Whistleblowing
How to report wrongdoing, in confidence.
From 30 September 2026 STEM has a confidential channel for reporting unlawful conduct and breaches of its Model 231. This page explains what can be reported, how, who receives the report and how the law protects you.
In short
- Model 231
- The rules STEM has adopted to prevent the offences a company can be held liable for. Whoever adopts them must have a confidential channel for reporting breaches: this is it.
- What
- Unlawful conduct relevant under Italian Legislative Decree 231/2001, and breaches of STEM's Model 231.
- How
- In writing, in a sealed envelope containing two more: by hand in the handler's locked box, or by post. Or in person, at a meeting with the handler.
- To whom
- Diana Gabur, handler. Alessandro Casciano, deputy. Albin Ameti, for reports concerning both the handler and the deputy.
- Timing
- Acknowledgement of receipt within 7 days, feedback within 3 months.
- Protection
- Your identity is kept confidential, and any retaliation against the reporting person is prohibited.
01
What Model 231 is, and what it is for
In Italy, a 2001 law — Legislative Decree 231 — provides that for certain offences it is not only the person who commits them who is liable: the company can be liable too, if the offence was committed in its interest or to its advantage by those who run it or work for it.
These include serious accidents caused by failure to follow safety rules, corruption, tax fraud, environmental offences and the exploitation of workers. In those cases the company can be ordered to pay fines, even heavy ones, or to stop part of its business.
Model 231 is the set of rules, procedures and checks a company adopts to prevent those offences from happening. If the company adopts it and genuinely applies it, before the event occurs, it may not be held liable. A Supervisory Body checks that the Model works and is complied with.
STEM adopts its Model 231 from 30 September 2026. And the law requires whoever adopts it to have a confidential channel for reporting breaches, and to protect those who report: that is the channel this page explains.
References · Legislative Decree 231/2001, arts. 5, 6 and 9; art. 6(2-bis), as replaced by Legislative Decree 24/2023
02
What can be reported
This channel is for two things only, if you learned of them while working with STEM: unlawful conduct relevant under Italian Legislative Decree 231 of 2001 — that is, the offences that can make the company itself liable — and breaches of STEM's Model 231, the rules and checks the company has adopted to prevent those offences.
Some examples of facts that may fall within it:
- serious breaches of health and safety rules;
- money, gifts or favours offered to a public official, or to an employee of a customer or supplier, to gain an advantage;
- false or inflated invoices, made-up costs;
- waste disposed of or dumped unlawfully;
- exploited workers, or foreign nationals put to work without a residence permit;
- Model 231 checks and procedures skipped or circumvented.
This channel is not for personal matters that concern only your own employment, or your relationship with your superiors: shifts, holidays, pay, a disagreement with your supervisor. The law keeps them out of this channel, and for those the usual routes remain.
An immediate danger on site does not wait for the post: report it at once to your supervisor or to the employer, as always. If you think a breach of the rules lies behind that danger, you may also report it here.
References · Legislative Decree 24/2023, art. 1(2)(a), art. 2(1)(a)(2) and art. 3(2)(b); for immediate danger, Legislative Decree 81/2008, art. 20(2)(e)
03
Who can report
Anyone who learned of the facts through their work with STEM can report:
- employees, on any contract: including fixed-term, part-time, apprenticeship, agency work or occasional work;
- self-employed workers and collaborators;
- people who work for or with a company that supplies goods or services to STEM, or carries out works for STEM;
- freelance professionals and consultants;
- volunteers and trainees, including unpaid ones;
- shareholders and those who administer, manage, control, supervise or represent the company, even de facto.
You can also report before the relationship begins, if you learned of the facts during selection or negotiations; during a probationary period; and after the relationship has ended, if you learned of them while it was ongoing.
References · Legislative Decree 24/2023, art. 3(3) and (4)
04
Reporting in writing
The report is written on paper, using three envelopes. The first two keep your name separate from what you report. The sealed envelope can be delivered in two ways: by hand, in the locked box of the handler you choose, or by post.
1 · Your details
On a sheet of paper write your name, surname and a personal contact for replies: home address or personal mobile, never your company email. Seal it in the first envelope.
2 · The report
On another sheet describe the facts: what happened, when, where, who was there, how you know. Add any documents you have. Do not write your name here. Seal it in the second envelope.
3 · The envelope you deliver
Put the two sealed envelopes in a third. On the outside write RISERVATA and the name of the handler you choose. Then put it in their box, or send it by post to the Pescia office.
