Whistleblower message and case login

This information is relevant for whistleblowers who have not opted for anonymous reporting and for persons concerned who are named in the report.

a) Type and purpose of processing
Some personal data may be collected during the whistleblower report and the case login. If the whistleblower has not opted for an anonymous report, their personal data will be used to process the case. The personal data of a data subject contained in the whistleblower report may also be processed and used to clarify and process the facts of the case. If the whistleblower has submitted a report, they can log in via the case login with a case number and password.

b) Legal basis
The portal is provided and the case is processed on the basis of a legal obligation (Art. 6 para. 1 lit. c GDPR) and within the scope of our legitimate interest (Art. 6 para. 1 lit. f GDPR). The processing of the referring person's personal data is based on voluntary consent (Art. 6 para. 1 lit. a GDPR).

c) Data categories
Whistleblower: Whistleblower: e-mail address, telephone number, first name, surname, your concern, possibly other data that the whistleblower sends us unsolicited

Persons concerned: The information may vary depending on the whistleblower report. Usually at least name details.

d) Source of the data
Whistleblower

e) Recipient
The recipients of the data are the Whistleblower Ombudsman Office {external/internal} and BKP Compliant GmbH (https://www.whistleblowing-compliant.eu/) and Proof Point development GmbH (https://www.conida.com) as processors.

f) Storage periods
Data will only be processed in this context for as long as the relevant purpose exists. It will then be deleted, provided there are no statutory retention obligations to the contrary.

g) Legal / contractual requirement
The provision of the whistleblower's personal data is voluntary.

h) Transfer to third countries
Processing does not take place outside the European Union (EU) or the European Economic Area (EEA).

i) Automated decision-making and profiling
As a responsible company, we do not use automated decision-making or profiling for this data processing.