(Translation from the Italian original which remains the definitive version)

EXTRACT FROM THE

ORGANISATIONAL,
MANAGEMENT AND CONTROL
MODEL
LEGISLATIVE DECREE NO.
231/2001

Adopted by the Board of Directors on 25 November 2010

Latest update approved by the Board of Directors on
11 September 2018
CONTENTS

1 LEGISLATIVE DECREE NO. 231/2001 ......................................................... 5

1.1 Legislative framework ................................................................................................. 5
1.2 The nature of Bodies’ liability .................................................................................... 5
1.3 Criteria for the attribution of liability to the body and exemptions from liability6
1.4 The crimes .................................................................................................................... 7
1.5 Sanctions....................................................................................................................... 8
1.6 Crimes committed abroad ........................................................................................ 10
1.7 Events that modify the Body ................................................................................... 10
1.8 Characteristics of the Organisational, management and control model ............ 10
1.9 Confindustria’s Guidelines ....................................................................................... 11
1.10 whistleblowing........................................................................................................ 12
2 THE 231 MODEL IN ESSELUNGA S.P.A. .................................................. 13
2.1 Brief background of the Group............................................................................... 13
2.2 Esselunga Group ....................................................................................................... 14
2.3 Esselunga’s organisation and activities ................................................................... 14
2.4 The Esselunga Model ............................................................................................... 15
2.5 Approval, amendment and implementation of the 231 Model ........................... 16
3 METHODS ...................................................................................................... 17
3.1 Development of the Model: the preliminary activities to define and update the
Model .................................................................................................................................... 17
3.2 The Model’s structure ............................................................................................... 17
3.3 The Model’s main components ............................................................................... 18
4 MODEL ELEMENTS .................................................................................... 19
4.1 Mapping of areas at risk and identification of the related controls - referral .... 19
4.2 Documentation of the activities and segregation of the duties ........................... 20
4.3 Description of the proxy system ............................................................................. 20
4.4 Information systems ................................................................................................. 21
4.5 Food certifications .................................................................................................... 21
4.6 Certification of the occupational safety management system.............................. 22
4.7 Code of Conduct ....................................................................................................... 23
4.8 whistleblowing procedure: scope and channels to raise disclosures ................... 23
4.9 General principles of conduct ................................................................................. 24
4.10 Disciplinary system ................................................................................................ 24
4.10.1 Introduction .................................................................................................... 24
4.10.2 Sanctions applicable to managers and other employees ............................ 25
4.10.3 Sanctions applicable to directors and statutory auditors ........................... 25
4.10.4 Sanctions applicable to temporary workers ................................................. 25
4.10.5 Sanctions applicable to suppliers, contractors and consultants ................ 25
4.10.6 Sanctions applicable to the addresses of reports (“whistleblowing”) ...... 26
5 COMMUNICATION AND CIRCULATION OF THE 231 MODEL ......... 26
5.1 General principles ..................................................................................................... 26

General part 2 of 29
 5.2 Communication of the Model ................................................................................. 26
6 TRAINING ...................................................................................................... 27
7 SUPERVISORY BODY ................................................................................... 27
7.1 General characteristics and role............................................................................... 27
7.2 Requirements of the Supervisory Body .................................................................. 28
7.3 Appointment, revocation and term of office......................................................... 28
7.4 Activities and powers ................................................................................................ 28
7.5 Information flows from/to the Supervisory Body ............................................... 29

General part 3 of 29
 Organisational, management and control model pursuant to Legislative decree
no. 231/2001
Special parts

Special part A - Crimes against the public administration (omissis)

Special part B - Occupational health and safety crimes (omissis)
Special part C - Crimes against industry and commerce and counterfeiting (omissis)
Special part D - Crimes relating to forgery of coins, public credit notes and duty
stamps (omissis)
Special part E - Crimes related to violations of copyrights (omissis)
Special part F - Computer crimes and unlawful data processing (omissis)
Special part G - Corporate crimes (omissis)
Special part H - Crimes related to handling stolen goods, money laundering and use of
money, goods or assets of illegal origin and self-laundering (omissis)
Special part I - Organised crime, Transnational crimes, Induction not to make
statements or to make untruthful statements to the judicial authorities (omissis)
Special part L – Crimes against the individual (omissis)
Special part M - Employment of third-country nationals residing without authorisation
(omissis)
Special part N - Crimes against the environment (omissis)
Special part O – Market abuse (omissis)

Annexes
Annex 1. Code of Conduct
Annex 2. Members of the Supervisory Body and their curricula vitae (omissis)

General part 4 of 29
1 LEGISLATIVE DECREE NO. 231/2001
1.1 LEGISLATIVE FRAMEWORK
Legislative decree no. 231 of 8 June 2001 (the “Decree”), which regulates the
administrative liability of legal entities, companies and unincorporated associations
introduced the concept of company liability into Italian law. This is a form of criminal
administrative liability of legal entities when certain crimes are committed or
attempted by senior management or their subordinates.

The Decree harmonised the Italian laws about the liability of legal entities with
international conventions signed by Italy in previous years, such as the Brussels
Conventions of 26 July 1995 and 26 May 1997 on the protection of the Communities’
financial interests and the fight against corruption involving officials of the European
Communities or officials of Member States of the European Union, and the OECD
Convention of 17 December 1997 on Combating Bribery of Foreign Public Officials
in International Business Transactions.

The Decree represents great legislative and cultural change with the introduction of
the criminal liability of the individual who committed the crime as well as the body in
whose interests the crime was committed or which benefitted therefrom.
Its provisions specifically apply to the following “parties (the “Bodies”) as provided
for by article 1 thereof:
 bodies with legal personality;
 entities and associations, including without legal personality.

1.2 THE NATURE OF BODIES’ LIABILITY

The report presenting the Decree emphasised that by administrative liability is meant a
“tertium genus that combines the essential features of the criminal system with the administrative
system to reconcile the reasons for effective preventive measures with those, which are even more
unavoidable, requesting greater guarantees”.
The Decree is the result of a legislative technique that has introduced into Italian
legislation a system to punish corporate crimes in addition to the existing disciplinary
measures by incorporating the inherent characteristics of criminal and administrative
crimes. The competent criminal court judge is not solely required to identify the
perpetrator of the crime but also the Body’s administrative liability and to apply the
related sanction in line with the provisions and timing of any criminal proceeding.
The Body’s administrative liability is separate to that of the individual who committed
the crime. It follows that the Body should not be exempt from liability even if the
offender cannot be identified or cannot be charged or if the crime is no longer
punishable for reasons other than amnesty (article 8 of the Decree).
Moreover, the Body’s liability is additional to and does not substitute that of the
individual who committed the crime.

General part 5 of 29
1.3 CRITERIA FOR THE ATTRIBUTION OF LIABILITY TO THE BODY AND
EXEMPTIONS FROM LIABILITY
In the case of the predicate crimes (set out in section 1.4), the Body is only liable if
certain conditions are met, specifically, the definition of the objective and subjective
criteria for the attribution of the crime to the Body have been defined.

