Posted on by Valentina Remonato

Video course Model 231 – OVV SpA

Course text: link

    NAME and SURNAME:

    FUNCTION/TASK/ROLE IN THE COMPANY:

    1. What is the main purpose of the 231 Organizational Model adopted by OVV S.p.A.
    A) Reduce company costsB) Prevent the commission of certain crimes and protect the entityC) Improve employee productivityD) Promote relationships with the Public Administration

    2. Which legislation introduced the administrative liability of entities in Italy
    A) Legislative Decree 81/2008B) Legislative Decree 196/2003C) Legislative Decree 231/2001D) Law 300/1970

    3. Who can commit crimes that entail liability for the organization pursuant to Legislative Decree 231/2001
    A) Only administratorsB) Only employeesC) Top management and those who operate under their direction or supervisionD) Only external suppliers

    4. Which of the following is an example of a predicate crime of Legislative Decree 231/2001
    A) Delay in coming to workB) Manslaughter with violation of workplace safety regulationsC) Failure to respect employee holidays

    5. Which of these is a sanction provided for by Legislative Decree 231/2001
    A) Holiday deductionB) Prohibition on contracting with the Public AdministrationC) Mandatory transfer of employees

    6. Who supervises the effective implementation of Model 231 in OVV S.p.A.
    A) The Board of DirectorsB) The Supervisory BodyC) The Board of AuditorsD) The Personnel Manager

    7. Which requirement is NOT required of the Supervisory Body
    A) AutonomyB) IndependenceC) ProfessionalismD) Political affiliation

    8. What is the main function of the Disciplinary System envisaged by Model 231
    A) Regulate employee holidays and leaveB) Establish sanctions in case of violations of the company model and proceduresC) Define the company's economic objectivesD) Organize commercial activities with suppliers

    9. What is meant by “personal data” according to the GDPR
    A) Only sensitive data relating to healthB) Any information relating to an identified or identifiable natural personC) Only the employee's first and last nameD) Only data collected via the internet

    10. What employees and collaborators must do in relation to Model 231
    A) Simply knowing about its existenceB) Respect the rules and report any violationsC) Approve the budget annuallyD) Prepare periodic tax reports

    To write to the SB: contacts ✉

    ➡️

    INFORMATION ON THE PROCESSING OF PERSONAL DATA BY THE SUPERVISORY BODY

    OVV S.P.A.  as Data Controller, we inform you as required pursuant to the articles. 13-14 EU Regulation 2016/679 (hereinafter GDPR) that personal data will be processed in the manner and for the purposes indicated below.

    Definitions

    • Processing is any operation or set of operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal data.
    • The data controller determines the purposes and means of the processing of personal data.
    • Personal data is "any information relating to an identified or identifiable natural person, this person is referred to as the interested party". An "identifiable natural person is considered to be one who can be identified, directly or indirectly, with particular reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more characteristic elements of his physical, physiological, genetic, mental, economic, cultural or social identity" (art. 4 GDPR).
    • Special data is data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data intended to uniquely identify a natural person, data relating to the person's health or sexual life or sexual orientation (art. 9 GDPR).
    • Sensitive data includes both specific data (art. 9 GDPR) and data relating to criminal convictions and crimes (ex art. 10 GDPR).
    • Common data is non-sensitive data.

    Purpose of processing, legal basis and source of data

    The supervisory body processes personal data communicated to it as part of the exercise of its supervisory activity as required by Legislative Decree 231/2001. It is forbidden to communicate data that is not lawfully processed.

    The data is processed for the execution of the activities necessary for the assignment received from OVV S.P.A., for the fulfillment of obligations or the exercise of rights as provided by law.

    The processing, such as the updating, verification and use of personal data, may also be a consequence of access to public registers (e.g. data relating to the shareholders of a company in the Business Register - Official Archive of the Chamber of Commerce).

    The same client company can communicate personal data to the Supervisory Body.

    Personal data is processed for the following purposes:

    • carry out the agreed activity, therefore the legal basis consists in pre-contractual measures or in the contract which can be written or oral, for example data processing to fulfill pre-contractual needs, processing activities necessary for the execution of the requested activity (art. 6.1,b GDPR);
    • ascertain, exercise or defend a right in court, therefore the legal basis for the processing of particular data lies in article 9.2, g GDPR.
    • pursue a legitimate interest of the Supervisory Body, therefore within the limits of what can reasonably be expected, the Supervisory Body has the right to effectively carry out its activities, such as sending communications, responding to requests received, acting or defending itself in court.  It is possible that personal data may be legitimately and freely communicated to the Supervisory Body without having been requested. In this case, the data is received by the Data Controller as part of its general activity and processed on the basis of legitimate interest (ex art. 6.1, f GDPR). The data sent freely by the interested party are processed lawfully also with the consent of the interested party (legal basis pursuant to art. 6.1, a GDPR).
    • fulfill a legal obligation for example deriving from Legislative Decree 08 June 2001 n. 231 (legal basis pursuant to art. 6.1,c GDPR).

