Data Privacy Policy
MAJOREL takes the topic of data protection and confidentiality very seriously. We adhere to the provisions of the EU General Data Protection Regulation (EU-GDPR) as well as current national data protection regulations. Please read this data protection information carefully before submitting a report.
Controller
The party responsible for data protection in the whistleblowing system isMajorel Group Luxembourg S.A.
43, boulevard Pierre Frieden
L-1543 Luxembourg
Email: contact@majorel.com
The data protection officer of Majorel Group Luxembourg S.A. (hereafter: MAJOREL) can be reached at the above postal address with the addition "An den Datenschutzbeauftragten" or at the email address: contact@majorel.com.
Type of collected personal data
Use of the whistleblowing system takes place on a voluntary basis. If you submit a report via the whistleblowing system, we collect the following personal data and information:
- your name, if you choose to reveal your identity,
- whether you are an employee of MAJOREL and
- the names and other personal data of persons whom you list in your report, if applicable.
The whistleblowing system (BKMS® Incident Reporting) does not set any cookies, and no personal data are collected by means of cookies.
Purpose and legal foundation of the data processing
The whistleblowing system (BKMS® Incident Reporting) serves the purpose of securely and confidentially receiving, processing and managing reports concerning violations of the compliance rules of MAJOREL. Incoming reports are received by a small selection of expressly authorised and specially trained employees of the compliance organisation of MAJOREL and always handled confidentially. The designated employees of the MAJOREL compliance organisation evaluate the matter and perform any further investigation required by the specific case. If the investigation reveals that compliance violations did in fact occur, this can result in appropriate measures being taken against persons involved.
The processing of personal data within the framework of the BKMS® Incident Reporting is based on the justified interest of our company in discovering and preventing abuses and thereby averting damage to MAJOREL, MAJOREL group companies, employees and customers. The legal foundation for this processing of personal data is therefore Article 6(1)(f) EU-GDPR.
Transmission of data to third countries
While processing a report or conducting a special investigation, it may be necessary to share reports with additional employees of MAJOREL or employees of other MAJOREL group companies, e.g. if the reports refer to incidents in subsidiaries. The latter may be based in third countries, in other words, countries outside the European Union or the European Economic Area for which no adequacy decision by the EU Commission exists and which may have different regulations concerning the protection of personal data. In such cases, it is therefore possible for personal data to be transmitted to third countries. We will always ensure that the applicable data protection regulations are complied with when sharing reports with third countries.
All persons who receive access to the data are obligated to maintain confidentiality.
Recipients of personal data
The processing of personal data in the BKMS® Incident Reporting by MAJOREL takes place on the BKMS® servers in a high-security data centre located in Germany. The operator (contract processor) of the BKMS® Incident Reporting is
Business Keeper AG
Bayreuther Straße 35
D-10789 Berlin
Germany
A corresponding processing contract in accordance with Art. 28 GDPR has been concluded. Neither Business Keeper AG nor third parties have access to the report contents in the BKMS System.
Information about the accused
We are legally obligated to inform accused parties of any reports received against them as soon as the disclosure of this information no longer jeopardises the investigation. Your identity as a whistleblower will not be disclosed unless we are legally bound to do so.
Rights of the data subject
Pursuant to European data protection legislation, you and the persons named in the report have a right of access, rectification, erasure, data portability, restriction of processing and right of objection to processing of your personal data. If the right to object to the processing of the personal data is invoked, the necessity of the stored data for the examination of a report will be evaluated immediately. Data that are no longer needed will be deleted at once. If you would like to make use of your right to object, please contact the address listed under item 1.
You also have the option of contacting a data protection authority and submitting a complaint there. The competent authority for our company is the
State Representative for Data Protection and Freedom of Information of North Rhine-Westphalia
Kavalleriestr. 2-4
40213 Düsseldorf
Phone: +49 (0) 211/38424-0
Fax: +49 (0) 211/38424-10
Email: poststelle@ldi.nrw.de
However, you can also contact the data protection authority responsible for your place of residence.
Automated decision-making
No automated decision-making takes place with regard to the processing of your personal data described here.
Profiling
No profiling takes place.
Retention period of personal data
Personal data are retained for as long as necessary to clarify the situation and issue a final assessment of the report or until existing contractual and/or legal obligations are met, unless overriding statutory retention periods prevent erasure of the data.
Updating of the privacy policy
If this privacy statement is modified, notice of this change will be published on the website and in other suitable locations.
Version: June 2018
