Data Privacy
Information on data processing for whistleblowers when using the whistleblowing system
(Information in accordance with Art. 13, 14 GDPR)
This information is intended to inform whistleblowers about the processing of personal data in the context of the whistleblower system, the purposes, storage periods and the rights to which data subjects are entitled in connection with data processing.
Who is responsible for data processing and who is the data protection officer?
domino-world™ Head Office
Karl-Marx-Straße 84-86
16547 Birkenwerder
Telephone: 03303/29 37 60
Fax: 03303/29 37 70
Zentrale@domino-world.de
The data protection officer of the controller is: Heike Schulze
E-mail: hschulze@domino-world.de
Purposes of data processing
domino-world's whistleblower system is used for the secure and confidential receipt, processing and management of information on compliance violations, violations of legal regulations and internal company rules of the organization by employees, customers, suppliers and other third parties. It is intended to promote the detection and clarification of such violations in order to prevent or mitigate damage to individuals and the company.
The whistleblower can decide whether they wish to remain anonymous. In any case, the whistleblower will receive feedback on their report after three months.
Legal basis for data processing
Data processing in the whistleblower system is carried out on the basis of legal provisions (Art. 6 para. 1 lit. c) GDPR in conjunction with Section 10 HinSchG), which apply to the responsible body in the context of operating a whistleblower system:
- Operation of the reporting channels pursuant to Section 16 HinSchG (establishment, design, responsible group of persons, etc.)
- Procedure for internal reports in accordance with Section 17 HinSchG (reviewing the report, maintaining contact with you as the whistleblower, requesting further information)
- Follow-up measures pursuant to Section 18 (e.g. internal investigations, conclusion of the procedure, forwarding to a competent authority for further investigations)
The information provided by the whistleblower via the reporting channel contains personal data. This data must be processed by the responsible body in order to comply with the legal obligations of the HinSchG. This is done in addition to the legal authorization for the following purposes (§ 10 HinSchG):
- Documentation of reports in accordance with Section 11 HinSchG
- Confidentiality requirement in accordance with § 8 HinSchG
Further processing or transmission of the data may be necessary for the prosecution of criminal offenses or administrative offenses or to prevent serious impairment of the rights of a third party (Section 24 (1) BDSG).
Insofar as necessary in addition to the special authorization or legal obligation, personal data is processed to protect legitimate interests (Art. 6 para. 1 lit. f) GDPR). This is done, among other things, for the purpose of fulfilling professional obligations and requirements.
In the event that the whistleblower gives consent to the processing of personal data (Art. 6 para. 1 lit. a) or Art. 9 para. 2 lit. a) GDPR) for specific purposes, the respective consent is the legal basis for the specific processing mentioned there. If the data processing is based on consent, this can be revoked at any time by notifying the controller with effect for the future. In this case, the personal data will be deleted if there are no other overriding interests or legal obligations for further storage and processing of the data.
What personal data is processed?
When using the whistleblower system, the following personal data is processed
- Name and contact details of the whistleblower if they do not wish to remain anonymous;
- Information as to whether the whistleblower is employed by the company or in which institution;
- Other personal data that may result from the report;
- if applicable, the names and other personal data of persons named in the report or in follow-up communication.
Recipients of the data
In the event of a report, the personal data will only be passed on if this is absolutely necessary to fulfill contractual and legal obligations or if the internal organization requires the transfer. This only applies to persons who are responsible for receiving reports or for taking follow-up measures, as well as persons assisting in the fulfillment of these tasks (§ 8 para. 1 no. 3 HinSchG).
However, there are legal obligations to disclose information, in particular in accordance with Section 9 (2) and (3) HinSchG. Accordingly, information about the identity of a whistleblower or other circumstances that allow conclusions to be drawn about the identity of this person may be disclosed
- in criminal proceedings at the request of the criminal prosecution authorities,
- on the basis of an order in administrative proceedings following a report, including administrative fine proceedings,
- on the basis of a court decision,
- the disclosure is necessary for follow-up measures by your employer.
In the first three cases, the whistleblower will be informed in advance of the disclosure and the reasons for it. This does not apply if the law enforcement agency, the competent authority or the court has stated that the information would jeopardize the relevant investigations, inquiries or court proceedings.
The whistleblowing system is operated as a service by independent external whistleblowing officers who receive the reports and act as within the meaning of the §14 HinSchG.
complianceline GmbH has been appointed as the reporting office officer. The persons/authorized persons to whom reports are sent can be identified on the reporting form.
How long will my data be stored?
