Information on data protection
In the following, we would like to inform you about the collection, processing and use of personal data within the framework of the whistleblowing system. Please read this data protection information carefully before submitting a report.
Purpose of the whistleblowing system
The whistleblowing system (BKMS® System) serves the purpose of receiving and processing reports concerning (suspected) violations of laws or internal rules of Paulaner Brauerei Gruppe GmbH & Co. KGaA as well as reports concerning irregularities in one’s own business area or the supply chain via a secure and confidential channel. The goal is to effectively and with a high level of confidentiality identify, investigate, eliminate and penalise such legal violations and serious violations of the obligations of employees, including behaviour harmful to the company and instances of business crime that arise anywhere in the group as well as misconduct at suppliers and business partners and to avert associated damages and liability risks for Paulaner Brauerei Gruppe GmbH & Co. KGaA, its affiliated companies, all employees, customers and business partners as well as all other people and the environment (Sections 30, 130 Administrative Offence Act [OWiG]).
Processing of personal data and legal basis
Personal data are collected and stored within the framework of the BKMS® System. The handling of these data complies with the applicable data protection laws.
Only the data that are objectively required for the purposes of the whistleblowing system (see above) will be processed.
The collected data are used exclusively for the purposes of the whistleblowing system as described above. The data are provided, in particular, to safeguard the legal obligations of the company and compliance requirements at the company. Processing of the data takes place within the framework of fulfilling employment contract obligations on the basis of Section 26 (1) German Data Protection Act (BDSG) and based on legitimate interests of Paulaner Brauerei Gruppe GmbH & Co. KGaA that override the interests of the respective data subject on the basis of Art. 6 (1)(f) General Data Protection Regulation (GDPR). Legitimate interests include ensuring compliance within the company. This includes discovering and investigating legal violations and serious violations of the obligations of employees, including behaviour harmful to the company and business crime as well as misconduct in one’s own business area and in the supply chain, and for the protection of all employees, customers and business partners as well as all other people and the environment. A further legal basis is Art. 6 (1)(c) GDPR in connection with the German Supply Chain Act.
Responsible parties and data security
The party responsible for data protection in the whistleblowing system is:
Paulaner Brauerei Gruppe GmbH & Co. KGaA
Ohlmüllerstrasse 42
81541 Munich
Telephone +49 89 48 00 5-0
Fax +49 89 48 00 5-409
Email info@paulaner.de
The whistleblowing system is operated by a specialised company, EQS Group AG, Bayreuther Str. 35, 10789 Berlin in Germany.
Personal data and information entered into the whistleblowing system are stored in a database of a high security data centre in Germany operated by EQS Group AG, separate from the other data stored by Paulaner Brauerei Gruppe GmbH & Co. KGaA. The data may be viewed by Paulaner Brauerei Gruppe GmbH & Co. KGaA exclusively for the purposes listed above. EQS Group AG and other third parties do not have access to the data. This is ensured in the certified procedure through a corresponding permission system and extensive technical and organisational measures.
All data are stored encrypted with multiple levels of password protection so that access is restricted to a very small selection of expressly authorised persons at Paulaner Brauerei Gruppe GmbH & Co. KGaA. In addition, a contract processing agreement as per Art. 28 GDPR was concluded to ensure a high level of data protection and data security.
Paulaner Brauerei Gruppe GmbH & Co. KGaA has appointed a data protection officer in each relevant instance. Inquiries concerning data protection can be directed to:
Paulaner Brauerei Gruppe GmbH & Co. KGaA
Data protection officer
Ohlmüllerstrasse 42
81541 Munich
Email: datenschutz@paulaner.de
Type of the collected personal data
Use of the whistleblowing system is voluntary. You have no legal or contractual obligation to provide your personal data.
If you submit a report via the whistleblowing system, we collect the following personal data and information:
- Your name and private contact and identification information, if you disclose your identity and these data (non-anonymous report)
- Whether you are employed by a company of the Schörghuber Group, i.e. professional contact information and organisation affiliation, if you provide this (non-anonymous report)
- The names and other personal data of persons whom you list in your report, if applicable.
Confidential handling of reports
Incoming reports are received by a small selection of expressly authorised and specially trained employees of Paulaner Brauerei Gruppe GmbH & Co. KGaA and always handled confidentially. The employees evaluate the matter and carry out any further investigation that may be required by the specific case. Only these employees have access to the data stored in the whistleblowing system.
While processing a report or conducting an internal investigation, it may be necessary in justified individual cases to share reports with other employees of Paulaner Brauerei Gruppe GmbH & Co. KGaA or with employees of another group company affiliated with Paulaner Brauerei Gruppe GmbH & Co. KGaA, e.g. if the reports refer to incidents at subsidiaries of Paulaner Brauerei Gruppe GmbH & Co. KGaA. It may be necessary for the investigation to share data with such companies of the group located in a country outside of the European Union or the European Economic Area where different regulations concerning the protection of personal data may apply. We will always ensure that the applicable data protection regulations are complied with when sharing reports and that appropriate guarantees under data protection law are provided for the protection of data subjects (e.g. EU standard data protection clauses or exemptions as per Art. 49 GDPR).
