A report can be submitted, in written or oral form, through the platform accessible directly from Metalba Aluminium s.p.a. https://www.metalba.com/en/contacts

It is advisable for the reporter to provide as much information as possible regarding the incident (following the instructions provided by the platform), taking care to describe the facts to be reported in detail. The reporter may also identify other individuals who can provide information on the incident and attach files or documents supporting the report.

In addition to administrators and members of corporate bodies, reports can be made by employees or collaborators of the Company who have witnessed, directly or indirectly, an offense or irregularity committed by the Company or one of its employees. This category also includes volunteers, interns, and freelancers.

Reports can also be made by external parties (e.g., suppliers), provided that the information has been acquired within the scope of their work context.

It is not necessary for a legal relationship with the Company to be in place at the time of the report.

Any behavior, act, or omission that harm public interest or the integrity of the Company and that constitute a violation of European regulations can be reported, including:

• offenses falling within the scope of application of EU acts related to the following sectors: public procurement, services, products and financial markets, prevention of money laundering and terrorist financing, product safety and compliance, transportation safety, environmental protection, radiation protection and nuclear safety, food and feed safety, animal health and welfare, public health, consumer protection, privacy and personal data protection, and network and information system security;

• acts or omissions harming the financial interests of the European Union;

• acts or omissions concerning the domestic market (e.g., violations of competition or State aids regulations);

• acts or behaviors undermining the purpose or objectives of EU acts.

Relevant unlawful conduct under d.lgs. 231/2001 or violations of the Company's organizational and management model can also be reported.

WARNING: Disputes concerning the personal interests of the reporter and exclusively related to their individual employment relationship cannot be reported.

All reports are received by the Whistleblowing Officer, who will send a receipt notice to the reporter within 7 days.

Initially, an analysis will be conducted to assess the validity of the report and its relevance to the reportable violations.

The Whistleblowing Officer may subsequently contact the reporter through the IT platform to request additional information or clarifications. Once the report has been processed and the necessary investigations have been conducted, the reporter will be informed of the outcome.

The Whistleblowing Officer may decide to archive the report if it is clearly unfounded or irrelevant to the scope of application.

All data related to the report (identities of involved parties and content of the report) are protected by security measures and standards (e.g., encryption tools and other methods to prevent unauthorized access).

The identity of the reporter is only known to the person responsible for handling the report, who ensures absolute confidentiality for the reporter and other mentioned parties.

At the time of submitting the report, the platform will automatically assign a unique identification code to the reporter, which can be used by the reporter for subsequent access to the platform.

It is recommended to carefully preserve this code as it cannot be duplicated or recovered if lost.

During the report submission process, the reporter may choose not to disclose their identity.

However, the Company encourages reporters to reveal their identity, ensuring absolute respect for the reporter's confidentiality and the application of protections provided by d.lgs. 24/2023, which cannot be applied to an unknown individual.

This also enhances the effectiveness of subsequent investigations conducted by the Whistleblowing Officer, who may only handle anonymous reports if their content is clear, precise, complete, and suitable for identifying specific facts and situations.

The Company does not tolerate misuse of the established reporting channel, i.e., using the channel to make reports with an obvious defamatory and opportunistic character.

If these elements are identified in the report or it becomes evident that the reporter's intention was to harm or unjustly blame others, the Company reserves the right to take disciplinary and/or legal actions against the reporter.

Furthermore, if the reporter's responsibility is established (e.g., by a first-instance judgment), the protections provided by d.lgs. 24/2023 will not be guaranteed.

An external report is a report addressed to ANAC.

A reporter can make a report to ANAC when:

• no reporting channel has been established in their work context, or if the activated channel does not comply with the provisions of d.lgs. 24/2023;

• the reporter has already made an internal report, but it has not been followed up;

• the reporter has reasonable grounds to believe that, if they made an internal report, it would not be effectively followed up or could pose a risk of retaliation;

• the reporter has reasonable grounds to believe that the violation may constitute an imminent and obvious danger to public interest.