    The personal data communicated through whistleblowing reports are processed for the purpose of:

    • investigate reports relating to alleged offenses or non-compliance with applicable regulations, including violations within the organisation;
    • fulfill the legal and regulatory obligations imposed on whistleblowing;
    • guarantee the protection of the whistleblowers and the individuals involved, protecting their confidentiality and personal data, including sensitive or particular ones, that could be included in the reports.

    Legal basis for the processing of data provided in whistleblowing reports:

    • For common personal data, the processing is based on the legal obligation to which the data controller is subject (Article 6.1,c GDPR), deriving from national and European Union legislation on whistleblowing (Legislative Decree 10 March 2023, n. 24, Legislative Decree 08 June 2001 n. 231).

    Legal basis for the processing of sensitive data provided in whistleblowing reports:

    • processing of particular data for obligations and rights in the field of employment, social security and social protection (Article 9.2,b GDPR), if the processing is necessary to fulfill legal obligations relating to the management of whistleblowing reports, including provisions for the protection of workers (including preventing retaliation).
    • processing of particular data for reasons of significant public interest (Article 9.2, g GDPR) for which processing is necessary as established by national legislation governing whistleblowing, including adequate guarantees for the rights and freedoms of data subjects.
    • the processing of personal data relating to the reporting of crimes (whistleblowing) takes place as authorized by European Union and national law which provides appropriate guarantees for the rights and freedoms of interested parties as indicated by law, in compliance with art. 10 GDPR; the legal basis is both the legitimate interest in ascertaining any wrongdoing (art. 6.1,f), and the fulfillment of a legal obligation (art. 6.1,c).

    What data is processed

    For the purposes indicated in this information, common personal data (so-called ordinary) are processed which are, for example, identification and contact data (name, surname, tax code, address, telephone number, e-mail and other contact data).

    Sensitive personal data (pursuant to art. 9 and 10 GDPR) may be processed in the management of whistleblowing reports and particular data (pursuant to art. 9 GDPR) to ascertain, exercise or defend a right in court.

    Categories of recipients

    Without prejudice to the communications carried out in fulfillment of legal and contractual obligations, the data collected and processed may be communicated exclusively for the purposes specified above to external companies or professional firms that provide assistance for the exercise of rights and the fulfillment of legal obligations deriving from the supervisory activity carried out (e.g. accountants, lawyers, specialized consultants), credit institutions, public administrations for the performance of institutional functions within the limits established by law or regulations (e.g. Chamber of Commerce, Revenue Agency, Court, ANAC, accounting or guarantee authority). Recipients of the data may also be IT companies or IT operators who provide IT services or IT assistance (e.g. cloud storage services such as electronic invoicing, services relating to hosting and data traffic managers, services for the IT management of whistleblowing reports). For the pursuit of the purposes described above, personal data is known by subjects who operate as persons authorized by the Data Controller to process personal data, these subjects assist or work for the Data Controller in order to allow it to carry out its business efficiently (e.g. collaborators, employees, administrators, corporate bodies).

    The subjects belonging to the above categories act, in some cases, as data controllers. The data is not disclosed. Further clarifications can be obtained by contacting the Owner.

    Period of retention of your personal data

    Personal data relating to whistleblowing reports will be processed in accordance with the provisions of Legislative Decree 10 March 2023, n. 24. Such data will be kept for the time strictly necessary to process the report and in any case no later than five years from the date of communication of the final outcome of the reporting procedure, without prejudice to the longer term where provided for by law.

    In general, personal data will be processed by the Data Controller for the time necessary to establish and manage the existing relationship.  The data subject to conservation obligations established by law or potentially necessary for the protection of rights deriving from the existing relationship will be stored in compliance with the relevant regulations. The storage time therefore generally corresponds to ten years.

    Mode

    The processing of personal data will take place using suitable tools to guarantee its security and confidentiality in compliance with the provisions of the art. 32 GDPR.

