FRÄNKISCHE Rohrwerke Gebr. Kirchner GmbH & Co. KG, Hellinger Straße 1, 97486 Königsberg, Germany, phone: +49 9525 88-0, fax: +49 952588-150, info@fraenkische.de (“Fränkische”) and its affiliated companies according to Sections 15 et seq. German Stock Corporation Act (Aktiengesetz) (individually referred to as “group companies”; collectively, as “Fränkische Group of Companies”, “we”) ensure compliance with the law through an appropriate compliance organisation, legally compliant processes, and other measures to prevent and respond to possible breaches of rules. These investigative measures include, among other things, the introduction and operation of a whistleblowing system by FRÄNKISCHE. Fränkische employees (“employees”) and third parties can use the whistleblowing system to inform Fränkische about possible violations of legal provisions or internal regulations (“breaches of rules”) (“whistleblowing”) and thus contribute to such violations being prosecuted and investigated.
The following shall inform you about the collection, processing, and use of personal data (“data”) in the context of the whistleblowing system. The FRÄNKISCHE Group of Companies processes personal data within the framework of the whistleblowing system only in accordance with the applicable data protection regulations. These requirements result in particular from the EU General Data Protection Regulation (“GDPR”) and the Federal Data Protection Act (Bundesdatenschutzgesetz) (“BDSG”). This Data Protection Information contains further explanations on data processing which serve to record and investigate the information received via the whistleblowing system (“investigations”). This Data Protection Information supplements our General Data Protection Information for Employees.
Who is responsible for processing your data?
The group companies of the FRÄNKISCHE Group of Companies operate the whistleblowing system as joint controllers pursuant to Art. 26 GDPR. The group companies specify the purposes and means of the joint data processing in accordance with the responsibilities defined in section 3.
For this purpose, the group companies of the FRÄNKISCHE Group of Companies have entered an agreement for joint responsibility pursuant to Art. 26 GDPR (“group-wide agreement”). The group-wide agreement sets out the specific obligations, rights, and responsibilities of the individual group companies in the joint processing of personal data in the context of the whistleblowing system.
In accordance with Art. 26 (2) Sentence 2 GDPR, we hereby inform you about the main contents of the group-wide agreement.
For which process stages does joint responsibility prevail?
In factual terms, joint responsibility applies to the entire operation and organisation of the whistleblowing system within the FRÄNKISCHE Group of Companies. This concerns in particular the internal management of the whistleblowing system and the implementation of specific whistleblowing procedures. The standardised procedure is intended to ensure that breaches of rules within the FRÄNKISCHE Group of Companies are investigated, stopped, and, if necessary, punished according to uniform standards.
The group companies are each independently responsible for the punishment and, if necessary, sanctioning of breaches of rules by employees identified within the scope of whistleblowing procedures. The associated data processing is regulated in the group-wide agreement.
What does the group-wide agreement on joint data processing regulate?
Determination of responsibility under data protection law
The group-wide agreement defines in particular the responsibility under data protection law within the framework of the whistleblowing system. FRÄNKISCHE has a key role within the framework of the whistleblowing system. The following is an overview of the main responsibilities under data protection law within the framework of the whistleblowing system:
- Processes and structures: FRÄNKISCHE provides the technical and organisational infrastructure necessary for the effective implementation of whistleblowing procedures via the service provider EQS Group GmbH. This includes, among other things, the organisation of internal and external reporting channels. FRÄNKISCHE is centrally responsible for the respective structures and processes.
- Data exchange in relation to information received: The group companies that receive information regarding possible breaches of rules are obliged to forward this information centrally to FRÄNKISCHE.
- Handling of specific whistleblowing procedures – serious breaches of rules: If the information received indicates that employees have committed serious breaches of rules, FRÄNKISCHE shall be responsible for initiating the required whistleblowing procedures. This applies, among other things, to the plausibility check of the information received, the planning and implementation of necessary measures to investigate the facts, and, if necessary, the preparation of a final report. Investigations may include, among other things, questioning data subjects and evaluating records and documents.
- Handling of specific whistleblowing procedures – other breaches of rules: If the information received indicates other breaches of rules, the respective group companies will independently initiate the required whistleblowing procedures.
- Cooperation within the scope of investigating the facts: FRÄNKISCHE and, if applicable, the group companies involved will cooperate within the framework of whistleblowing procedures in order to ensure an effective investigation of the reported suspicious facts. This cooperation may require a mutual exchange of personal data.