The first objective criterion is that the predicate crime is committed by a party who
reports to the Body. Article 5 of the Decree states that the offenders are:
 parties that represent, administer or manage the Body or one of its
organisational units and have financial and operating independence or parties
that de facto manage and control the Body (senior management);
 parties subordinate to the senior management (subordinates).

The second objective criterion is that the unlawful conduct is performed by one of the
above parties “in the interests of or to the advantage of the company” (article 5.1 of the
Decree):
 an “interest” exists when the offender has acted intentionally to benefit the Body,
regardless of whether they have achieved their intention;
 an “advantage” exists when the Body has benefitted or could have benefitted
from the crime, which does not necessarily have to be in financial terms.

The Decree explicitly provides that the Body is not liable if the members of senior
management or the subordinates have acted “solely in their own interests or in the interests of
third parties” (article 5.2 of the Decree).

The “interest or advantage” criterion is by its nature not compatible with the negligent
nature of the predicate crimes covered by article 25-septies of the Decree (manslaughter
and grievous bodily harm) while it reflects the intentional nature of premeditated
crimes.
The negligent component of the last two cases (which implies the lack of intention)
means that that they cannot be considered predicate crimes committed in the Body’s
interests (which would imply intention). As the legislation is silent on this point, the
most accredited interpretation holds that the plausible criterion for the assignment of
these negligent crimes is if non-compliance with safety regulations gives the Body an
objective advantage (at least in terms of the smaller costs arising from non-
compliance). Therefore, the criterion in question is limited in this case to the objective
circumstance that non-compliance is an advantage to the Body, as shown in the
special part of the Model covering article 25-septies.

The subjective criteria for charging the crime to the Body establish the conditions
when this can take place: in order for the crime not to be charged thereto for
subjective reasons, the Body must be able to show that it has done all in its powers to
organise, manage and monitor its activities to prevent the commission of one of the
predicate crimes listed in the Decree.

General part 6 of 29
Accordingly, the Decree provides that the Body’s liability is excluded when, before the
crime is committed:
 the Body has prepared and implemented organisational and management
models suitable to prevent crime;
 the Body has set up a control body (the Supervisory Body), with independent
powers to supervise the organisational models’ working.

In the case of a crime committed by a member of senior management, it is assumed

that the Body is liable given that senior management embodies, represents and
implements the Body’s management policies: the Body’s liability is only excluded if it
can prove that the crime was committed by fraudulently evading the existing
Organisational, management and control model (the “Model”) and the Supervisory
Body has not omitted any controls or performed them inadequately as this body has
the specific duty of supervising the Model’s correct functioning and compliance
therewith (article 6 of the Decree)1. Accordingly, the Decree requires stronger proof
that the Body is not involved in these cases, as it must also prove that senior
management has defrauded the Model.
In the case of crimes committed by a subordinate, the Body is liable only when the
crime may be committed due to non-compliance with management and supervisory
obligations. The Body’s liability is excluded if it can prove that it has adopted suitable
conduct rules for its type of organisation and activities performed that guarantee that
its business is carried out in compliance with the law and can identify and eliminate
any risk situations promptly (article 7.1 of the Decree)2 . This is an “organisation fault”,
as the Body has indirectly consented to the commission of the crime by not properly
monitoring its activities and the parties at risk of committing a predicate crime.

1.4 THE CRIMES

Pursuant to the “principle of legality” as per article 2 of the Criminal Code, the Decree
sets out a numerus clausus of crimes the Body can be held liable for (the predicate crimes).
These crimes, for which the Body can be held liable, are listed in the Decree and are as
follows:
 Crimes against property of the public administration (article 24)
 Crimes related to public funding (article 24)
 Computer crimes and unlawful data processing (article 24-bis)
 Organised crime (article 24-ter)
 Crimes against the public administration (article 25)
 Forgery of coins, public credit notes, duty stamps and identification tools or
1 Pursuant to article 6.1 of Legislative decree no. 231/2001, “If the crime has been committed by the persons indicated in article
5.1.a) [senior management], the body is not liable if it can prove that: a) the management body has adopted and successfully implemented,
before the crime was committed, organisational and management models suitable to prevent crimes of the type committed; b) responsibility for
supervising the models’ working and compliance and to ensure they are up-to-date was assigned to an internal body with independent decision-
taking and control powers; c) the persons who committed the crime fraudulently evaded the organisational and management models, d) the body
as per letter b) did not perform all its controls or was negligent”.
2 Pursuant to article 7.1 of Legislative decree no. 231/2001, “In the case covered by article 5.1.b) [subordinates], the body is liable

if the crime was possible because of non-compliance with management and supervisory obligations”.
General part 7 of 29
 marks (article 25-bis)
 Crimes against industry and commerce (article 25-bis.1)
 Corporate crimes (article 25-ter)
 Crimes related to terrorism or subversion of democratic order covered by the
Criminal Code and special laws (article 25-quater)
 Female genital mutilation practices (article 25-quater.1)
 Crimes against the individual (article 25-quinquies)
 Market abuse (article 25-sexies)
 Transnational crimes (Law no. 146/2006)
 Crimes violating occupational health and safety regulations (article 25-septies)
 Crimes related to handling stolen goods, money laundering and use of money,
goods or assets of illegal origin and self-laundering covered by articles 648, 648-
bis, 648-ter and 648-ter.1 of the Criminal Code (article 25-octies)
 Crimes related to violations of copyrights (article 25-novies)
 Induction not to make statements or to make untruthful statements to the
judicial authorities (article 25-decies)
 Crimes against the environment (article 25-undecies)
 Employment of third-country nationals residing without authorisation (article
25-duodecies)

1.5 SANCTIONS
Article 9.1 of the Decree identifies the sanctions to be imposed on the Body;
specifically:
 fines;
 prohibitions;
 bans on operations;
 suspension or withdrawal of permits, licenses or concessions used to commit
the crime;
 bans on contracting with the public administration, except to obtain a public
service;
 exclusion from benefits, loans, grants or subsidies and the possible
withdrawal of those already granted;
 ban on advertising goods or services;
 seizure;
 publication of the conviction ruling.

Fines are applicable to all cases of administrative liability of a Body regardless of the
crime. They are applied using a quota system, no less than 100 and not higher than
1,000, with a minimum amount of €258.00 and a maximum of €1,549.00 (article 10 of
the Decree). When calculating the fine, the Judge decides the number of quotas
considering: (i) the seriousness of the crime, (ii) the Body’s degree of liability, (iii) the
activities performed by the Body to eliminate or mitigate the consequences of the
General part 8 of 29
crime and to prevent the commission of other crimes, and (iv) the Body’s financial
conditions and position (article 11 of the Decree).3
The prohibitions are applied in addition to the fines, and solely for those crimes for
which they are specifically envisaged and exclusively when at least one of the following
conditions is met: (i) the Body has made a significant profit from the crime and the
crime has been committed by a member of senior management or one of its
subordinates when, in the latter case, it was possible to commit the crime or the crime
was facilitated by serious organisational weaknesses; (ii) the crime has been performed
more than once (article 13 of the Decree).