    The personal data provided to the Data Controller by the reporting person for the purpose of representing the alleged illicit conduct of which he has become aware, by reason of his relationship with the Data Controller, committed by the subjects who work for the Data Controller, including those falling within the special categories or judicial data (so-called sensitive), are processed in compliance with the principle of minimization, relevance and non-excess, for the purpose of carrying out the necessary investigative activities aimed at verifying the validity of the facts being reported as well as for the adoption of the consequent measures by the Data Controller or, if the conditions are met, by the competent authorities indicated in the art. 11, Legislative Decree no. 24/2023.

    Data transfer

    Any transfer of personal data outside the EU is regulated by specific contracts aimed at requiring the recipient to comply with the adequate guarantees provided for by current legislation on Privacy, or by subjects who benefit from an adequacy decision (art. 44 et seq. GDPR); a copy of the adequate guarantees can be requested by contacting the Data Controller and obtained in the event of transfer.

    Consequences of failure to provide

    Failure to provide the data requested for contractual, pre-contractual purposes, exercise of rights and legal obligations will make it impossible for the Data Controller to fulfill what is requested of him and his legal obligations. No consequences are foreseen for failure to provide data for the purposes of legitimate interest described above, except for effects relating to lower organizational efficiency.

    Rights of the interested party

    As an interested party, you are granted all the rights provided regarding the protection of personal data, with particular reference to the articles. 15 to 21 GDPR the following rights are highlighted.

    • Right of access, art. 15 GDPR: right to obtain confirmation as to whether or not personal data concerning you is being processed and, in this case, obtain access to your personal data, including a copy of the same;
    • right of rectification, art. 16 GDPR: right to obtain, without unjustified delay, the rectification of inaccurate personal data concerning you and/or the integration of incomplete personal data;
    • right to cancellation (right to be forgotten), art. 17 GDPR: right to obtain, without unjustified delay, the cancellation of personal data in accordance with the terms indicated in EU Regulation no. 679/2016;
    • right to limit processing, art. 18 GDPR, it allows you to obtain the limitation of processing, when: a) the interested party contests the accuracy of the personal data; b) the processing is unlawful and the interested party opposes the deletion of the personal data and instead requests that their use be limited; c) although the Data Controller no longer needs them for the purposes of the processing, the personal data are necessary for the interested party to ascertain, exercise or defend a right in court; d) the interested party has objected to the processing, as indicated below, pending verification regarding the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party;
    • right to data portability, art. 20 GDPR: right to receive, in a structured format, commonly used and readable by an automatic device, the personal data concerning you provided to the Data Controller and the right to transmit them to another Data Controller without impediments, if the processing is based on consent and is carried out by automated means. Furthermore, the right to have your personal data transmitted directly from the Data Controller to another Data Controller if this is technically feasible;
    • right of opposition, art. 21 GDPR: right to object, at any time, to the processing of personal data concerning you based on the condition of lawfulness of legitimate interest, including profiling, unless there are legitimate reasons for the Data Controller to continue processing which prevail over the interests, rights and freedoms of the interested party or for the establishment, exercise or defense of a right in court. It should be noted that the owner does not carry out profiling or marketing activities directed at natural persons.
    • revoke the consent previously given without prejudice to the lawfulness of the processing based on the consent given before the revocation, the processing can continue only if another suitable legal basis exists.
    • lodge a complaint with the Guarantor Authority (Guarantor for the protection of personal data). For further information you can consult the website of the Guarantor for the Protection of Personal Data: www.gpdp.it.

    Exercise of rights with reference to whistleblowing reports

    It is specified that pursuant to art. 13, paragraph 3, Legislative Decree no. 24/2023, the rights referred to in articles 15 to 22 of the GDPR can be exercised within the limits of the provisions of article 2-undecies, letter. f), of the Privacy Code, according to which, in the text modified by the art. 24, paragraph 4, Legislative Decree no. 24/2023, "cannot be exercised with a request to the data controller or with a complaint pursuant to Article 77 of the Regulation if the exercise of these rights could result in effective and concrete prejudice [...] to the confidentiality of the identity of the person reporting violations of which he or she became aware by reason of his/her employment relationship or the functions performed, pursuant to the legislative decree implementing Directive (EU) 2019/1937 [...], concerning the protection of persons who report violations of the Union law […]”.

    Primary method of exercising rights

    You can exercise your rights at any time through the contact channels made available, for greater certainty of receipt of the request we recommend sending a registered letter with return receipt. to OVV S.P.A.  with registered office in Via Dante Alighieri n. 67, 24040 Castel Rozzone (BG) or a pec a officinevv@legalmail.it.