The personal data will be stored for the duration of the contractual or legal obligations and deleted in compliance with data protection regulations after the purpose has been fulfilled or at your request, taking into account the corresponding statutory retention obligations of the controller (Section 11 (5) HinSchG).
- The basic obligation to delete the documentation of your personal data is three years after completion of the procedure.
- The documentation may be stored for longer in order to fulfill the requirements of the HinSchG or other legal provisions, as long as this is necessary and proportionate.
A retention obligation beyond the purpose required exists in the following cases, among others:
- Fulfillment of retention obligations under commercial and tax law, e.g. German Commercial Code (HGB), German Fiscal Code (AO), German Money Laundering Act (GwG). The retention and documentation periods specified there are two to ten years.
- Preservation of evidence within the framework of the statutory limitation periods. According to §§ 195 ff. of the German Civil Code (BGB), these limitation periods can be up to 30 years, whereby the regular limitation period is three years.
To what extent do automated individual case decisions or profiling take place?
The whistleblower system does not involve any automated processing to reach a decision (including profiling).
Is data transferred to a third country?
No transfer to third countries is planned.
Is there an obligation to provide personal data?
No. There is no obligation to provide personal data when using the reporting office as a whistleblower. The whistleblower is free to use the digital reporting channel anonymously for reports.
What data protection rights can a data subject assert?
Data subjects can request information about the personal data stored about them. In addition, under certain conditions, the correction or deletion of personal data can be requested.
Data subjects also have the right to restrict the processing of their data, i.e. to mark the stored personal data with the aim of restricting its future processing.
Finally, data subjects may also have the right to receive the data they have provided in a structured, commonly used and machine-readable format.
You can assert these rights at any time at the above address.
In the event that personal data of the whistleblower is used on the basis of consent, this consent can be revoked at any time without giving reasons.
The whistleblower has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1) GDPR. The personal data concerned will then no longer be processed unless compelling legitimate grounds for the processing can be demonstrated which override the interests, rights and freedoms of the controller, or the processing serves the establishment, exercise or defense of legal claims.
In addition, the whistleblower has the right to lodge a complaint with a data protection supervisory authority if he or she is of the opinion that the processing of personal data concerning him or her by the responsible body violates applicable data protection law.
The data protection supervisory authority responsible for domino-world is the
State Commissioner for Data Protection and Freedom of Information
Dagmar Hartge
Stahnsdorfer Damm 77
14532 Kleinmachnow
Telephone: 033203/356-0
Fax: 033203/356-49
E-Mail: Poststelle@LDA.Brandenburg.de
(Information in accordance with Art. 13, 14 GDPR)
This information is intended to inform whistleblowers about the processing of personal data in the context of the whistleblower system, the purposes, storage periods and the rights to which data subjects are entitled in connection with data processing.
Who is responsible for data processing and who is the data protection officer?
domino-world™ Head Office
Karl-Marx-Straße 84-86
16547 Birkenwerder
Telephone: 03303/29 37 60
Fax: 03303/29 37 70
Zentrale@domino-world.de
The data protection officer of the controller is: Heike Schulze
E-mail: hschulze@domino-world.de
Purposes of data processing
domino-world's whistleblower system is used for the secure and confidential receipt, processing and management of information on compliance violations, violations of legal regulations and internal company rules of the organization by employees, customers, suppliers and other third parties. It is intended to promote the detection and clarification of such violations in order to prevent or mitigate damage to individuals and the company.
The whistleblower can decide whether they wish to remain anonymous. In any case, the whistleblower will receive feedback on their report after three months.
Legal basis for data processing
Data processing in the whistleblower system is carried out on the basis of legal provisions (Art. 6 para. 1 lit. c) GDPR in conjunction with Section 10 HinSchG), which apply to the responsible body in the context of operating a whistleblower system:
- Operation of the reporting channels pursuant to Section 16 HinSchG (establishment, design, responsible group of persons, etc.)
- Procedure for internal reports in accordance with Section 17 HinSchG (reviewing the report, maintaining contact with you as the whistleblower, requesting further information)
- Follow-up measures pursuant to Section 18 (e.g. internal investigations, conclusion of the procedure, forwarding to a competent authority for further investigations)
The information provided by the whistleblower via the reporting channel contains personal data. This data must be processed by the responsible body in order to comply with the legal obligations of the HinSchG. This is done in addition to the legal authorization for the following purposes (§ 10 HinSchG):
- Documentation of reports in accordance with Section 11 HinSchG
- Confidentiality requirement in accordance with § 8 HinSchG
Further processing or transmission of the data may be necessary for the prosecution of criminal offenses or administrative offenses or to prevent serious impairment of the rights of a third party (Section 24 (1) BDSG).
