Whistleblowing system – data protection note for France
The ALDI Nord companies take data protection and confidentiality very seriously and adhere to the provisions of the EU General Data Protection Regulation (GDPR) as well as current national data protection regulations. Please read this data protection information carefully before submitting a report.
Responsible party and data protection officer:
The party responsible for the data processing is:
ALDI Services Sarl
13, rue Clément Ader, Parc d'activité de la Goële
77230 Dammartin-en-Goële
Our Data Protection Officer can be reached by email at contact.dpd@aldi.fr and by post to ALDI Services Sarl, attn. Data protection officer, 13, rue Clément Ader, Parc d'activité de la Goële 77230 Dammartin-en-Goële.
Purpose of the whistleblowing system, legal foundation and provider
The whistleblowing system (BKMS® System) serves the purpose of securely and confidentially receiving, processing and managing reports concerning violations of the compliance rules.
The whistleblowing system is operated by a specialised company, EQS Group GmbH, Bayreuther Str. 35, 10789 Berlin in Germany, on behalf of ALDI Services.
The legal basis for this processing of personal data is Article 6 paragraph 1 point c GDPR. The whistleblowing system implements the reporting rights stipulated by the Sapin-II legislation. Its purpose is the detection and prevention of misconduct in order to protect the company, its employees and its customers from damage.
Processing of personal data
Personal data and information entered into the whistleblowing system are stored in a database of a high security data centre operated by EQS Group GmbH. Only the competent and authorised employees of ALDI Services have access to the data. EQS Group GmbH and other third parties do not have access to the data. This is ensured in the certified procedure through extensive technical and organisational measures.
All data are stored encrypted with multiple levels of password protection so that access is restricted to a very small selection of expressly competent and authorised persons at ALDI Services.
Type of personal data collected
Use of the whistleblowing system takes place on a voluntary basis. When you submit a report via the whistleblowing system, the following personal data and information may be collected:
- the identity, role and contact data of the whistleblower,
- the identity, role and contact data of the individuals named in the report,
- the identity, role and contact data of the individuals who process the report,
- the described situation,
- the evidence collected within the scope of the investigation,
- the investigation report,
- the consequences of the report.
Confidential handling of reports
Incoming reports are received by a small selection of expressly competent and authorised employees of ALDI Services. They are always handled in strict confidence. The employees of the compliance department of ALDI Services evaluate the matter and perform any further investigation required by the specific case.
During the processing of a report or the conducting of a special investigation, it may become necessary to forward reports to other parties. We will always ensure that the applicable data protection regulations are complied with when sharing reports. Any third parties that are involved in the investigation are contractually obliged to destroy the transmitted data once the investigation is concluded or return them to ALDI Services.
All persons who receive access to the data are contractually obligated to maintain confidentiality.
Details of the individuals named in the report
We are legally obligated to inform affected parties of any reports naming them and their rights as soon as the disclosure of this information no longer jeopardises the investigation.
Your identity as a whistleblower will not be disclosed unless you explicitly consent to this.
Your rights
Pursuant to European data protection legislation, you and the persons named in the report have a right of access, rectification, erasure, restriction of processing and right to object to the processing of your personal data. If the right to object to the processing of the personal data is invoked, the necessity of the stored data for the examination of a report will be evaluated immediately. Data that are no longer needed will be deleted at once. You also have the right to lodge a complaint with the CNIL.
To clarify any questions or assert your rights, please contact the Data Protection Officer at contact.dpd@aldi.fr.
Retention period of personal data
Personal data is retained for as long as necessary to clarify the situation and perform a final assessment.
If a report is found to be inadmissible, all transmitted data are immediately anonymised and archived or, if that is impossible, destroyed.
Personal data contained in an admissible report that does not lead to disciplinary or legal proceedings are anonymised and archived or, if that is impossible, destroyed within two months of the conclusion of the investigation.
If a disciplinary or legal procedure is initiated against a person named in a report or a whistleblower acting in bad faith, the data will be retained until the proceedings conclude.
Use of the whistleblowing portal
Communication between your computer and the whistleblowing system takes place over an encrypted connection (SSL). Your IP address will not be stored during your use of the whistleblowing system. In order to maintain the connection between your computer and the BKMS® System, a cookie is stored on your computer that contains only the session ID (a so-called session cookie). This cookie is only valid until the end of your session and expires when you close your browser.
It is possible to set up a postbox within the whistleblowing system that is secured with an individually chosen pseudonym/user name and password. This allows you safely to send reports either by name or, in exceptional cases, anonymously. This system only stores data inside the whistleblowing system, making it particularly secure. It is not a form of regular e-mail communication.
Information on data protection for the website
Please also note the data protection information on our website:
https://www.aldi.fr/protection_des_donnees.html