Search

Privacy Policy for Whistleblowing

When an internal or external whistleblower reports an irregularity within the company, this is referred to as “whistleblowing.” This confidential report may contain information and reasonable suspicions about actual or potential violations that have either already occurred or are very likely to occur. A whistleblower system therefore offers the opportunity to uncover potential violations.

The EU Whistleblower Directive (Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law) aims to protect persons who report breaches. It also protects persons who are the subject of a report or disclosure, as well as other persons affected by a report or disclosure. For Germany, the requirements are defined in the Whistleblower Protection Act (HinSchG). This creates a legal obligation to introduce a whistleblower procedure (so-called “internal reporting point”).

If you suspect violations of the law, unethical behavior, or other misconduct, the Whistleblower Reporting Point/Portal is available to you. Our employees, customers, suppliers, and business partners can use it to report suspected or actual violations.

Such violations include, for example:

  • Fraud, theft, embezzlement
  • Bribery/corruption
  • Offenses under the Supplier Due Diligence Act or the Supply Chain Act
  • Antitrust violations
  • Violations of data protection or IT security policies
  • Product safety
  • Violations of environmental protection regulations
  • Conflicts of interest
  • Sexual harassment, discrimination, violations of personal integrity

Procedure for reporting suspected cases

If you believe that the actions of one or more employees constitute misconduct, you should always report these concerns to your supervisor. If you have legitimate reasons to feel uncomfortable discussing this with your supervisor or fear negative consequences for yourself, such as reprisals, unfair treatment, or dismissal, you can also contact your superior supervisor.

Use of the whistleblower portal

The safest way to submit a report is to open the following address in the browser of your private device: https://georgmartin.hinweisgebersystem.online/.
This portal guarantees independent and anonymous processing of reported incidents. Should the whistleblower(s) Hinweisgeberin (Whistleblower) persönliche Interessen innerhalb der erhobenen Angelegenheit haben, sollten sie dies von Anfang an mitteilen.

False information

The company will treat all reports of misconduct seriously and protect individuals who report complaints in good faith. However, disciplinary or legal action may be taken against whistleblowers who provide false information or information. The Whistleblower Protection Act explicitly excludes protection of the whistleblower’s identity for false information or even defamation. In such cases, the malicious whistleblower is even obligated to compensate for the damages (Section 38 of the Whistleblower Protection Act).

Dealing with reports

Incoming reports are processed according to a standardized and fair process. All information received is treated with strict confidentiality; reports can be submitted anonymously upon request, with anonymity being guaranteed throughout the process.

After submitting your report, you will receive notification of receipt and acknowledgement of your report within 7 days. You can rely on the discreet and confidential handling of your information. You will be informed of the information from the investigation process and any follow-up measures no later than 3 months after your report.

The Whistleblower Protection Act provides protection against discrimination for submitting a report. Therefore, the whistleblower has no reason to fear any negative consequences. If violations of German law are reported, the law protects the whistleblower from any negative consequences. Furthermore, the whistleblower is not liable for any damages resulting from the disclosure of the violation.

Protecting the whistleblower’s identity is the highest priority of the Whistleblower Protection Act. This is ensured by the option to submit confidential reports. The whistleblower’s identity will only be disclosed with their consent. An exception applies in the case of judicial or administrative investigations. In these cases, the whistleblower is informed before disclosing his or her identity.

Data processed, purposes of processing and legal basis

The processing of personal data includes:

  • data on the whistleblower (if not reported anonymously), possibly on the accused and other persons involved (e.g., witnesses),
  • other data dependent on the content of the report (data in the report),
  • and related data processed as part of internal investigations.

The purposes of the processing are the investigation and, if necessary, the proof of violations of applicable law and/or internal instructions, as well as the defense of the company against legal claims and any official investigations and proceedings by documenting the processing, proceedings, and investigations.

The legal basis is:

  • essentially the legal obligation to process data pursuant to Art. 6 (1) (c) GDPR in conjunction with Sections 10 et seq. HinSchG, insofar as it relates to the content of reports,
  • and Art. 6 (1) (a) GDPR, if data is provided voluntarily and without necessity, or if data is further processed based on consent. Consent can be revoked at any time, effective from the time of revocation.
  • Alternatively, Art. 6 (1) (f) GDPR applies as a legitimate interest if it affects any conflicting interests, such as for documentation within the company to avoid liability or to defend against unjustified legal claims or in any legal proceedings.

Recipient's categories

The reporting center is operated by an external service provider, which in turn uses a cloud-based whistleblower and communications platform. Furthermore, data is shared within the company with the relevant internal departments in accordance with the HinSchG (Intelligence Protection Act). Other recipients may include other external service providers, such as legal services and/or forensic experts, as well as consultants consulted as appropriate.

Other information

The rights of data subjects stated in the parent page of the privacy policy apply. Transfer to third countries is not planned.

Deletion of data

All data related to the report/case will be deleted three years after the conclusion of the proceedings in accordance with Section 11 (5) of the HinSchG (Article Protection Act), unless there are other legal grounds for retaining the case for a longer period. This could be the case if longer retention periods exist due to commercial or tax law regulations.

Top