Seizure entails the acquisition of the price or the profit generated by the crime or an
equivalent value by the state (article 19 of the Decree).

If it is not possible to seize the assets directly making up the price or profit generated
by the crime, the state may seize amounts of cash, goods or other assets equivalent to
the price or profit generated by the crime. As a precautionary measure, the state may
order the attachment of goods that may be seized as they are the price or profit
generated by the crime or their monetary equivalent (article 53 of the Decree)4.

With respect to precautionary attachment, point 1-bis was included in article 53 of the
Decree when Law decree no. 101/2013 was converted (pursuant to Law no.
125/2013). This point provides that, in the case of an attachment prior to seizure of
equivalent assets pursuant to article 19.2 of the Decree, the receiver allows the
company bodies to use the companies, securities, shares or liquid funds attached to
guarantee the company’s continuity and development.
The company bodies usually retain management of these assets and management is
only transferred to a court-appointed administrator if they are not used to ensure the
company’s continuity and development. Therefore, the court-appointed administrator
only monitors the company bodies’ activities, acting as the go-between between the
judicial authorities and the company.
Publication of the conviction ruling may be ordered when the Body is subject to a
prohibition. The Body may be required to have all or part of the ruling published in
3 Pursuant to article 12 of Legislative decree no. 231/2001, the fine to be applied to the Body may be reduced in special
circumstances: specifically, it is halved and cannot exceed €103,291.00 if (i) the offender has committed the crime mainly
in its own interests or those of third parties or the Body has not received an advantage or the advantage has been
minimum; (ii) the financial damage caused was very minimal. In addition, the fine is decreased from between one third to
a half if, before the first level court hearing takes place, (i) the Body has fully compensated the damage and eliminated the
damaging or dangerous effects of the crime or if it has effectively taken steps to do so; (ii) the Body has adopted and
rolled out an organisational model suitable to prevent crimes of the nature performed. If both these conditions are met,
the fine is reduced from between half to two thirds.
4 As shown by case law (Supreme Court, IV criminal section, ruling no. 34505 of 2012), in order to order preventive

attachment, the judge shall assess the merits of the allegation and recognise the serious evidence of the Body’s liability.
Moreover, the principle of certainty of the offenses and penalties provided for by the Decree prevents the precautionary
attachment of the amounts making up the profit of the crimes not included in the list of predicate crimes. This is also
true when the public prosecutor alleges these crimes to be those actually committed by the criminal associations, while
the creation of the criminal association is a predicate crime implying the Body’s liability pursuant to article 24-ter of the
Decree (Supreme Court, VI criminal section, ruling no. 3635 of 2014).
In this ruling, the principle of non-retroactivity was invoked to clarify that the profit from actions performed before the
application of the regulations that include a specific crime in the list that implies the Body’s liability cannot be attached or
seized. The period when the crime was performed is considered rather than when the profit is received.
General part 9 of 29
one or more newspapers, indicated by the judge in the ruling, and to post it in the
municipality where it has its headquarters (article 18 of the Decree).

If the crimes punishable on the basis of the Decree are attempted only, the fines (in
terms of their amounts) and the prohibitions (in terms of their duration) are reduced
by between a third to a half. Fines cannot be imposed if the Body voluntarily prevents
the fulfilment of the action or the event (article 26 of the Decree).

1.6 CRIMES COMMITTED ABROAD

Bodies with their headquarters in Italy are also liable for crimes committed abroad as
long as the country where the crime is committed does not decide to take action
against them (article 4.1 of the Decree).

1.7 EVENTS THAT MODIFY THE BODY

The Decree includes rules for the liability of the Body in the case of modifying events
such as transformations, mergers, demergers and sales of businesses.

In the case of a transformation of the Body, it continues to be liable for crimes

committed before the transformation effective date. The new Body will be required to
pay the fines applied to the original Body for crimes committed before the
transformation (article 28 of the Decree).

In the case of a merger, the Body resulting from the merger is liable for the crimes
committed by the merged/merging bodies (article 29 of the Decree).

In the case of a partial demerger, the demerged Body continues to be liable for the
crimes committed before the demerger. However, the Bodies benefitting from the
partial or total demerger are jointly liable for the payment of the fines due by the
demerged Body for the crimes committed before the demerger up to the limits of the
actual value of the assets transferred to each Body (article 30 of the Decree).

In the case of a sale or a transfer of a business in which a crime was committed, without
prejudice to the benefit of preventative enforcement of the seller, the buyer is jointly
and severally liable with the seller for the payment of the fine, to the extent of the
value of the sold business and the fines recorded in the mandatory accounting records
or of which the buyer was aware. Moreover, the fines are applicable to the Bodies that
keep or receive, including a part thereof, a business unit in which a crime was incurred
(article 33 of the Decree).

1.8 CHARACTERISTICS OF THE ORGANISATIONAL, MANAGEMENT AND CONTROL

MODEL
The Decree does not regulate the Model’s nature and characteristics in detail but
General part 10 of 29
covers certain general principles. The mere adoption of the Model by the Body is not
sufficient to exclude its liability.

Pursuant to article 6.1.a) of the Decree, the Model is only valid as a reason for
exemption from liability if:
 it is efficient, i.e., it is reasonably suitable to prevent the crime(s) committed;
 it has been effectively implemented, that is to say its content is applied to the
company procedures and internal controls.

With respect to the Model’s efficiency, article 6.2 of the Decree requires that it shall at
least have:
 identified the risk areas in which it is possible that the crimes could be
committed;
 provided for specific protocols designed to program how the Body takes and
implements decisions for the crimes to be prevented;
 identified how the financial resources suitable to prevent the crimes shall be
managed;
 established the information obligations vis-à-vis the Supervisory Body;
 introduced a suitable disciplinary system to punish non-compliance with the
measures set out in the Model (the “disciplinary system”).

The Decree provides for a regular check of the Model and its updating to ensure it is
implemented efficiently. This check shall take place whenever significant violations of
its provisions take place or there are changes in the Body’s organisation or business
activities (article 7 of the Decree).
In short, the Model shall provide for suitable measures, depending on the
organisation’s size, nature and type of business, to ensure that it carries out its
activities in compliance with the law. It shall also identify and promptly eliminate any
risk situations.

1.9 CONFINDUSTRIA’S GUIDELINES

Article 6.3 of the Decree provides that “The organisational and management models may be
adopted, ensuring the requirements of point 2, based on codes of conduct drawn up by sector
associations, communicated to the Ministry of Justice which, together with the competent ministries,
may comment on the models’ suitability to prevent crimes within 30 days”.

Current regulations, the “Guidelines for the development of organisational, management and
control models as per Legislative decree no. 231/2001” (also the “Guidelines”, set out in the
next section) updated by Confindustria (General Confederation of Italian Industry) on
March 2014, company procedures and court rulings of the past few years were taken
into account in the drafting of the Model adopted by Esselunga s.p.a. (the “Company”
or “Esselunga”).

