Privacy Policy
We take the protection of personal data seriously and always process it in compliance with applicable data privacy laws, in particular the General Data Protection Regulation (GDPR). With this privacy policy, we aim to inform you about how, why and to what extent we process personal data, and what your rights are as a data subject.
Please read this Privacy Policy carefully before making a disclosure.
Our whistleblowing system (BKMS® System) provides you with a secure communication platform through which you may make disclosures. Disclosures can be made using your own name or anonymously. You can set up a postbox within the whistleblowing system that is secured with an individually chosen pseudonym/user name and password. This allows you to receive feedback and stay anonymous during the following communication if you so wish. Data is only stored in the whistleblowing system and it is therefore particularly protected; no conventional e-mail communication is involved.
You also have the option of sending attachments through the whistleblowing system. Please note that files may contain hidden personal data that could jeopardise your anonymity.
Data controller and general information
Your data is processed by AWIN AG, (Landsberger Allee 104 BC, 10249 Berlin Germany), e-mail: global-privacy@awin.com (referenced as “Awin”, “we” or “us”). Awin’s Privacy Policy can be found at https://www.awin.com/gb/privacy. The whistleblowing system is operated on Axel Springer's behalf in Germany by EQS Group AG (BKMS), Bayreuther Str. 35, 10789 Berlin – a company that specialises in this – under a commissioned processing arrangement. More informations on the processing of Data by BKMS can be found at Datenschutzhinweise (business-keeper.com).
Collection and processing of personal data
Personal data and information entered into the whistleblowing system is stored in a database at a high-security data centre located in Germany. Only Awin is able to view this data. EQS Group AG and other third parties have no access to the data. As part of a certified procedure, this is ensured by means of comprehensive technical and organisational measures.
All data is encrypted and password-protected, following the latest standards in security and technology when stored. Access is therefore strictly restricted, as it is only granted to a necessary minimum of recipients legally bound by confidentiality obligations in order to handle the disclosure, accordingly to Awin’s authorisation concept.
When dealing with a disclosure or carrying out a special investigation, it may be necessary to make disclosures available to other Awin employees or employees of other Group companies, if the disclosures relate to activities in subsidiaries, for example. The latter may also be based in countries outside the European Union or the European Economic Area, where different rules concerning the protection of personal data may apply. We always take care to ensure compliance with applicable data privacy provisions when sharing disclosures. In some instances we may also be required to inform our ultimate parent undertaking (Axel Springer SE) of compliance violations. Any disclosures pursuant to this paragraph are made in accordance with Art. 6(1) point (c) or (f) GDPR, as applicable.
Type of personal data collected
Use of the whistleblowing system is voluntary. If you make a disclosure through the whistleblowing system, we collect the following personal data and information: your name (if you reveal your identity), whether you are an employee of Awin and, where applicable, the names of individuals and other personal data of individuals that you mention in your disclosure.
Legal basis and purpose of the whistle-blowing system
The purpose of the whistleblowing system (BKMS® System) is to receive, deal with and manage disclosures concerning compliance breaches at Awin in a secure and confidential manner. In the context of the BKMS® System, the processing of personal data is supported by our legitimate interest in uncovering and preventing corruption, fraud and other anomalies and thus in preventing damage to Awin, its employees and customers. Depending on the situation, the legal ground for the rocessing of personal data is Art. 6(1) point (c) or (f) GDPR.
Sharing your data with third parties
Insofar as we are required or permitted to do so by law, according to Article 6(1) point (c) or (f) GDPR, we will transmit personal data to public authorities such as the police or public prosecution service to prevent misuse, prosecute criminal acts and to secure, establish and enforce legal claims, unless outweighed by your rights and interests in the protection of your personal data pursuant to applicable law.
Storage duration
We store personal data only for as long as it is required to clarify and definitively assess the disclosure, or not longer than 90 days after the resolution, unless we are otherwise entitled or obligated by law to retain it longer.
Session cookie
Communication between your computer and the whistleblowing system is via an encrypted connection (TLS). Your computer's IP address is not stored during or after use of the whistleblowing portal. In order to maintain the connection between your computer and the BKMS® System, a null cookie is stored on your computer, which contains only the session ID. The cookie is valid only until the end of your session and automatically deletes itself when you close your browser.
Contact details and your rights
Should you have any queries or comments on data privacy or wish to exercise your rights as a data subject, please contact our data protection officer at any time:
AWIN AG
Data Protection Officer
Landsberger Allee 104 BC
10249 Berlin Germanyglobal-privacy@awin.com
▫ Right to access information and rectification
Provided there are no legal grounds to the contrary, you can obtain information from us as to whether personal data relating to you is processed by us and also the specific data that we have stored about you, in accordance with Art. 15 GDPR. You can also have errors in your data corrected and missing information completed, according to Art. 16 GDPR.
▫ Erasure, restriction of processing and 'right to be forgotten'
You can obtain the erasure of your personal data and the restriction of its processing (Art. 17 and 18 GDPR). Please note that retention obligations are laid down in law and as a result of this we may not be able to completely erase your data in every case. In such cases, your data will be labelled to the effect that future processing should be restricted.
▫ Objection to data processing
You may object to your data processing at any time. Please note however that our legitimate interest in investigating fraudulent activity might override your right to privacy in accordance with Article 21(1), second sentence, GDPR.
▫ Right of complaint
You also have the right to lodge a complaint with the competent supervisory authority and the option of seeking legal remedies. The supervisory authority with whom the complaint was lodged will notify the complainant about the status and result of their complaint, including the option of seeking a judicial remedy. The leading authority in this matter is the Berliner Beauftragter für Datenschutz und Informationssicherheit, Friedrichstrasse 219, 10969, Berlin, datenschutz-berlin.de
▫ Existence of automated decision-making processes
We do not perform any automated decision-making or profiling.
Last revised: 24 March 2021