Home - BKMS System

Information on data protection

We take data protection and confidentiality very seriously and adhere to the provisions of the EU General Data Protection Regulation (EU-GDPR) as well as current national data protection regulations. Please read this data protection information carefully before submitting a report.

Purpose of the TÜV SÜD Trust Channel and legal basis

The TÜV SÜD Trust Channel (BKMS^® System provides for securely and confidentially receiving, processing and managing reports concerning compliance violations. The processing of personal data in the BKMS^® System is based on the legitimate interests of our company to detect and prevent misconduct and thus avoid damage to TÜV SÜD AG, its employees and customers. Article 6 (1) (f) EU-GDPR serves as legal basis for this data processing.

Processing of the whistleblower's identification data is based on consent to be given (Art. 6 para. 1, lit. a GDPR). The voluntary nature of the consent is given by the fact that the information can also be provided anonymously. As a rule, however, consent can only be effectively revoked within one month of receipt of the hint, as TÜV SÜD AG is obliged in certain cases under Art. 14 para. 3 lit. a GDPR to inform the person implicated of the claims made against him and of the investigations conducted against him within one month, including the retention, nature of the data, the purpose of processing and the identity of the person responsible and, if applicable, of the whistleblower, and it is then no longer possible to stop processing the whistleblower's identification data. Moreover, processing of the data has already progressed so far after the date that deletion is no longer possible. However, the revocation period may also be shortened, sometimes considerably. This is the case if the nature of the notification requires the direct involvement of the authorities or a court. As soon as we have disclosed the name to the authorities or a court, it will be stored in our case files as well as by the authorities or court and can no longer be deleted.

Controller

Controller of the TÜV SÜD Trust Channel is

TÜV SÜD AG
Westendstraße 199
80686 München
Tel.: +49 (0) 89 5791-0
Email: info@tuvsud.com

The TÜV SÜD Trust Channel is operated by a specialised company, EQS Group GmbH, Karlstraße 47, 80333 Munich in Germany, on behalf of TÜV SÜD AG.

Personal data and information entered into the TÜV SÜD Trust Channel are stored in a database operated by EQS Group GmbH in a high-security data centre in Germany. Only a limited group of employees of TÜV SÜD AG have access to the data. EQS Group GmbH and other third parties do not have access to the data. This is ensured in the certified procedure through extensive technical and organisational measures.

All data are stored encrypted with multiple levels of password protection so that access is restricted to a very small selection of expressly authorised persons at TÜV SÜD AG.

TÜV SÜD AG has appointed a data protection officer. Those affected can contact the TÜV SÜD Data Protection Officer directly:

Data protection officer

TÜV SÜD Business Services GmbH
Westendstraße 199
80686 München
datenschutzbeauftragter@tuvsud.com

Type of the collected personal data

Use of the TÜV SÜD Trust Channel takes place on a voluntary basis. If you submit a report via the TÜV SÜD Trust Channel, we collect the following personal data and information:

your name, if you choose to reveal your identity,
Your contact details, if you provide them,
The fact that you have submitted a hint via the TÜV SÜD Trust Channel
whether you are employed at TÜV SÜD, and
the names of persons and other personal data of persons that you name in your report.

Confidential handling of reports

Incoming reports are received by a small selection of expressly authorised and specially trained employees of the Compliance department of TÜV SÜD AG and are always handled confidentially. The employees of the Compliance department of TÜV SÜD AG will evaluate the matter and perform any further investigation required by the specific case.

All persons who receive access to the data are obligated to maintain confidentiality.

Data transfer

During the processing of a report or the conduction of a special investigation, it may become necessary to share reports with additional employees of TÜV SÜD AG or employees of other group companies, e.g. if the reports refer to incidents in subsidiaries.

In addition, your personal data are only forwarded to third parties or public authorities for further investigations in individual cases if this is required for investigating illegal conduct or for prosecution. However, this takes place only if specific reasons exist to suspect illegal or inappropriate conduct.

The sharing of this data is based on our legitimate interest in combatting malpractice, prosecuting crimes and defending, asserting and enforcing claims insofar as these are not outweighed by your rights and interests in the protection of your personal data, Art. 6(1)(f) GDPR.

The latter may be based in countries outside the European Union or the European Economic Area with different regulations concerning the protection of personal data. We always ensure that the applicable data protection regulations are complied with when sharing reports.

