Whistleblowing

Last Mile Solutions S.r.l. (LastMile2You) provides an internal channel for reporting breaches you have learned about in a work context. The channel and the protections for people who report are governed by Italian Legislative Decree no. 24 of 10/03/2023, which implements Directive (EU) 2019/1937, and by our whistleblowing procedure (in Italian).

This page summarises the procedure and the protections the law provides. The details are in the procedure. The Italian version of this page is the reference text.

Who can report

The company’s workers, on any type of contract: including part-time, intermittent, fixed-term, apprenticeship, casual, occasional and agency workers.
Trainees and volunteers.
Self-employed workers, freelancers, collaborators and consultants who work for the company.
Suppliers: people who work for, or with, businesses that supply goods, services or works to the company.
Shareholders.
Anyone who, even informally, holds administrative, management, control, supervisory or representative functions in the company.

You can report while the relationship is ongoing, before it starts (if you learned of the facts during recruitment or negotiations), during a probation period, and after it has ended, if you learned of the facts while working with us.

Clients are not among the people who can use this channel. For a complaint about our service, write to info@lastmile2you.com.

What you can report

Conduct, acts or omissions, including attempted ones, that harm the public interest or the integrity of the company:

breaches in areas governed by European Union law and the national rules that implement it: public procurement; financial services, products and markets; prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety, animal health and welfare; public health; consumer protection; privacy and personal data protection; security of networks and information systems;
acts or omissions that harm the financial interests of the European Union;
breaches relating to the internal market, including EU rules on competition and State aid and arrangements aimed at a tax advantage that defeats the purpose of corporate tax rules;
acts or conduct that defeat the purpose of EU rules in these areas;
unlawful conduct relevant under Italian Legislative Decree 231/2001 and breaches of the company’s 231 Model (“231 reports”). For example: bribery, including between private parties; tax offences; money laundering; health and safety at work offences; environmental offences; employing third-country nationals without a valid residence permit.

The full list is in section 5 of the procedure.

What is not covered

This channel is not for:

personal grievances or requests about your own employment or your relationships with managers and colleagues. For these, speak to your manager or to the personnel office through the usual channels;
complaints about service failures or the company’s performance;
reports that are insulting or threatening, or based only on rumour with no reference to facts.

Breaches of the Code of ethics that are not also breaches of the 231 Model or one of the breaches listed above are reported as the Code of ethics explains.

How to report: the internal channel

Reports are sent through the MyGovernance platform (the “Platform”). The Platform protects, including through encryption, the confidentiality of the reporting person, of the people involved, and of the content and documents.

Create your personal credentials at areariservata.mygovernance.it/#!/WB/Last-Mile-Solutions.
Send your report by logging in at areariservata.mygovernance.it/#!/Login.

You can report:

in writing on the Platform, attaching documents and video;
by voice message on the Platform;
in person, at your request, at a meeting with the Report Handler arranged within a reasonable time. The meeting is recorded in minutes that you sign to confirm they are accurate. To ask for the meeting, use the Platform, in your report or in a later message: the Report Handler replies there with a date and place.

Keep your credentials: the Platform is where you receive the acknowledgement, any requests for clarification and the final feedback.

Describe the facts as precisely as you can. These help, though you do not need all of them:

what happened;
when and where;
who is involved (name, role, location);
supporting documents;
other people who know about the facts;
any other information that helps to check them.

Do not investigate on your own: report, and leave the checks to the Report Handler.

Who handles the report and when

Reports are received and handled by the company’s Supervisory Body (Organismo di Vigilanza, OdV), appointed under Legislative Decree 231/2001 and designated as Report Handler. The Supervisory Body is autonomous and independent of the company’s departments.

Within 7 days of receipt you get an acknowledgement.
The Report Handler assesses whether the report falls within the procedure. If it does not, they close it and give you the reason on the Platform.
If it does, they investigate. They may ask you for clarification, obtain documents, interview other people and use external advisers.
Within 3 months of the acknowledgement (or, if none was sent, of the end of the 7-day period) you receive feedback on the outcome. If the checks take longer, you are told within the same period that they are continuing.

If a report reaches someone other than the Report Handler, that person must pass it to the Report Handler within 7 days, in confidence, and tell you they have done so. Please use the channels above: a report sent elsewhere is handled under Legislative Decree 24/2023 only once it reaches the Report Handler.

Anonymous reports

You can report without saying who you are. Anonymous reports may be considered if they are detailed, meaning they describe specific facts and circumstances.

If you are later identified and suffer retaliation, you have the same protections as someone who gave their name.

