Home - BKMS System

Data protection information

We take data protection and confidentiality very seriously and adhere to the provisions of the EU General Data Protection Regulation (GDPR) as well as current national data protection regulations. In the following, we would like to inform you about the collection, processing and use of personal data within the whistleblowing system. Please read this data protection information carefully before submitting a report.

Purpose and legal foundation of the whistleblowing system

The whistleblowing system (BKMS^® System) serves to receive, process and manage reports of violations of statutory requirements and compliance rules and regulations of SMS group via a secure and confidential channel.

The processing of personal data within the framework of the BKMS^® System is based on the legitimate interest (Art. 6(1)(f) GDPR) of our company in discovering and preventing misconduct and preventing harm to SMS group, its employees and business partners.

If a received report concerns an employee of SMS group, the processing also serves to prevent criminal acts or other infringements in connection with the employment relationship (Section 26 para. 1 German Federal Data Protection Act (BDSG)).

Responsible party

The party responsible for data protection in the whistleblowing system is SMS group, Compliance, Wiesenstraße 30 57271 Hilchenbach, Germany.

The whistleblowing system is operated by a specialised company, EQS Group GmbH, Bayreuther Str. 35, 10789 Berlin in Germany, on behalf of SMS group.

Personal data and information entered into the whistleblowing system are stored in a database operated by EQS Group GmbH in a high-security data center. Only SMS group has access to the data. EQS Group GmbH and other third parties do not have access to the data. This is ensured by extensive technical and organisational measures within the certified process.

All data are encrypted and saved with multi-level password protection, so that access is limited to a very small number of explicitly authorized recipients at SMS group.

SMS group GmbH has appointed a data protection officer. Questions about data protection can be sent to SMS group GmbH, Eduard-Schloemann-Strasse 4, 40237 Duesseldorf, Germany, with subject “Data protection” or to dataprotection(at)sms-group.com.

Type of collected personal data

Use of the whistleblowing system is voluntary. When you wish to submit a report using the whistleblowing system, we collect the following personal data and information:

Your name, if you reveal your identity
Whether you work at SMS group
Potentially names of people or other personal data of people mentioned in your report.

Confidential handling of reports

Incoming reports are received and processed in a strictly confidential manner by a small circle of explicitly authorized and specially trained employees of the compliance organization of SMS group. The employees of the compliance organization of SMS group evaluate the matter and perform any further investigation required by the specific case. If a corresponding legal obligation exists or it is required by data protection law for investigation of the report, other conceivable categories of recipients include criminal justice authorities, anti-trust authorities, other administrative authorities and courts as well as international law offices and auditing firms hired by SMS group.

In the case of deliberate submission of false reports with the intent of discrediting an individual (denunciation), confidentiality cannot be guaranteed.

While processing a report or conducting a special investigation, it may be necessary to share reports with additional employees of SMS group or employees of other group companies, e.g. if the reports refer to incidents in subsidiaries. The latter may be based in countries outside the European Union or the European Economic Area with different regulations about the protection of personal data. We will always ensure that the applicable data protection regulations are complied with when sharing reports.

All persons who receive access to the data are obligated to maintain confidentiality.

Informing the accused person

In certain cases, we are legally obligated to inform accused parties of the accusations made against them. This is legally required in cases in which it is objectively established that sharing of this information with the accused will definitely no longer impede the concrete investigation of the report. Insofar as legally possible, your identity will not be disclosed in this process, and it will be additionally ensured that no conclusions concerning your identity are possible.

Rights of the data subjects

Pursuant to European data protection legislation, you and the persons named in the report have a right of access, rectification, erasure, restriction of processing and right of objection to processing of your personal data. If the right to object to the processing of the personal data is invoked, the necessity of the stored data for the examination of a report will be evaluated immediately. Data that are no longer needed will be deleted at once.

To take advantage of your rights as a data subject, please contact compliance@sms-group.com

You also have the right to lodge a complaint with the supervisory authority.

Retention period of personal data

Personal data are retained for as long as necessary to clarify the situation and perform a final assessment or for as long as a legitimate interest exists on the part of the company or retention is required by law. After the processing of the report is finished, the data are deleted in accordance with the corresponding statutory requirements.

Use of the whistleblowing system

The communication between your computer and the whistleblowing system takes place through an SSL-encrypted connection. Your IP address will not be stored during your use of the whistleblowing system. In order to maintain the connection between your computer and the BKMS^® System, a cookie is stored on your computer that contains only the session ID (a so-called session cookie). The cookie is only valid until the end of your session and expires when you close your browser.