The outside, like this
RISERVATA
This example is for the handler: if the report goes to another handler, write their name. If you put it in the box by hand, the address is not needed. RISERVATA is Italian for «confidential»: write it in Italian, as shown.
Each handler has their own locked box: Diana Gabur's is at the Pescia office, Alessandro Casciano's and Albin Ameti's at the Buggiano depot. You will find the addresses below, next to their names.
By post, the envelope goes to the Pescia office. Whoever collects the post does not open envelopes marked RISERVATA: they put them, still sealed, in the handler's box within two working days.
If the report concerns the handler, the director Stefano Giugliano or the administrative work done by the handler, put it by hand in Alessandro Casciano's box at the Buggiano depot: that way it does not pass through the Pescia office.
The handler opens the envelope and records it in a confidential register.
If you do not want to give your name, put only the envelope with the report inside the outer one. What happens to reports without a name is explained below.
There are no email addresses, telephone numbers or online forms for reports, and they must not be used: email, even certified email (PEC), does not on its own guarantee the reporting person's confidentiality.
References · STEM Model 231, Annex C, art. 9; Legislative Decree 24/2023, art. 4(3); ANAC Guidelines no. 1/2025, § 2.2
05
Reporting in person
You can ask to speak in person with the handler you choose. The meeting is arranged within a reasonable time and, if you prefer, somewhere outside the company.
To ask for it you have two options: tell the handler in person, or leave them a sealed envelope like the outer one — marked RISERVATA and with their name, in their box or by post — containing only the request for a meeting and a personal contact.
With your consent, a written record of the meeting is made. You read it back, you can correct it, and you sign it too.
References · STEM Model 231, Annex C, art. 9; Legislative Decree 24/2023, art. 4(3) and art. 14(4)
06
Who receives the report
Reports are received by three people at STEM, trained for this task. You choose whom to write to, depending on whom the report concerns, and write their name on the envelope. The report is handled by the handler you chose, unless it concerns them.
Handler
Diana Gabur
Receives reports. Not those concerning herself, the director Stefano Giugliano or the administrative work she does herself: those go to the deputy.
Deputy
Alessandro Casciano
Receives reports concerning the handler, the director Stefano Giugliano or the administrative work done by the handler, and those you choose to send to him. Stands in for the handler when she is absent for more than seven days.
If it concerns both
Albin Ameti
Receives reports concerning both the handler and the deputy, and those you choose to send to him.
Anyone involved in a report, or with a conflict of interest with the people involved, cannot see its file.
The company's directors have no access to the reports or to the register, and do not direct the checks: they are informed only at the end, for the measures that are theirs to take, and if the report concerns one of them the outcome goes only to the other. The Supervisory Body too receives, at the end, only the information it needs for its task, never your name.
If a report reaches the wrong person, they pass it to the right handler within seven days and let you know.
References · STEM Model 231, Annex C, art. 9; Legislative Decree 24/2023, art. 4(2) and (6)
07
What happens next
If you left a contact in the envelope:
Within 7 days
the handler sends you an acknowledgement of receipt.
During the checks
they may ask you for clarification or further information.
Within 3 months of the acknowledgement
they give you feedback: they tell you what action has been taken, or is planned, on the report.
If no acknowledgement of receipt arrives, the three months run from the end of the seven days after the report was submitted.
If the checks reveal a criminal offence, the report may be passed to the judicial authorities, while keeping your identity confidential.
References · Legislative Decree 24/2023, art. 5(1)(a), (b) and (d); ANAC Guidelines no. 1/2025, § 3.5
08
Reports without a name
You do not have to sign. An anonymous report, if it is substantiated — precise, with facts, dates and places that can be checked — is recorded and examined.
Without a contact, however, the handler cannot send you the acknowledgement or the feedback, or ask you for clarification.
If you are later identified and suffer retaliation, the protections of the law apply to you too.
References · STEM Model 231, Annex C, art. 9; Legislative Decree 24/2023, art. 16(4)
09
How the law protects you
Confidentiality
Your identity, and any information from which it could be worked out, is not disclosed without your consent to anyone other than those responsible for receiving or handling the report.
The same confidentiality protects the people involved or named in the report, until the end of any proceedings that follow from it.
In disciplinary proceedings arising from the report, your name may be used only with your consent.
No retaliation
No one may punish or harm you for reporting. Examples of retaliation:
- dismissal, suspension, demotion or withheld promotion;
- a change of duties or place of work, a pay cut, a change of working hours;
- negative performance notes or references, disciplinary sanctions;
- intimidation, harassment, discrimination, ostracism;
- failure to renew, or early termination of, a fixed-term contract;
- early termination of a supply contract.
