Kolbe Lecco has set up this internal reporting channel pursuant to Italian Legislative Decree no. 24 of 10 March 2023, which transposes Directive (EU) 2019/1937 on the protection of persons who report breaches. This procedure explains who can report, what can be reported, how reports are handled and which protections are guaranteed.
If Kolbe Lecco has published its own procedure (see the documents at the bottom of the page), it prevails over this default procedure.
1. Legal framework
This procedure applies Legislative Decree 24/2023, the guidelines of the Italian National Anti-Corruption Authority (ANAC) and, where relevant, Regulation (EU) 2016/679 (GDPR) and Legislative Decree 231/2001.
2. Who can report
Anyone who has become aware of a breach in their work context with Kolbe Lecco can report it, in particular:
- employees, including those on probation, and self-employed workers;
- collaborators, freelancers and consultants;
- volunteers and trainees, paid or unpaid;
- shareholders and persons with administrative, management, control, supervisory or representative functions;
- workers and collaborators of suppliers of goods, services or works.
Reports can also be made before the relationship has started (for example during recruitment), during the probation period and after it has ended, if the information was acquired in the course of the relationship.
3. What can be reported
Conduct, acts or omissions that harm the public interest or the integrity of Kolbe Lecco, such as:
- administrative, accounting, civil or criminal offences;
- conduct relevant under Legislative Decree 231/2001 or breaches of the organisation and management model;
- breaches of European Union law in areas such as public procurement, financial services and the prevention of money laundering, product and transport safety, environmental protection, public health, consumer protection, privacy and personal data protection, competition and State aid.
Depending on the nature and size of the organisation, the Decree may limit the matters that can be reported: the procedure adopted by Kolbe Lecco specifies those that apply.
Complaints, claims or requests of a personal nature that concern exclusively one's own employment relationship or relations with superiors are not whistleblowing: the ordinary channels must be used for them.
4. How to report
Reports are submitted through this platform, available 24 hours a day from computers and smartphones. You can report:
- in writing, by filling in the form and attaching any documents;
- orally, by recording a voice message: the voice is altered before being saved, so it cannot be recognised;
- on request, in a meeting with the report manager, which can be requested through the chat of the report.
Once the report has been sent, the platform shows an identification code: keep it safe, as it is the only way to follow the report, read the replies and send additional information. If you provide an email address you will also receive notifications, but the address is not shown to the report manager.
Reports should be as detailed as possible: when and where the events took place, a description of them, any details that make it possible to identify who committed them, other people who may know about them and supporting documents.
5. Handling of the report and deadlines
The report is received by the manager appointed by Kolbe Lecco: an autonomous internal person or office with trained staff, or an autonomous external party. The manager:
- issues an acknowledgement of receipt within seven days of receiving the report;
- keeps in touch with the reporting person and, if necessary, asks for additional information;
- assesses the report and diligently follows it up;
- provides feedback within three months of the acknowledgement of receipt or, if no acknowledgement was sent, within three months of the end of the seven-day period after the report was submitted.
The status of the report, the messages and the feedback can be checked at any time on this platform by entering the identification code.
6. Confidentiality
The identity of the reporting person and any information from which it may be deduced are not disclosed, without their express consent, to anyone other than the persons competent to receive or follow up the report. The same confidentiality protects the persons concerned or mentioned in the report and the facilitators.
The platform stores the contents of reports, the identity of the reporting person, messages and attachments in encrypted form; it removes metadata from uploaded files and records the operations performed by the managers.
7. Anonymous reports
Reports can be made anonymously. Anonymous reports are handled as provided for by the organisation's procedure, in particular when they are sufficiently detailed. If an anonymous reporting person is later identified and suffers retaliation, the protections provided for by the Decree apply to them.
The manager may ask the reporting person to disclose their identity when this is necessary to follow up the report: the reporting person is free to accept or not.
8. Prohibition of retaliation and protection measures
Any form of retaliation against those who report in good faith, i.e. with reasonable grounds to believe that the information was true at the time of reporting, is prohibited: for example dismissal, demotion, transfer, failure to promote, negative assessments, intimidation or discrimination. Retaliatory acts are null and void.
The protections extend to facilitators, to persons in the same work context who have a stable emotional or family relationship with the reporting person up to the fourth degree, to colleagues who have a regular and current relationship with them and to entities owned by the reporting person or for which they work.
Any retaliation suffered can be reported to ANAC. The Third Sector entities listed by ANAC offer free support measures to reporting persons.
9. ANAC external channel and public disclosure
In addition to the internal channel, the reporting person can use the external channel managed by ANAC when:
- the internal channel is not active or does not comply with the Decree;
- they have already made an internal report that has not been followed up;
- they have reasonable grounds to believe that an internal report would not be effectively followed up or could lead to a risk of retaliation;
- they have reasonable grounds to believe that the breach may constitute an imminent or manifest danger to the public interest.
Information on how to report to ANAC is published at www.anticorruzione.it. In the cases provided for by Article 15 of the Decree, public disclosure is also possible; it is always possible to report to the judicial or audit authorities.
10. Data processing and retention
Personal data are processed by Kolbe Lecco, as data controller, in compliance with the GDPR and only to handle the report; data that are clearly not useful are not collected or, if collected accidentally, are deleted.
Reports and the related documentation are kept for as long as necessary to handle them and in any case no longer than five years from the date on which the final outcome was communicated.
11. Liability of the reporting person
This procedure does not affect the criminal and civil liability of the reporting person. When their criminal liability for defamation or slander, or their civil liability for wilful misconduct or gross negligence, is established, even by a first-instance judgment, the protections are not guaranteed and a disciplinary sanction may be imposed; in the cases provided for by Article 21 of the Decree, ANAC may also impose an administrative fine of 500 to 2,500 euros.
Reports that are manifestly unfounded or made for the sole purpose of harming the reported person are also a source of liability.
Last update of the default procedure: 20/10/2026