Confidentiality

Only the Report Handler has access to the report. In documents the report is referred to by a code, not by your name.
Your identity, and any information from which you could be identified, is not disclosed to anyone other than the Report Handler without your express consent.
The same confidentiality protects the people involved and those mentioned in the report.
In disciplinary proceedings your identity is not disclosed if the charge rests on findings separate from the report. If the charge rests, even in part, on the report and knowing your identity is essential to the defence, it may be disclosed only with your express consent. In that case we tell you the reasons in writing.
In criminal proceedings your identity is protected by secrecy in the ways and within the limits of Article 329 of the Italian Code of Criminal Procedure. Before the Court of Auditors (Corte dei conti) it is not disclosed until the investigation phase has closed.

Protection from retaliation

The company does not tolerate retaliation against anyone who reports. Examples of retaliation include: dismissal or suspension; demotion or being passed over for promotion; changes to duties, workplace, pay or working hours; exclusion from training; negative appraisals or references; disciplinary measures; intimidation, harassment or ostracism; discrimination; not renewing or not converting a fixed-term contract; damage to reputation, including on social media; blacklisting that prevents finding work in the sector; early termination of a supply contract; cancellation of a licence or permit; requiring psychiatric or medical examinations.

Retaliatory acts are void. If, in proceedings, you show that you reported and then suffered a detrimental act, it is presumed to be retaliation: the person who took that act must prove it had reasons unrelated to the report. This presumption applies to the reporting person, not to the other protected people listed below.

If you believe you have suffered retaliation, including attempted or threatened retaliation, you can tell ANAC, the Italian National Anti-Corruption Authority. ANAC can fine anyone who retaliates, obstructs a report or breaches confidentiality.

The same protections apply to:

facilitators, meaning people who help you make the report and work in the same work context as you;
people in your work context who are linked to you by a stable emotional bond or are relatives up to the fourth degree;
colleagues who work with you and have a regular, ongoing relationship with you;
entities you own, entities you work for, and entities operating in the same work context as you.

When the protections apply

The protections apply if, when you reported, you had reasonable grounds to believe that the facts were true and fell within what can be reported, and you followed the procedure and Legislative Decree 24/2023. Your personal reasons for reporting do not matter.

If, on those conditions, you disclose information covered by certain duties of secrecy, by copyright or data protection rules, or that harms the reputation of the person involved, you are not liable for it. You must have had reasonable grounds to believe the disclosure was necessary to reveal the breach, and you must not have committed an offence to obtain the information.

The protections do not apply if you are found, even by a first-instance judgment, criminally liable for defamation or false accusation (calunnia), or civilly liable on the same grounds where there was intent or gross negligence. In those cases a disciplinary sanction is also provided for.

Support

Third-sector organisations on the list published by ANAC offer free information, help and advice on how to report, on protection from retaliation, on the rights of the person involved and on access to state-funded legal aid. The list is on the ANAC website.

ANAC’s external channel

The internal channel should be used first. You can, however, report to ANAC if, at the time of reporting, one of these conditions applies (Article 6 of Legislative Decree 24/2023):

the internal channel is not active or does not comply with the law;
you have already made an internal report and it was not followed up;
you have reasonable grounds to believe that an internal report would not be followed up effectively or would expose you to retaliation;
you have reasonable grounds to believe that the breach may pose an imminent or obvious danger to the public interest.

ANAC’s channel cannot be used for 231 reports, which go to the internal channel only.

The external channel is on the ANAC website, with its reporting platform. If you report to ANAC when none of these conditions applies, ANAC does not handle the report and you do not have the protections of Legislative Decree 24/2023.

Public disclosure and reporting to the authorities

You can make the facts public, for example through the press, and keep the protections only if:

you made an internal report and a report to ANAC, or a report directly to ANAC, and received no feedback within the set time limits;
you have reasonable grounds to believe that the breach may pose an imminent or obvious danger to the public interest;
you have reasonable grounds to believe that reporting to ANAC would expose you to retaliation or would not be followed up effectively, for example because evidence could be destroyed or the person receiving the report could be involved.

You can always report the facts to the judicial authorities or the Court of Auditors.

Personal data

Last Mile Solutions S.r.l. processes the personal data contained in reports as controller, in line with the GDPR and Italian Legislative Decree 196/2003. We collect only the data that the report needs: data that is clearly not useful is not collected or, if collected, is deleted at once.

Documents are kept securely, normally on the Platform, for as long as needed to handle the report and in any case for no more than 5 years from the communication of the final outcome.

The rights in Articles 15 to 22 GDPR may be restricted where exercising them could compromise the confidentiality of the reporting person’s identity (Article 2-undecies of Legislative Decree 196/2003).

The information on data processing for reporting persons and people involved (Articles 13 and 14 GDPR) is in this section and in this site’s Privacy notice.