Rules for the Processing of Personal Data
in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation; OJ EU.L.2016.119.1; hereinafter referred to as the GDPR).
We take data protection and confidentiality very seriously, and comply with the provisions of the GDPR as well as current national personal data protection laws. Please read the following information carefully before sending your report.
Personal Data Controller
The Personal Data Controller is “Hochland Polska” Sp. z o.o. with its registered office in Kaźmierz, ul. Okrężna 2, 64-530 Kaźmierz, entered in the Register of Entrepreneurs kept by the District Court of Poznań – Nowe Miasto and Wilda in Poznań, 9th Commercial Division of the National Court Register under KRS No. 0000106528, NIP 5660013371, REGON 130158192, share capital PLN 19,885,800.00 (hereinafter referred to as the Controller, Hochland Polska, or simply we). The Controller can be contacted at the above-mentioned address or by e-mail: daneosobowe@hochland.com.
The Controller has appointed a Data Protection Officer, who can be contacted at the above-mentioned registered office address or via e-mail: daneosobowe@hochland.com
Purpose of a Whistleblowing System and Legal Basis
A whistleblowing system (BKMS® System) is used to securely and confidentially receive and process information regarding actual or potential violations of laws or internal regulations adopted by Hochland Polska.
The processing of personal data in the BKMS® System is based on the legitimate interest of the Controller, which is to detect and prevent actual or potential violations of laws or internally adopted regulations and the related prevention of damage on the part of Hochland Polska, its employees, clients, contractors or other related entities (Article 6(1)(f) of the GDPR).
In some cases, the processing of personal data in the BKMS® System may be based on a legal obligation to which the Controller is subject - this will be the case when the examination of a report is necessary to fulfil the obligations imposed on us by law, for example, when the report concerns a breach of the principles of equal treatment in employment Article 6 Paragraph 1 lit. f of the GDPR).
Scope of Personal Data Processing
The use of a whistleblowing system is voluntary. If irregularities are reported through the whistleblowing system, we collect the following information, including personal data:
- Your full name if you choose to reveal your identity,
- Information on whether you are employed in Hochland Polska
- The information provided in the report, including personal data of the persons mentioned in the report (if you provide it).
As a rule, we have a legal obligation to inform the persons indicated in the report about the processing of their personal data carried out in accordance with the principles described in this document, unless this may prevent or seriously impede the purposes of processing their personal data. For this reason, this document is public, so that such persons have access to it.
Personal Data Recipients
The reporting system is operated by a specialised company, EQS Group GmbH, EQS Group GmbH, Karlstraße 47, 80333 München, Germany, on behalf of Hochland Polska.
Information, including personal data entered into the whistleblowing system is stored in a database maintained by EQS Group GmbH in a high-security data centre. Only Hochland Polska has access to the data. EQS Group GmbH or other third parties do not have access to the data. This is ensured by a certified procedure through extensive technical and organisational activities.
All data is encrypted and stored in a multi-level password-protected manner, which means that only designated persons have access to it.
The reports received are handled by a small group of expressly authorised and specially trained employees of the ... Department at Hochland Polska. We always treat the information contained in the reports as confidential, and those handling the reports are required to maintain confidentiality. Designated employees explain the situation and may carry out any further investigation required in the case.
In some cases when examining a report or conducting a special investigation procedure, it may be necessary to make the report available to additional employees of Hochland Polska or employees of other companies in the Hochland Group, for example if the report concerns an irregularity taking place in a group company. If necessary to investigate the report, the data may be transferred to such a company established in a country outside the European Union or the European Economic Area where other data protection regulations apply. In such a case, the transfer of data takes place on the basis of appropriate data security guarantees in order to protect the data subjects. If the European Commission has not adopted an adequacy decision for a country, these guarantees are standard contractual clauses of the European Commission. Data subjects have the right to obtain from us copies of the relevant guarantees for the transfer of personal data to third countries.
If it proves necessary to examine your report or is required by law, your data may also be accessed by authorised state authorities, including law enforcement agencies, administrative bodies or courts.
Personal Data Retention Period
Please note that the data retention period may depend in particular on the type and seriousness of the reported irregularities. This means that personal data will be kept for as long as it is necessary to investigate the situation and assess the report. Data may also be stored until the legitimate interest of Hochland Polska has ceased or until the expiry of the periods required by the relevant legislation. After this period, the data will be erased.
Rights of the Data Subject
You have the right to:
- request access to your personal data, rectify it, erase it or limit its processing, as well as the right to data portability,
- where the basis for the processing of personal data is a legitimate interest of the Controller – the right to object at any time to the processing of personal data for reasons related to your particular situation,
- lodge a complaint with the supervisory body, i.e. the President of the Personal Data Protection Office.
In order to exercise your rights, please contact us at the above-mentioned e-mail address.
Use of Personal Data for Automated Decision-Making, Including Profiling
Your personal data will not be used to make automated decisions, including profiling.
Security of Reporting
The communication between the computer and the whistleblowing system takes place via an encrypted connection (SSL). The computer’s IP address is not saved while using the system. In order to maintain the connection between your computer and the BKMS® System, a cookie is stored on your computer, which only contains a session ID (so-called null cookie). This cookie is only valid until the end of your session and expires when you close your browser. It is not used for any other purpose, in particular we do not use it to track your online activities.
As part of the whistleblowing system, you can configure a mailbox that is protected by an individually selected nickname/user name and password. This allows you to send reports to the relevant employees of Hochland Polska by signing your name or anonymously. This system stores data only inside the whistleblowing system, which makes it particularly secure. This is not a form of regular e-mail communication.
Note on Sending Attachments
By sending a report or supplementary information, you can send attachments to the relevant employees of Hochland Polska. If you wish to send your report anonymously, please observe the following safety instructions:
Files may contain hidden personal data that could compromise your anonymity. Before sending the file, this data must be deleted. If you are unable or unsure how to do this, copy the text of the attachment to the text of the report, or send the printed document anonymously to the address specified in the footer, giving a reference number which you will receive at the end of the reporting process.