Last updated: 18 September 2026
Made in Evolve S.r.l. adopts this policy in implementation of Legislative Decree 24/2023 (the Decree), which transposes Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law. Having fewer than 50 employees, the Company is not legally required to establish an internal reporting channel: it does so on a voluntary basis, applying the safeguards of the Decree to all persons listed in section 1. The policy allows the Reporting Person to report breaches and unlawful conduct learned of in the work context safely and confidentially, with identity protection, protection from retaliation and diligent follow-up, and supplements the Code of Ethics and Conduct.
The following may make a report and benefit from the protections:
The protections extend to Facilitators who assist the Reporting Person, to their colleagues and family members and to entities they own or work for (Article 3(5) of the Decree).
Reports may concern information, including well-founded suspicions, about Breaches committed or likely to be committed within the Company, and conduct aimed at concealing them:
The policy does not cover disputes or claims linked to a personal interest of the Reporting Person and relating exclusively to their own employment relationship (Article 1(2)(a) of the Decree), which follow ordinary channels, nor information that is manifestly unfounded, in the public domain or based on unsubstantiated rumours.
The internal channel is the mailbox help@madeinevolve.com, accessible only to the Handler referred to in section 3.2. Reports may also be made orally: upon request sent to the same mailbox, the Handler arranges a direct meeting within a reasonable time, documented by minutes signed by the Reporting Person or, with their consent, by a recording.
The report should contain a description of the facts, the period and place, the persons involved, any supporting documents and a contact address for communications. Anonymous reports are handled if sufficiently detailed; an anonymous Reporting Person who is subsequently identified enjoys the same protections against retaliation (Article 16(4) of the Decree).
Reports are handled by a person designated by the Company, autonomous from senior management, specifically trained and bound by a duty of confidentiality. The Handler receives no instructions on the merits of individual reports and informs the administrative body only to the extent necessary to adopt consequent measures. If the report concerns the Handler or a person connected to them, the Reporting Person may send it directly to the administrative body, which appoints a substitute.
| Stage | Deadline |
|---|---|
| Acknowledgement of receipt to the Reporting Person | Within 7 days of receipt |
| Investigation: exchanges with the Reporting Person, collection of documents, hearing of the persons involved | During the 3 months |
| Feedback to the Reporting Person on the outcome or on the status of the investigation | Within 3 months of the acknowledgement of receipt or, failing that, of the expiry of the 7 days |
| Closure or adoption of consequent measures (disciplinary, contractual, report to the authorities) | At the end of the investigation |
The investigation respects the right to be heard and the presumption of innocence of the person concerned, who is informed of the proceedings in a manner compatible with the investigation and with the confidentiality of the Reporting Person.
The identity of the Reporting Person and any information from which it may be inferred may not be disclosed without their express consent to persons other than the Handler (Article 12 of the Decree). In disciplinary proceedings the identity may be disclosed only where indispensable for the defence of the accused person and with the express consent of the Reporting Person, after written notice of the reasons; in criminal proceedings it is covered by secrecy within the limits of Article 329 of the Italian Code of Criminal Procedure. Confidentiality is also guaranteed to the person concerned and to the persons mentioned in the report.
Any Retaliation is prohibited, meaning any conduct, act or omission, even if only attempted or threatened, which causes or may cause unjust harm to the Reporting Person by reason of the report: for example dismissal, suspension, demotion, non-renewal, change of duties or workplace, negative evaluations, discrimination, early termination of a supply contract (Article 17 of the Decree). Retaliatory acts are null and void and in court the Company bears the burden of proving that the measure is based on reasons unrelated to the report. The protections apply if, at the time of the report, the Reporting Person had reasonable grounds to believe that the information was true and fell within the scope of the policy (Article 16 of the Decree).
In the cases and under the conditions set out in Article 6 of the Decree, where applicable, the Reporting Person may make an external report to the National Anti-Corruption Authority (ANAC) through the platform at www.anticorruzione.it: in particular where the internal report has not been followed up, where there are reasonable grounds to believe that it would not be effectively followed up or would entail a risk of retaliation, or where there is an imminent or manifest danger to the public interest. Public disclosure is protected only under the conditions of Article 15 of the Decree, in particular where the internal and external reports have not received feedback within the deadlines. Reporting to the judicial authorities remains unaffected.
Pursuant to Article 13 GDPR, the controller of the data contained in reports is Made in Evolve S.r.l., Via Rosalba Carriera 26, 41126 San Damaso, Modena (MO), which can be contacted at privacy@madeinevolve.com. The legal basis is compliance with the obligations and exercise of the powers provided for by the Decree (Article 6(1)(c) and (f) and Article 9(2)(g) GDPR). Data are processed by the Handler only, with appropriate technical and organisational measures, and disclosed only to legal advisers or authorities where necessary; data that are manifestly not useful are not collected or are deleted.
| Category | Retention |
|---|---|
| Reports, minutes, recordings and investigation documentation | For the time necessary to handle them and in any case no longer than 5 years from notification of the final outcome (Article 14 of the Decree) |
The rights under Articles 15 to 22 GDPR may be exercised by writing to privacy@madeinevolve.com; under Article 2-undecies of the Italian Privacy Code they may be restricted where this would cause actual and concrete prejudice to the confidentiality of the Reporting Person. A complaint may be lodged with the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it. In all other respects the Privacy policy applies.
The protections do not apply to those who report facts they know to be false or with gross negligence. Reports made with intent or gross negligence, established even at first instance in criminal proceedings for defamation or slander or in civil proceedings, constitute a disciplinary offence sanctionable under the applicable collective agreement and Article 7 of the Workers’ Statute and, for suppliers and contractors, just cause for termination of the contract (Article 16(3) of the Decree). ANAC’s administrative sanctions under Article 21 of the Decree remain applicable, for retaliation, obstruction of reporting, breach of confidentiality or established liability of the Reporting Person.
The policy is adopted by the administrative body, communicated to staff, published on this website and referred to in contracts with suppliers and contractors. The competent court is that of Modena; Italian law applies.
This English version is provided for convenience; in case of discrepancy the Italian version prevails.