Company’s Model.

The Company may also:

a) provide Third Parties with adequate information on the policies and procedures outlined in the Model;

b) include contractual clauses in agreements with Third Parties aimed at ensuring compliance with the Model;

c) for their part.

In particular, in this regard, the Company may expressly reserve the right to terminate the contract in the event of conduct by Third Parties that induces the Company to violate the provisions of the Model.

Notification to the Supervisory Body by Third Parties or Recipients

Third Parties and/or Recipients are also required to immediately inform the Supervisory Body (OdV) in the event that they receive, directly or indirectly, or become aware of violations of the Model.

Reports are to be made using the channels indicated in the whistleblowing procedure, available at the following link: https://selectaspa.it/whistleblowing/.

The Company guarantees Third Parties confidentiality and anonymity, ensuring that they will not suffer any consequences due to their reporting activity and that, under no circumstances, will this prejudice the continuation of the existing contractual relationship.

Since the Model is an “act issued by the governing body” (in accordance with the provisions of Art. 6, paragraph 1, letter a), of Legislative Decree No. 231/01), its adoption, as well as any subsequent amendments and integrations necessary due to emerging corporate needs or regulatory adjustments, are entrusted to the competence and responsibility of the Board of Directors.

In particular, the Board of Directors, also upon the recommendation of the Supervisory Body (OdV), is required to integrate the Model with additional Special Sections relating to other types of offenses which, due to new regulations or subsequent decisions, necessities, or activities of the Company, may be deemed relevant. This activity will also aim to ensure that no amendments are introduced that could conflict with or reduce the effectiveness of the Model.

The OdV, in particular, is tasked with identifying and reporting the need for amendments or integrations to the Model concerning, among other things:

• the introduction of new procedures and controls in cases where a review of existing ones is insufficient;
• the revision of corporate and company documents that formalize the assignment of responsibilities and tasks to positions responsible for “sensitive” organizational structures or that play a key role in high-risk activities;
• the introduction of additional controls for sensitive activities, with the formalization of improvement initiatives undertaken in specific procedures;
• the identification of needs to integrate general rules;
• the introduction of new Special Sections that take into account new categories of offenses added to the Decree or new activities undertaken by the Company.