General part 11 of 29
Any differences between the Guidelines and the Model are the result of the need to
adapt organisation and management measures to specific business activities carried out
by the Company and to the environment in which the Company operates.
This may require a deviation from instructions contained in the trade associations’
Guidelines that, by definition, are of a general character and do not have binding
value.

The key points, set out herein and considered when preparing this Model, may be
summarised as follows:
 identification of the areas at risk to identify those internal departments within
which the adverse events covered by the Decree may take place;
 preparation of a control system able to prevent the risks through specific
protocols. The most important components of this control system as identified
by Confindustria are:
 Code of Conduct;
 organisational system;
 manual and computer-based procedures;
 authorisation and signatory powers;
 integrated control system;
 communication with personnel and training.

These components shall be based on the following principles:

 verifiability, traceability, consistency and congruity of all transactions;
 application of the segregation principle (no one department shall independently
manage an entire process);
 documentation of the controls;
 development of an appropriate disciplinary system for violations of the Code of
Conduct and procedures provided for by the Model;
 agreement of the requirements to be met by the Supervisory Body, being:
 independence;
 professionality;
 continuity of action;
 reporting obligations.

1.10 WHISTLEBLOWING
The law no. 179 of November 30, 2017 “Provisions for the protection of
whistleblowers who report offences or irregularities which have come to their
attention in the context of a public or private employment relationship”, with effect
from 29 December 2017, amended the article no. 6 of Legislative Decree 231/2001, in
order to harmonize provisions for public and private sector and to set protective
measures for workers or collaborator who report offences or irregularities which have
come to their attention in the context of the employment relationship.

General part 12 of 29
In detail, into the article no. 6 of the Decree, three new paragraphs have been inserted,
paragraph 2-bis, 2-ter and 2-quater, which introduced new requirements for the
organizational, management and control models. Paragraph 2-bis establishes that the
models must provide for:
 one or more channels that allows the subjects indicated in article no. 5,
paragraph 1, letter a) and b) to raise detailed disclosures of unlawful conducts
relevant pursuant to legislative decree no. 231/2001, or breaches of the
organizational, management and control model;
 at least one alternative reporting channel suitable to assure, through IT means,
the confidentiality of the identity of the whistleblower;
 prohibition against retaliation or discriminatory acts, whether direct or indirect,
towards the whistleblower for reasons, directly or indirectly, connected to the
report;
 within the disciplinary system adopted, sanctions against those infringing
protection measures of whistleblower, as well as those making, maliciously or
negligently, disclosures that turn out to be unfounded.

The paragraph 2-ter provides that discriminatory action against the whistleblower, may
be reported to the Labor Inspectorate, so that appropriate measures can be taken. The
paragraph 2-quarter, finally, provides that retaliation or discriminatory dismissal or the
change of job shall be invalid. It is then for the Employer to prove that these measures
have been adopted for different reasons than the disclosure.
As outlined in the Confindustria’s explanatory notes, the aim of the law is to
encourage the emergence of problems of corruption and to strengthen the prevention
and contrast action, as well as to enhance the protection of the reporting parties.

To guarantee the effectiveness of the whistleblowing system, the Company has

adopted a specific procedure for managing the reporting by the employees, directors
and members of the corporate bodies as well as third parties, who were informed of
the existence of special channels of communication that make it possible to raise
reports, based on precise and detailed evidence, also guaranteeing the confidentiality
relative to the identity of whistleblower, even using information technology methods.

2 THE 231 MODEL IN ESSELUNGA S.P.A.

2.1 BRIEF BACKGROUND OF THE GROUP
Supermarkets Italiani S.p.A. was incorporated in 1957 and continues to be the holding
company of Esselunga Group. In November of the same year, it opened the first
Italian supermarket in Viale Regina Giovanna, Milan. It opened its Florence offices in
1960.

Esselunga S.p.A. was set up in 1980. The steady development of its sales network was
flanked by a logistics network and, in 1987, it opened the first automated goods
warehouse in Limito di Pioltello.
General part 13 of 29
The Company’s propensity for innovation can also be seen in the commercial side of
its business: it started to produce delicatessen ready-made meals in its factories in the
1960s.

2.2 ESSELUNGA GROUP

As well as operating in large-scale retail sector through its stores either owned directly
or leased to it by La Villata S.p.A. Immobiliare di Investimento e Sviluppo and other
companies, Esselunga S.p.A., wholly owned by Supermarkets Italiani S.p.A., is also
active in the real estate sector where it researches, designs and develops new projects.

Other companies that are part of Esselunga Group are:

 Atlantic S.r.l., wholly owned by Esselunga, which manages more than 80 bars in
the Company’s main stores;
 EsserBella S.p.A., wholly owned by Esselunga through Orofin S.p.A., which
manages over 35 perfumeries in the Company’s main stores;
 Fìdaty S.p.A.5, wholly owned by Esselunga, which issues and manages “Fidaty
Oro” payment cards which can only be used in the Esselunga stores, Atlantic
bars and EsserBella perfumeries;
 Orofin S.p.A., wholly owned by Esselunga, which owns most of the real estate
development projects;
 a number of other companies set up to promote real estate development
projects designed to assist development of the Esselunga sales network.

Esselunga acquired the 67,50% interest in Villlata Partecipazioni S.p.A. during 2017,
which owns the entire share capital of La Villata S.p.A. Immobiliare di Investimento e
Sviluppo. The company operates in the construction, purchase, development, sale and
leasing of real estate assets for commercial use and it is also involved in maintaining
buildings managed by Esselunga.

In October 2017, Esselunga completed the placement of its first dual-tranche bond,
each of €500 million, with expiry in 6 and 10 years. The placement was reserved for
institutional investors. The proceeds from the bond issuance will be used to refinance
the existing indebtedness mainly and then to finance its activities. These bonds are
listed on the Luxembourg Securities Exchange.

2.3 ESSELUNGA’S ORGANISATION AND ACTIVITIES

(omissis)

5In 2011, Fidaty S.p.A. was cancelled from the general list as per article 106 and the special list as per article 107 of
Legislative decree no. 385/1993 (the Consolidated Banking Act). As a result, Fidaty S.p.A. is no longer required to
comply with the related obligations for money laundering applicable to financial intermediaries by law.
General part 14 of 29
2.4 THE ESSELUNGA MODEL
In order to comply with requirements about legality, correctness and transparency in
carrying out its business activities, Esselunga decided to adopt and introduce a Model
as per Legislative Decree no. 231.
This decision was based on its belief that adoption of such a Model (optional under
the terms of the Decree) would be a valid tool to increase the awareness of the
persons who work for or on behalf of the Company about the importance of their
correct conduct to prevent the risk that the crimes covered by the Decree could be
committed.

Specifically, the Company intends to achieve the following main objectives by

adopting the Model:
 inform the employees, senior management and all those parties who work on
behalf of or for Esselunga in the areas at risk that they could commit crimes if
they violate the measures set out herein that might be punishable by fines which
they would pay and administrative sanctions imposed on the Company in
criminal cases;
 emphasise that conduct contrary to the law and the ethical principles adopted by
Esselunga in its Code of Conduct are strongly condemned by the Company;
 enable the Company to monitor the activities at risk so as to be able to intervene
promptly to prevent or combat crimes.

