Privacy Notice – Whistleblower System
We, Hilgenberg GmbH, Strauchgraben 2, 34323 Malsfeld, Germany, Tel.: +49 (0) 56 61 73 03 0, Email: info@hilgenberg-gmbh.de, would like to explain below how we process your personal data through the whistleblower system. If you have any questions about data protection, please contact our data protection officer at hilgenberg-gmbh@dsb-moers.de. Further contact information can be found here: www.dsb-moers.de.
Purpose and legal basis of data processing
The operation of our whistleblower system serves to ensure that our processes comply with applicable legal requirements, investigate reported matters and, where applicable, pursue further legal action. We are legally required to establish and operate the whistleblower system. The legal basis for the processing of personal data is Article 6 (1) (c) GDPR in conjunction with Section 10 of the German Whistleblower Protection Act (Hinweisgeberschutzgesetz – HinSchG). In this context, we process data relating to possible criminal offences within the meaning of Section 2 HinSchG. If you provide us with special categories of personal data, we process such data where necessary for the establishment, exercise or defence of legal claims pursuant to Article 9 (2) (f) GDPR or, where applicable, in connection with our legal obligations pursuant to Article 9 (2) (g) GDPR.
Where investigations are carried out in the employment context, the legal basis for the processing of personal data is Section 26 (1), sentence 2 of the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). Where special categories of personal data are concerned, Section 26 (3) BDSG applies. We may also process personal data where this is necessary to safeguard our legitimate interests or the legitimate interests of third parties. In such cases, the legal basis is Article 6 (1) (f) GDPR. Legitimate interests include, in particular, assessing the plausibility of reports, preventing further or future misconduct, exonerating employees, and fulfilling obligations to cooperate in investigations involving law enforcement authorities.
Categories of recipients
In connection with the operation of the whistleblower system, we engage service providers for certain activities who are subject to specific confidentiality and data protection obligations and whose access to personal data cannot be excluded. The relevant category of recipient is the provider of the whistleblower portal. Where necessary, we may engage third parties to assist in investigating and assessing reported matters, such as lawyers, auditors, experts or forensic specialists.
Personal data may be disclosed to public authorities where overriding statutory provisions require this or where such disclosure is necessary for further legal action. Where necessary, personal data may also be transferred to insurance companies.
Personal data is not transferred to recipients in third countries.
Retention period and deletion of data
Personal data collected through the whistleblower system is retained and deleted in accordance with the applicable data protection requirements, in particular Section 11 HinSchG. As a general rule, the data is deleted three years after the conclusion of the procedure, unless other legal provisions require a longer retention period.
Your rights of access, rectification, erasure, objection and data portability
You may exercise your right to access, rectification and erasure of data at any time. To do so, please contact us using the contact details provided above. If you request data erasure but we are still legally obliged to retain it, access to your data will be restricted (blocked). The same applies where you object to the processing. You may exercise your right to data portability, provided that the technical means are available at the recipient and at our company.
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority at any time.
Provision of personal data
The purpose of the processing is to investigate matters relating to criminal offences. Please provide us with information about the matter that is as specific as possible. Please note that any additional information you provide when submitting a report that allows you to be identified directly or indirectly may be processed by the organisation when handling the case, even if you submit the report anonymously.
Profiling
No profiling or automated individual decision-making within the meaning of Article 22 GDPR takes place in connection with the handling of whistleblower cases.
Technical information and data security
The whistleblower system provides the option of anonymous communication via an encrypted connection. When using the system, your IP address and your current location are not stored at any time. After submitting a report, you will receive access credentials for the whistleblower system mailbox, enabling you to continue communicating with us securely.
To ensure data protection and confidentiality, we maintain appropriate technical safeguards. The data you provide is stored in a specially secured database operated by the service provider used for the whistleblower system.
Correcting information you have entered: If you discover that you have provided incomplete or incorrect information, simply submit a new report through the system, referring to your previous report and correcting the information provided.
If you have chosen to create a secure mailbox when submitting a report, you can make changes by logging into the system using the identification number and password you created.
Version of this Privacy Notice: 30 January 2025