Whistleblower­System

The following section contains information about the collection, processing and use of personal data in connection with the whistleblower system. The processing of personal data within Trusty is based on the organization's legitimate interest in detecting and preventing violations and in avoiding related damage and liability risks for the organization. If a report concerns an employee of the organization, the processing also serves to prevent criminal offenses or other legal violations in connection with the employment relationship. Your personal data includes, pursuant to Art. 4 No. 1 GDPR, all information relating to you or that can be related to you. The information below explains how your data is processed as part of whistleblower management.

1. Name and contact details of the controller 

The controller within the meaning of data protection law is dc AG, Von-Linde-Str. 11, 95326 Kulmbach. You can find more information about our company, details about the persons authorized to represent it, and additional contact options in the Legal Notice on our website: www.dc.ag/en/legal-notice
 

2. Our Data Protection Officer 

We have appointed a Data Protection Officer in our company. 
You can reach them using the following contact details:

ITs Hein GmbH
Andreas Hein
Kulmbacher Str. 27b
95460 Bad Berneck
Email: info@dc.ag
 

3. Collection and storage of personal data; type, purpose and use

3.1 Category of personal data
In principle, use of the whistleblower system is possible without providing personal data - insofar as legally permissible. However, you may voluntarily disclose personal data as part of the whistleblower process, in particular:

• Identity details
• First and last name
• Place of residence
• Contact details such as phone number or email address
• Content data
• Meta/communication data
• any other data that is provided 

As a rule, we do not request or process special categories of personal data, such as information about racial and/or ethnic origin, religious and/or philosophical beliefs, trade union membership or sexual orientation. However, due to free-text fields in the reporting form, such special categories of personal data may be voluntarily disclosed by you. 
In addition, the report you submit may contain personal data of third parties to whom you refer in your report. Data subjects will be given the opportunity to comment on the report. In this case, we will inform the data subjects about the report. Your confidentiality will also be protected in this case, as the data subject will not be given any information about your identity - insofar as legally possible - and your report will be used in a way that does not jeopardize your anonymity.

3.2 Source of personal data 
We collect personal data directly from the whistleblower (through provision) and from the accused person. The data is provided via an online form through the whistleblower system. 

3.3 Purpose and legal basis
The whistleblower system enables you to contact us and report compliance and legal violations. We process your personal data in order to review the report you submitted through the whistleblower system and investigate the suspected compliance and legal violations. In this context, we may have follow-up questions for you. For this purpose, we exclusively use communication via the whistleblower system. The confidentiality of the information you provide is our top priority. 
The corresponding processing of your personal data is based on the consent you provide when submitting a report through the whistleblower system (Art. 6 para. 1a General Data Protection Regulation, GDPR). 
In addition, we process your personal data insofar as this is necessary to fulfill legal obligations. This includes, in particular, reports of facts relevant under criminal, competition and employment law (Art. 6 para. 1c GDPR). 

Finally, your personal data is processed if this is necessary to safeguard the legitimate interests of the company or a third party (Art. 6 para. 1f GDPR). We have a legitimate interest in processing personal data for the prevention and detection of violations within the company, for reviewing the lawfulness of internal processes and for safeguarding the integrity of the company.

If you disclose special categories of personal data to us, we process this data on the basis of your consent (Art. 9 para. 2 lit. a GDPR). 

We also use your personal data in anonymized form for statistical purposes. 

We do not intend to use your personal data for any purposes other than those listed above. Otherwise, we will obtain your prior consent accordingly. 
 

3.4 Technical implementation and security of your data

The whistleblower system includes an option for anonymous communication via an encrypted connection. After submitting a report, you will receive login credentials for the whistleblower system mailbox so you can continue communicating with us securely and, if desired, anonymously.  
To ensure data protection and confidentiality, we implement appropriate technical measures. The data you provide is stored in a specially secured database operated by the provider of the whistleblower system. All data stored in the database is encrypted in accordance with the current state of the art. 
 

3.5 Storage period 

The collected data is stored for as long as necessary in compliance with statutory retention periods (according to § 11 HinSchG-E: the documentation is deleted two years after the procedure has been concluded).
 

4. Disclosure of personal data

The stored data may only be accessed by specially authorized persons within the company. Insofar as necessary to fulfill the purpose stated above, specially authorized persons from our affiliated companies may also be entitled to access the data. This is particularly the case if the investigation of your report is carried out in the country concerned. All persons authorized to access the data are expressly bound to confidentiality. 
We transfer your personal data only for the purposes described above. In particular, your data is shared with the following parties:

• Authorities: e.g. courts, law enforcement authorities
• External reporting offices
• Service providers that we use within the framework of data processing agreements
• Joint controllers with whom we share responsibility

 

5. Your rights as a data subject 

As a person affected by the data processing, you have various rights:

Right to withdraw consent: You may withdraw any consent you have given us at any time. Data processing based on the withdrawn consent may then no longer be continued for the future. 
 
Right of access: You may request information about the personal data we process about you. This applies in particular to the purposes of data processing, the categories of personal data, where applicable the categories of recipients, the storage period, where applicable the origin of your data, as well as where applicable the existence of automated decision-making including profiling and meaningful information about its details. 
 
Right to rectification: You may request the correction of inaccurate personal data stored by us or the completion of your personal data. 
 
Right to erasure: You may request the deletion of your personal data stored by us, unless its processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defense of legal claims. 
 
Right to restriction of processing: You may request restriction of the processing of your personal data if you contest the accuracy of the data or if the processing is unlawful but you oppose its deletion. You also have this right if we no longer need the data, but you need it for the establishment, exercise or defense of legal claims. In addition, you have this right if you have objected to the processing of your personal data. 
 
Right to data portability: You may request that we provide you with the personal data you have provided to us in a structured, commonly used and machine-readable format. Alternatively, you may request the direct transfer of the personal data you have provided to us to another controller, insofar as this is possible.
Right to lodge a complaint (complaints office): You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of personal data, for example if you believe that we are processing your personal data unlawfully. 

Our competent data protection supervisory authority is:  
Bavarian State Office for Data Protection Supervision (BayLDA) 
Promenade 18, 91522 Ansbach 
Phone: +49 (0) 981 180093-0 
Email: poststelle@lda.bayern.de
 

6. Your right to object

If we process your personal data on the basis of a legitimate interest, you have the right to object to this processing. If you would like to exercise your right to object, a notice in text form is sufficient. So feel free to write to us, send us a fax or contact us by email. You can find our contact details under section 1 of this privacy notice.
 

7. Online data processing

Certain personal data is also processed via our website at dc.trusty.report, including the IP address of website visitors. You can therefore find additional privacy information online at www.dc.ag/en/privacy-policy