Therefore, the Model is designed for the Company’s entire workforce, which is
required to be familiar and comply with its provisions.
The Model addressees are:
 directors and statutory auditors;
 members of senior management who act on behalf of and for the Company;
 managers;
 all other employees;
 contract workers.

The Company also ensures compliance with the law, the Code of Conduct, the Model
and internal procedures, for the parts applicable to them, by third parties (contractors,
consultants, suppliers, worker cooperatives, etc.) specified in contractual clauses which
require compliance therewith and allow the Company to terminate the contract if it is
violated (termination clauses).
The Model consists of a set of rules, tools and conduct guidance, designed to provide
the Company with an effective organisational and management system that is
reasonably suitable to identify and prevent the 231 predicate crimes.

The Model’s efficient functioning depends on how closely it reflects the company it is
designed for.

General part 15 of 29
2.5 APPROVAL, AMENDMENT AND IMPLEMENTATION OF THE 231 MODEL
The Company’s Board of Directors adopted the Model on 25 November 2010
pursuant to article 6.1.a) of the Decree.
It concurrently set up the Supervisory Body.

On 11 October 2011, the Board of Directors approved new special parts of the Model
(Crimes against industry and commerce, Forgery of coins, public credit notes, duty
stamps, Crimes related to violations of copyrights, Computer crimes and unlawful data
processing, Corporate crimes, Crimes related to handling stolen goods, money
laundering and use of money, goods or assets of illegal origin) and updates to the
existing special parts and Annexes.

Then, on 19 March 2013, the Board of Directors approved updates to the Model and
specifically to the general part and the related Annexes 1 (Legislative decree no. 231 of
8 June 2001), 2 (List of the Legislative decree no. 231/2001 predicate crimes) and 3
(Code of Conduct) and all the existing special parts. During the same meeting, the
Board of Directors also resolved to adopt four new special parts about transnational
crimes, organised crime, the crime of employing third-country nationals residing
without authorisation and crimes against the environment.

On 10 November 2015, the Board of Directors resolved to approve other updates to

the Model’s general part and the special parts related to Crimes against the
environment and Crimes related to handling stolen goods, money laundering and use
of money, goods or assets of illegal origin and including the self-laundering.
At the same time the other special parts were updated to comply with new controls
resulting from the new procedures adopted by the Company.

On 12 December 2017, the Board of Directors approved updates to the Model and
specifically to the general part and the special parts related to crimes against
individuals (due to the introduction of illegal intermediation and exploitation of
labour) and to Organised crime and Transnational crimes - Induction not to make
statements or to make untruthful statements to the judicial authorities parts that were
unified in order to ensure greater uniformity.

The Company has considered the crimes of Market abuse relevant and applicable after
the bond placement.
The Company deleted Annex 1 - Legislative decree no. 231 of 8 June 2001 and 2- List
of the Legislative decree no. 231/2001 predicate crimes, because these documents
should become obsolete as a result of the continuous updating of the Decree and its
scope of application.
The board of Directors approved also the updated Code of Conduct.

On September 11st 2018, the Board of Directors approved updates to the general part
of the Model in compliance with the new regulation on whistleblowing which
introduced a management system of reports in the Model. A review of areas at risk
General part 16 of 29
and related controls and the definition of new controls, if necessary, were done after
the recent organizational changes.

This Model replaces that adopted on 12 December 2017.

3 METHODS
3.1 DEVELOPMENT OF THE MODEL: THE PRELIMINARY ACTIVITIES TO DEFINE
AND UPDATE THE MODEL
(omissis)

3.2 THE MODEL’S STRUCTURE

This Model consists of a general part and some special parts and annexes.

The general part sets out the contents of the Decree, the Model’s purpose, the
Supervisory Body’s duties, the applicable sanctions and, in general, its principles, logics
and structure.

The general part includes the following annexes:

 Annex 1: Code of Conduct;
 Annex 2: Members of the Supervisory Body and their curricula vitae.

The special parts cover the specific crimes listed below:

 Special part A: Crimes against the public administration;
 Special part B: Occupational health and safety crimes;
 Special part C: Crimes against industry and commerce and counterfeiting;
 Special part D: Crimes relating to forgery of coins, public credit notes and duty
stamps;
 Special part E: Crimes related to violations of copyrights;
 Special part F: Computer crimes and unlawful data processing;
 Special part G: Corporate crimes;
 Special part H: Crimes related to handling stolen goods, money laundering and
use of money, goods or assets of illegal origin and self-laundering;
 Special part I: Organised crime, Transnational crimes, Induction not to make
statements or to make untruthful statements to the judicial authorities;
 Special part L: Crimes against the individual;
 Special part M: Employment of third-country nationals residing without
authorisation;
 Special part N: Crimes against the environment;
 Special part O: Market abuse.

General part 17 of 29
The aim of each special part is to remind the identified addressees of their obligation
to adopt rules of conduct that comply with those provided for by the internal
procedures referred to by the Model, designed to prevent the commission of the
crimes covered by the Decree and identified as relevant on the basis of the
organisational structure and business operations.

The following are indicated for each special part:

 the areas at risk and the related sensitive activities;
 the units and/or offices that operate in each area at risk;
 the crimes that could be committed and how;
 the main existing controls for each area at risk;
 the conduct standards to be complied with to reduce the risk that crimes could
be committed.

Based on the results of the risk assessment, at present, the Company has found the
crimes article 25-quater of the Decree - terrorism and subversion of democracy not to
be relevant although they are theoretically applicable. Based on the above findings the
Company doesn’t prepare special parts for these crimes.

The crimes at article 25-quater.1 of the Decree - female genital mutilation practices
were considered not applicable to the Company’s situation.

The Company based its evaluations on its current structure and activities and the type
of crime in question.
The Company is committed to continuously monitoring its activities both in relation
to these crimes and any legislative changes the Decree may be subjected to. If one or
more of the above crimes becomes relevant, or new crimes are included in the Decree,
the Company will decide whether to integrate this Model with new special parts.

3.3 THE MODEL’S MAIN COMPONENTS

The Model is integrated by the measures and principles of the Code of Conduct and
all the processes, procedures and systems.

Specifically, for the purposes of this Model, it includes all the tools already in place at
the Company, comprising all the adopted policies, procedures and rules of conduct.
These tools are an integral and substantial part of the Model.

Accordingly, the following documents are an integral and substantial part of the
Model:
 the Code of Conduct, which sets out all the Company’s rights, duties and
responsibilities vis-à-vis the addressees;
 the organisational structure designed to ensure the clear and organic assignment
of duties, providing for their segregation where possible or, if not, compensating

General part 18 of 29
 controls, and to check the correctness of the addressees’ conduct;
 internal procedures and controls that guarantee suitable transparency of and
familiarity with the decision-making processes and regulate the operating models
in place to take and implement decisions about the areas at risk;
 proxy and decision-making powers systems that reflect the responsibilities
assigned to ensure the clear and transparent representation of how the Company
takes and implements decisions;
 disciplinary system and related sanctions mechanism to be applied if the Model
is not complied with.

