Data controller and purposes - Below is the information relating to the collection and processing of personal data by Valentino S.p.A., with registered office in Milan, via Turati 16/18, 20121, as data controller (hereinafter also the "Owner" or the "Company", or "VALENTINO") in relation to reports of potentially illicit conduct pursuant to Legislative Decree. 10 March 2023, n. 24, which implements Directive (EU) 2019/1937 (hereinafter the "Reports").
Personal data processed - The processing of personal data in relation to reports will take place in compliance with the GDPR, as well as other applicable laws and/or regulations within the limits of compatibility with the GDPR itself.
In particular, to process the report and for the related management of the same, the personal data of the Reporter may be processed, as well as the personal data of the subject/s subject to the report (such as name, position held, etc.) as well as any further data connected to the case reported and subsequent checks (data of the so-called "facilitators" or subjects involved in the Report).
Method of processing - The Data Controller will process only the data strictly necessary for the management of the report, deleting any excessive or irrelevant data.
However, each Reporter is invited to indicate only data strictly necessary for the report and to omit any further data that may prove irrelevant or excessive. In particular, you are invited to omit any data belonging to particular categories of yourself and/or of the reported subject (such as data relating to health, sexual orientation and/or religion) that are not relevant to the report.
In order not to compromise the possibility of effectively evaluating the merit of the report and/or collecting the necessary evidence, the reported person may not be immediately informed of the processing of his/her data, to guarantee the correct management of the investigations and in any case in compliance with what provided for by the applicable legislation and for the time strictly necessary.
Legal basis - The legal basis of the processing lies in the fulfillment of the obligations assumed by the Company through its Code of Ethics, also in light of Legislative Decree 231/01 and in the legal and contractual obligations of the Company also assumed directly towards its employees and collaborators.
Furthermore, where required by applicable law, the legal basis of the processing lies in the consent of the Reporter collected in the manner deemed appropriate and in compliance with local legal provisions.
Scope of knowledge of the data - The data will be known by the subjects belonging to the Ethics Committee and by a limited number of subjects supporting the Ethics Committee, as well as any other colleagues who may be involved, always guaranteeing full compliance with the rule of strict necessity and relevance.
In some cases, the data may also be known by external consultants and professionals (such as lawyers) and by Public Authorities, where the case reported involves the need to undertake specific protection and safeguard actions.
Storage and transfer of data - The data relating to the reports will be stored and managed in Europe, however it may be necessary to communicate abroad any information pertinent to the individual Report in order to allow its management. Valentino will in any case carry out data transfers to countries even outside the European Union, guaranteeing the necessary organizational and technical security measures.
The data will be kept for a period strictly connected to the specific purpose - and in any case no later than five years from the date of communication of the final outcome of the reporting procedure - i.e. the management of the report and its documentation where this is necessary for purposes of protection of the Company and/or the subjects involved, including judicial protection.
The data will be stored in both physical and electronic repositories, closed and accessible only to authorized parties.
Rights recognized to the interested party - Please remember that it is always possible to contact the Data Protection Officer appointed by Valentino S.p.A. by writing to privacy@valentino.com to request, within the limits of the law, access to your personal data, rectification, cancellation of the same, limitation of processing or to oppose the same, in addition to the right of portability. Please remember that it is also always possible to lodge a complaint with the Data Protection Authority, competent for illicit data processing.
Where, however, there is a risk that from the exercise of the rights recognized to the interested party referred to in the articles. from 15 to 22 of the GDPR (exercisable with a request to the data controller or with a complaint to the Data Protection Authority, competent in matters of illicit data processing) may result in an effective and concrete prejudice to the confidentiality of the identity of the Reporter and that the ability to effectively verify the validity of the Report or to collect the necessary evidence could be compromised, we reserve the right to limit or delay the exercise of said rights, in accordance with the provisions of the applicable legal provisions.
