Privacy Policy for the Law on Better Protection of Informants (Whistleblower Protection Act - HinSchG)
Manning GmbH (hereinafter referred to as "we") operates an internal reporting point that individuals can turn to if they have obtained information about violations in connection with their professional activity or in anticipation of professional activity, and they can report or disclose such violations to the reporting points provided for by this law (hereinafter referred to as "informants").
For the operation of the internal reporting point, we process personal data of informants, individuals who are the subject of a report, and potentially other individuals named in a report (hereinafter collectively referred to as "you"). With this privacy policy, we inform you about the personal data we process for the operation of the internal reporting point.
1. Purpose of Processing: Operation of the Internal Reporting Point and Reports of Violations under the HinSchG
1.1 We operate an internal reporting point (internal reporting point) that we have established in accordance with § 12 (1) HinSchG, to which you can turn. This reporting point operates reporting channels through which you can contact the reporting point to report information about specific violations under the HinSchG.
Your reports can be made in text form via email. The internal reporting point reviews the violation and, if necessary, takes appropriate follow-up actions such as internal investigations, referrals to a unit responsible for internal investigations, or to a relevant authority.
2. Categories of Personal Data and Legal Basis
2.1 For the operation of the internal reporting point, we collect and process, in particular, the following personal data:
2.1.1 If you are an informant reporting to the internal reporting point:
- Information about the violations reported by the informant,
- Information about your identity, such as first and last names, contact details, and address, if provided,
- Other data, if necessary for the investigation of the report, such as data from your personnel file, such as your workplace, your supervisor, your colleagues,
- Documentation of your incoming reports in a permanently retrievable manner,
- Where necessary to fulfill the tasks of a reporting point: Personal data revealing racial and ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data for unique identification, or sexual orientation (special categories of personal data).
2.1.2 If you are the subject of a report by an informant or if you are mentioned in a report by an informant, especially if you could provide relevant information for internal investigations:
- Information about the violations reported by the informant,
- Information about your identity, such as your first and last names, contact details, and address, if provided,
- Documentation of the incoming report in a permanently retrievable manner,
- Other data, if necessary for the investigation of the report, such as data from your personnel file, such as your workplace, your supervisor, your colleagues,
- Where necessary to fulfill the tasks of a reporting point: Personal data revealing racial and ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data for unique identification, or sexual orientation (special categories of personal data).
2.2 We collect and process your personal data to fulfill our obligations under the HinSchG, insofar as this is necessary for the establishment and operation of an internal reporting point and its reporting channels (§ 12 HinSchG), to conduct the internal reporting process under § 17 HinSchG, and to take follow-up measures under § 18 HinSchG. In this case, the legal basis for the processing is § 10 (1) sentence 1 HinSchG in conjunction with Art. 6 (1) UAbs. 1 lit. c GDPR.
If the internal reporting point collects or processes personal data based on your consent, the legal basis for processing is Art. 6 (1) GDPR.
For the necessary collection and processing of special categories of personal data, the legal basis is § 10 (2) HinSchG in conjunction with Art. 9 (2) GDPR.
3. Disclosure to Third Parties
3.1 The internal reporting point maintains the confidentiality of your identity if you are the informant and the reported information pertains to violations, or if you had reasonable grounds to believe that this was the case at the time of reporting. The confidentiality of your identity is also maintained if you are the subject of a report by an informant or are otherwise mentioned in an informant's report.
Only individuals assisting in fulfilling these tasks have access to the incoming reports and the associated personal data.
3.2 Information about your identity as an informant or about other circumstances that allow conclusions to be drawn about your identity may be disclosed to the relevant authority in the following cases:
- In criminal proceedings at the request of law enforcement authorities,
- Pursuant to an order in administrative proceedings following a report, including administrative fine proceedings,
- Pursuant to a court decision.
The legal basis for this is § 9 (2) HinSchG in conjunction with Art. 6 (1) GDPR.
3.3 Information about your identity as an informant or about other circumstances that allow conclusions to be drawn about your identity may be disclosed if the disclosure is necessary for follow-up measures by the internal reporting point, and you, as an informant, have consented to the disclosure beforehand. The consent is given separately and in text form for each individual disclosure of your identity (§ 9 (3) sentence 2 HinSchG).
The legal basis for this is § 9 (3) HinSchG, in conjunction with Art. 6 (1) GDPR.
3.4 Information about your identity as a person, if you are the subject of a report or if you are mentioned in a report by an informant, may be disclosed:
- With your consent,
- By internal reporting points, if necessary for internal investigations within our organization,
- If necessary for taking follow-up measures,
- In criminal proceedings at the request of law enforcement authorities,
- Pursuant to an order in administrative proceedings following a report, including administrative fine proceedings,
- Pursuant to a court decision.
The legal basis for this is § 9 (4) HinSchG in conjunction with Art. 6 (1) GDPR, or in the case of your consent, Art. 6 (1) GDPR.
3.5 Personal data will not be transferred to third countries outside the European Economic Area (EEA) unless this is absolutely necessary for investigations or follow-up measures outside the EEA (Art. 49 (1) GDPR).
4. Duration of Storage, Deletion
Personal data collected and/or processed as part of a report, internal reporting point process, or follow-up measures will be deleted as soon as the purpose associated with the collection has been achieved or subsequently ceases, unless legal retention obligations prohibit deletion.
Any documentation (such as word or content logs and other documentation of reports) will be deleted three years after the completion of the process. Documentation may be retained for a longer period to fulfill the requirements of the HinSchG or other legal regulations, as long as this is necessary and proportionate. If an audio recording is used to create a protocol, the audio recording will be deleted once the protocol is completed.
5. Your Rights and Contact
You can request to access your personal data at any time, free of charge, and obtain information about their origin, recipients, or categories of recipients to whom this data is disclosed. You can also request the purpose of storage and, if necessary, request corrections, deletions, and/or restrictions on processing.
You also have the right to object to the processing of your data at any time if the processing is carried out to protect our legitimate interests. In this case, your data will only be processed if we can demonstrate compelling legitimate grounds for processing that outweigh your interests in discontinuing processing or if processing is necessary for the establishment, exercise, or defense of legal claims.
If the processing of your data is based on consent, you have the right to withdraw this consent at any time. In this case, we will no longer process your data unless permitted by law. The legality of the processing of your data before your withdrawal is not affected by your withdrawal.
If you have any questions, comments, or requests regarding the collection, processing, and use of your personal data by us, or to exercise your rights as mentioned above, please contact us via email at consent@manningglobal.com or by mail to: Manning GmbH, Hohenzollernstraße 60, 80801 München.
If you believe that the processing of your data violates data protection regulations, you have the right to lodge a complaint with a data protection authority. For example, you can contact the Bavarian State Office for Data Protection Supervision as the competent data protection authority for us at the following address:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
6. Data Protection Officer
Michel Dassen
Hohenzollernstrasse 60
80801 München
+49(0)174 168 6955
michel@manningglobal.com
