Information on the processing of your personal data when using the whistleblowing system BKMS®
We take data protection and confidentiality very seriously and adhere to the provisions of the EU General Data Protection Regulation (EU-GDPR) as well as current national data protection regulations. Please read this data protection information carefully before submitting a report.
Responsible controllers and data protection contact
The parties jointly responsible for data protection in the whistleblowing system BKMS
® are:
thyssenkrupp AG Thyssenkrupp Allee 1
45143 Essen
+49 201 844 0
whistleblowing@thyssenkrupp.com
and the thyssenkrupp group company jointly responsible in the relevant case.
Please be aware:Depending on the assessment of data protection responsibilities in accordance with national whistleblower protection laws, different data protection responsibilities may apply in other countries.
This may mean that thyssenkrupp AG has sole responsibility, or that thyssenkrupp AG acts as a processor for other thyssenkrupp group companies, or separate data protection responsibilities exist between thyssenkrupp AG and other thyssenkrupp group companies.
Questions on data protection can be sent to datenschutzbeauftragter@thyssenkrupp.com
The whistleblower system is operated on our behalf by a company specializing in this area, EQS Group GmbH, Karlstraße 47, D-80333 Munich.
Personal data
Personal data and information entered into the reporting system are stored in a database operated on behalf by EQS in a high-security data centre. Only the above mentioned controllers have access to the data. EQS and other third parties do not have access to the data. This is ensured in the certified process by comprehensive technical and organizational measures.
All data is stored in encrypted form with multi-level password protection and is subject to an authorisation concept so that access is restricted to a very narrow group of recipients who are expressly authorized.
Purpose of the whistleblowing system and legal basis
- The whistleblower system (BKMS® System) is used to receive, process and manage reports on compliance and legal violations in a secure and confidential manner. We process your personal data insofar as this is necessary for the fulfilment of legal obligations. This includes, in particular, notifications of facts relevant under criminal, competition and labor law (Art. 6 para. 1 lit. c GDPR in conjunction with the respective national implementation law for Directive (EU)2019/1937 (EU Whistleblowing Directive)).
Finally, your personal data is processed if this is necessary to protect the legitimate interests of the organization or a third party (Art. 6 para. 1 lit. f GDPR). We have a legitimate interest in processing the personal data for the prevention and detection of violations within the organization, for the verification of internal processes for their lawfulness and for maintaining the integrity of the organization.
Type of the collected personal data
Use of the whistleblowing system takes place on a voluntary basis. If you submit a report via the whistleblowing system, we collect the following personal data and information:
- your name, if you choose to reveal your identity,
- whether you are employed at a respective thyssenkrupp group company, and
- the names of persons and other personal data of you and of persons that you name in your report.
Confidential handling of reports
Incoming reports are received by a small selection of expressly authorised and specially trained employees of the Compliance department and are always handled confidentially. The employees of the Compliance department will evaluate the matter and perform any further investigation required by the specific case.
During the processing of a report, it may become necessary – where permitted by law – to share reports with additional employees or employees of other group companies, e.g., if the reports refer to incidents in subsidiaries. The latter may be based in countries outside the European Union or the European Economic Area with different regulations concerning the protection of personal data. We always ensure that the applicable data protection regulations are complied with when sharing reports.
All persons who receive access to the data are obligated to maintain confidentiality.
Information of the accused person
As a basic principle we are bound by law to inform the accused persons that we have received a report concerning them, unless this threatens further investigations into the report. In doing so, your identity as whistleblower is not revealed as far as is legally possible.
Rights of the data subjects
According to European data protection law, you and the persons named in the report have the right to inquiry, rectification, erasure, restriction of processing and the right to object to processing of personal data concerning them. If the right of objection is claimed, we will immediately examine to what extent the stored data is still necessary for the processing of a report. Data that is no longer required is deleted immediately. In addition, you have the right to lodge a complaint with a supervisory authority.
Retention period of personal data
Personal data is retained for as long as necessary to clarify the situation and perform an evaluation of the report or a legitimate interest of the above mentioned controllers exists, or it is required by law. After the report processing is concluded, this data is deleted in accordance with the statutory requirements.
Use of the reporting portal
Communication between your computer and the reporting system takes place over an encrypted connection (SSL). Your IP address will not be stored during your use of the reporting system. To maintain the connection between your computer and the BKMS
® System, a cookie is stored on your computer that merely contains the session ID (a so-called session cookie). This cookie is only valid until the end of your session and expires when you close your browser.
It is possible to set up a postbox within the reporting system that is secured with an individually chosen pseudonym/ username and password. This allows you to send reports to the responsible employee either by name or in an anonymous, safe way. This system only stores data inside the reporting system, which makes it particularly secure. It is not a form of regular e-mail communication.
Report submission via telephone
Your anonymity will also be protected by the BKMS
® System when you submit your report via telephone. Neither the above mentioned controllers nor EQS will have access to your telephone number. Your description of the incident will be recorded in the BKMS
® System. Afterwards, the encrypted sound file is transcribed by the responsible employee. If you have set up a secured postbox at the end of the report submission by telephone, you can receive feedback in the form of a voice recording by the responsible employee, and you can add information to your report, if necessary. Alternatively, you can access your secured postbox via the web application, review feedback, and make additions in written form. To protect the confidentiality of your report or addition, you can neither listen to it on your telephone nor in the web-based secured postbox.
Note on sending attachments
When submitting a report or an addition, you can simultaneously send attachments to the responsible employee. If you wish to submit an anonymous report, please take note of the following security advice: Files can contain hidden personal data that could compromise your anonymity. Remove this data before sending. If you are unable to remove this data or are unsure how to do so, copy the text of your attachment into your report text or send the printed document anonymously to the address listed in the footer, citing the reference number received at the end of the reporting process.
Information pursuant to Art. 26 para. 2 GDPR in case of joint responsibility:
The joint responsibility of the parties applies to the operation and organization of the BKMS® System within the thyssenkrupp group. This includes the internal administration of the BKMS® System and the implementation of whistleblower procedures. The parties use a uniform compliance management system and uniform IT systems for this purpose. The parties have agreed that data subjects can assert their data protection rights directly against either the respective national thyssenkrupp group company or thyssenkrupp AG using the contact details given above. The parties jointly responsible shall provide any information referred to in Articles 13 and 14 GDPR to the data subject free of charge in a concise, transparent, intelligible and easily accessible form, using clear and plain language. For this purpose, each Party provides the other Party with all necessary information relating to their respective operating range. The Parties immediately inform each other about the exertion of the rights of a data subject and provide the other Party with all necessary information referred to the right of access. Pursuant to Articles 15 through 22 GDPR, the data subject may exercise his or her rights under the GDPR in respect of and against both parties. The joint responsibility of the parties applies to the operation and organization of the BKMS System within the thyssenkrupp group. This includes the internal administration of the BKMS System and the implementation of whistleblower procedures. The parties use a uniform compliance management system and uniform IT systems for this purpose. The parties have agreed that data subjects can assert their data protection rights directly against either the respective national thyssenkrupp group company or thyssenkrupp AG using the contact details given above. The parties jointly responsible shall provide any information referred to in Articles 13 and 14 GDPR to the data subject free of charge in a concise, transparent, intelligible and easily accessible form, using clear and plain language. For this purpose, each Party provides the other Party with all necessary information relating to their respective operating range. The Parties immediately inform each other about the exertion of the rights of a data subject and provide the other Party with all necessary information referred to the right of access. Pursuant to Articles 15 through 22 GDPR, the data subject may exercise his or her rights under the GDPR in respect of and against both parties.