Italy - Ericsson Telecomunicazioni SPA

PRIVACY INFORMATION NOTICE PURSUANT TO REGULATION (EU) 2016/679 - GENERAL DATA PROTECTION REGULATION, HEREAFTER, “GDPR” - FOR WHISTLEBLOWERS

Pursuant to Regulation (EU) 2016/679 (hereafter, “GDPR”), Ericsson Telecomunicazioni S.p.A. (hereafter, referred to as “Company” or “Controller”) has adopted a system for handling internal whistleblowing reports as described in the document called “TEI Internal Channel”, available at the following link: https://www.ericsson.com/en/about-us/corporate-governance/code-of-ethics/reporting-compliance-concerns/eu-local-reporting-channel/italy-tei-local-reporting also available in the section Corporate Governance/Code of Ethics of the Company website,  and provides this information regarding the processing of your personal data for the management of the whistleblowing report you submitted to the attention of the Company.

1. Identity and contact details of the Controller

The Controller is the Company to which the whistleblowing report is submitted, namely Ericsson Telecomunicazioni S.p.A. with registered office in Roma (00118) at Via Anagnina 203.

2. Contact details of the Data Protection Officer (DPO)

The Company has designated a Data Protection Officer, who can be contacted at the following email address: dpo-italy@ericsson.com .

3. Purposes and legal basis of data processing

The Controller will process (i) your identifying data as the reporting party, where the whistleblowing report is not submitted anonymously, as well as (ii) information relating to the alleged conduct and any other data that you may have provided in the whistleblowing report and depending on the type of whistleblowing report made and the complained conduct or that are relevant based on the reported event; and (iii) information that may have been acquired over the course of the necessary investigative activities in order to verify and solve the whistleblowing report; for:

a. Purposes of management of the whistleblowing report on the basis of the whistleblower's complaint

The Controller will process the data for purposes strictly and objectively necessary for the application and management of the whistleblowing reporting procedure, including the verification of the facts that are alleged in the whistleblowing report, the resolution of the whistleblowing report, the preparation of the response, the adoption of any measures of relief or support for the whistleblowers and the establishment of proceedings including disciplinary proceedings, as well as to provide feedback to questions and queries you have raised regarding corporate compliance, pursuant to the provisions of the document called “TEI Internal Channel”, mentioned above, to the extent required by applicable laws.

In no cases, your whistleblowing reports will be used against you for discriminatory or retaliatory purposes by the Controller.

b. Purposes of compliance with regulatory obligations, laws and provisions of Authorities legitimated by law.

The Controller will process the data in order to fulfill obligations under the law, regulations or legislation, national and/or EU, including the provisions of the Italian Legislative Decree No. 24/2023 implementing the Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law and providing rules on the protection of persons who report breaches of national regulatory provisions (so-called "Whistleblowing Decree"), as well as effectively prevent and combat fraudulent, illegal or irregular conduct and support the effective application and implementation of the Organization, Management and Control Model pursuant to Legislative Decree no. 231/2001 (so-called “231 Model”), within the limits of what is required by applicable regulations.

Data may also be processed to execute requests from the competent administrative or judicial authorities or public entities in general, compliantly with legal formalities.

For the purposes described above, personal data may be processed for the fulfilment of legal obligations to which the Controller is subject. The disclosure of personal data is not compulsory, as permitted by law (for example, in the case of a whistleblowing report in anonymous form).

c. Further processing based on the Legitimate Interest of the Controller or a third party

In addition, the Controller will process personal data:

• for its own internal control and business risk monitoring needs, as well as in order to optimize and streamline the internal business and administrative processes also provided centrally by the Ericsson Group, which imply and require that whistleblowing reports be retained for longer than the time required for the mere management and resolution of the whistleblowing report in question;
• in order to ascertain, exercise or defend a right or a legitimate interest of the Controller or third party (including other companies of the Ericsson Group) before any appropriate authority.

The legal basis for the processing is represented by the pursuit of the legitimate interest of the Controller or third parties, represented by the right of defence and by the interest in guaranteeing the effectiveness and efficiency of the Company’s Internal Control and Risk Management System, also in order to prevent and effectively combat fraudulent, illegal or irregular conduct. This legitimate interest has been appropriately assessed by the Controller.

Processing for purposes based on the Controller’s legitimate interest is not mandatory and you may object to such processing trough the modalities indicated in this privacy information notice. However, if you object to such processing, your personal data will not be used for such purposes, unless the Controller demonstrates the existence of prevailing compelling legitimate grounds or personal data is necessary for the exercise or defense of a Controller’s right pursuant to Article 21 of the GDPR.