If you suffer one of these measures after a report, the law presumes it is retaliation: it is up to whoever took it to prove they had other reasons. Retaliatory acts are void, and anyone dismissed for reporting is entitled to be reinstated.
The same protection applies to anyone who helps you report, to colleagues you work with regularly, and to relatives up to the fourth degree and people with whom you have a stable relationship, if they work in the same environment.
If you suffer retaliation
You can report it to ANAC, the Italian National Anti-Corruption Authority. Note: it is the retaliation you report to ANAC, not the wrongdoing.
You can also ask for free information and assistance from the third-sector organisations that have an agreement with ANAC: the list is on the ANAC page.
ANAC's whistleblowing page →When the protections apply
They apply if, at the time you report, you had reasonable grounds to believe that the facts were true and that they were among those that can be reported here, and if you used this channel. Your reasons for reporting do not matter.
They are lost if the reporting person is convicted, even at first instance, of defamation or false accusation, or is found liable in civil proceedings on the same grounds, with wilful misconduct or gross negligence. In that case a disciplinary sanction is also imposed.
References · Legislative Decree 24/2023, art. 3(5), arts. 12, 16, 17 and 19
10
What about ANAC's external channel?
For a company like STEM — fewer than fifty employees, with a Model 231 — the law provides only this internal channel: not ANAC's external channel, and not public disclosure either.
Anyone always remains free to report a criminal offence to the judicial authorities.
References · Legislative Decree 24/2023, art. 3(2)(b)
11
Your personal data
This is the notice on the processing of the personal data of reporting persons, of people involved or named in a report, and of those who help to report.
Who processes the data
The data controller is STEM S.r.l. It has not appointed a data protection officer: the law does not require it to.
For requests concerning a report, write to the handler, using the RISERVATA envelope described above: that way your request stays confidential too.
The data controller
STEM S.r.l.
- Registered office
- Via Carlo Marx 275, 51015 Monsummano Terme (PT)
- VAT and tax number
- 01833230475
Why, and on what basis
We process the data to receive and handle reports as required by law and by Model 231: recording them, checking them, giving feedback and taking the measures that follow.
We do so to comply with a legal obligation: having a Model 231, STEM must have this channel and run it. If a report contains data on health or on criminal offences, we process it only to the extent that the same law allows.
What data
The data you give us, in the report or at the meeting: your identification and contact details, if you give them; the facts you describe; the details of the people involved or named.
Write only what is needed: data that is clearly not needed is not collected or, if it arrives, is deleted immediately. Giving your name is not compulsory.
Who sees it
Only the handler responsible for that report and, if technical checks are needed, the professionals they appoint, bound to confidentiality. The Supervisory Body receives only the information it needs, never the reporting person's name; the directors, at the end of the checks, only what is needed for the measures to be taken. Where necessary, the data may be passed to the judicial authorities or to the other competent authorities, in the cases provided for by law.
We do not transfer it outside the European Union.
How long we keep it
For as long as needed to handle the report, and in any case no longer than five years from the communication of the final outcome.
Your rights
You can ask to know whether we process data about you and to have a copy, to have it corrected or completed, to have it erased or its use restricted, where the law allows. No decisions are taken by automated means.
If you believe your data is being processed incorrectly, you can lodge a complaint with the Garante per la protezione dei dati personali, the Italian data protection authority.
Where exercising them would put the reporting person's confidentiality at real risk, these rights may be delayed, restricted or excluded, and cannot be exercised by a request to us or by a complaint. In that case we tell you why, unless doing so would itself put that confidentiality at risk, and you can exercise them through the Garante.
Where to lodge a complaint
Garante per la protezione dei dati personali
Piazza Venezia 11, 00187 Roma
If you are a person involved
While the checks are under way you do not receive a personal notice: it would reveal that a report exists, and perhaps who made it. If proceedings are opened against you, you receive a notice of your own.
You can ask to be heard, including through written observations and documents.
References · Regulation (EU) 2016/679, art. 6(1)(c), arts. 13 and 14; Legislative Decree 196/2003, art. 2-undecies; Legislative Decree 24/2023, arts. 12, 13 and 14
The law behind this page
The channel is provided for by Italian Legislative Decree no. 24 of 10 March 2023, which protects persons who report breaches, and by article 6 of Legislative Decree no. 231 of 8 June 2001. STEM's rules are set out in its Model 231, Annex C, article 9. Personal data is processed in accordance with Regulation (EU) 2016/679 and Italian Legislative Decree no. 196 of 30 June 2003.
In force from 30 September 2026