    Owner and further contact details

    The data controller is OVV S.P.A.  with registered office in Via Dante Alighieri n. 67, 24040 Castel Rozzone (BG), Tel 39 0363 380411, Fax 39 0363 815948, E-Mail: info@ovv.it, VAT number – Tax code and registration number. to the Bergamo Company Register: 00787180165.

    VIDEO COURSE AND QUIZ➡️

    COURSE TEXT

    Welcome to the Ovv SpA Model 231 training course
    This information path is aimed at all internal subjects and is aimed at increasing awareness regarding the adopted Organizational Model 231.

    Below this video you will find the link to the text of the explanation addressed and a questionnaire.

    The questionnaire will be received exclusively by the Supervisory Body, which will use it solely to verify the assimilation of the contents.

    The Supervisory Body of Ovv S.p.A. is made up of Dr. Alessandro Remonato, engineer Francesco Agazzi and lawyer Valentina Remonato, who holds the position of President.

    Legislative Decree 231/2001

    Ovv S.p.A. has adopted its own organizational model in compliance with Legislative Decree no. 231 of 2001, legislation which introduced the administrative liability of legal persons in Italy.

    Based on the decree, companies can be held responsible for certain crimes committed in the interest or to the advantage of the entity by individuals who hold top positions or who operate under their direction or supervision.

    The predicate crimes include, by way of example:

      • manslaughter and serious or very serious injuries resulting from the violation of workplace health and safety regulations
      • tax and corporate crimes
      • embezzlement, extortion, corruption and undue inducement
      • crimes against industry and commerce
      • environmental crimes
      • irregular employment of foreign citizens
      • fraud or fraud against the State or the European Union
      • computer crimes.

    The list is extensive and in continuous legislative evolution.

    The sanctions

    The decree provides for very severe sanctions. As well as heavy fines pecuniary, interdictory measures are envisaged, such as:

      • prohibition on carrying out the activity
      • suspension or revocation of licenses and authorizations
      • ban on contracting with the Public Administration
      • exclusion from public contributions or funding.

    These are consequences that can permanently compromise the very life of the company.

    The Organizational Model

    To avoid liability, companies must demonstrate that they have adopted and effectively implemented an organizational and management model suitable for preventing crimes.
    The effectiveness of the model is assessed on the basis of its concrete prevention capacity and is subjected to control by the Supervisory Body.

    The Supervisory Body (OdV)

    The SB is appointed by the Board of Directors and must guarantee autonomy, independence and professionalism.
    It has the task of:

      • monitor the functioning of the model
      • verify compliance with the procedures
      • manage reports, including anonymous ones (whistleblowing)
      • propose model updates.

    Integration with company systems

    The 231 model integrates with management systems through the method PDCA:

      • Plan: identify risks and plan preventive actions
      • Do: implement organizational measures
      • Check: check the effectiveness of the measures through the Supervisory Body
      • Act: constantly correct and improve the system.

    Tools linked to the model

    The model includes three fundamental tools:

      • Code of Ethics, which defines corporate values ​​such as legality, respect for the Constitution, dignity of people, quality and business ethics.
      • Code of Conduct, which translates values ​​into practical rules of daily conduct: correct use of company assets and information, IT security, decorum and mutual respect.
      • Disciplinary System, which establishes proportionate sanctions for those who violate the rules, according to the principles of legality, transparency, graduality and adversarial nature.

    Internal controls and risk management

    The internal control system is based on:

      • separation of roles
      • traceability of decisions
      • transparency of processes.

    The main risk areas are covered by specific protocols, for example:

      • relations with the Public Administration
      • health and safety at work
      • environmental management
      • accounting and finance
      • protection of computer and personal data.

    Personal Data Protection

    The European GDPR Regulation and the Privacy Code guarantee that the processing of personal data takes place in full respect of people's rights and dignity.
    Personal data means any information that allows the identification of a natural person.
    The processing includes all operations on the data, from collection to storage up to deletion.

    Data subjects have specific rights, such as access, rectification, deletion and data portability.
    The company, as data controller, must guarantee transparency, security and correctness.

    The role of employees

    All employees and collaborators have the duty to:

      • know and respect the rules of the model
      • follow the operating procedures
      • report any risky behavior
      • contribute to an integral and respectful work environment.

    Violations can result in disciplinary sanctions up to dismissal, as well as serious consequences for the company.

    Model update

    The model is not static: it is periodically updated by the Board of Directors, with the support of the Supervisory Body, to always keep it adequate and compliant with the law.

    Conclusion

    Model 231 is a protection tool for the company and for every person who works there.
    Applying it means preventing risks, respecting the law and protecting the reputation and integrity of OVV S.p.A.

    VIDEO COURSE AND QUIZ➡️