In addition to the above, and where strictly necessary to verify the reported conduct and to follow up on the whistleblowing report received, the Controller may also process special categories of personal data as per Article 9 of the GDPR or data relating to criminal convictions and offenses as per Article 10 of the GDPR for reasons of relevant public interest referred to in the Whistleblowing Decree and in any case within the limits set forth the applicable laws, including Articles 9 and 10 of the GDPR.

In any case, the Controller processes personal data that are strictly and objectively necessary to verify the merits of the whistleblowing report and proceed to its resolution only. Should the Controller, even accidentally, collect any unnecessary personal data, such personal data will be promptly deleted.

4. Modalities to process personal data

The data - when provided and collected - will also be processed by electronic means, recorded in special databases, and used strictly and exclusively for the purposes specified. These means are suitable to guarantee the security of the processing and confidentiality of the personal data collected, as well as to prevent unauthorized access, dissemination, modification and exfiltration of the personal data, thanks to the adoption of appropriate technical and organizational security measures, in compliance with the above-mentioned laws and related confidentiality obligations and, in any case, according to the purposes and methods set forth in this privacy information notice. Data will be processed in aggregate/anonymous form when this is appropriate in view of the purposes declared.

5. Personal data recipients

For the pursuit of the purposes indicated in paragraph 3, the Controller, the subjects authorized by the Controller to process data, who are in charge of handling the whistleblowing report, as specifically indicated in the document called “TEI Internal Channel”, mentioned above, as well as any data processors pursuant to Article 28 of the GDPR, may get to know your personal data. Data processors shall be specifically identified by the Controller, who shall also specifically instruct them on the methods and purposes of processing whilst ensuring that they are subject to adequate confidentiality and privacy obligations.

The Controller may also disclose the personal data collected to third parties belonging to the following categories, provided that this is necessary for the pursuit of the purposes of processing and on the basis of the same requirements of lawfulness set out in paragraph 3:

• police, appropriate authorities and other public authorities. These parties shall act as independent controllers;
• within the limits permitted by the applicable legislation, companies, entities or associations, or parent companies, subsidiaries or associated companies pursuant to Article 2359 of the Italian Civil Code, or among these companies, companies subject to joint control, as well as consortia, business networks and groups and temporary business associations and their members, with exclusive reference to the aspects falling within their responsibility (for example, in the case in which the whistleblowing report also regards their employees). Unless otherwise specified, such parties shall act as independent controllers;
• auditing firms and other companies contractually linked to the Controller (including those belonging to the same group) that perform, by way of example, consultancy activities, activities in support for the provision of services, etc., which shall act, as the case may be, as independent data controllers, or as data processors on the basis of a specific agreement on the processing of personal data concluded pursuant to Article 28 of the GDPR. Ericsson is one of these parties, which has been charged, in particular, with the task of setting up and managing the communication channels made available to submit and manage Whistleblowing Reports.

In any case, the Controller communicates your personal data to the aforementioned recipients only data that are necessary to achieve the specific purposes for which they are intended.

Your data shall not be disseminated.

6. Transfer of personal data outside the European Economic Area

As part of the management of whistleblowing reports, for some of the purposes indicated in paragraph 3, your personal data may be transferred outside the European Economic Area, also by entering them in databases shared with and/or managed by third party companies, which may even not be part of the Ericsson Group (like the Controller). The management of the database and the processing of such data shall be subject to the purposes for which they have been collected and carried out with the utmost respect for the standards of confidentiality and security set out in the applicable data protection laws.

Whenever your personal data is transferred outside the European Economic Area and, in particular, to Countries that according to the European Commission do not offer adequate security measures, the Controller shall sign the standard contractual clauses adopted by the European Commission whilst taking any other technical and organizational measures that are appropriate and necessary to ensure an adequate level of protection of your personal data and, in any case, at least equal to that guaranteed within the European Economic Area, in accordance with what is indicated in this Privacy Policy, including, among others, the Standard Contractual Clauses approved by the European Commission.

7. Data storage period

Data shall be processed in the paper and computer archives of the Controller and protected by suitable security measures for a period of time not exceeding that necessary to achieve the purposes for which they are collected and for the longer period of time possibly necessary to comply with legal provisions and/or for judicial protection, subject to ordinary statutes of limitation. In detail, your personal data shall be retained for 2 years if the report has been found to be inadmissible and is therefore not classified as a whistleblowing report, or for 5 years if it is classified as a whistleblowing report, starting from the communication of the final outcome of the whistleblowing procedure, unless retention of personal data for a longer period is required for claim or litigation purposes, as a consequence of requests by competent authorities, or under applicable laws. At the end of the storage period, your personal data shall be erased or irreversibly anonymized.

