WHISTLEBLOWINGP OLICY

— Table of Contents

1. PURPOSE

2

2. SCOPE OF APPLICATION

2

3. SCOPE OF REPORTING

2

4. OPERATING METHODS

2

a. Receipt of whistleblowing reports			 Whistleblowing reports received from outside dedicated channels
			 Content of whistleblowing reports
b. Preliminary assessmentc. Investigationd. Closing of reports

5. RECORD-KEEPING

4

6. MANAGEMENT OF CONFLICTS
OF INTEREST

5

7. COMMUNICATION, TRAINING AND
INFORMATION

5

8. GUARANTEES AND PROTECTION

5

a. Guarantee of Confidentialityb. Protection of Whistleblowerc. Protection of Whistleblower from retaliation and discriminations
d. Protection of Reported Person

9. DISCIPLINARY SANCTIONS AND
OTHER MEASURES

7

10. PERSONAL DATA PROTECTION

7

11. DEFINITIONS

8

12. REFERENCES

9— 1. Purpose
This procedure regulates the process for receiving andprocessing whistleblowing reports and the management of
the relevant investigations, in compliance with applicablelaws applicable to the whistleblower, the reported facts
and personal data protection.

Violations of orders issued by
Public Authorities;
Violations of Model 231 and company
procedures;
Violations of human rights;
Conduct that causes damage or harm, even if
only in terms of image, to the Prada Group.

— 2. Scope of
application
This procedure shall apply to all Prada Group
companies, both in Italy and abroad, to the PradaGroup Personnel, stakeholders and other third
parties, witnessing an offense or a wrongdoingreferable to the Prada Group personnel. The PradaGroup Personnel shall mean any persons referable
to it, such as directors, executives, other membersof the corporate and supervisory bodies, Groupmanagement and employees, third parties who are notGroup employees such as business partners, clients,
suppliers, audit firms, consultants, subjects acting on
behalf of the organization, associates, interns, etc.

Reports other than the cases described above, inparticular those referring to claims, complaints
or grievances of a commercial nature, will not beprocessed.

— 4. Operating methods
The process consists of the following steps:
Receipt of whistleblowing reports;
Preliminary assessment;
Investigation;
Closing of reports.

The management of whistleblowing reports andthe relevant personal data processing is carried out
by Prada S.p.A. also in the interest of other Group
Companies, in accordance with applicable law
provisions, including personal data protection laws
and regulations and in particular Regulation (EU)2016/679 on the lawfulness of the processing related
to personal data protection (GDPR).

a. Receipt of whistleblowing reports
The Prada Group, in order to ensure the effectivenessof the reporting process and provide extensive andindiscriminate access to all those who want to makea whistleblowing report, has made available many
alternate communication channels, such as:— 3. Scope of reportinga computer platform accessible from thewww.pradagroup.com website and thecompany intranet;

The following can be reported through theWhistleblowing channel:

e-mail at the address:
whistleblowing@pradagroup.com;

Violations of the Prada Group’s Code of Ethics
and its core values;

ordinary mail, at the address: Prada S.p.A.
via Antonio Fogazzaro 28, 20135 Milan(k.a. Internal Audit Department);

Violations of laws and regulations;

WHISTLEBLOWING POLICY

2

The Internal Audit Department is responsible formonitoring the functionality of these communication
channels and must be contacted in case of any
malfunction.
Moreover, whistleblowing reports can be sent to thesupervisory body of Prada S.p.A.
(organismo.vigilanza@prada.com) which ensures thatthey are forwarded to the Ethics Committee.
In the event that the whistleblower uses the computer
platform or the dedicated e-mail address to send
the whistleblowing report, Prada S.p.A. shall always
inform the sender that the whistleblowing report has
been acknowledged.
Although anonymous whistleblowing reports
are accepted, the Prada Group suggests thatwhistleblowers prefer named reports, in orderto streamline investigations and improve theireffectiveness.
Finally, if through the above-mentioned channels thewhistleblower requests an in-person meeting, theEthics Committee will make itself available to meetwith him/her to collect the report.
Whistleblower’s guarantees and protection are set out
in section 7 below, to which reference is made.

Whistleblowing reports received fromoutside dedicated channels
The Prada Group personnel receiving a whistleblowing
report from outside the dedicated channels shallforward the original and any annexes to the Internal
Audit Director without delay, in accordance withthe highest standards of confidentiality and withappropriate procedures to protect the whistleblower
and the identity and integrity of reported parties,
without prejudice to the effectiveness of the following
investigations.

