Data protection information for whistleblowers (system)

The operation of our whistleblower system serves to ensure the legal compliance of our processes, the clarification of facts and, if necessary, further legal prosecution. We are legally obliged to set up and operate the whistleblower system; the legal basis for data processing is Art. 6 para. 1 lit. c GDPR in conjunction with Section 10 of the Whistleblower Protection Act (HinschG). In doing so, we process data on possible criminal offences within the meaning of Section 2 HinSchG. If you disclose special categories of personal data to us, we process these for the establishment, exercise or defence of legal claims (Art. 9 para. 2 lit. f GDPR) or within the scope of our legal obligations pursuant to Art. 9 para. 2 lit. g GDPR. If investigations are carried out in the context of employment, the legal basis is § 26 para. 1 sentence 2 BDSG; if special data is involved here, § 26 para. 3 BDSG. We may also process the data in order to protect our legitimate interests or those of third parties. The legal basis is then Art. 6 para. 1 lit f GDPR. Legitimate interests here are in particular the plausibility check of information, the prevention of further or future misconduct, the relief of employees and the fulfilment of obligations to cooperate in clarification measures in connection with law enforcement authorities.

As part of the whistleblower system, we use service providers who are separately bound to confidentiality and data protection for specific areas where access to personal data cannot be ruled out. These categories of recipients are Service companies for data destruction and, if necessary, external consultants. If necessary, we commission third parties in the context of clarification and evaluation of facts, such as lawyers, auditors, experts or forensic experts.

Data is passed on to authorities if there are overriding legal provisions or for further legal prosecution. If necessary, personal data will be transmitted to insurance companies

Personal data collected as part of the whistleblower system will be stored or deleted in accordance with the relevant data protection regulations, in particular in accordance with Section 11 HinSchG (generally 3 years after completion of the procedure), unless other legal provisions require longer storage.

Your right to information, rectification, erasure, objection and data portability.

You can exercise your right to information, correction and deletion of data at any time. Simply contact us using the channels described above. If you wish your data to be deleted but we are still legally obliged to retain it, access to your data will be restricted (blocked). The same applies in the event of an objection. You can exercise your right to data portability insofar as the technical possibilities are available to the recipient and to us.

You have the right to lodge a complaint with a data protection supervisory authority at any time.

The purpose of the processing is to clarify the facts of criminal offences. Please provide us with as much specific information as possible about the facts of the case.

In connection with the processing of whistleblower cases, no profiling and no automated decision-making in individual cases within the meaning of Art. 22 GDPR takes place.

We reserve the right to amend the content of this privacy policy at any time. This is usually done in the event of further development or adaptation of the services used. You can view the current privacy policy on our website. Status of this declaration: 18.01.2024