Rules of procedure for reports and complaints

You can select the type of complaint by clicking ‘Report’.

Here you can submit the following information/complaints:

1) Human rights violations
2) Environmental offenses
3) Complaints relating to the employment relationship
4) Reports

Points 1 and 2 (human rights violations and environmental offences) relate to breaches in accordance with the German Supply Chain Due Diligence Act (Supply Chain Due Diligence Act – LkSG) and are handled by our Human Rights Officer. This complaints procedure applies to the entire supply chain, i.e. also to our suppliers. The complaints procedure is open to any person or organisation that has relevant information on the breaches indicated.

Under Item 3 (complaints relating to the employment relationship) you can make a complaint about your working conditions if you are or were employed by our company. Such complaints will be handled by our HR department.

Point 4 refers to reports in accordance with the German Whistleblower Protection Act (HinSchG) which will be handled by our internal reporting office. The complaints procedure is open to any person who is employed by our company or works for us as a contract employee and has relevant information on breaches under the German Whistleblower Act (HinSchG).

Anonymity

You can, of course, submit your complaints completely anonymously. However, we would like to point out that we cannot confirm receipt in this case. You will also not receive a follow-up report.

However, if you are willing to provide us with your contact information, we guarantee that your submission will be treated confidentially and that you will not suffer any disadvantages as a result.

The benefits of providing your contact information are that you will receive a confirmation of receipt, you may receive inquiries from us regarding important details, and you will receive a final report on the process.

Requirements for reports and complaints:

• Describe the incident/breach as accurately as possible:

What exactly happened?

• Identify the people responsible:

Who committed the breach or initiated the incident?

• Tell us the specific time and location of the breach or incident:

When exactly and where exactly did the incident/breach occur?

• If other persons are also affected, please name the persons involved/affected, as these may be important witnesses: 

Who else was affected?

Who saw, heard, or witnessed the incident?

• If possible, please provide us with evidence that proves the misconduct of the person(s)

For example, photos, witness statements, medical reports, etc.

• Please provide your contact information in case we have any questions.

Processing of reports/complaints:

1. Receipt of a report

We will confirm receipt of a report within seven working days at the latest. The confirmation may include questions regarding the facts of the case. The person submitting the report will be given the opportunity to share information, where any additional questions can also be addressed. 

2. Reviewing the report

The report will be checked internally by the responsible contact persons. Investigations will be carried out into the circumstances described. As long as a breach cannot be confirmed, the person responsible will be presumed innocent. We continue to attach great importance to fair treatment, both of whistleblowers and the individuals concerned. We always strive to maintain proportionality in our investigations.  

3. Conclusion of investigations

As a result of the investigations, preventive or remedial measures will be initiated where necessary.

4. Closing report

At the end of the investigations, but at the latest after three months, a closing report will be drawn up and sent to the individuals concerned and the whistleblower. 

5. Discontinuation of the processing of a complaint or report

If the reported incident or breach is not confirmed by our investigations, the whistleblower will be informed of the reasons for discontinuing the investigation of the complaint. Reasons for this may include reports that are knowingly false or a lack of sufficient information to justify a suspicion.  

Whistleblower system in accordance with the German Whistleblower Protection Act (HinSchG)

In accordance with our legal obligation, we have established a whistleblower system on our website. Our employees and visitors to our website—who may include customers, suppliers, contacts, and service providers (external parties) as well as interested parties—can use the whistleblower system to report possible violations of legal requirements or internal regulations (‘breaches of rules and regulations’) (‘whistleblowing’) and thereby contribute to their investigation and prosecution.

We hereby inform you, in accordance with Articles 13 and 14 of the GDPR, about the processing of your personal data (‘data’) within the scope of our whistleblower system. We will process personal data within the scope of the whistleblower system only in accordance with applicable data protection regulations. These regulations are set forth in particular in the GDPR and the German Federal Data Protection Act (BDSG). This Privacy Notice contains further explanations regarding data processing for the purpose of registering and investigating reports received through the whistleblower system (‘investigative measures’). It supplements our general Privacy Policy.

• Who is responsible for processing your data?

We are responsible for processing your data as defined in Article 4(7) GDPR.

Depending on the type and scope of the measures required, we may entrust service providers, who are not bound by instructions, with the specific implementation of the investigatory measures. These service providers may include auditors, law firms or tax consultants. In this case, the service providers often act as individual data controllers as defined in Article 4(7) GDPR.

• Background information regarding the processing of your data

We are required to ensure compliance with applicable laws in the course of our business operations. This applies, for example, to provisions of criminal law, regulatory offense law, tax law, data protection law, employment law, antitrust law, and other binding legal provisions. If we do not sufficiently comply with these legal requirements, there is a risk of adverse consequences such as financial penalties or imprisonment, fines, claims for damages, or damage to our reputation. To fulfill our legal obligations, we therefore take appropriate measures to ensure compliance with legal provisions and internal company regulations. These measures include the implementation and operation of a whistleblower system.