If necessary, the report text you submit will be shared with subcontracted partners of EQS Group AG for translation. The data protection agreement concluded with EQS Group AG also applies to these service providers.
Where a corresponding legal obligation exists or in the event of a legitimate interest of Paulaner Brauerei Gruppe GmbH & Co. KGaA or a third party in investigation of the report, other possible recipients include law enforcement agencies, anti-trust authorities, other administrative authorities and courts. It may also be necessary to share reports with law firms, auditing firms or external data protection officers hired by Paulaner Brauerei Gruppe GmbH & Co. KGaA or another affiliated group company, in which case these recipients are also obligated professionally or by law to maintain confidentiality.
All persons who receive access to the data are obligated to maintain confidentiality.
Information about the accused party
Every person involved in a report will be informed at the appropriate time and in consideration of our notification obligations under data protection law and pursuant to Art. 13, 14 GDPR of the accusations of suspected wrongdoing made against them, as long as this notification would not significantly complicate continuation of the investigation into the situation. If no such danger exists, this notification generally takes place within one month, otherwise no later than upon conclusion of the investigations. In certain cases, the accused person has the right pursuant to Art. 15 GDPR to demand information about the stored data and information concerning them.
Even if you have shared with us your name or other personal data (non-anonymous report), your identity as whistleblower will not be disclosed – insofar as legally possible – either in connection with the fulfilment of our notification obligations or in the provision of information to the accused person and it will also be ensured that it is not possible to draw any conclusions concerning your identity as whistleblower. Deviating rules can apply if you consent to disclosure of your identity or if a corresponding legal obligation applies. This is the case in particular if the disclosure is indispensable in order that persons affected by the report can exercise their right to a hearing. In all cases, you will be informed in advance of the disclosure of your identity. However, disclosure by us will not take place as long as the whistleblower has an overriding, legitimate interest in keeping his or her identity confidential (Section 29(1) BDSG), which is fundamentally the case as long as the investigation into the subject matter of the report has not yet been concluded. Because all information concerning the whistleblower is fundamentally deleted or entirely anonymised upon completion of the investigation (see below), especially if the investigation produced no result, a disclosure of your identity is largely ruled out in this case as well.
Rights of the data subjects
Pursuant to GDPR, you and the persons named in the report have – in addition to the aforementioned right of access and information – a right to rectification, erasure, restriction of processing or blocking and a right to object to the processing of your personal data. If the right to object to the processing of the personal data is invoked, we will immediately evaluate the necessity of the stored data for the examination of a report and inform the data subject of the overriding interests that permit the processing. The data will be blocked for these purposes for the duration of this evaluation. Data that are no longer needed will be deleted at once.
If the data have been shared with a third party, we will inform the recipient of the correction, erasure or blocking of the data in accordance with the statutory regulations. You also have the right to lodge a complaint with the data protection supervisory authority. The applicable authority in our case is the Data Protection Authority of Bavaria.
With regard to exercising these rights of the data subject, Paulaner Brauerei Gruppe GmbH & Co. KGaA is the competent party as well as your direct contact partner.
Retention period for personal data
Personal data are retained for as long as necessary to clarify the situation detailed in the report and perform a concluding evaluation as well as beyond this time if pertinent archiving periods exist on the basis of law, contract or charter. If a report results in criminal, disciplinary or civil court processes, the storage duration can extend until the final conclusion of the respective process. Data collected with a report that are of no relevance for the process will be deleted immediately. After the report processing is concluded, the data will be deleted or anonymised in accordance with statutory requirements. Any links to your identity as a whistleblower will be finally and irreversibly removed during anonymisation.
Use of the whistleblowing system
Communication between your computer and the whistleblowing system takes place over an encrypted connection (SSL). Your IP address will not be stored during your use of the whistleblowing system. In order to maintain the connection between your computer and the BKMS® System, a cookie is stored on your computer that merely contains the session ID (a so-called session cookie). This cookie is only valid until the end of your session and expires when you close your browser.
It is possible to set up a secured postbox within the whistleblowing system with an individually chosen pseudonym/ user name and password. This allows you to send reports to the respectively responsible employee of Paulaner Brauerei Gruppe GmbH & Co. KGaA either by name or in an anonymous, safe way. This system only stores data inside the whistleblowing system, which makes it particularly secure. It is not a form of regular e-mail communication.
Note on sending attachments
When submitting a report or an addition, you can simultaneously send attachments to the responsible employee of Paulaner Brauerei Gruppe GmbH & Co. KGaA. If you wish to submit an anonymous report, please take note of the following security advice: Files may contain hidden personal data that could jeopardise your anonymity. Please remove all such information before sending a file. If you are unable to remove this data or are uncertain about how to do so, copy the text of your attachment into your report text or send the printed document anonymously (with personal data blacked out) to the address listed in the footer, citing the reference number received at the end of the reporting process.
Version: 1 Sept. 2023