- Data exchange after completion of the investigation of facts: FRÄNKISCHE and the group companies involved will exchange information after completion of the investigation of facts with regard to the findings and, if necessary, agree on the follow-up measures to be taken.
- Documentation of whistleblowing procedures: FRÄNKISCHE is centrally responsible for the documentation of whistleblowing procedures carried out.
- Information obligations: FRÄNKISCHE shall inform the data subjects about data processing concerning them in the form of a General Data Protection Information Regarding the Whistleblowing System. FRÄNKISCHE or, if applicable, the group company responsible for carrying out a specific whistleblowing procedure will also provide the data subjects with more specific information on the processing of their personal data.
Further rules on joint responsibility
The group-wide agreement specifies further rules on the protection of personal data in the context of the whistleblowing system. These rules include, in particular, the following provisions:
- Standards for data transfers
- Confidentiality obligations
- Technical and organisational data security measures to be taken by the group companies
- Use of data processors
- Mutual obligations to provide information; for instance, in the event of data breaches or enquiries by data subjects
What does joint responsibility mean for data subjects?
Data subjects can direct their enquiries directly to FRÄNKISCHE:
Fränkische Rohrwerke
Gebr. Kirchner GmbH & Co. KG
Hellinger Straße 1
D-97486 Königsberg
Phone: +49 9525 88-0
Fax: +49 9525 88-150
Email: info@fraenkische.de
You can contact our data protection officer at:
DataCo GmbH
Herr Kivanc Semen
Dachauer Str. 65
80335 München
Tel.: +49 89740045840
Email： datenschutz@fraenkische.de
However, data subjects may also exercise their rights in relation to the processing under joint responsibility vis-à-vis a jointly responsible group company.
FRÄNKISCHE will, where appropriate, coordinate with the relevant group companies with regard to enquiries directed to them in order to be able to respond effectively to the enquiry.
Depending on the type and scope of the measures required, FRÄNKISCHE may commission service providers not subject to directives with the specific implementation of the corresponding investigations. These service providers may include auditors, law firms, or tax consultants. In this case, the service providers will frequently act as data controllers within the meaning of Art. 4 (7) GDPR.
For what purposes does FRÄNKISCHE process your data?
The FRÄNKISCHE Group of Companies processes your data within the framework of applicable law, in particular for the following specific compliance and investigative purposes:
- Plausibility analysis of information received
- Investigation of misconduct
- Implementation of legal obligations
- Prevention of future misconduct
- Exercise of law
- Exoneration of employees
- Examination of relevance for other group companies
- Implementation of legal obligations to cooperate
In addition, the purposes mentioned in the General Data Protection Information for Employees may be considered possible purposes of data processing.
What data or categories of data are affected by investigations?
In the context of investigations, we may process the following data or categories of data about you:
- Data relating to the information
- Operational information
- Information on relevant facts
- Operational documents
- Communication behaviour
- Personal data
- Private contents
- Data on criminal convictions and offences
- Special categories of personal data
What is the legal basis for the processing of your data?
The FRÄNKISCHE Group of Companies only processes your data in the context of investigations to the extent permitted by at least one applicable legal basis under data protection law. This includes, in particular, the provisions of the GDPR and the BDSG or similar national regulations for events outside Germany as well as other relevant legal provisions.
The respective group company can base the permissible data processing within the scope of investigations in the whistleblowing system in particular on the following legal bases:
- Implementation of the employment relationship pursuant to Section 26 (1) Sentence 1 BDSG or similar national regulations for events outside Germany.
- Investigation of criminal offences pursuant to Section 26 (1) Sentence 2 BDSG or similar national provisions for events outside Germany.
- Implementation of legal obligations according to Section 6 (1) lit. c GDPR.
- Labour-management contracts pursuant to Art. 88 (1) GDPR in conjunction with Section 26 (4) BDSG or similar national regulations for events outside Germany.
- Protection of legitimate interests pursuant to Art. 6 (1) lit. f GDPR; in particular, for legal defence, improvement of compliance structures, support of data subjects, and implementation of foreign legal provisions.
The respective group company shall ensure that investigations are only carried out to protect legitimate interests insofar as conflicting legitimate interests and rights of the employees affected thereby do not prevail.
With which bodies will your data be shared?
The FRÄNKISCHE Group of Companies will only share your data with third parties within the scope of investigations in the whistleblowing system if there is a legal basis for doing so, or if your consent to the corresponding sharing of data has been obtained in advance.