Content of whistleblowing reports
The whistleblower reports the information in his/her possession based on well-founded reasons andtruthful news.
The following preliminary verification and assessment
phases are facilitated by reports with a precise anddetailed content, such as:
Description of reported facts, with indication of
known circumstances (manner, time, place);

WHISTLEBLOWING POLICY

Identification elements of the reported
person(s) as far as known;
Indication of any other persons who may reporton the facts being reported;
Indication, or if available, provision of any
documents supporting the report, in addition
to the identifying details of the whistleblower(e.g. personal and contact details), in cases of
non-anonymous reports.
In the event of unfounded reports, made in bad faithor with gross negligence, the Prada Group reserves
the right to act in defense of its interests and toprotect the harmed parties.

b. Preliminary Assessment
The Ethics Committee analyzes the whistleblowing
reports received and:starts the relevant investigation with thesupport, based on the nature of the report,of the Internal Audit Department, the Security
Department, the Legal Department, the CSR
Department or the HR Department, if thereport has a precise, detailed and verifiable
content and makes reference to significant
facts;
files the whistleblowing report, if its content
is non-detailed and/or unverifiable and theWhistleblower is not reachable to provide thenecessary information;
if the whistleblowing report concerns facts that
although concerning the Prada Groupdo not fall within the scope of applicationof this document (so-called “non-inherent
reports”, such as, including but not limited to,commercial complaints, commercial proposals,
marketing activities), sends it to the competentfunction of the Company or the Group, forthe management of the matter, which will be
responsible for informing the Audit andRisk Committee of Prada S.p.A. of the resultsof the verification activity;
refrains from dealing with the investigation
if the reported facts are known to be underinvestigation by public authorities (e.g. judicial
authorities and administrative bodies);3

files the report, if the report relates tofacts that were previously known and fully
ascertained, and without the new report addingor allowing for the addition of further elements
or aspects to what was already known(so-called solved reports).
Without prejudice to what is envisaged in the eventthat an investigation is started, the Department orfunction responsible for the investigation shall, at thefirst useful meeting of the Ethics Committee, reporton the above-mentioned whistleblowing reports,
giving reasons for the choices made.

c. Investigation
The objective of the investigation is to carry out
in-depth analyses in order to assess the validity ofreported facts.
To this end, the five departments (Audit, Security,
Legal, CSR and HR) forming the Ethics Committee
play an active role in the process, either singularly orcollectively, supported by the competent company
Functions and/or by external consultants dependingon the subject of the report. The Department(s)involved in the investigation shall report to the Ethics
Committee on its result and the latter may ask for thenecessary additions.

d. Closing of reports
The Ethics Committee shall examine the results of theinvestigation and:if the content of the report is confirmed,
it requests the definition of any necessary
measures to the competent functions andin compliance with the system of powers of
attorney in force;
if during the investigation (regardless of theoutcome) areas of weakness and/or points
for improvement of the internal control andrisk management system emerge, it may
request the implementation of the necessary
improvement actions; the Internal Audit
Department shall support the Management incharge for defining the action plans and shallmonitor (as part of the follow-up process) theirimplementation within the agreed time frame.

WHISTLEBLOWING POLICY

For reports falling within the scope of Law Decree
231/2001, the Internal Audit Director or a member ofthe Ethics Committee submits to the Supervisory Body
the results of the investigation before its final closurein order to collect any additional needs for further
assessment.
After hearing the opinion of the Supervisory Body
for reports concerning 231/2001 matters, theEthics Committee closes the report, classifying it as“Grounded” or “Ungrounded” and “With actions” or“Without actions” whether they are for improvementsof the Internal Control System or of any other type(e.g. reporting to judicial authorities). Finally, theEthics Committee activates the communication flows
between the Management and Control Bodies andthe other players of the internal control system,
including in particular the Audit and Risk Committee,
the Supervisory Body and the Executive in charge fordrafting the Accounting Documents.

— 5. Record-keeping
The Ethics Committee, supported by the Internal
Audit Department, guarantees that all original
documents on reports, as well as paperwork on theinvestigation and on the audits referred to the report,
are stored in appropriate computer repositories withthe highest security and confidentiality standards
in compliance with law provisions and according to
specific internal rules, if existing.
The personal data of the persons involved in thereport and in the following investigation, for any
reason (whistleblower, reported person and third
parties) are processed and stored in compliance withpersonal data protection laws.
In particular, if reported facts do not fall within thescope of Whistleblowing or cannot be ascertained,
Personal Data will be deleted or made anonymouswithin 30 days after receipt of the report.
If the report is unfounded and no judicial ordisciplinary action is finally launched, personal data
shall be deleted or made anonymous within 30 days
after the end of the investigation process. Anonymized
reports will be archived for 5 years.
If the report is founded and/or if a judicial ordisciplinary action is initiated, personal data will be
kept for 10 years or for such longer period as may

4be necessary to comply with legal provisions and/or
for judicial protection purposes, subject to ordinary
statutes of limitation.