8. Rights of data subjects

In your capacity as data subject, you shall have the following rights, as summarised below, where applicable and within the limits specified in the relevant legal provisions and, in particular, in Article 2-undecies of Legislative Decree no. 196 of 30 June 2003, as lastly amended (the “Italian Privacy Code”).

a. Right of access

You shall have the right to obtain from the Controller confirmation as to whether or not the personal data concerning you are being processed, and, where that is the case, access to the personal data and the following information: (i) the purposes of the processing; (ii) the categories of personal data concerned; (iii) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if such recipients are from third countries or international organizations; (iv) when possible, the prescribed storage period of the data or, when this is not possible, the criteria used to determine this period; (v) the right to lodge a complaint with a supervisory authority; (vi) if the data are not collected from you, all available information on their origin.

It is understood that your confidentiality shall be protected to the maximum extent permitted, especially with reference to your identity, which shall not be disclosed either to the reported person or third parties, unless this is necessary to seek protection in court, fulfil legal obligations and otherwise within the limits provided for by law, in order to avoid cases of direct or indirect retaliation, threats, violence, discrimination, etc. against you for reasons directly or indirectly connected with the whistleblowing report. The confidentiality of your identity cannot be guaranteed in the event of an Illicit whistleblowing report (i.e., any whistleblowing report that is revealed unfounded based on objective elements and for which the concrete circumstances that were ascertained during the investigation phase lead to believe that it was presented in bad faith or with extreme negligence).

b. Right of rectification and erasure

In the cases provided for by the applicable legal provisions, you may exercise the right to obtain the rectification of the inaccurate personal data regarding you without unjustified delay and, taking into account the purposes of processing, the right to obtain the integration of incomplete personal data, even through a supplementary declaration.

You shall have the right to request the erasure of the personal data concerning you for any of the following reasons: (i) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (ii) the data are being processed unlawfully; (iii) you have objected to the processing activity and there is no overriding legitimate reason; (iv) the personal data must be erased in order to comply with a legal obligation.

However, the Controller shall have the right to reject the request for erasure if the right to freedom of expression and information prevails or to allow the fulfilment of a legal obligation, defend any of its own rights in court or for its legitimate interest.

c. Right to restriction of processing

You shall have the right to obtain the restriction of processing from the Company in the following cases: (i) for the amount of time necessary for the Controller to verify the accuracy of the data whose accuracy has been contested by the data subject; (ii) in case of unlawful processing of personal data; (iii) even if your personal data are not necessary for the purposes of the processing, you need them to be processed so that a claim can be established, exercised or defended in court; (iv) for the amount of time necessary to verify whether or not the legitimate interests of the Controller override your request to object to the processing.

d. Right to object

You shall have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data regarding you on the basis of the legitimate interest pursuant to Article 6(1)(f) GDPR. However, the Controller shall be entitled to continue processing by demonstrating that there are compelling legitimate reasons overriding your interests, rights and freedoms.

e. Right to lodge a complaint and/or application

You have the right to lodge a complaint with the Italian Data Protection Authority (“Garante”) and/or an application with the judicial authority.

According to Article 2-terdecies of the Italian Privacy Code, in case of death, the abovementioned rights may be exercised by another person entitled who has its own interest or acts as your mandatory or family reasons that need to be protected exist. You can expressly avoid the exercise of some of the abovementioned rights by your successors submitting a written request to the Controller o to the e-mail address of the DPO. Such declaration may be, at any time, withdrawn or modified with the same modalities.

The Controller reserves the right to restrict or delay the exercise of the said rights, within the limits provided for by the applicable legal provisions, especially where there is a risk of actual, concrete and otherwise unjustified prejudice to the confidentiality of the Whistleblower’s identity and when the capacity to effectively ascertain the grounds for the Whistleblowing Report or gather necessary evidence may be compromised (see Articles 2-undecies and 2-duodecies of the Italian Privacy Code and Article 23 of the GDPR). In particular, such rights may also be exercised:

• in compliance with the legal or regulatory provisions governing the sector (including the Italian Legislative Decree no. 231/2001 as amended by Law no. 179/2017, as well as the Whistleblowing Decree);
• and may be delayed or restricted or excluded with a motivated notice to be sent to the data subject without delay, unless the notice may compromise the purposes of restriction, for the time and within the limits that this constitutes a necessary and proportionate measure, taking into account the fundamental rights and legitimate interests of the data subject, in order to protect the confidentiality of the Whistleblower’s identity.

You may exercise the rights listed above by writing to the Controller to which you submitted the whistleblowing report (tei.whistleblower@ericsson.com),  or by writing to the DPO at the e-mail address:  dpo-italy@ericsson.com.