It follows that the term “Model” not only refers to this document but also to the other
documents that will be adopted in the future as provided for herein and that will
continue with the same objectives.

4 MODEL ELEMENTS
4.1 MAPPING OF AREAS AT RISK AND IDENTIFICATION OF THE RELATED
CONTROLS - REFERRAL
As mentioned earlier, mapping of the areas at risk and the related identification of the
pertinent controls are carried out by area, based on a review of the internal context
and interviews of personnel.

The Company identifies the areas in which offences identified by the Decree could be
committed, based on nature and characteristics of the activities of the Company.
The assessment of the potential risks focused also on the different ways in which said
crimes could be committed during the activities of the company’s areas, in order to
provide a complete picture of how the different types of crimes can be committed in
the environment where the Company works.

In addition to the areas which are directly involved because they include activities
which might integrate criminal conducts, the definition of area at risk also covers the
areas which are indirectly involved in the perpetration of other crimes, in which they
have an instrumental role. In particular, instrumental activities shall mean those
activities where it is possible that certain conditions will occur such as to facilitate the
perpetration of crimes in the context of the areas which are directly dedicated to the
mentioned activities in relation to the species of crime.

With reference to all the areas at risk, including instrumental ones, the review covered
any indirect relationships, such as those the Company has, or might have, through
third parties.

The special parts of the model, split by crime, (to which reference should be made)
provide details of the mapping of the areas at risk and a summary of the internal
controls used by the Company.
General part 19 of 29
4.2 DOCUMENTATION OF THE ACTIVITIES AND SEGREGATION OF THE DUTIES
As part of its organisational system, the Company has fine-tuned and integrated a
number of both manual and computer-based procedures, to regulate the performance
of its activities. These procedures ensure the best possible compliance with the
segregation principle, whereby no one person can manage an entire process from its
start to its completion.

Specifically, the procedures adopted by the Company represent the rules to be

followed in the internal processes and define the controls to be performed to ensure
the correctness, effectiveness and efficiency of its activities.
Therefore, the Company ensures compliance with the following principles:
 encourage the involvement of more than one party to guarantee the proper
segregation of duties by the juxtaposition of functions;
 adoption of measures that provide that each transaction and action can be
verified and documented, is consistent and appropriate;
 recommend adoption of measures to document the controls performed over the
transactions and/or actions so that, at any time, it is possible to rerun controls.

4.3 DESCRIPTION OF THE PROXY SYSTEM

The Company has a clear-cut and formalised proxy system. Specifically, the allocation
of powers and responsibilities is formalised in a proxy system, including proxies for
occupational health and safety, hygiene and safety of food and the environment.

With respect to occupational health and safety, the Board of Directors has appointed
one of its members as the “Employer” pursuant to Legislative decree no. 81/2008.
Within the limits established by law and given the Company’s complex organisational
structure, the Employer has delegated the related powers to the managers in charge of
the areas at risk and they in turn may sub-delegate powers. These managers,
empowered by the Employer, report solely and hierarchically to the Company’s
managing director for organisational and business issues and to the Employer for any
issues related to health and safety.

The Board of Directors has entrusted a director with the supervision of compliance
with regulations on food hygiene, the production, processing, storage, transportation
and sale of food, including of third parties. This director is also responsible for
ensuring compliance with all the laws about the promotion, purchase and retail sale,
including on-line, of food products. The director has delegated these powers to the
food hygiene managers of the relevant departments.

In addition, the Board of Directors has entrusted one of its members with supervision
of the issues related to the protection of the environment, especially with respect to
the roll-out and maintenance of all the systems needed to ensure that all discharges
and effluents comply with the standards of acceptability required by ruling legislation,
compliance with all the regulations about pollution, protection of health and the
General part 20 of 29
environment to prevent any forms of pollution and protect the environment. The
director has delegated these powers to the environmental managers of the relevant
departments.

All proxies provide for the clear-cut and transparent identification of the activities
performed by each delegated manager and are in line with their positions within the
Company.

4.4 INFORMATION SYSTEMS

The main systems used to manage the administration, treasury, management accounts,
marketing, personnel, procurement, sales, logistics and e-commerce areas are
supported by top quality IT applications. They provide guidance about how to
perform certain transactions and ensure a high level of standardisation and
compliance, as the processes managed by these applications are validated when the
software is released.

The information systems are managed using procedures that guarantee the physical
and logical safety of the systems and their data to ensure:
 the principle of the segregation of duties by the juxtaposition of functions;
 the mapping of transactions and documentation of controls.

4.5 FOOD CERTIFICATIONS

Food Safety Certification
Esselunga has a Food Security Management System which meets and incorporates
both mandatory and voluntary legislation requirements (Standard BRC, IFS, FSSC
22000) and established one methodological framework for food risk assessment and
the definition of management and control procedures.
Esselunga decided to certify its quality management system for food safety according
to the FSSC 22000 scheme which is based on international standards (ISO 22000)
integrated with technical specifications of the food sector (pre-requisites) in order to
be recognized by GSFI (Global Food Safety Initiative) - created with the aim of
establishing unequivocal food safety criteria – and by EA (European Cooperation for
Accreditation).
In June 2018 SGS (Société Générale de Surveillance) certified the Parma’s plant for
production and packaging of fresh semolina pasta, fresh egg pasta (stuffed or not) and
for production and packaging of bakery products (bread, oven confectionery products,
artisanal biscuits).
By the end of 2018 and early 2019 the certification may also be extended to the
Pioltello’s production plants for production and packaging of gastronomy, pastry,
juice and beverages products, to the Meat Processing Centre for meat fresh processing
and meat preparation (Hamburger) and to the Fish Processing Centre for processing
and packaging of fish products and processed products (sushi, fish salads, etc.).

General part 21 of 29
Voluntary beef labelling
In 2001 Esselunga was the first large distribution chain to obtain the authorization of
the Voluntary beef labelling specifications no. Aut. Min. IT012ET (according to Reg.
EC 1760/2000 and subsequently the MD 16/01/2015) from the Minister of
Agricultural, Food and Forestry Policy (MIPAAF). The purpose of specifications is to
allow the inclusion in the beef’s labels of other optional information such as the
indication of the breed, the breeding system (guarantee of animal welfare according to
the standard of “National reference Centre of animal welfare”) and the category of the
adult bovine (e.g. vitellone and scottona). These, in addition to basic compulsory
information (country of birth, fattening, slaughtering), should ensure the complete
traceability along the entire production chain and greater transparency in the
information provided.
Esselunga is subject to the control of SGS certification body, an independent body
approved by the Ministry (MIPAAF).