— 6. Management ofconflicts of interest
In the event that reported facts concern:one or more members of the Ethics
Committee, either directly or indirectly, or
activities falling within the scope of theirorganizational responsibilities, these members
will be excluded from the management of thewhistleblowing report;
one or more members of the Board of Directorsof Prada S.p.A. or of the Group Companies(except for the Chairman), the duties of the
Ethics Committee shall be performed by the
Chairman of the Board of Directors of
Prada S.p.A..
In the event of further and different situations wherea member of the Ethics Committee is in a conflict ofinterest, he/she is required to declare the conflict.
The remaining members will assess the advisabilityof confirming or excluding the involvement of said
member in the meetings of the Ethics Committee
concerning the specific conflict issue.
The members of the Ethics Committee always
have access to the platform and to the e-mail box
whistleblowing@pradagroup.com, therefore eachof them has timely access to the reports received
through this channel.
In the event of a member of the Ethics Committee
having a conflict of interest, the other membersof the Ethics Committee shall temporarily disable
the Member from accessing the platform and thewhistleblowing email box.
In the event of further and different situations inwhich a member of the Ethics Committee has aconflict of interest, it is his or her responsibility to
declare the conflict. The advisability of involving
or excluding that member from Ethics Committee
meetings dealing with the specific conflict issue will beassessed by the remaining members.

WHISTLEBLOWING POLICY— 7. Communication,
training and information
The Ethics Committee is responsible for promoting
over time the necessary information and training
actions intended, when necessary, for the company
staff on the management of reports and, specifically,on the usefulness of the process, the support tools
and guarantees and protections of the Whistleblowers
and Reported Parties.

— 8. Guarantees andprotections
a. Guarantee of confidentiality
All Prada Group Personnel involved in various capacities
in the management of reports are required to ensure
confidentiality over the existence and content of thereport, as well as the identity of the Whistleblowers (ifknown) and Reported Parties.
Any disclosure on the existence and content of thereport, as well as the identity of the Whistleblowers (ifknown) and Reported parties, must strictly comply withthe “need to know” criterion.
To this end, the Ethics Committee shall record in theappropriate Register of Authorized Persons the listof persons to whom it has been necessary to provide
communications regarding each report and theinformation disclosed (e.g. existence and/or content
of the report, identity of the Whistleblower and/or theReported Party, outcome of the investigations carriedout).

b. Protection of whistleblower
The Prada Group guarantees the confidentiality of theidentity of the Whistleblower starting from the receipt of
the report, in compliance with law provisions.
For reports sent through the computer platformreferred to in 4.a above, the confidentiality of the
Whistleblower’s identity (as well as the content of thereport) is protected as follows:
the platform is issued by a specialized third
party, independent form the Prada Group;5the platform adopts the “no-log” policy,
i.e. it does not directly or indirectly detect
information on connection methods (e.g.
server, IP address, mac address), thus ensuring
full anonymous access. Moreover, the company
IT systems are not able to identify the accesspoint to the platform (IP address), even if
access is made from a computer connectedto the company network or through a link
available on the www.pradagroup.com website;
the platform guarantees high security
standards, using advanced encryption
algorithms and other methods of protection
from unauthorized access;the whistleblower may indicate his or her
name in his or her report or decide to remain
anonymous.
For reports transmitted via ordinary and electronic
mail channels, the confidentiality of the whistleblower's
identity (as well as the content of the report) is protected
as follows:
ordinary correspondence addressed to
the Internal Audit Department is delivered
unopened (as delivered by the postal service) to
the Internal Audit Director;
the whistleblowing@pradagroup.com email
box may only be accessed by members of
the Ethics Committee; the administrator of
the corporate e-mail system may access thereference mailbox exclusively for technicalneeds, following a justified written request ona case-by-case basis to be sent to the Internal
Audit Director, and access will be allowed only
upon prior written authorization.

