Whistleblowing Privacy Policy

pursuant to  EU Regulation 2016/679 for the protection of personal data

In compliance with the provisions of EU Reg. 2016/679 (European Regulation for the Protection of Personal Data) and Legislative Decree 196/2003, as amended by Legislative Decree No. 101/2018, through this privacy policy Next Yacht Group S.r.l. - as Data Controller - provides you the necessary information regarding the processing of your personal data acquired through the special channel for whistleblowing misconduct or irregularities (so-called Whistleblowing), pursuant to Legislative Decree 24/2023

1. DATA CONTROLLER

Data Controller - pursuant to art. 4 and 24 of EU Reg. 2016/679 - is NEXT Yacht Group S.r.l., having its registered office in Lungocanale Palombari dell’Artiglio 42, 55049, Viareggio (LU), VAT number 02466190465.

The Data Controller can be contacted at the following e-mail address: privacy@nextyachtgroup.com

The Data Controller has also appointed a Data Protection Officer (DPO) who can be contacted for questions relating to the processing of your personal data at the following e-mail address: dpo@nextyachtgroup.com

2. TYPE OF DATA PROCESSED AND COLLECTED

The Data Controller will process the following personal data provided through the online reporting platform "Whistleflow" provided by the company Basis lnformation Technology S.r.l:

- personal and contact data of the whistleblower  and any facilitators and type of relationship with the company (in the case of non-anonymous whistleblowing);

- personal and contact data of the reported person or other persons mentioned in the whistleblowing and any other non-predeterminable information disclosed to describe the whistlestblowed facts;

- personal data belonging to special categories, if included in the whistleblowing.

Personal data that are manifestly not useful for the processing of a specific report, if accidentally collected, are immediately deleted.

3. PROCESSING PURPOSES AND LEGAL BASIS 

We inform you that we will process your personal data in compliance with the conditions of lawfulness - pursuant to art. 6 EU Reg. 2016/679 - within the limits and to the extent strictly necessary to fulfill the following purposes:

a) fulfillment of obligations under Legislative Decree 24/2023 or other national and/or European regulations;

b) management of the Whilsblowing made pursuant to Legislative Decree No. 24/2023 and taking of any necessary measures;

c) to suppress or prevent unlawful conduct as well as to protect the rights and legitimate interests of the Data Controller, including in court.

Legal basis of the processing is the following:

- for the purposes referred to in (a) and (b),  the fulfillment of a legal obligation to which the Data Controller is subject, pursuant to Art. 6, para. 1(c) EU Reg. 2016/679;

- for the purpose referred to in (b), with specific reference to the disclosure of the identity of the whistleblower and the preservation for documentation purposes of whistleblowing recorded by telephone or through voice messaging systems or otherwise in oral form, by the consent of the whistleblower, pursuant to Art. 6, para. 1(a) EU Reg. 2016/679;

- for the purposes referred to in (c), by the legitimate interest of the Data Controller, pursuant to Art. 6, para. 1(f) EU Reg. 2016/679;

4. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Personal data collected may be disclosed to recipients who will process personal data as Data Processors and/or as "autonomous" Data Controllers.

Specifically, the data may be disclosed to the following persons/entities:

- the company Basis Information Technology S.r.l., provider of the "Whistleflow" platform, specifically designated as the Data Processor, pursuant to Art. 28 EU Reg. 2016/679;

-   the company Claris S.r.l., designated under art. 28 EU Reg 2016/679 for the management of the whistleblowing;

-  only as necessary, firms or companies within legal and advisory relationships for support in the phases

of whistleblowing management;

- ANAC and other competent authorities for the fulfillment of legal obligations and/or provisions of public authorities, upon request.

5. TRANSFER OF DATA TO A THIRD COUNTRY AND / OR AN INTERNATIONAL ORGANIZATION

The personal data provided will not be transferred to a third country and / or an international organization.

It should also be noted that the servers of the service provider company are located within the territory of the European Union.

6. PERIOD OF RETENTION  OR CRITERIA USED TO DETERMINE SUCH PERIOD

The processing will be carried out using computer or manual methods and tools designed to ensure maximum security and confidentiality, by persons specifically authorized to do so.

In compliance with the provisions of Art. 5 EU Reg. 2016/679 and the principle of minimization, and in accordance with Art. 14 of Legislative Decree 24/2023, the data collected through the whistleblowing and related documentation shall be retained for as long as necessary for the processing of the report and in any case no longer than five years from the date of the communication of the final outcome of the whistleblowing procedure, in compliance with the confidentiality obligations provided for in the regulations.

7. RIGHTS OF THE DATA SUBJECTS AND METHODS OF EXERCISE OF SUCH RIGHTS  

In your capacity as a data subject, you can enforce your rights referred to in Chapter III (articles 15-22) of EU Reg. 2016/679 by contacting the Data Controller by e-mail at privacy@nextyachtgroup.com, by registered letter to the address of the company's registered office or by delivery of a hard copy.

The rights you enjoy, pursuant to EU Reg. 2016/679, are the following:

-       access;

-       rectification;

-       cancellation;

-       withdrawal of consent;

-       limitation of processing;

-       objection to processing;

-       portability.

These rights are guaranteed to you without any formalities for their exercise, which is essentially free of charge.

Without prejudice to any other administrative or judicial action, the data subject can lodge a complaint with the Supervisory Authority in accordance with the provisions of EU Regulation 2016/679 and the Privacy Code, as amended by Legislative Decree 101/2018.

It should be noted that, pursuant to Article 2-undecies of Legislative Decree No. 196/2003, as amended, the aforementioned rights may not be exercised by certain data subjects involved in the whistelblowing (reported persons and/or other persons involved in the whistelblowing), if the exercise of such rights may result in actual and concrete prejudice to the confidentiality of the identity of the whistelblower.