Our employees are required to report any potential violations of rules and regulations to us. Employees and external parties who report a potential violation of rules and regulations (‘whistleblowers’) may use internal and external channels to report such violations. We have taken appropriate measures to ensure that the reports we receive are followed up on promptly and effectively. In particular, we ensure—during the course of any investigative measures—that the legitimate interests of the individuals affected by the reports or named in the reports (‘data subjects’) are protected.

•  For what purposes do we process your data?

We process your data in accordance with applicable laws, specifically for the following investigative purposes:

• Verifying the plausibility of reports: Before taking any investigative steps, we will verify, among other things, whether the information provided by the whistleblower appears plausible and indicates a violation of our rules and regulations by us or our employees. The processing of your data serves, among other things, the purpose of this plausibility check.
• Investigation of Misconduct: Investigative measures may be used to detect and investigate possible breaches of contractual obligations or criminal offenses committed by our employees in the performance of their official duties, as well as other violations of rules and regulations and irregularities within the company. These include, for example, the detection and punishment of fraud, tax offenses, money laundering, or other economic crimes, as well as violations of our Code of Conduct and codes of practice.
• Compliance with Legal Obligations: We are subject to comprehensive legal oversight obligations. These obligations arise, among other things, from Sections 130 and 30 of the German Administrative Offenses Act (OWiG). Investigative measures are intended to ensure compliance with these and other legal obligations. For example, we conduct investigative measures to ensure that our services comply with legal and regulatory requirements.
  • Prevention of future misconduct: Furthermore, the results of the investigative measures—to the extent that they are appropriate—are also incorporated into general preventive measures (such as training) and thus help prevent or make it more difficult for our employees to violate their duties under their employment contract or commit crimes in the future.
  • Exercising rights: Investigative measures can also serve to mitigate and prevent imminent economic or other harm or disadvantages to us, and thus to effectively defend, exercise, and enforce our rights. For example, we may use the results and information obtained through investigative measures in employment tribunal proceedings or other legal disputes.
  • Exoneration of employees: In consultation with the respective data subject, we will also take appropriate measures to investigate possible allegations against employees who are wrongly suspected of having committed an offense and to exonerate them (‘rehabilitation’).
  • Implementation of obligations to cooperate: We may be required to forward data collected in the course of investigative measures to law enforcement authorities or other authorities due to legal obligations to cooperate. This may be the case, for example, if a law enforcement authority initiates a criminal investigation against a data subject as a result of an investigative measure. In addition, the purposes stated in the general Privacy Policy for the employment relationship may also be considered as possible purposes of data processing.
• Which data or categories of data are affected by investigative measures?

As part of our investigative procedures, we may process the following data or categories of data about you:

• Data relating to reports: As part of the whistleblower procedure, we record, among other things, the time, content, and other relevant circumstances related to reports submitted by whistleblowers. For example, we will record whether the whistleblower submitted the report through an internal or external reporting channel. If a whistleblower discloses their identity as part of a report, we will also record this.
  • Operational data: We may also process operational information about you as part of investigative measures (for example, your position in the company, job title, whether you are a supervisor, business email address, and business phone number).
  • Information on Relevant Facts: Typical investigative measures often pertain to specific facts. The identification and assessment of relevant information regarding these facts may lead to conclusions about your behavior or the actions you have taken. In some cases, this may also include breaches of duty or criminal offenses.
  • Business-related documents: We will also review business-related documents as part of our investigative measures, when necessary. In specific cases, these may include timesheets or hourly timesheets, contracts, performance records, logbooks, or invoices. These documents may also contain your personal data.
  • Communication behavior: In addition, investigative measures may allow us to draw conclusions about your communication behavior when using our contact options or our internal communication systems. For example, we may also access the contents of emails in employees’ company inboxes or your email correspondence with us for the purpose of email analysis. In addition, we will, to the extent necessary, evaluate log data or metadata.
  • Personal data: We may process your general personal data as part of investigatory measures (for example, name, home address, home phone number, personal email address).
  • Private content: In certain cases, the data records to be evaluated may also allow conclusions to be drawn about private content relating to you. This may be the case, for example, if a report submitted by a whistleblower contains such content. However, we will take appropriate technical and organizational measures to ensure that data records containing purely private content are not evaluated.
  • Data on criminal convictions and offenses: As part of our investigative measures, we may also need to collect data about you that allows us to draw conclusions regarding criminal offenses or criminal convictions involving you. However, we will only process this data in accordance with the relevant data protection regulations, in particular Article 10 of the GDPR.
  • Special categories of personal data: In individual cases, we may also collect special categories of personal data, as defined in Article 9(1) of the GDPR, as part of investigative measures. This may be the case, for example, if a report submitted by a whistleblower contains such data. Special categories of personal data include, for example, health data, data on potential union membership, biometric data, or data on political or religious affiliations. We will only process such data in accordance with the relevant data protection regulations, in particular in accordance with Article 9(2) of the GDPR or, if employees are involved, Section 26(3) of the German Federal Data Protection Act (BDSG).
• On what legal basis do we process your data?

