Rules of procedure for reports and complaints

You can select the type of complaint by clicking ‘Report’.

Here you can submit the following information/complaints:

1) Human rights violations
2) Environmental offences
3) Complaints relating to the employment relationship
4) Reports

Points 1 and 2 (human rights violations and environmental offences) relate to breaches in accordance with the German Supply Chain Due Diligence Act (Lieferkettensorgfaltspflichtengesetz – LkSG) and are handled by our Human Rights Officer. This complaints procedure applies to the entire supply chain, i.e. also to our suppliers. The complaints procedure is open to any person or organisation that has relevant information on the breaches indicated.

Under point 3 (complaints relating to the employment relationship) you can make a complaint about your working conditions if you are or were employed by our company. Such complaints will be handled by our HR department.

Point 4 refers to reports in accordance with the German Whistleblower Protection Act (HinSchG) which will be handled by our internal reporting office. The complaints procedure is open to any person who is employed by our company or works for us as a contract employee and has relevant information on breaches under the German Whistleblower Act (HinSchG).

Anonymity

You can of course submit your complaints completely anonymously. However, we would like to point out that we cannot confirm receipt in this case. You will also not receive a closing report.

However, if you are willing to provide us with your contact details, we guarantee that your submission will be treated confidentially and that you will not suffer any disadvantages as a result.

The advantages of providing contact details are that you will receive a confirmation of receipt, you may receive queries from us on important details and you will get a closing report on the procedure.

Requirements for reports/complaints:

• Describe the incident/breach as accurately as possible:

What happened exactly?

• Name the people responsible:

Who committed the breach or initiated the incident?

• Tell us the specific time and place of the breach or incident:

When exactly and where exactly did the incident/breach occur?

• If other persons are also affected, please name the persons involved/affected, as these may be important witnesses: 

Who else was affected?

Who saw, heard or witnessed the incident?

• If possible, provide us with evidence that proves the misconduct of the person(s)

For example, photos, witness statements, medical reports, etc.

• Please provide your contact details for any queries.

Processing of reports/complaints:

1. Receipt of a report

Receipt of a report will be confirmed within seven working days at the latest. The confirmation may contain possible queries about the facts of the case. The person submitting the report will be given the opportunity to share information, where further questions can also be clarified. 

2. Checking the report

The report will be checked internally by the responsible contact persons. Investigations will be carried out into the circumstances described. As long as a breach cannot be confirmed, the person responsible will be presumed innocent. We continue to attach great importance to fair treatment, both of whistleblowers and the individuals concerned. We always strive to maintain proportionality in our investigations.  

3. Conclusion of investigations

As a result of the investigations, preventive or remedial measures will be initiated where necessary.

4. Closing report

At the end of the investigations, but at the latest after three months, a closing report will be drawn up and sent to the individuals concerned and the whistleblower. 

5. Discontinuation of processing of a complaint/report

If the reported incident or breach is not confirmed by our investigations, the whistleblower will be informed of the reasons for discontinuing the processing of the complaint. Reasons for this may be that reports are knowingly false or not enough information is available to justify a suspicion.  

Whistleblower system in accordance with the German Whistleblower Protection Act (HinSchG)

In accordance with our legal obligation, we have set up a whistleblower system on our website. Our employees and visitors to our website, who may be customers, suppliers, contact persons and service providers (external parties) as well as interested parties, can use the whistleblower system to inform us of possible breaches of legal requirements or internal regulations (‘breaches of rules and regulations’) (‘whistleblowing’) and thereby contribute to their investigation and prosecution.

We hereby inform you in accordance with Articles 13, 14 GDPR about the processing of your personal data (‘data’) within the scope of our whistleblower system. We will only process personal data within the scope of the whistleblower system in accordance with applicable data protection regulations. These regulations are set out in particular in the GDPR and the German Federal Data Protection Act (BDSG). This Privacy Notice contains further explanations on data processing for the purpose of registering and investigating reports received via the whistleblower system (‘investigatory measures’). It supplements our general Privacy Policy.

• Who is responsible for processing your data?

We are responsible for processing your data as defined in Article 4(7) GDPR.

Depending on the type and scope of the measures required, we may entrust service providers, who are not bound by instructions, with the specific implementation of the investigatory measures. These service providers may include auditors, law firms or tax consultants. In this case, the service providers often act as individual data controllers as defined in Article 4(7) GDPR.

• Background information regarding the processing of your data

We are required to ensure compliance with applicable laws in the course of our business operations. This applies, for example, to provisions of criminal law, regulatory offences law, tax law, data protection law, employment law, antitrust law and other binding legal provisions. If we do not sufficiently comply with these legal requirements, there is a risk of disadvantages such as financial penalties or imprisonment, fines, claims for damages or damage to our reputation. In order to fulfil our legal obligations, we therefore take appropriate measures to ensure compliance with legal provisions or internal company regulations. These measures include the introduction and operation of a whistleblower system.