You can set up a secured postbox with your pseudonym/user name and password of choice in the whistleblowing system. This allows you to send reports to the respectively responsible employee of SMS group either by name or in an anonymous, safe way. This system only stores data inside the whistleblowing system, which makes it particularly secure. It is not a regular e-mail communication.

Note on sending attachments

During the report submission or when submitting additional information, you can send attachments to the responsible employee of SMS group. If you wish to submit an anonymous report, please note the following security advice: Files can contain hidden personal data that could put your anonymity at risk. Remove such data before sending. If you are unable to remove these data or are uncertain about how to do so, copy the text of your attachment into your report text or send the printed document anonymously to the address listed in the footer, citing the reference number received at the end of the reporting process.

Version: July 2020

Rules of Procedure for the Complaints Procedure under the German Supply Chain Due Dilligence Act

Preamble

Compliance with the German Supply Chain Due Diligence Act is a high priority at the SMS group. Violations must be identified at an early stage to ensure appropriate countermeasures can be taken and potential damage to customers, employees, business partners, the company and other affected parties can be averted.

This requires everyone's attention as well as your willingness to point out possible serious violations of the rules in the event of substantiated indications. We also attach importance to corresponding reports from business partners, customers and other third parties.

Within the framework of a transparent procedure, the complaints procedure protects the whistleblowers, the affected parties and the company. Uniform and fast processes as well as confidential and professional processing of reports through internal experts are the foundation of this system.

The complaints procedure enables any internal or external person to confidentially point out human rights or environmental risks or violations within the SMS group's supply chain or in their own division.

The most important information on the complaints procedure is presented below.

1 For what kind of complaints and reports can our complaints procedure be used?

Reports on serious violations of statutory and internal company rules that adversely affect the SMS group - including, in particular, human rights and environmental risks or obligations - can be submitted via the complaints procedure.

Human rights risks include, in particular, the violation of the prohibition of child labor, the violation of the prohibition of forced labor and all forms of slavery, the disregard of occupational health and safety and work-related health hazards, the disregard of the freedom of association and the right of collective bargaining, the violation of the prohibition of unequal treatment in employment, the violation of the prohibition of withholding an adequate living wage, the destruction of natural resources through environmental pollution, the unlawful violation of land rights, and the violation of the prohibition of hiring or using private/public security forces that may cause bodily harm due to a lack of instruction or control.

Environmental risks arise, in particular, in connection with mercury, persistent organic pollutants (POPs) and hazardous waste.

2 Who can submit complaints and reports?

The complaints procedure is accessible to everyone. Employees as well as persons and organizations outside the SMS group can submit complaints and reports here.

3 Which whistleblowing channels can be used to submit reports?

The following whistleblowing channels can be used to submit reports:

Via the Internet, an online whistleblowing system for submitting the complaint or report can be accessed at: https://www.bkms-system.com/sms-group. The report can be submitted either under a name or anonymously. The input mask is available in several languages. It can be accessed without any time restrictions. Whistleblowers may incur telecommunications costs when using the Internet.

If whistleblowers use the aforesaid online tool to submit a complaint or report, they can set up a postbox. Whistleblowers will receive feedback via this postbox, they can answer questions and are generally informed about the progress of their reports. When setting up the postbox, whistleblowers select their own pseudonym/user name and password.

Complaints can also be made by post or by internal mail to the person appointed by the company [complaints officer] at the following address

SMS GmbH – Compliance

Wiesenstrasse 30, D-57271 Hilchenbach

or

via e-mail at compliance@sms-group.com

4 How will my report be handled? Who will know about it?

Regardless of the communication channel chosen by whistleblowers, we treat all reports confidentially. However, we are required to comply with any legal obligations to provide information to authorities and any legal exceptions to the confidentiality obligation.

The confidentiality of a whistleblower's identity is maintained throughout the process. This also includes persons who are the subject of a report and any other persons named in the report. Unauthorized employees are denied access to the reporting channels.

All information shall be processed, taking into account the principle of confidentiality, by an employee assigned by the company to implement the complaints procedure. The persons appointed by the company to implement the complaints procedure are impartial, i.e. they are independent in the performance of their duties and are not bound by instructions.

Personal information that enables identification may only be disclosed on a "need to know basis" if this information is necessary to investigate the report and consistent with data protection requirements. The reports are processed within the framework of the applicable data protection regulations.

Unnecessary exposure and reputational damage must be avoided. Observe the regulations in point 7.

5 What happens after I have submitted my report?

If a complaint is received via the reporting channels, its receipt is documented internally.

Confirmation of receipt

Regardless of the communication channel chosen, whistleblowers will receive confirmation of receipt no later than seven days after receipt of their report, provided that communication is possible. This may be done in writing, by e-mail or electronically via the digital whistleblowing system, depending on the communication channel chosen.