c. Protection of whistleblower from
retaliation and discriminations
In compliance with the law and the Groups’ Code of
Ethics, Prada shall prohibit and sanction any form of
retaliation or discrimination against whistleblowers (aswell as anyone who cooperated to assess the reported
facts), regardless of whether the report was found to be
grounded or not.
If, in particular, the Whistleblower in good faith is an
Employee, the Ethics Committee (through the competentcompany functions) will monitor the Employee’s working
life for 2 years from the date of the report, to prove
the absence of discriminatory actions or other formsof retaliation following the report. If the whistleblower
is an employee, he/she may not be dismissed, his/herrole cannot be changed, he/she may not be suspended,transferred or subjected to any other organizational
measure having direct or indirect negative effects on his/her working conditions.

d. Protection of reported parties
The Prada Group shall require everyone to cooperatein ensuring mutual respect in the company and shallprohibit attitudes that may harm the dignity, honor andreputation of individuals. The confidentiality guarantees
established by this Procedure shall also protect theReported Party.
The Reported Party shall not be subject to disciplinary
sanctions in the absence of objective evidence of thereported breach, i.e. without having investigated thereported facts and challenged the relevant charges inaccordance with law and/or contract procedures.
The Reported Party may not request to know the nameof the whistleblower, except in cases expressly provided
for by the law.
For the further protection of the whistleblower, theactions and powers allowed by law remain unaffected.

In all cases where the name of the Whistleblower
has been disclosed, in the handling of the reports by
the Ethics Committee, this name shall be separated
from the content of the report and replaced with thealphanumeric code assigned to it when first recordedin the specific Register kept at the Internal Audit
Department.

WHISTLEBLOWING POLICY6

— 9. Disciplinary
sanctions and othermeasuresreceive a specific privacy information regarding theprocessing of their data, in the event that by providing
such information the capacity of effectively verifying
the validity of the report or of collecting the necessary
feedback is likely to be compromised.

For its Employees, the Prada Group shall provide and (ifthe conditions are met) adopt disciplinary sanctions:

The management of whistleblowing reports is performedby Prada S.p.A. also in the interest of its subsidiaries
in compliance with the provisions of applicable laws,
including, in particular, the principles of necessity,
proportionality and lawfulness of the processing as
provided in the GDPR.

against those responsible for any retaliation or
disciplinary acts or in any case of illegitimate
direct or indirect damage against the
Whistleblower (or anyone who has cooperated
to the assessment of facts being reported) for
reasons directly or indirectly related to thereport;against the Reported Party, for the assessed
responsibilities;
against anyone who violates the confidentiality
obligations referred to in this Procedure;
against Employees, as required by the law,
who have submitted an unfounded report withwillful misconduct or gross negligence.
Disciplinary measures will be proportioned to the extent
and seriousness of the unlawful conduct ascertained
and, in the most serious cases, they may lead to thetermination of the employment relationship.
Regarding Third Parties (e.g. partners, suppliers,
consultants, agents) legal remedies and actions
shall apply in addition to the contractual provisions
concerning compliance with the Code of Ethics.

— 10. Personal dataprotection

In compliance with the minimization principle referred
to in art. 5 of the GDPR, only personal data relevant
and necessary for the purposes of this Procedure canbe processed. Therefore, all personal data (of the
Whistleblower, if the latter has indicated his/her nameon the report, of the Reported Person or of any othernatural person) contained in the report or otherwise
collected during the investigation phase that are notstrictly necessary to ascertain whether the Report iswell-founded will be deleted or made anonymous.
Data subjects may exercise their rights under the GDPR
and applicable legal provisions by contacting the Group
Data Protection Officer at: privacy@prada.com.
When there is a risk that the exercise of the rights
granted to the data subject may result in an actual andconcrete prejudice to the confidentiality of the identityof the Whistleblower and may affect the ability toeffectively verify the truthfulness of the Report or togather the necessary evidence, Prada S.p.A. reserves
the right to limit or delay the exercise of the above
rights, in compliance with applicable law provisions.
The Reported Person or any third parties may under nocircumstances exercise their right of access in order toobtain information on the identity of the whistleblower,
unless in the case of an Illicit Report.