Our employees are obliged to inform us of possible breaches of rules and regulations. Employees and external parties who report a possible breach of rules and regulations (‘whistleblowers’) can use internal and external channels to report possible breaches. We have taken appropriate measures to ensure that the reports we receive are followed up promptly and effectively. We ensure in particular, in the course of the investigatory measures to be taken, that the legitimate interests of the persons affected by the reports or named in the reports (‘data subjects’) are safeguarded.

•  For what purposes do we process your data?

We process your data within the scope of applicable laws, in particular for the following specific investigatory purposes:

• Checking the plausibility of reports: Before initiating investigatory measures, we will check, among other things, whether the information provided by the whistleblower appears plausible and indicates a breach of rules and regulations by us or our employees. The processing of your data serves, among other things, the purpose of this plausibility check.
• Investigation of misconduct: Investigatory measures can be used to detect and investigate possible breaches of contractual obligations or criminal offences committed by our employees in the performance of their official duties as well as other breaches of rules and regulations and irregularities within the company. These include for example, the detection and sanctioning of fraud, tax offences, money laundering or other economic crimes or breaches of our Code of Conduct and codes of practice.
• Implementation of legal obligations: We are subject to comprehensive legal supervisory obligations. These result, among other things, from Sections 130 and 30 of the German Administrative Offences Act (OWiG). Investigatory measures are intended to implement these and other legal obligations. For example, we carry out investigatory measures to ensure that our services meet legal and regulatory requirements.
  • Prevention of future misconduct: Furthermore, the outcomes of the investigatory measures – insofar as they are appropriate – are also incorporated into general preventive measures (for example, training) and thus help to prevent or make it more difficult for our employees to violate their duties under their employment contract or commit crimes in the future.
  • Exercising rights: Investigatory measures can also serve to compensate for and ward off imminent economic or other damage or disadvantages for us and thus to effectively defend, exercise and enforce rights. For example, we may use the results and information obtained through investigatory measures in the context of employment tribunal proceedings or other legal disputes.
  • Relief of employees: In consultation with the respective data subject, we will also take appropriate measures to investigate possible accusations against employees who are wrongly suspected of having committed an offence and to relieve the burden on them (‘rehabilitation’).
  • Implementation of obligations to cooperate: We may be obliged to forward data collected in the course of the investigatory measures to law enforcement authorities or other authorities due to legal obligations to cooperate. This may be the case, for example, if a law enforcement authority initiates a criminal investigation against a data subject as a result of an investigatory measure. In addition, the purposes stated in the general Privacy Policy for the employment relationship can also be considered as possible purposes of data processing.
• Which data or data categories are affected by investigatory measures?

As part of investigatory measures, we may process the following data or categories of data about you:

• Data relating to reports: As part of the whistleblower procedure, we record, among other things, the time, content and other relevant circumstances in relation to reports provided by whistleblowers. For example, we will record whether the whistleblower submitted the report via an internal or external reporting channel. If a whistleblower discloses their identity as part of a report, we will also record this.
  • Operational data: We may also process operational information about you as part of investigatory measures (for example, position in the company, job title, possible supervisor position, business email address, business phone number).
  • Information on relevant facts: Typical investigatory measures often refer to concrete facts. The determination and evaluation of relevant information on the respective facts may allow conclusions to be drawn about your behaviour or actions taken by you. In individual cases, this may also include breaches of duty or criminal offences.
  • Business-related documents: We will also evaluate business-related documents as part of our investigatory measures, where necessary. In individual cases, these may include time sheets or hourly time sheets, contracts, performance records, logbooks or invoices. These documents may also contain your personal data.
  • Communication behaviour: In addition, investigatory measures may allow conclusions to be drawn about your communication behaviour when using our contact options or our internal communication systems. For example, we may also access the contents of emails in employees’ company in-boxes or your email communication with us for the purpose of email analysis. In addition, we will, to the extent necessary, evaluate log data or metadata.
  • Personal data: We may process your general personal data as part of investigatory measures (for example, name, home address, home phone number, personal email address).
  • Private content: In individual cases, the data records to be evaluated may also allow conclusions to be drawn about private content relating to you. This may be the case, for example, if a report submitted by a whistleblower contains such content. However, we will take appropriate technical and organisational measures to ensure that data records with purely private content are not evaluated.
  • Data on criminal convictions and offences: As part of investigatory measures, we may also have to collect data about you that allows conclusions to be drawn about criminal offences or criminal convictions affecting you. However, we will only process these data in accordance with the relevant data protection regulations, in particular Article 10 GDPR.
  • Special categories of personal data: In individual cases, we may also collect special categories of personal data as defined in Article 9(1) GDPR as part of investigatory measures. This may be the case, for example, if a report submitted by a whistleblower contains such data. Special categories of personal data include, for example, health data, data on possible union membership, biometric data or data on political or religious affiliations. We will only process such data in accordance with the relevant data protection regulations, in particular in accordance with Article 9(2) GDPR or, if employees are involved, Section 26(3) of the German Federal Data Protection Act (BDSG).
• On what legal basis do we process your data?

