CONTROL AND RISK MANAGEMENT SYSTEM

The design, implementation and monitoring activities of the risk management and internal control system defined by the Company are inspired by the CoSo Framework methodological reference, drawn up on the basis of the principles indicated by the Committee of Sponsoring Organisations of the Treadway Commissions; the Company constantly plans and carries out activities to develop and refine the system in its components, in a logic of continuous improvement.

Corporate bodies involved:

• The Board of Directors plays the role of directing and evaluating the adequacy of the internal control and risk management system.
• The Board of Statutory Auditors maintains regular communication flows with the Board of Directors, the Supervisory Board and the Auditing Company.

Within the company organisation, there are control functions that are independent of the operational structures. These functions play a key role in the overall organisational system. Their independence ensures that they can perform their tasks independently, without any external interference. Each of the control functions operates in a coordinated manner with the others, avoiding overlapping competences, but maintaining its own decision-making autonomy. This ensures effective coverage and management of the main risks to which the company is exposed.

• The Head of Internal Audit is responsible for verifying that the Internal Control and Risk Management System (SCIGR) is adequate, functional and consistent with the Board of Directors' guidelines. In carrying out his mandate, the Internal Audit Manager maintains periodic communication flows and, in relevant cases, with all the parties that supervise the internal control and risk management system, each within its competence. The Internal Audit Manager takes part in the meetings of the Supervisory Board as an internal member and, where required, in the audits of the Board of Auditors.
• The Compliance Function is committed to promoting and enforcing regulatory compliance. The Compliance Department's main task is to disseminate corporate awareness of the importance of acting in compliance with national and international regulations, including the provisions applicable to listed companies, consumer protection and personal data protection, regulations on bribery and whistleblowing, and accessibility. All this with a view to preventing possible violations and ensuring responsible and ethical business management.

The task of auditing the accounts is entrusted to a specialised company, appointed by the Shareholders' Meeting on the proposal of the Board of Statutory Auditors.

The auditing firm, which must be registered in a special register kept by Consob, has the task of checking during the financial year that the company accounts are properly kept and that the operating events are correctly recorded in the accounting records. It is also required to inform the Board and Consob without delay of any facts that it deems reprehensible, to verify that the financial statements and the consolidated financial statements correspond to the results in the accounting records and to the checks carried out and that they comply with the rules governing them.

At the end of each financial year, the auditing firm expresses an opinion on the financial statements, which is formalised in a special report.

In accordance with the applicable regulatory provisions, the Ordinary Shareholders' Meeting of the Company on 23 January 2025 appointed the auditing firm Deloitte & Touche S.p.A. to carry out the statutory audit of the financial statements for three financial years starting from 1 March 2024.

Since 25 May 2018, the Company has adopted a Privacy Organisational Model, in compliance with the provisions of Regulation (EU) 2016/679 (GDPR) and, in general, with the regulations on privacy, defining guidelines, inter alia, for the management of corporate and organisational relations and for the necessary coordination of operational and compliance activities on the processing of personal data.

The Company has appointed as DPO of the Unieuro Group the lawyer Diego Fulco, founding partner of the firm NetForLegal, partner of ‘Net For Legal’, attributing to him all the powers and functions pursuant to art. 39 GDPR. The appointment is effective from 27 April 2021.

The DPO reports to the Board of Directors and, where necessary, to the Board of Statutory Auditors.

Model 231 implements the provisions of Legislative Decree 231 of 2001 - which introduced into the Italian legal system the administrative liability of entities for certain predicate offences committed in their interest or to their advantage by directors, managers or employees - in order to prevent the commission of the offences set out in the Decree. The purpose of the Model is to encourage the performance of company activities in accordance with principles of fairness, ethics and transparency and, at the same time, to avoid potential risk situations in business management.

Supervisory Board

The Supervisory Board has the task of supervising the correct functioning, effectiveness and observance of Model 231, as well as of ensuring that it is updated and periodically verifying the implementation of the principles and controls contained therein. The
Supervisory Board of Unieuro S.p.A. reports to the Board of Directors.
The members of Unieuro S.p.A.'s Supervisory Board meet the requirements of:

• autonomy and independence from any conditioning in the performance of their activities;
• professionalism and competence in legal matters, control systems and company organisation;
• continuity of action in constantly monitoring compliance with Model 231, as well as its implementation and updating.

The current Supervisory Board is composed of:

• Giorgio Rusticali, Chairman of the Body and external member;
• Raffaella Folli, Head of the Internal Audit Function internal member;
• Chiara Tebano, external member.

It consists of:

1. a General Section that illustrates the contents of Legislative Decree 231/01, the purposes of the 231 Model, the procedures for setting up and functioning of the Supervisory Board, the system of sanctions, and staff training
2. a Special Part describing the conduct and prevention measures to reduce the risk of committing the predicate offences referred to in Legislative Decree 231/01.

Model 231 is periodically updated in consideration of any organisational and/or regulatory changes in line with best practices and industry standards.

The Code of Ethics is an integral part of Model 231 and constitutes its essential foundation for defining a culture of ethics and corporate transparency.