Organic certification
In 2001 Esselunga obtained the Organic certification for import of swiss chocolate
(chocolate with hazelnuts, dark and milk chocolate).
Since 2017, Esselunga has begun a project of organic certification of its plants and
own warehouses. Warehouses of Limito, Biandrate and Florence and the external
warehouses for logistics support were awarded certification; also Limito plant where
juices and drinks are produced from pressed fresh fruit and vegetables and Fish
Processing Centre of Biandrate where certification involved the fish processing (sea
bass, sea bream, salmon fish burger, shrimps).
The Biological certification plan within 2018 will affect Limito for both the
production plants abd the Meat Processing Centre and Parma production plant.

4.6 CERTIFICATION OF THE OCCUPATIONAL SAFETY MANAGEMENT SYSTEM

Esselunga has an occupational health and safety management system that complies
with the requirements of the British standard OHSAS 18001:2007.
It obtained certification for all its sites (commercial, production, processing, logistics,
etc.) in 2012.
An independent third party issues the certificates and the Company undergoes regular
inspections by this third party.
Esselunga was the first company in large-scale retail sector to be certified OHSAS
18001:2007 in Italy for all its sites and activities.

The Company is already working on the new UNI ISO 45001 “Occupational health
and safety management systems – Requirements” that replaced the OHSAS
18001:2007 from march 2018, in order to adjust to the requirements in advance.
The Company obtained also the environmental certification UNI EN ISO 14001.

General part 22 of 29
4.7 CODE OF CONDUCT
An essential part of the system of preventive controls required by the Decree is the
adoption of ethical standards and conduct guidelines to prevent crime.

The Code of Conduct prescribes a set rules of company deontology which the
Company recognizes as its own and asks its governance bodies, employees and third
parties with whom the it works with, to observe it.

These standards and guidelines are contained in the Code of Conduct adopted by the
Company, which is an integral part of the Model and the crime prevention system.
Violation of the rules of conduct set out in the code implies the application of
disciplinary measures.

4.8 WHISTLEBLOWING PROCEDURE: SCOPE AND CHANNELS TO RAISE

DISCLOSURES
The Company, in line with the additions made to the article 6 of Legislative Decree
231 and the Law no. 179 of 2017, established a whistleblowing reporting system that
protect the whistleblowers’ identity and their privacy. All employees and collaborators
are informed of the knowledge, understanding and dissemination of objectives and of
the spirit of the reports.
Reports should be about:
 relevant wrongdoings that can give rise to any situation leading to liability as
contemplated by Decree 231/01;
 breaches of organization, management and control model they became aware of
by reason of employment.

Reports raised only for personal situations, based on mere suspicions and without a
testimonial or documentary value, do not fall within the scope of whistleblowing.

(omissis)

Whistleblower should raise his disclosure using a specific channel, via informatics tool,
for all employees and members of the corporate bodies to guarantee the
confidentiality concerning the identity of the whistleblower and the content of report,
as required by the law.
Reports should be sent by email to the Supervisory Body’s address
[email protected], as laid down in paragraph 7.5 “Information flows from/to the
Supervisory Body”.

(omissis)

The Company and addresses of reports should protect the whistleblower against direct
or indirect acts of discrimination or retaliation, due to the report.

General part 23 of 29
Duties and controls of the addresses in order to check the information are detailed in
the Company procedure.

(omissis)

4.9 GENERAL PRINCIPLES OF CONDUCT

All activities included in the areas at risk of the special parts of the Model must be
carried out in compliance with the prevailing laws, values, politics and procedures
approved by Esselunga, as well as the regulations contained in this Model.
The organizational, management and control system of the Company should respect
the principles of attribution of responsibilities and representative powers, segregation
of roles and activities, and liability, transparency and traceability of acts.

Performing the activities listed in each Special Part of the Model and carrying out their
own duties, the Addresses of the Model involved in the activities must know and
respect:
 applicable Italian and eventually foreign legislation;
 provisions contained in the Model;
 Code of Conduct;
 company procedures and guidelines, as well as all the documentation connected
with the organizational, management and control Model of the company, and its
specific controls.

In detail, the Addresses should comply with principles and rules of conduct avoiding:
 any behaviors that may expose the Company to one of the types of crimes
included in the Decree;
 any behaviors which may involve the commission of types of crimes included in
the Decree;
 any actions against professional ethics and good business practice;
 in the relationships with competitors and third parts in general, behaviors that
don’t respect the principles of loyalty, correctness, transparency and legality with
the aim of foster or encourage interests of the Company and or obtain unfair
advantages.

4.10 DISCIPLINARY SYSTEM

4.10.1 Introduction
Pursuant to article 6.2.e) of Legislative decree no. 231/2001, the 231 Model must
include an adequate disciplinary system designed to punish non-compliance with:
 the Model’s rules and internal procedures as well as the rules of conduct set out
in the Company’s Code of Conduct:
 the implementation of actions and behaviours that are not compliant with the
Law no. 179/2017.
General part 24 of 29
The disciplinary system is also an essential requisite for the Model to be valid as per
article 7.4.b) of Legislative decree no. 231/2001.

The disciplinary system set up in accordance with Legislative decree no. 231/2001 is
an internal system integrating the current laws and regulations which acts as an
independent sanction system applied in addition to the criminal sanctions system.
Therefore, its application does not depend on the criminal liability of the person’s
conduct or the outcome of the related criminal proceeding (if any).
The Company’s disciplinary system, adopted as per the Decree, is independent of the
other procedures for infringements of the general disciplinary rules adopted by the
Company pursuant to article 7 of Law no. 300 of 20 May 1970.
The current disciplinary system shall be properly circulated together with the Model as
it is an integral and substantial part thereof.
Application of disciplinary measures does not in any way affect the Company’s right to
take action against the liable party to obtain compensation for all the damage suffered
as a result of the party’s conduct.

4.10.2 Sanctions applicable to managers and other employees

(omissis)

4.10.3 Sanctions applicable to directors and statutory auditors

(omissis)

4.10.4 Sanctions applicable to temporary workers

If temporary workers violate the Model, the internal procedures or the Code of
Conduct, the HR and organisation department informs the Supervisory Body of the
Model’s violation.

(omissis)

4.10.5 Sanctions applicable to suppliers, contractors and consultants

If suppliers, contractors or consultants violate the rules or standards set out in the
Model, the internal procedures or the Code of Conduct (for the parts applicable from
time to time), their contracts with the Company may be terminated in line with the
terms and conditions of the specific clauses included in these contracts or engagement
letters. The Company may also claim compensation for damages if their conduct leads
to concrete damage. The units which manage the contractual relationship with the
supplier, contractor or consultant inform the Supervisory Body of the Model’s
violation and apply the sanction.
In addition, whenever the Supervisory Body receives a communication of this kind
(including anonymously) or acquires evidence that the Model may have been violated
as part of its supervisory duties, it takes steps to perform the inspections and checks

General part 25 of 29
deemed appropriate.
The Supervisory Body then assesses whether the Model has been violated using the
information collected. If this is the case, it informs the units in charge of managing the
contractual relationship so that it can apply the sanction.

