AppStd/EnvelopeGenerator
8
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

refactor(privacy-policy): remove 6. Hinweisgebersystem

Browse Source
This commit is contained in:
tekh
2025-11-20 16:46:31 +01:00
parent a3b12a6957
commit 140d271b28
2 changed files with 0 additions and 259 deletions
Download Patch File Download Diff File Expand all files Collapse all files

127
EnvelopeGenerator.Web/wwwroot/privacy-policy.en-US.html
View File

@@ -153,133 +153,6 @@
<a href="https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html">Laender-node.html</a>
</p>
</section>
<section>
<h2>6. Whistleblower System</h2>
<p>
Compliance with legal regulations and internal guidelines, including our Code of Conduct and the Code of
Conduct for Business Partners, is our (the data processing entity's) top priority. This applies both to our
own business operations and to our supply chains.
</p>
<p>
It is important to us to identify risks early and avoid violations. We aim to take appropriate measures in a
timely manner to prevent potential harm to affected persons, customers, employees, business partners, and
our corporate group.
</p>
<p>
For this reason, we have established an independent, neutral, and confidential whistleblower system that
enables internal and external whistleblowers to submit reports, including anonymously. Through our
transparent complaint procedure, we offer the greatest possible protection, especially to the affected
persons, whistleblowers, and employees involved in investigating reported incidents.
</p>
<p>
Under this procedure, any actual or alleged violations of legal requirements, our Code of Conduct, or the
Code of Conduct for Business Partners may be reported. Human rights or environmental risks, as well as
breaches of duty along the entire supply chain of our group companies and in our own business operations,
can also be the subject of a report.
</p>
<p>
Standardized and swift processes, as well as confidential and professional handling of the reports by
internal experts, form the basis of this fair procedure. Discrimination or punishment of whistleblowers and
individuals responsible for handling complaints and reports will not be tolerated.
</p>
<h3>6.1 Purpose and Legal Basis of Data Processing</h3>
<p>
The purpose of processing personal data is to manage the whistleblower system, which also includes
identifying serious violations or potential violations of applicable law and other serious matters. The
processing of this data is necessary to comply with legal obligations imposed on us, in accordance with Art.
6 para. 1 sentence 1 lit. c) GDPR. This refers to the law that enhances the protection of whistleblowers
(Whistleblower Protection Act - HinSchG).
</p>
<p>
Additionally, the processing serves the legitimate interest of identifying serious violations or potential
violations of applicable law and other serious matters, in accordance with Art. 6 para. 1 sentence 1 lit. f)
GDPR.
</p>
<p>
Regarding the processing of special categories of personal data, this is necessary based on the
Whistleblower Protection Act for reasons of significant public interest, in accordance with Art. 9 para. 2
lit. g) GDPR. The processing of such special data is carried out in accordance with Art. 9 para. 2 lit. f)
GDPR in conjunction with Art. 6 para. 1 sentence 1 lit. f) GDPR to establish, exercise, or defend legal
claims.
</p>
<p>
Affected persons are those about whom a report is made. These can be employees, contractors, or other
individuals in a business relationship with the data processing entity. Furthermore, we process personal
data of the whistleblower if they provide their contact details or other identifying information.
Whistleblowers should be aware that we may process personal data about them during the handling of the
reported case.
</p>
<h3>6.2 Categories of Personal Data</h3>
<p>
Reports can be made anonymously, in which case no personal data of the reporting person will be processed.
The type of personal data processed depends on the information provided. If the reporting person provides
personal data about another individual, including the reported individual or persons, that data will also be
processed. The following categories of personal data may be processed:
</p>
<ul>
<li>General personal data (e.g., first name, last name, address, email address, phone number, etc.)</li>
<li>Personal data related to criminal convictions or suspicions</li>
<li>Special categories of personal data (information about racial or ethnic origin, political opinions,
religious or philosophical beliefs, trade union membership, health data, and information about a
person's sex life or sexual orientation)</li>
</ul>
<p>
We ask the reporting person to only provide information relevant to the case and to avoid reporting
sensitive information unless it is essential for handling the reported case.
</p>
<h3>6.3 Obligation to Provide Personal Data</h3>
<p>
It is not mandatory to provide the personal data mentioned in section 6.2, as anonymous reporting is also
possible. However, please note that we may be unable to process the report if no personal data is provided.
</p>
<h3>6.4 Recipients of Personal Data</h3>
<p>
Reports are logged in the system of the data processing entity as cases. After evaluation, these cases are
forwarded internally to the relevant departments, and follow-up actions may be initiated. If a report
involves one of the group companies of the data processing entity, the relevant cases are forwarded to the
responsible individuals at the respective company, who will then conduct an internal evaluation and take
action if necessary. When transferring personal data, the principle of data minimization is observed,
meaning only the data strictly necessary for handling the report is shared.
</p>
<p>
Personal data of the whistleblower will be shared with authorities when necessary to address serious
violations or issues, or to safeguard the right to defense of the affected persons. In other cases, personal
data of the whistleblower will only be shared with their consent. Data about persons other than the
whistleblower will only be shared in connection with the investigation of a reported case or to address
serious violations or issues.
</p>
<p>
The reporting platform is provided by the processor WhistleB Whistleblowing Centre AB, based in Stockholm,
Sweden. Further information about WhistleB and the corresponding terms of use can be found at:
<a
href="https://report.whistleb.com/content/documents/whistleb_terms_of_use.pdf">whistleb_terms_of_use.pdf</a>
</p>
<h3>6.5 Retention Period</h3>
<p>
Personal data that is found to be irrelevant to the processing of a reported case, as well as reports deemed
unfounded, will be immediately classified as "not relevant." In this case, the personal reference is removed
unless the report was anonymous from the outset. To meet the legally required documentation obligations and
deletion periods pursuant to § 11 para. 1 and para. 5 HinSchG, the report is initially archived without
personal reference but is not yet deleted. Archived cases serve solely to fulfill these documentation
obligations and can no longer be used for further processing.
</p>
<p>
Reports and personal data collected during the processing of a report form the basis for further handling
and are anonymized as soon as possible. However, if it is necessary to take follow-up actions pursuant to §§
3 para. 8 and 18 HinSchG, it may be necessary to deviate from anonymization, whether due to official orders
or to protect legal claims. In such cases, pseudonymization is generally sought, unless other directives
apply, such as a court order. Documentation is deleted three years after the conclusion of the process, but
it may be retained longer if required to meet the requirements of this law or other legal provisions, as
long as it remains necessary and appropriate.
</p>
</section>
</body>
</html>