WHISTELBLOWINGPRIVACY POLICY STATEMENT FOR WHISTLEBLOWER AND PEOPLE CONCERNEDPURSUANT TO ARTICLES 13 AND 14 OF REGULATION (EU) 2016/679 CONCERNING THE PROTECTION AND
PROCESSING OF PERSONAL DATA (GDPR)
1. IDENTITY OF THE DATA CONTROLLER
The Data Controller is Marazzi Group S.r.l. a Socio Unico, with registered office at Viale Regina Pacis 39, 41049 Sassuolo(Modena) Italy, in the person of its current legal representative (the "Data Controller" or "Marazzi").
To exercise your rights, or for any information concerning them and/or this Privacy Policy Statement, you may contact theData Controller at: privacy@marazzigroup.com tel. +39 0536 860800.
The Data Controller has appointed a Data Protection Officer (“DPO”), whom you can contact to exercise your rights, as listed
in point 7 below, as well as to receive any information concerning them and/or this Privacy Policy Statement, by writing to:
dpo@marazzigroup.com.
2. WHICH PERSONAL DATA WE PROCESS AND WHERE WE OBTAIN THEM
For the purposes stated in this Privacy Policy Statement, the Data Controller will process your personal data, supplied directly
by you or by third parties, comprising ordinary, identification and contact data (such as your first name, surname, telephone
number, email address and other contacts), your professional data (such as the company to which you belong, yourdepartment within the company, etc.). The data processed relating to the people concerned are those provided by thewhistleblower in the description of the offence reported. In this case Marazzi is unable to predict the categories of data
covered by the report, which may also include special data or those relating to previous criminal offences and crimes.
3. PURPOSES AND LEGAL BASIS OF THE PROCESSING
The Data Controller collects and processes personal data for the following purposes:a) purposes strictly related to and useful for verification of the merits of, and for dealing with, whistleblowing reports
received with regard to behaviours, actions or dereliction of duty damaging to the public interest or the integrity of a
private entity as defined by Italian Law no. 179 of 30 November 2017 (“Provisions to safeguard whistleblowers
reporting offences or misconduct which has come to their knowledge through employment in the public or privatesector”) and Italian Legislative Decree no. 24 of 10 March 2023 implementing Directive (EU) 2019/1937 of theEuropean Parliament and of the Council of 23 October 2019 (“D.Lgs 24/23”), on the protection of people who reportbreaches of Union law and of national legislation, especially with regard to compliance with legal obligations andmeasures issued by legally constituted Authorities. The legal basis for this purpose is the fulfilment of a legal
obligation to which the Data Controller is subject under article 6, para 1, subsection c) of the GDPR, and D.Lgs 24/23.
The contribution of your personal data for this purpose is not compulsory, since reports may also be madeanonymously.
b) purposes related to the disclosure of your identity, to people other than those assigned to receive or follow up reports(para 2 of art. 12 D.Lgs 24/2023) or in the context legal action based entirely or partially on the whistleblowing reportif knowledge of your identity is essential for the defence of the accused (para 5 of art. 12 D.Lgs 24/2023). The legal
basis for this purpose is consent under article 6, para 1, subsection a) of the GDPR, and D.Lgs 24/23.

4. DATA STORAGE PERIOD, NATURE OF CONTRIBUTION AND PROCESSING PROCEDURESYour personal data will be stored for the period of time necessary to process the report and in all cases for no more than 5
years after the date of notification of the final outcome of the whistleblowing procedure, unless a different storage time isenvisaged. Personal data obviously not useful for the processing of a specific report are not collected, or if they areaccidentally collected they are erased immediately.

Your personal data will be processed, in compliance with the provisions of the GDPR, by paper, IT, telematic and telephonicmeans, for the stated purposes, and in all cases by procedures which guarantee an appropriate level of security andconfidentiality, in accordance with the provisions of article 32 of the GDPR and art. 4 of D.Lgs 24/23.
5. RECIPIENTS OF YOUR PERSONAL DATA, AND PARTIES WHO MAY GAIN KNOWLEDGE OF THEM
For the pursuance of the purposes set forth in point 3 above, the personal data processed will become known to the company
staff assigned to manage reports and/or external parties designated as Data Processors under appropriate contracts andbound by the same confidentiality obligations, and if necessary will be disclosed to third parties (e.g. National Anti-Corruption
Authority, Judicial Authorities, Police) authorised by law to access personal data and with the status of independent Data
Controllers. The complete, updated list of the entities to which your personal data may be disclosed can be requested fromthe Data Controller using the contacts provided in point 1 of the Privacy Policy Statement.
Your personal data will not be disseminated.
6. TRANSFER OF PERSONAL DATA OUTSIDE THE EUROPEAN UNION
For technical and organisational purposes, your data may be transferred to non-European Union member states: this transfer
is, in any case, lawful since it is covered by adequacy decisions issued by the European Commission and/or standard dataprotection clauses based on the models adopted by the European Commission pursuant to art. 46 of the GDPR.
In this specific case, the non-European member state is the United States of America.
In all cases, you may request a copy of the safeguards adopted for transfer of your personal data outside the EU, and precise
information concerning the places where they have been made available, by sending a specific request to the Data Controller
at the email address privacy@marazzigroup.com.
7. YOUR RIGHTS AS DATA SUBJECT
With regard to the data processing described in this Privacy Policy Statement, as data subject, on the conditions set forth by
the GDPR, you may exercise the rights provided by articles 15 – 22 of the GDPR, within the limits established by article 2,
subsection 11 of Italian Legislative Decree no. 196 of 30 June 2003. The data subject also has the right to lodge a complaint
with the Data Protection Authority of their member State of residence or work, or where the alleged breach occurred.
To exercise these rights, you may contact the Data Controller, addressing any requests to the DPO using the contacts
provided above. In this case, the identification and contact data essential to identify you as applicant and fulfil your request
must be provided.
The “people concerned” as defined by art. 2, para 6, subsection l) of D.Lgs 24/23 may exercise the rights set forth in articles
15 et. seq. of the GDPR by addressing a specific request to the Italian Data Protection Authority: Garante per la protezione
dei dati personali Piazza Venezia n. 11 - 00187 Rome Switchboard: (+39) 06.696771 Fax: (+39) 06.69677.3785. Email:protocollo@gpdp.it, certified email: protocollo@pec.gpdp.it.
Please also note that the Data Controller may request further information necessary to confirm the identity of the data subject.
Marazzi Group S.r.l. a Socio Unico(Data Controller)
Sassuolo 15 July 2023