We will only process your data as part of investigatory measures to the extent permitted under at least one applicable data protection regulation. This includes in particular the provisions of the GDPR, the BDSG and other relevant legislation. We can base permissible data processing as part of investigatory measures in particular on the following legal bases:

• Implementation of the employment relationship (Section 26(1)(1) BDSG): Data processing as part of investigatory measures may be necessary, among other things, for the performance and termination of the employment relationship with our employees. This applies, for example, to investigatory measures to uncover breaches of duties under employment contracts that do not constitute a criminal offence. Investigatory measures may also be necessary for the performance of employment relationships. This may be the case, for example, if we impose sanctions under employment law against a data subject based on findings made as part of an investigatory measure.
  • Investigation of criminal offences (Section 26(1)(2) BDSG): If investigatory measures serve to uncover possible criminal offences in the context of employment relationships, they may be justified in accordance with Section 26(1)(2) BDSG. However, we will only base the corresponding data processing on Section 26(1)(2) BDSG if documented actual indications justify the suspicion of a criminal offence in the employment relationship and the interests of the data subject are not overriding.
  • Implementation of legal obligations (Article 6(1) c) GDPR): As already mentioned, we are subject to comprehensive legal supervisory obligations. The investigatory measures we carry out therefore also serve, among other things, to ensure compliance with these legal obligations.
  • Protection of legitimate interests (Article 6(1) f) GDPR): We may also process your data in order to protect our or a third party’s legitimate interests. These legitimate interests may include among other things:
    • Legal defence: One of the reasons why we carry out investigatory measures is to prevent damage to our company. In this respect, data processing can also serve our legitimate interests in the form of the assertion, defence and exercise of legal claims.
    • Support for data subjects: Investigatory measures can also serve to relieve the burden on data subjects. This is basically a legitimate interest of a third party.
• To which parties will we transfer your data?

We will only transfer your data to third parties as part of investigatory measures if there is a valid legal basis or if we have obtained your prior consent to the respective data transfer. We may disclose your data to the following recipients:

• Courts, authorities and other public bodies: We may also disclose the outcomes of investigatory measures to public authorities. This may involve German or foreign public prosecutors, courts or other authorities. Such disclosure may be necessary in particular if we are legally obliged to disclose the relevant data. This may be the case, for example, in the context of criminal investigations that are initiated as a result of investigatory measures.
  • Service providers: In addition to promota.de GmbH, we may also use the support of external service providers, such as law firms or auditing companies, when carrying out investigatory measures. We will take appropriate measures to ensure that these service providers process your data only in accordance with the applicable data protection regulations.
  • Other third parties: To the extent necessary to fulfil the purposes stated in this Privacy Notice and provided that no conflicting interests of data subjects meriting protection prevail, your personal data may also be transferred to opposing parties or insurance companies. If we have not collected your personal data directly from you, we will typically receive it from the entities mentioned above in this section of the Privacy Notice, as well as from business partners or similar sources.
• What data protection rights do you have?

As a data subject, you can exercise various data protection rights. In order to exercise your rights, you can contact us using the contact details above.

The rights of data subjects include in particular:

• Right of access (Article 15 GDPR);
  • Right to rectification (Article 16 GDPR);
  • Right to erasure (Article 17 GDPR);
  • Right to restriction of processing (Article 18 GDPR);
  • Right to lodge a complaint with a data protection supervisory authority.
• How long do we store your data?

We will store or delete data collected in the context of investigating reports in accordance with the relevant data protection regulations, in particular Article 17 GDPR. This means that we will generally delete your data if the data are no longer required for the purposes stated in this Privacy Notice.

However, statutory retention requirements or our legitimate interests may justify longer retention of your data. For example, we may continue to retain your data during ongoing legal disputes that are the result of possible investigatory measures.

The storage periods are determined in each individual case according to our interest in retention, taking into account the importance of retention for us, the legitimate interests of data subjects in erasure and the likelihood that a suspicion reported in the whistleblower system proves to be correct.

• To what extent are automated individual decision-making or profiling measures taken?

Neither automated individual decision-making nor profiling measures within the meaning of Article 22 GDPR take place in the context of investigatory measures.