Personal data contained in the Reports will be processedin compliance with the applicable data protection
legislation in force, including Regulation (EU) no.
2016/679 ("GDPR"), as well as any other applicable laws
and/or regulations, and in accordance with the specificprivacy policy provided to data subjects and publishedon the platform.
When preparing reports, the reported party and otherparties involved in the report may not immediately

WHISTLEBLOWING POLICY7

— 11. Definitions
Anonymous report: whistleblowing report that comesfrom an individual whose personal details are unknown
or not clearly identifiable;
Audit and Risk Committee: Committee formed within
the scope of the Board of Directors with advisory andproposing functions towards the Board of Directors
itself. The Audit and Risk Committee of Prada S.p.A. is
composed by three non-executive directors, all selectedfrom among the members of the Board of Directors of
the Company;
Ethics Committee: Collegial body responsible formanaging reports, which assesses their adequacy,suggests to the Board of Directors any improvements tothe process, and promotes the necessary informationand training actions aimed at the company population.
It is composed by: Internal Audit Director, Human
Resources Director, General Counsel, Security Manager
and, for reports concerning CSR, the CSR Director will
be attending;
GDPR (General Data Protection Regulation): Regulation(EU) 2016/679 concerning the protection of natural
persons with regard to the processing of personal dataand on the free movement of such data, abrogating
Directive 95/46;
Grounded report: whistleblowing report corresponding
to the situation ascertained from the investigations
carried out;
Illicit report: any whistleblowing report that turns out tobe unfounded based on objective elements and for which
the concrete circumstances that were ascertained during
the investigation lead to believe that it was submitted inbad faith or with extreme negligence;
Internal Audit: Prada Group’s Internal Audit
Department;
Non-inherent report: whistleblowing report concerning
facts not falling within the scope of violations of
the Code of Ethics, laws, regulations, provisions of
Public Authorities, internal rules, Model 231, facts ofcorruption (active or passive), facts or behaviors thatare contrary (or in contrast) with the responsibility
undertaken by Prada of respecting human rights of
WHISTLEBLOWING POLICY

single individuals or communities and attributable tothe following categories: social and economic impacts,
health and safety and violation of workers’ rights or any
communication referred to behaviors that may cause
damage or harm, including image damage, to Prada;
Non-verifiable report: whistleblowing report notcontaining sufficient details allowing – based oninvestigation tools available – to verify the soundness ofreported facts;
Parent Company: Prada S.p.A.;
Prada Group: shall mean Prada S.p.A. and its direct andindirect Subsidiaries, in Italy and abroad;
Prada Personnel: directors, executives, other membersof the corporate and supervisory bodies, management
and employees of the Prada Group;
Report with actions: report resulting in an action to
improve the internal control system or a disciplinary
sanction;
Report without actions: report that is not followed byan action to improve the internal control system or adisciplinary sanction;
Solved Report: report related to facts that werepreviously known and fully ascertained, not adding any
new elements to what was already known;
Supervisory Body/ies: the Supervisory Body of Prada
S.p.A. and its Italian Subsidiaries pursuant to art. 6 of
Law Decree no. 231 of 2001;
Ungrounded report: whistleblowing report notcorresponding to the situation ascertained from theinvestigations carried out;
Verifiable detailed report: whistleblowing report inwhich the narrative of the author, the facts, events orcircumstances which constitute the basic elements of
the alleged offence (e.g. type of offence, period when
it occurred, value, causes and purposes of the offence,company, area, persons, units, entities concerned or
involved, anomaly in the internal control system, etc.)
is given with a level of detail sufficient to concretely
permit, on the basis of the investigation tools available,
the relevant company bodies to verify the truthfulness orotherwise of the facts or circumstances detailed in thereport;8

Whistleblower/s: Prada Personnel, Stakeholders
and other third parties, witnessing an offence or an
irregularity involving Prada Personnel;
Whistleblowing report/s: any communication
received by the Prada Group pertaining to the Internal
Control and Risk Management System and concerning
behaviors related to Prada Personnel in violation of
the Code of Ethics, any laws, regulations, provisionsof Public Authorities, internal rules, Model 231, factsof corruption (active or passive), facts or behaviors
that are contrary (or in contrast) with the responsibility
undertaken by Prada of respecting human rights ofsingle individuals or communities and attributable tothe following categories: social and economic impacts,
health and safety and violation of workers’ rights or any
communication referred to behaviors that may cause
damage or harm, including image damage, to Prada.

— 12. References
Italian Law Decree no. 231/2001 Disciplineof the administrative responsibility of legal
entities, companies and associations, including
those without legal personality, pursuant toart.11 of law no. 300 of 29 September 2000
and following amendments and additions;
Code of Ethics (available in the“Code of Ethics” section of the company
intranet);
Organization, Management and Control Modelpursuant to Italian Law Decree no. 231 of 8June 2001 (available in the “Organization
Model” section of the company intranet);
EU Regulation 2016/679;
Foreign rules and regulations applicable in theCountries where the Group operates.

Approved by the Board of Directors of
Prada S.p.A. on July 28, 2022

WHISTLEBLOWING POLICY

9