We will only process your data as part of investigative measures to the extent permitted under at least one applicable data protection regulation. This includes, in particular, the provisions of the GDPR, the BDSG, and other relevant legislation. We may base permissible data processing as part of investigative measures, in particular, on the following legal grounds:

• Implementation of the employment relationship (Section 26(1)(1) BDSG): Data processing as part of investigative measures may be necessary, among other things, for the performance and termination of the employment relationship with our employees. This applies, for example, to investigative measures aimed at uncovering breaches of duties under employment contracts that do not constitute a criminal offense. Investigative measures may also be necessary for the performance of employment relationships. This may be the case, for example, if we impose sanctions under employment law against a data subject based on findings made as part of an investigative measure.
  • Investigation of criminal offenses (Section 26(1)(2) BDSG): If investigative measures are intended to uncover possible criminal offenses in the context of employment relationships, they may be justified in accordance with Section 26(1)(2) BDSG. However, we will only base the corresponding data processing on Section 26(1)(2) BDSG if documented, concrete evidence justifies the suspicion of a criminal offense within the employment relationship and the interests of the data subject do not take precedence.
  • Implementation of legal obligations (Article 6(1)(c) of the GDPR): As previously mentioned, we are subject to comprehensive legal oversight obligations. The investigative measures we carry out therefore also serve, among other things, to ensure compliance with these legal obligations.
  • Protection of legitimate interests (Article 6(1)(f) of the GDPR): We may also process your data in order to protect our legitimate interests or those of a third party. These legitimate interests may include, among other things:
    • Legal defense: One of the reasons we conduct investigative measures is to prevent harm to our company. In this regard, data processing may also serve our legitimate interests in the form of asserting, defending, and exercising legal claims.
    • Support for data subjects: Investigative measures can also serve to alleviate the burden on data subjects. This essentially constitutes a legitimate interest of a third party.
• To which parties will we transfer your data?

We will only transfer your data to third parties as part of investigative measures if there is a valid legal basis or if we have obtained your prior consent to the respective data transfer. We may disclose your data to the following recipients:

• Courts, authorities and other public bodies: We may also disclose the outcomes of investigatory measures to public authorities. This may involve German or foreign public prosecutors, courts or other authorities. Such disclosure may be necessary in particular if we are legally obliged to disclose the relevant data. This may be the case, for example, in the context of criminal investigations that are initiated as a result of investigatory measures.
  • Service providers: In addition to promota.de GmbH, we may also use the support of external service providers, such as law firms or auditing companies, when carrying out investigatory measures. We will take appropriate measures to ensure that these service providers process your data only in accordance with the applicable data protection regulations.
  • Other third parties: To the extent necessary to fulfil the purposes stated in this Privacy Notice and provided that no conflicting interests of data subjects meriting protection prevail, your personal data may also be transferred to opposing parties or insurance companies. If we have not collected your personal data directly from you, we will typically receive it from the entities mentioned above in this section of the Privacy Notice, as well as from business partners or similar sources.
• What data protection rights do you have?

As a data subject, you can exercise various data protection rights. In order to exercise your rights, you can contact us using the contact details above.

The rights of data subjects include in particular:

• Right of access (Article 15 GDPR);
  • Right to rectification (Article 16 GDPR);
  • Right to erasure (Article 17 GDPR);
  • Right to restriction of processing (Article 18 GDPR);
  • Right to lodge a complaint with a data protection supervisory authority.
• How long do we store your data?

We will store or delete data collected in the context of investigating reports in accordance with the relevant data protection regulations, in particular Article 17 GDPR. This means that we will generally delete your data if the data are no longer required for the purposes stated in this Privacy Notice.

However, statutory retention requirements or our legitimate interests may justify longer retention of your data. For example, we may continue to retain your data during ongoing legal disputes that are the result of possible investigatory measures.

The storage periods are determined in each individual case according to our interest in retention, taking into account the importance of retention for us, the legitimate interests of data subjects in erasure and the likelihood that a suspicion reported in the whistleblower system proves to be correct.

• To what extent are automated individual decision-making or profiling measures taken?

Neither automated individual decision-making nor profiling measures within the meaning of Article 22 GDPR take place in the context of investigatory measures.