In the case of data sharing in the context of investigations, the following data recipients come into particular consideration:
- Works councils and other special interest groups
- Other group companies in the FRÄNKISCHE Group of Companies
- Courts, authorities, and other public bodies
- Service providers such as auditors, lawyers, and tax consultants
- Order processors subject to directives
- Other third parties, e.g., opposing parties or insurance companies
The General Data Protection Information for Employees includes a more detailed list of possible recipients of your personal data as well as details of the relevant legal basis.
If the FRÄNKISCHE Group of Companies has not collected your personal data processed for compliance purposes directly from you, we typically receive them from the entities, business partners, or similar sources mentioned above in this section of the Data Protection Information.
Confidential treatment of information
Information received in the context of the whistleblowing system is received by a defined group of expressly authorised and specially trained employees of the FRÄNKISCHE Group of Companies and shall always be treated confidentially. The designated processors will examine the facts and, if necessary, carry out a further case-related investigation of the facts.
In principle, you have the option of submitting a corresponding report anonymously. If you submit a report anonymously, please describe the facts of the case and the breaches of rules in detail and, if available, support them with further documents. Your report can only have an effect if there is a sufficiently concrete basis for an investigation and possibilities for giving evidence.
However, providing us with your name and further contact details will help us to investigate the matter efficiently and to investigate any queries. If you provide us with personal information as part of giving information, we will use your data to check the facts of the case, for any queries, and for documenting the facts of the case and internal investigations.
In certain cases, the FRÄNKISCHE Group of Companies has an obligation under data protection law to inform the accused person of the allegations made against them. If there were a significant risk that such information would jeopardise the effective investigation of the allegation or the collection of the required evidence, the information to be provided to the accused person may be postponed for as long as this risk exists. In doing so, the identity of the whistleblower will not be disclosed to the extent that this is permissible in accordance with Art. 14 (3) lit. a GDPR.
Confidentiality cannot be guaranteed when knowingly posting false information to discredit a person (“denunciation”).
In the course of processing a report received or in the course of an investigation, it may be necessary to share information with other employees of the FRÄNKISCHE Group of Companies, e.g., if the information relates to events in subsidiaries of the FRÄNKISCHE Group of Companies.
If required for the investigation, the information may be shared with group companies of the FRÄNKISCHE Group of Companies in a country outside the European Union or the European Economic Area on the basis of suitable or appropriate data protection guarantees for the protection of data subjects.
The FRÄNKISCHE Group of Companies always ensures that the relevant provisions of data protection law are complied with when sharing information. Any person who gains access to the data is obliged to maintain confidentiality.
Which data privacy rights do you have?
As a data subject, you can assert various data subject rights. To exercise your rights, you can contact the FRÄNKISCHE Group of Companies via the contact details mentioned in the first section above.
Data subject rights include in particular:
- Right of access according to Art. 15 GDPR
- Right to rectification according to Art. 16 GDPR
- Right to erasure according to Art. 17 GDPR
- Right to restriction of processing according to Art. 18 GDPR
- Right to appeal to a supervisory authority
For further information on how to exercise your data subject rights, please refer to the General Data Protection Information for Employees.
How long will your data be stored?
The FRÄNKISCHE Group of Companies stores or deletes the data collected in the course of the investigation of information in accordance with the relevant data protection requirements; in particular, in accordance with Art. 17 GDPR. Accordingly, your data will generally be deleted when it is no longer required for the purposes stated in this Data Protection Information.
However, legal data retention regulations or legitimate interests of the FRÄNKISCHE Group of Companies may justify longer storage of your data. For example, the FRÄNKISCHE Group of Companies may continue to retain your data during current legal disputes that are the result of possible investigations.
The storage periods depend on the storage interest of the FRÄNKISCHE Group of Companies in each individual case, taking into account the importance of the storage, the interests worthy of protection of data subjects in the deletion, and the probability that a suspicion reported in the whistleblowing system is true.
The General Data Protection Information for Employees contains further information on the relevant requirements for the storage of personal data of employees.
What measures for automated individual decision-making or profiling are in place?
In the context of investigations, neither automated individual decision-making nor profiling measures within the meaning of Art. 22 GDPR take place.
Right to appeal to the competent supervisory authority
You also have the right to appeal to the competent supervisory authority:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
D-91522 Ansbach
https://www.lda.bayern.de
However, you can also direct your complaint to another supervisory authority responsible for data protection, which will forward your complaint to the competent supervisory authority.