Information of the accused person

We are legally obligated according to Art. 14 GDPR to inform third parties of any reports received against them and personal data of theirs that we process as soon as the disclosure of this information no longer jeopardises the investigation. In doing so, your identity as whistleblower is not revealed as far as is legally possible.

Confidentiality cannot be guaranteed if false information is knowingly given with the aim of discrediting a person (denunciation).

Rights of the data subjects

According to European data protection law, you and the persons named in the report have the right to inquiry, rectification, erasure, restriction of processing and the right to object to processing of personal data concerning them. If the right of objection is claimed, we will immediately examine to what extent the stored data is still necessary for the processing of a report. Data that is no longer required is deleted immediately. In addition, you have the right to lodge a complaint with a supervisory authority.

Retention period of personal data

Personal data is retained for as long as necessary to clarify the situation and perform an evaluation of the report or a legitimate interest of the company exists or it is required by law. After the report processing is concluded, this data is deleted in accordance with the statutory requirements.

Use of the TÜV SÜD Trust Channels

Communication between your computer and the TÜV SÜD Trust Channel takes place over an encrypted connection (SSL). Your IP address will not be stored during your use of the TÜV SÜD Trust Channel. In order to maintain the connection between your computer and the BKMS^® System, a cookie is stored on your computer that merely contains the session ID (a so-called session cookie). This cookie is only valid until the end of your session and expires when you close your browser.

It is possible to set up a postbox within the TÜV SÜD Trust Channel that is secured with an individually chosen pseudonym / user name and password. This allows you to send reports to the responsible employee at TÜV SÜD AG either by name or in an anonymous, safe way. This system only stores data inside the TÜV SÜD Trust Channel, which makes it particularly secure. It is not a form of regular e-mail communication.

Note on sending attachments

When submitting a report or an addition, you can simultaneously send attachments to the responsible employee of TÜV SÜD AG. If you wish to submit an anonymous report, please take note of the following security advice: Files can contain hidden personal data that could put your anonymity at risk (e.g. metadata, such as who last saved the file). Remove this data before sending. If you are unable to remove this data or are unsure how to do so, copy the text of your attachment into your report text or send the printed document anonymously to the address listed in the footer, citing the reference number received at the end of the reporting process.

TÜV SÜD Trust Channel privacy policy for Spain

At TÜV SÜD we take the confidentiality and protection of your data very seriously in accordance with the EU General Data Protection Regulation and the Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights. Please read this information on personal data protection carefully before sending a message.

The TÜV SÜD Trust Channel is the information channel for securely and confidentially receiving, processing and managing messages about potential compliance violations at TÜV SÜD.

However, there may be other external reporting channels of the regional administrations and the external reporting channel of the Independent Whistleblower Protection Authority, where any natural person may directly report the commission of any infringement as defined in the scope of application of Law 2/2023 of 20 February, regulating the protection of persons who report regulatory and anti-corruption infringements, without prejudice to prior communication through the TÜV SÜD Trust Channel.

Data controller

TÜV SÜD in Spain (*)
Ronda de Poniente, 4
28760 Tres Cantos (Madrid)
Email: ldpc.es@tuvsud.com

Contact of the Data Protection Officer in Spain: ldpc.es@tuvsud.com - Local Data Protection Coordinator.

(*) TÜV SÜD operates in Spain through the following entities:
- TÜV SÜD ATISAE, S.A.U.
- TÜV SÜD IBERIA, S.A.U.
- TÜV SÜD AMT, S.A.U.
- ATISAE de Castilla y León, S.A.U.

The Spanish parent company of the TÜV SÜD GROUP in Spain, within the meaning of article 42 of the Commercial Code, is the company TÜV SÜD ATISAE, S.A.U. When you send information through the TÜV SÜD Trust Channel, the Data Controller will be the company about which you make your complaint or claim. In the event that it is not possible to identify the company about which the complaint is made, the Data Controller will be TÜV SÜD ATISAE, S.A.U. as the Spanish parent company of the Group in Spain.

Personal data and information entered into the TÜV SÜD Trust Channel is stored in a database in a highly secure data centre. Access to the data and information is limited to a restricted number of specifically authorized employees only. All data is stored encrypted with various levels of password protection.