Utilization of the digital whistleblowing system

If you have submitted a report through our digital whistleblowing system, you can set up a postbox. Please write down the user name and password and keep them safe. You can submit additional information and communicate with the complaints officers at any time via the postbox.

Substantiation

The employees entrusted with the implementation of the complaints procedure shall examine the facts communicated with the submitted complaint. The complaint received is classified and prioritized according to topic and severity.

If an investigation is not possible due to a lack of sufficient information, the employee entrusted with the implementation of the complaints procedure will contact the whistleblower to request further information, if possible.

If neither sufficient fact-based information is available nor contact can be made, the compliance case will be closed due to a lack of substantiation.

Assessment/Investigation

The employee entrusted with the implementation of the complaints procedure shall fully assess the facts of the case and ensure that all reports are appropriately investigated. The facts of the case will be discussed with the person who submitted the report, but in the case of anonymous reports only to the extent possible. If necessary, the case will be forwarded to another responsible department for processing and clarification.

The employees entrusted with the implementation of the complaints procedure are bound by the principle of confidentiality, are impartial and are not bound by instructions. Furthermore, they are obliged to comply with data protection regulations and to ensure transparency and the rights of all data subjects. This includes the protection of the whistleblower.

If, after clarification of the facts, discussion and investigation, the employee entrusted with the implementation of the complaints procedure is convinced that there are no human rights or environmental risks or violations of human rights or environmental obligations in the company's own division or at supplier facilities, the person submitting the report will be informed of this in writing or by e-mail. The procedure will be closed in this case.

If the investigation confirms human rights and environmental risks or violations of human rights or environmental obligations in the company's own division and at supplier facilities, appropriate follow-up measures (preventive and remedial measures) shall be initiated by the unit responsible in the company. This may include appropriate disciplinary action on a case-by-case basis.

In exchange with the whistleblower, a proposal for remedial action can be prepared.

The processing time depends on the actual case and can take from a few days to several months, based on the complexity of the case. However, the company will make every effort to complete processing in a timely manner.

The whistleblower will be notified of the conclusion of the complaints procedure, if possible.

6 Optional procedure for an amicable settlement of disputes

The company is free to also offer a procedure for an amicable settlement of disputes, in particular an arbitration or mediation process, at any stage of the complaints procedure. The whistleblower is free to participate in this procedure for an amicable settlement of disputes. Details of the procedure for an amicable settlement of disputes shall be discussed jointly by the parties involved and regulated in an agreement to be concluded separately.

7 What right do I have to raise compliance concerns?

The company will ensure that employees who have raised suspected or actual misconduct relevant to the German Supply Chain Due Diligence Act (LkSG) in good faith are protected from any intimidation or reprisals, even if the reported suspicion is not confirmed. "In good faith" means that the person is convinced that the report is true, whether or not a subsequent investigation confirms the report. Knowingly making a false report of a violation of the German Supply Chain Due Diligence Act (LkSG) with the intent to intentionally and untruthfully incriminate another person constitutes a compliance violation and will be subject to appropriate action.

Intimidation and reprisals against employees who report actual or suspected misconduct in good faith will not be tolerated.

If you feel that you are experiencing intimidation or reprisals as a result of reporting concerns regarding the German Supply Chain Due Diligence Act (LkSG), please contact Global Support Function Compliance.

Compliance concerns involving intimidation or reprisals after submitting a report regarding the German Supply Chain Due Diligence Act (LkSG)

will also be investigated using the principles outlined above.

Insofar as the whistleblowers affected are employees of a direct supplier, the company shall endeavor to make appropriate contractual arrangements with the supplier.

Das Unternehmen stellt sicher, dass Mitarbeitende, die ein vermutetes oder tatsächliches LkSG relevantes-Fehlverhalten in gutem Glauben angesprochen haben, vor allen Einschüchterungen oder Repressalien geschützt sind, auch wenn sich der gemeldete Verdacht nicht bestätigt hat. „In gutem Glauben“ bedeutet, dass die Person überzeugt ist, dass die Darstellung der Wahrheit entspricht, unabhängig davon, ob eine spätere Untersuchung diese Darstellung bestätigt oder nicht. Eine wissentliche Falschmeldung über einen LkSG-Verstoß mit dem Ziel, eine andere Person vorsätzlich und wahrheitswidrig zu beschuldigen, stellt einen Compliance-Verstoß dar und wird mit angemessenen Maßnahmen geahndet.

8 Which department is responsible for the complaints procedure in the company?

Global Support Function Compliance is responsible for the complaints procedure.

Compliance affects all of us – Do your part!