This notice explains how we process personal data in connection with our whistleblowing hotline and the reporting channels available through it, such as the online portal and telephone hotline.
Controller
The controller is Leonhard Moll Betonwerke GmbH & Co KG, Lindwurmstraße 129 a, 80337 Munich, Germany (hereinafter referred to as “we”, “us” or “our”). You can contact us at ....
Data Protection Officer
For questions relating to data protection, you can contact our Data Protection Officer at: ....
Whistleblowing System
As part of our compliance management system, we have established a whistleblowing hotline. You can use this hotline to report matters falling within the scope of the German Whistleblower Protection Act (Hinweisgeberschutzgesetz – HinSchG) or matters in respect of which we otherwise have a legitimate interest in becoming aware.
We have appointed the law firm Heuking Kühn Lüer Wojtek as our outsourced internal reporting office to receive and examine such reports (hereinafter referred to as the “Reporting Office”).
Reports may be submitted to the Reporting Office by telephone, email, post or in person.
Reports may be submitted anonymously. Use of the Reporting Office is voluntary.
When you submit a report to the Reporting Office, it records the information you provide. This includes your personal data, where you disclose such data, and generally the names and other personal data of any persons referred to in your report. Further information on how the Reporting Office handles your personal data is provided in the Reporting Office’s data protection notice.
a) Categories of personal data we process
Once the Reporting Office has examined a report, we receive a report from it which may contain the following personal data:
- the name and other personal data of the reporting person, but only where the reporting person does not wish to remain anonymous and has consented to the disclosure of such data to us;
- the names and any other personal data arising from the report relating to persons named in the report.
In the course of further investigating the reported matter and processing the report, we may collect and process additional personal data.
b) Purposes of processing and legal bases
We process the data provided to us by the Reporting Office for the purpose of processing and managing reports concerning compliance violations, breaches of legal requirements and misconduct connected with our business operations by employees, customers, suppliers and other third parties.
Where you disclose your identity as a reporting person and consent to the Reporting Office disclosing your name to us, the legal basis for processing your personal data is your consent pursuant to Article 6(1), first sentence, point (a) of the GDPR.
Where the reported matter falls within the scope of the German Whistleblower Protection Act, section 10 HinSchG constitutes the legal basis for processing the personal data of you as the reporting person and of the person or persons concerned by the report.
Outside the scope of the HinSchG, the legal basis for processing the personal data of you and the persons concerned by the report is our legitimate interest in detecting and preventing breaches of law and misconduct pursuant to Article 6(1), first sentence, point (f) GDPR. We have a legitimate interest in detecting and preventing breaches of law and misconduct, in particular where we are legally required to do so in certain areas. Such violations may also result in substantial financial loss and serious reputational damage.
Where the person concerned is one of our employees, the legal basis for processing in connection with the handling or further investigation of the reported matter may also be Article 6(1), first sentence, point (b) GDPR, concerning the performance of a contract or steps taken prior to entering into a contract, or section 26(1), second sentence, of the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG), concerning processing for the detection of criminal offences. Where applicable, processing may also be based on our legitimate interests described above pursuant to Article 6(1), first sentence, point (f) GDPR.
c) Disclosure to third parties
The Reporting Office ensures that all reports and data are treated confidentially at all times and throughout every stage of the process. This applies in particular to the personal data of the reporting person and of the person or persons concerned by the report. Access to incoming reports and information concerning the handling of reports or follow-up measures is restricted to a limited number of designated and authorised persons who are required to handle such information confidentially.
Where a report concerns another company within our group of companies, we will disclose the content of the report and the results of any further investigation to the relevant company within our group.
We may disclose the content of the report and the results of any further investigation of the reported matter to courts, authorities and other public bodies. This may occur where we are legally required to disclose the data or where disclosure is necessary for the establishment, exercise or defence of legal claims.
In connection with investigative measures and the establishment, exercise or defence of legal claims, we may also seek assistance from law firms or audit firms.
We may also engage technical or other service providers to assist with investigating and processing the reported matter. Such service providers act on our instructions as processors within the meaning of Article 28 GDPR and on the basis of appropriate data processing agreements. They may become aware of the content of a whistleblowing report but are required to treat the relevant data confidentially.
Despite the measures taken to preserve confidentiality, the personal data of reporting persons and persons concerned may, in exceptional circumstances, be disclosed to authorities, courts or other third parties. This may occur where we are required to disclose such information, for example in connection with an investigation by a public authority or criminal investigation, or where disclosure is necessary for the establishment, exercise or defence of legal claims. In certain circumstances, we may also be required to disclose reported information to persons concerned by the report.
d) Retention period
Personal data will be retained for as long as is necessary to investigate the report and carry out any resulting measures, for as long as we have a legitimate interest in retaining it, or for as long as retention is required by law. The data will subsequently be deleted in accordance with the applicable statutory requirements.
Provision of personal data
Use of the whistleblowing system and the provision of personal data are voluntary. However, certain information may be required in order to examine the reported matter, ask follow-up questions or take appropriate follow-up measures. Where the relevant information is not provided, it may not be possible to process the report, or the processing may be restricted.
Your rights
You have the following rights in relation to personal data concerning you:
- the right of access;
- the right to rectification or erasure;
- the right to restriction of processing;
- the right to object to processing;
- the right to data portability.
Right to withdraw consent
You have the right to withdraw any consent previously given to the processing of your personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
To exercise your rights, please contact us by email at ... or by post at the address of the controller stated above.
Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with any competent data protection supervisory authority concerning our processing of your personal data. The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision in Ansbach, Germany.