4.10.6 Sanctions applicable to the addresses of reports (“whistleblowing”)

(omissis)

5 COMMUNICATION AND CIRCULATION OF THE 231 MODEL

5.1 GENERAL PRINCIPLES
In order to effectively implement the Model, the Company intends to ensure that its
content and principles are communicated in full both internally and externally.
The HR and organisation department communicates such content and principles and
provides the related training, identifying the best ways of benefitting from them.
The Supervisory Body monitors the communication and training activities and also
works with the HR and organisation department for projects designed to spread
familiarity with the Model, provide training on the Decree, the impact of legislation on
the Company’s activities and conduct standards as well as increase the employees’
awareness of the importance of complying with the Model’s principles.
The communication and training activities are tailored for the type of person/party
involved but are always designed to comply with the principles of completeness,
clarity, accessibility and continuity so that the recipients gain an understanding of the
internal rules they are required to comply with and the ethical standards they shall base
their conduct on.

5.2 COMMUNICATION OF THE MODEL

Employees can access and view the updated Model documentation in a special section
of the company intranet and on “My Portal”.

The updated version of the Model, approved by the Board of Directors, is emailed to
all the office employees with a company e-mail address.
All employees are informed of the publication of the updated version of the Model.

New hires are also notified of the Company’s adoption of the Model and Code of
Conduct when they are taken on.
The Company publishes an abstract of the general part of the Model and the Code of
Conduct on its website.
Suppliers, contractors and consultants are usually required to comply with the Model
for the parts applicable to them from time to time as per the specific contractual
clauses and, if necessary, by reference to the Model as published on the company’s
website.

General part 26 of 29
6 TRAINING
The Company provides training about the content of the Decree and the principles set
out in the Model. The training courses differ depending on the employees’ position,
the level of risk in their areas and whether they represent the company with third
parties.

The HR and organisation department prepares a training programme for the

employees who work in the areas at risk, supervised by the Supervisory Body, and
plans how such training will be provided.
Participation at training courses is mandatory and checked using a special attendance
monitoring system. This mandatory participation is a fundamental part of the Model
and violation leads to application of the sanctions provided for in the disciplinary
system. The training courses cover:
 the Decree and the predicate crimes;
 the Code of Conduct;
 the Supervisory Body;
 the disciplinary system.

The courses are provided both in the classroom and as e-learning. The second option
ensures the timely and widespread circulation of the course contents to all employees
thanks to its graphics and the interaction methods.
The course content is updated to reflect changes in the legislation (e.g., introduction
of new predicate crimes) and the Model’s content (e.g., adoption of new special parts).
The Supervisory Body regularly checks the implementation of the training
programme.

In line with the principles and values included in the Model and the Code of Conduct,
Esselunga acknowledges the importance of the issues of occupational health and
safety. It is committed to improving its employees’ safety in the workplace.
Accordingly, the Company undertakes projects to inform the employees and provide
training about how to prevent accidents at work and risks to their health and safety.

7 SUPERVISORY BODY
7.1 GENERAL CHARACTERISTICS AND ROLE
Article 6.1.b) of the Decree requires that a Supervisory Body be set up as part of the
requirements for a Body not to be held liable for the crimes listed therein. This
Supervisory Body shall be provided with independent powers for its activities and
controls and its duties comprise monitoring the working of and compliance with the
Model and to ensure it is up-to-date.

The Supervisory Body is internal to the Company but independent of the other
company bodies, including the Board of Directors and internal control functions. Its

General part 27 of 29
duties are to monitor the effectiveness and updating of and compliance with the
Model and its components inside the Company. Its role includes:
 monitoring the effectiveness of and compliance with the Model, which includes
the ongoing supervision of the internal activities to ensure the Model is
complied with and checking that the actual procedures comply with the Model;
 assessing the Model’s adequacy and effectiveness by checking that it is suitable
to prevent the crimes covered by the Decree and comply with the related laws
given the Company’s characteristics and type of operations;
 verifying that the Model maintains its characteristics and is updated to reflect
changes in the Company’s internal organisation and in the relevant laws. The
Supervisory Body proposes changes to the Board of Directors that approves
them.

Given the Company’s size and complex business activities, its Supervisory Body has
three members. Annex 2 provides their names and curricula vitae.

7.2 REQUIREMENTS OF THE SUPERVISORY BODY

(omissis)

7.3 APPOINTMENT, REVOCATION AND TERM OF OFFICE

(omissis)

7.4 ACTIVITIES AND POWERS

In order to efficiently carry out its duties, the Supervisory Body has a number of
powers and rights, including the following powers:
 independent activation of control procedures;
 duty of supervising addresses’ compliance with the Model;
 performance of planned or random checks and inspections of operations or
actions carried out in the critical areas, deemed appropriate to correctly carry out
its duties, including through the Company’s existing control units;
 collection and processing of relevant information about the Model’s
implementation;
 performance of internal investigations and inspections to check communications
of possible violations and document any irregularities or violations of the Model
identified from the analysis of the information flows and communications;
 communication of ascertained violations to the HR and organisation
department, the Board of Directors or the board of statutory auditors,
depending on the case, so the appropriate actions can be taken;
 request information and work with the heads of the internal units and offices to
carry out its activities, availing of their assistance for different aspects of the
Model;
General part 28 of 29
  unrestricted access to all the offices, files and documents to obtain all
information, data or documentation deemed necessary;
 utilisation of the services of third party consultants with technical expertise in
specialist areas, when necessary or appropriate;
 work with the HR and organisation department to organise the annual training
programme on the Model and the Decree, to promote projects to circulate an
understanding and knowledge of the Model principles and to prepare the
organisational documentation necessary for the Model’s working, including the
related instructions, information, clarifications and updates.

The Supervisory Body’s powers to take decisions independently must be guaranteed,

as without this it cannot be held to be independent.
It draws up an internal regulation covering its working, activities and procedures for
the correct and effective performance of its functions.

7.5 INFORMATION FLOWS FROM/TO THE SUPERVISORY BODY

Article 6.2.d) of the Decree establishes that the Model shall include mandatory
information to be provided to the Supervisory Body, especially in the case of any
violations of the Model itself, the internal procedures or the Code of Conduct. This
information is provided to improve the Supervisory Body’s controls but does not
require that it takes action if it does not deem it necessary or appropriate.
The information channels used to provide information to and from the Supervisory
Body are described below.
The Company’s managers and employees are required to inform the Supervisory Body
promptly of any violations of the Model or its parts, including by non-group parties, as
well as any other information that is potentially relevant to the Decree’s application.

(omissis)

Communications to the Supervisory Body shall be made in writing to the e-mail

address [email protected], apart from the informatics tool.

The Supervisory Body ensures that the parties making the communications are safe
from any form of retaliation, including any sort of discrimination or penalisation
directly or indirectly connected to the report.

The Supervisory Body shall ensure that the parties making the communication are not
referred to by name, except when required by law or to protect the Company’s rights.
It may adopt measures to deter the provision of untrue information, if the party
providing the information is aware that it is untrue.

(omissis)

General part 29 of 29