Whistleblower­System

The following section contains information about the collection, processing, and use of personal data in connection with the whistleblower system. The processing of personal data within Trusty is based on the organization's legitimate interest in detecting and preventing violations and in avoiding related damage and liability risks for the organization. If a report concerns an employee of the organization, the processing also serves to prevent criminal offenses or other legal violations in connection with the employment relationship. Your personal data includes, pursuant to Art. 4 No. 1 GDPR, all information relating to you or that can be linked to you. The information below explains how your data is processed as part of whistleblower management.

1. Name and contact details of the controller 

The controller within the meaning of data protection law is dc AG, Von-Linde-Str. 11, 95326 Kulmbach. You can find more information about our company, details about the persons authorized to represent us, and additional contact options in the Legal Notice on our website: www.dc.ag/en/legal-notice
 

2. Our Data Protection Officer 

We have appointed a Data Protection Officer in our company. 
You can contact them using the following details:

ITs Hein GmbH
Andreas Hein
Kulmbacher Str. 27b
95460 Bad Berneck
Email: info@dc.ag
 

3. Collection and storage of personal data; type, purpose, and use

3.1 Category of personal data
In principle, use of the whistleblower system is possible - where legally permitted - without providing personal data. However, as part of the whistleblower process, you may voluntarily disclose personal data, in particular:

• Identity information
• First and last name
• Place of residence
• Contact details such as phone number or email address
• Content data
• Metadata/communication data
• any other data that is provided 

As a rule, we do not request or process special categories of personal data, such as information about racial and/or ethnic origin, religious and/or philosophical beliefs, trade union membership, or sexual orientation. However, due to free-text fields in the reporting form, such special categories of personal data may be voluntarily disclosed by you. 
In addition, the report you submit may contain personal data of third parties to whom you refer in your report. Data subjects will be given the opportunity to comment on the reports. In this case, we will inform the affected persons about the report. Your confidentiality will also be protected in this case, as the affected person will not be given any information about your identity - where legally possible - and your report will be used in a way that does not jeopardize your anonymity.

3.2 Source of personal data 
We collect personal data directly from the whistleblower party (through the information provided) and from the accused person. The data is provided via an online form through the whistleblower system. 

3.3 Purpose and legal basis
The whistleblower system allows you to get in touch with us and report compliance and legal violations. We process your personal data in order to review the report you submitted via the whistleblower system and to investigate the suspected compliance and legal violations. In this context, we may need to ask you follow-up questions. For this purpose, we use communication exclusively through the whistleblower system. For us, the confidentiality of the information you provide is the top priority. 
The relevant processing of your personal data is carried out on the basis of your consent given when submitting a report via the whistleblower system (Art. 6 para. 1a General Data Protection Regulation, GDPR). 
We also process your personal data where this is necessary to fulfill legal obligations. This includes, in particular, reports of matters relevant under criminal, competition, and employment law (Art. 6 para. 1c GDPR). 

Finally, your personal data is processed where this is necessary to safeguard the legitimate interests of the company or a third party (Art. 6 para. 1f GDPR). We have a legitimate interest in processing personal data to prevent and detect violations within the company, to review internal processes for their lawfulness, and to protect the integrity of the company.

If you disclose special categories of personal data to us, we process this data on the basis of your consent (Art. 9 para. 2 lit. a GDPR). 

We also use your personal data in anonymized form for statistical purposes. 

We do not intend to use your personal data for purposes other than those listed above. Otherwise, we will obtain your prior consent. 
 

3.4 Technical implementation and security of your data

The whistleblower system includes an option for anonymous communication via an encrypted connection. After submitting a report, you will receive login credentials for the whistleblower system mailbox so you can continue communicating with us securely and, if desired, anonymously.  
To ensure data protection and confidentiality, we take appropriate technical measures. The data you provide is stored in a specially secured database by the provider of the whistleblower system. All data stored in the database is encrypted in line with the current state of the art. 
 

3.5 Duration of storage 

The collected data is stored for as long as necessary in compliance with statutory retention periods (according to § 11 HinSchG-E: the documentation is deleted two years after completion of the procedure).
 

4. Disclosure of personal data

Access to the stored data is only possible for specifically authorized persons within the company. To the extent necessary to fulfill the purpose stated above, specifically authorized persons from our affiliated companies may also be entitled to access the data. This is particularly the case if the investigation of your report is carried out in the country concerned. All persons authorized to access the data are expressly required to maintain confidentiality. 
We transfer your personal data only for the purposes described above. In particular, your data is shared with the following recipients:

• Authorities: e.g. courts, law enforcement authorities
• External reporting offices
• Service providers that we use within the framework of data processing agreements
• Joint controllers with whom we share responsibility

 

5. Your rights as a data subject 

As a person affected by data processing, you have various rights:

Right to withdraw consent: You may withdraw any consent you have given to us at any time. As a result, the data processing based on the withdrawn consent may no longer be continued in the future. 
 
Right of access: You may request information about your personal data processed by us. This applies in particular to the purposes of processing, the categories of personal data, where applicable the categories of recipients, the storage period, where applicable the origin of your data, and where applicable the existence of automated decision-making including profiling and meaningful information about its details. 
 
Right to rectification: You may request the correction of inaccurate or the completion of your personal data stored by us. 
 
Right to erasure: You may request the deletion of your personal data stored by us, unless its processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims. 
 
Right to restriction of processing: You may request restriction of the processing of your personal data if you contest the accuracy of the data or if the processing is unlawful but you oppose its deletion. You also have this right if we no longer need the data, but you require it for the establishment, exercise, or defense of legal claims. In addition, you have this right if you have objected to the processing of your personal data. 
 
Right to data portability: You may request that we provide you with the personal data you have provided to us in a structured, commonly used, and machine-readable format. Alternatively, you may request the direct transfer of the personal data you have provided to us to another controller, where technically feasible.
Right to lodge a complaint (complaint authority): You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data, for example if you believe that we are processing your personal data unlawfully. 

Our competent data protection supervisory authority is:  
Bavarian State Office for Data Protection Supervision (BayLDA) 
Promenade 18, 91522 Ansbach 
Phone: +49 (0) 981 180093-0 
Email: poststelle@lda.bayern.de
 

6. Your right to object

If we process your personal data on the basis of a legitimate interest, you have the right to object to this processing. If you would like to exercise your right to object, a notice in text form is sufficient. So feel free to write to us, send a fax, or contact us by email. You can find our contact details under section 1 of this privacy notice.
 

7. Data processing online

Certain personal data, including the IP address of website visitors, is also processed via our website at dc.trusty.report. You can therefore find additional privacy information online at www.dc.ag/en/privacy-policy