Whistleblower System

at SchoPlast Plastic GmbH

Privacy Notice Pursuant to Articles 13, 14, and 21 of the General Data Protection Regulation (GDPR) Regarding the Whistleblower System

Person Responsible:

Schoplast Plastic GmbH

Zum Stadtwald 3, 01877 Bischofswerda

Telefon: +49 3594 7735-34

E-Mail: meldestelle@schoplast.de

Internet: www.schoplast.de

Data Protection Officer:

Dresdner Institut für Datenschutz

Hospitalstraße 4, 01097 Dresden

Telefon: +49 351 655 722 0

E-Mail: zentrale@dids.de

Internet: www.dids.de

Purposes of processing and legal basis:

Schoplast Plastic GmbH is responsible for operating the reporting office. More specifically, the company will receive and process reports in accordance with the HinSchG. Those making reports can be assured of confidentiality. It is also possible to make an anonymous report.

The processing of personal data in this context is carried out on the basis of Article 6(1), first sentence, point (c) of the GDPR in conjunction with Section 10 of the HinSchG. This may also include special categories of personal data within the meaning of Article 9(1) of the GDPR, provided this is necessary for the fulfilment of the internal reporting office’s tasks.

Categories of data and sources

Only personal data that is necessary for the purposes of the relevant proceedings and that is disclosed by the whistleblower will be processed. Possible categories of data that may be processed in connection with a report include, for example:

Personal master data
Organisational data
Occupational data
Reference data
Special categories of data

We receive the above-mentioned data either from the person making the report themselves or from the designated reporting body as part of a reporting procedure.

Obligation to provide your personal data

You are not obliged to provide us with your personal data. The reporting centre we have commissioned will only pass on your personal data to us with your consent.

Recipients of data transfers:

Your personal data will only be disclosed in cases where there is a legal basis for doing so or where you have given us your consent to such disclosure. In the context of a registration procedure, the following recipients may be involved in particular:

Departments within the responsible body or other organisations, insofar as they are affected by any investigative or follow-up measures pursuant to Section 18 of the HinSchG.
The designated reporting office
Public authorities and other government bodies
External service providers, e.g. solicitors or data processors

Purpose of a transfer to a third country, including the legal basis:

No personal data is transferred to a third country.

Duration of storage:

Personal data shall be deleted after three years in accordance with Sections 195 and 199(1) of the German Civil Code (BGB), provided that longer retention is disproportionate and necessary to fulfil the requirements set out in the HinSchG.

Information on the rights of data subjects:

Data subjects may at any time request information about the personal data relating to them and, where applicable, request the rectification or erasure of such data, or the restriction of its processing, or object to its processing. They also have a right to data portability. Furthermore, where data processing is carried out on the basis of consent, this consent may be withdrawn at any time with effect for the future. To exercise your rights, please contact our Data Protection Officer using the contact details provided above.

Right to lodge a complaint with the supervisory authority:

Under Article 77 of the GDPR, every data subject has the right to lodge a complaint with a data protection supervisory authority if they suspect that the processing of their personal data is unlawful.