Data processed and purpose of processing

Use of the TÜV SÜD Trust Channel is voluntary. If you send a message via the TÜV SÜD Trust Channel, we will collect the following personal information:

your name, if you have decided to reveal your identity,
your contact details, if you provide them,
the fact that you have submitted a notice through the TÜV SÜD Trust Channel,
if you are an employee of TÜV SÜD, and
the names and other personal information of the persons you mention in your message.

The purpose of the processing of personal data contained in the TÜV SÜD Trust Channel is to receive, process and administer messages about possible compliance violations in a secure and confidential manner.

Legitimation of the processing

In the case of the companies TÜV SÜD ATISAE, S.A.U. and TÜV SÜD IBERIA, S.A.U., the processing of personal data is legitimized in compliance with a legal obligation, specifically in compliance with the requirements established by Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption.

In the case of the companies TÜV SÜD AMT, S.A.U. and ATISAE de Castilla y León, S.A.U. the processing of data is legitimized in the public interest according to article 6.1.e of the General Data Protection Regulation.

The processing of personal data considered to be of special categories is considered appropriate on the basis of the essential public interest as provided for in Article 9.2.g of the above-mentioned Regulation.

Data retention

The personal data processed shall only be stored by TÜV SÜD Trust Channel for as long as is necessary to decide whether or not it is appropriate to initiate an investigation into the facts reported. If the information received contains personal data that fall into special categories of data, they will be deleted immediately, without any further recording and processing.

When the investigation is carried out, the data will be anonymized in the TÜV SÜD Trust Channel and will become part of the investigation system, where it will remain for as long as necessary to clarify the facts reported and take the appropriate measures.

If the information provided or part of it is not true, it shall be deleted from TÜV SÜD Trust Channel as soon as this becomes known, unless the lack of truthfulness could constitute a criminal offence, in which case the information shall be retained for as long as necessary during the legal proceedings in the internal information system.

In any case, if no investigation has been initiated within three months of receipt of the communication, the information shall be anonymized and the communications shall only be kept for the purpose of demonstrating the functioning of the system.

Recipients of the information

Whoever submits a communication has the right not to have his or her identity disclosed to third parties. The internal information system has the appropriate technical and organizational measures in place to preserve the identity and guarantee the confidentiality of the data relating to the persons concerned and any third parties mentioned in the information provided, especially the identity of the informant in case he/she has identified him/herself.

The identity of the informant shall not be disclosed to the person concerned and may only be communicated to the judicial authority, the Public Prosecutor's Office or the competent administrative authority in the context of a criminal or disciplinary investigation.

During the investigation process, it may be necessary to share information about the reported facts with employees of other Group companies or with specialized external investigators. In the event that information is shared with these agents, it will always be ensured that the applicable regulations on personal data protection are complied with.

User rights

We remind you of your right to request access to your personal data, its rectification, deletion, limitation, opposition to processing and portability of your data. You may exercise your rights by e-mail at ldpc.es@tuvsud.com or by post to the address Ronda de Poniente, 4, 28760 Tres Cantos, Madrid, for the attention of the Local Data Protection Coordinator. We also remind you that you have the right to lodge a complaint with the Spanish Data Protection Agency.

Use of TÜV SÜD Trust Channel

Communication between your computer and the TÜV SÜD Trust Channel takes place via an encrypted connection (SSL). Your IP address is not stored while you are using the TÜV SÜD Trust Channel. In order to establish proper communication, a cookie containing only the session identifier (so-called session cookie) will be saved on your computer. This cookie will only be valid until you end the session, and will expire when you close your browser.

You have the option of setting up a mailbox within the TÜV SÜD Trust Channel, access to which is protected by an individually selected pseudonym or user name and password. You can use it to send messages to the responsible TÜV SÜD employee, either with your name or anonymously and securely. This system only stores data within the TÜV SÜD Trust Channel, which makes it particularly secure. It is not a regular e-mail communication system.

When sending a message or additional information, you can send attachments to the responsible TÜV SÜD employee at the same time. If you wish to send an anonymous message, please note the following security warning: Files may contain hidden personal information that could jeopardize your anonymity (e.g. metadata, such as who last saved the file). Remove such information before submission. If you are unable to remove it or do not know how to do so, copy the text of your attachment into the text of the message or anonymously send the printed document to the address indicated in the footer, specifying the reference number that you will receive at the end of the message submission process.