Compliance models

In March 2023, Acea’s Board of Directors adopted the Anti-Corruption Guidelines, which standardise and integrate all the compliance controls contained in the internal regulatory system (Code of Ethics, 231 Model, related procedures etc…), with a view to defining an organic system of rules and principles intended to prevent and combat risks associated with unlawful practices.

 

The guidelines are designed to regulate the roles and responsibilities of the parties involved and the monitoring activities pertaining to anti-corruption.

 

More specifically, the guidelines make it possible:

 

• to define and revise the Acea Group anti-corruption framework (namely the main pillars used by the Group to prevent and combat corruption)

   

• to identify sensitive areas potentially more exposed to the risk of corruption, the behavioural principals to be observed and some applicable controls

   

• to define information and reporting flows with regard to the framework’s implementation and monitoring. 

   

The guidelines apply: 

 

• to Acea and to Acea’s direct and Indirect subsidiaries (as regards investee companies the document should be considered a support instrument for the definition of their respective regulatory tools)

   

• to suppliers, partners, business associates and, more generally, all those acting in the name and on behalf of Acea or the Group companies, or with whom the same come into contact in the course of their business.  

   

   

The voluntary implementation of a Corruption Prevention Management System (CPMS), according to the requirements set forth by standard UNI ISO 37001:2016, forms part of a virtuous circle for combating and preventing corruption phenomena.

 

The system’s “manifesto” is the Anti-Corruption Policy, approved by the Board of Directors in March 2023, which sets out the general principles and engagements pertaining to Acea S.p.A.

 

This document is intended not only for Acea personnel, but also suppliers, partners and everyone acting in the name and on behalf of Acea or with whom Acea comes into contact in the course of its business. It specifically represents the commitment vis-à-vis the principles and requirements laid down by standard ISO 37001:2016.

 

In September 2023, Acea S.p.A. was awarded ISO 37001:2016 certification for their CPMS.

 

 

Acea’s Anti-Corruption Manager (ACM) oversees compliance for corruption prevention purposes and has the responsibilities defined in the Anti-Corruption Guidelines.

 

In particular, the ACM:

 

• monitors and coordinates activities connected with the adopted anti-corruption framework;  

   

• coordinates, develops, monitors and maintains the Corruption Prevention Management System in accordance with standard UNI ISO 37001:2016.

   

A similar function has been created at the Group companies.

 

 

The Acea Group has adopted an extensive Antitrust & Consumer Protection Compliance Programme, aligned with domestic and international best practices, defining organisational policies, rules, measures and control units designed to ensure the conformity of its actions with legislation and promote the development of a business culture oriented towards respect for principles of fair competition and correct behaviour vis-à-vis consumers. 

 

During the last few years, the Programme, which is also implemented by the subsidiaries, has been revised and updated. More specifically, in 2022 the Board of Directors approved the “Antitrust and Consumer Protection Compliance Guidelines”, valorising the experience gained during the first years of application and implementation of the Programme at Group level.

 

The Guidelines describe the main components of the Antitrust Programme, namely:

 

• commitment and involvement on the part of senior management as regards the implementation and monitoring of the Programme; 

   

• appointment of the Antitrust Contact Person; 

   

• identification and assessment of the company’s specific Antitrust Risk (Risk Assessment); 

   

• definition of rules and development of management procedures capable of reducing Antitrust Risks (Risk Management); 

   

• promotion of specific, periodic and mandatory training sessions (Training) and updating of staff, alongside initiatives aimed at communicating and disseminating the Programme (Communication); 

   

• definition of a suitable system of disciplinary measures and incentives aimed at supporting compliance with the Programme; 

   

• periodic updating and monitoring of the Programme by way of systematic actions to evaluate the efficacy of its various components (Monitoring).

   

   

Moreover, in December 2023, Acea SpA’s Board of Directors approved an update of the “Antitrust and Consumer Protection regulatory compliance Handbook”, the Antitrust Compliance Programme’s main regulatory tool. 

 

More specifically, the Handbook:

 

• sets out the main points of the legislation laid down for the protection of Competition and Consumers

   

• explains the relevant circumstances and actions and the most important behavioural rules to be observed by all addressees of the Antitrust Compliance Programme, failure to comply with which gives rise to appropriate disciplinary sanctions and/or contractual remedies. The rules set forth in the Manual are complemented by the provisions contained in the internal regulations, which form an integral part thereof.

 

The Manual is addressed to:

 

• Acea and its Subsidiaries,

   

• all managers, employees and other parties (natural persons and legal entities) operating on behalf and/or under the management and/or subject to the determining influence of Acea or the Subsidiaries, for whatsoever reason, directly or indirectly, on a permanent or provisional basis, in Italy or abroad.

   

   

Acea’s Antitrust Contact person is responsible for the design, implementation and monitoring of the Acea SpA Antitrust Compliance Programme. His/her duties are set out in the Antitrust and Consumer Protection Compliance Guidelines and Regulations.

 

In particular, the Contact person takes care of the following:

 

• the adoption of the Compliance Programme;

   

• the implementation of all Programme components;

   

• the Programme’s periodic monitoring and update;

   

• activities for preventing and combating prohibited behaviours.

   

He/she also defines the guidelines with regard to Antitrust Compliance at Group level.

 

A similar figure has been set up in the Group companies. 

 

 

On 14 March 2022 Acea SpA’s Board of Directors adopted the Privacy Governance Guideline, setting out the essential elements of the Acea Privacy Governance Model, together with the related interpretation, within the Group, of the compliance framework.

 

The Guideline forms part of the integrated framework adopted by the Acea Group for the application of Regulation (EU) 2016/679 (“General Data Protection Regulation”, hereinafter “GDPR”) regarding the protection of natural persons and the processing of personal data.

 

The objectives of the Guideline are as follows:

 

• to regulate Acea SpA’s direction and control initiatives and explain objectives, principles and activities pertaining to Privacy issues;

   

• to define the general rules for transverse actions involving the Privacy Governance Model.

   

 

More specifically, the Group’s Privacy Governance framework pursues the following purposes:

 

• to ensure observance of current legislation with regard to data processing;

   

• to define roles and responsibilities of the persons involved in the application of Acea’s “Privacy Organisational Model” as shown below, and to explain the latter’s role of direction and control within the Group;

   

• to define the data protection principles that must be implemented and effectively enforced;

   

• to define the framework of security controls that must be analysed and explained in the dealings with parties (legal entities or natural persons) who process data on behalf of Acea;

   

• to define the activities to be carried out in order to analyse areas that may potentially impact data protection;

   

• to assess the risk and impact on the rights and freedoms of natural persons in connection with the processing of personal data;

   

• to explain disclosure requirements;

   

• to implement the actions necessary for protecting the rights of the parties concerned, ensuring the correctness of the handling process and response to their requests;

   

• to define the requirements of privacy reports and personal data processing registers;

   

• to describe the functional architecture of the automatic privacy system management tools in the companies.