Insofar as necessary in addition to the special authorization or legal obligation, personal data is processed to protect legitimate interests (Art. 6 para. 1 lit. f) GDPR). This is done, among other things, for the purpose of fulfilling professional obligations and requirements.
In the event that the whistleblower gives consent to the processing of personal data (Art. 6 para. 1 lit. a) or Art. 9 para. 2 lit. a) GDPR) for specific purposes, the respective consent is the legal basis for the specific processing mentioned there. If the data processing is based on consent, this can be revoked at any time by notifying the controller with effect for the future. In this case, the personal data will be deleted if there are no other overriding interests or legal obligations for further storage and processing of the data.
What personal data is processed?
When using the whistleblower system, the following personal data is processed
- Name and contact details of the whistleblower if they do not wish to remain anonymous;
- Information as to whether the whistleblower is employed by the company or in which institution;
- Other personal data that may result from the report;
- if applicable, the names and other personal data of persons named in the report or in follow-up communication.
Recipients of the data
In the event of a report, the personal data will only be passed on if this is absolutely necessary to fulfill contractual and legal obligations or if the internal organization requires the transfer. This only applies to persons who are responsible for receiving reports or for taking follow-up measures, as well as persons assisting in the fulfillment of these tasks (§ 8 para. 1 no. 3 HinSchG).
However, there are legal obligations to disclose information, in particular in accordance with Section 9 (2) and (3) HinSchG. Accordingly, information about the identity of a whistleblower or other circumstances that allow conclusions to be drawn about the identity of this person may be disclosed
- in criminal proceedings at the request of the criminal prosecution authorities,
- on the basis of an order in administrative proceedings following a report, including administrative fine proceedings,
- on the basis of a court decision,
- the disclosure is necessary for follow-up measures by your employer.
In the first three cases, the whistleblower will be informed in advance of the disclosure and the reasons for it. This does not apply if the law enforcement agency, the competent authority or the court has stated that the information would jeopardize the relevant investigations, inquiries or court proceedings.
The whistleblowing system is operated as a service by independent external whistleblowing officers who receive the reports and act as within the meaning of the §14 HinSchG.
complianceline GmbH has been appointed as the reporting office officer. The persons/authorized persons to whom reports are sent can be identified on the reporting form.
How long will my data be stored?
The personal data will be stored for the duration of the contractual or legal obligations and deleted in compliance with data protection regulations after the purpose has been fulfilled or at your request, taking into account the corresponding statutory retention obligations of the controller (Section 11 (5) HinSchG).
- The basic obligation to delete the documentation of your personal data is three years after completion of the procedure.
- The documentation may be stored for longer in order to fulfill the requirements of the HinSchG or other legal provisions, as long as this is necessary and proportionate.
A retention obligation beyond the purpose required exists in the following cases, among others:
- Fulfillment of retention obligations under commercial and tax law, e.g. German Commercial Code (HGB), German Fiscal Code (AO), German Money Laundering Act (GwG). The retention and documentation periods specified there are two to ten years.
- Preservation of evidence within the framework of the statutory limitation periods. According to §§ 195 ff. of the German Civil Code (BGB), these limitation periods can be up to 30 years, whereby the regular limitation period is three years.
To what extent do automated individual case decisions or profiling take place?
The whistleblower system does not involve any automated processing to reach a decision (including profiling).
Is data transferred to a third country?
No transfer to third countries is planned.
Is there an obligation to provide personal data?
No. There is no obligation to provide personal data when using the reporting office as a whistleblower. The whistleblower is free to use the digital reporting channel anonymously for reports.
What data protection rights can a data subject assert?
Data subjects can request information about the personal data stored about them. In addition, under certain conditions, the correction or deletion of personal data can be requested.
Data subjects also have the right to restrict the processing of their data, i.e. to mark the stored personal data with the aim of restricting its future processing.
Finally, data subjects may also have the right to receive the data they have provided in a structured, commonly used and machine-readable format.
You can assert these rights at any time at the above address.
In the event that personal data of the whistleblower is used on the basis of consent, this consent can be revoked at any time without giving reasons.
The whistleblower has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1) GDPR. The personal data concerned will then no longer be processed unless compelling legitimate grounds for the processing can be demonstrated which override the interests, rights and freedoms of the controller, or the processing serves the establishment, exercise or defense of legal claims.
In addition, the whistleblower has the right to lodge a complaint with a data protection supervisory authority if he or she is of the opinion that the processing of personal data concerning him or her by the responsible body violates applicable data protection law.
The data protection supervisory authority responsible for domino-world is the
State Commissioner for Data Protection and Freedom of Information
Dagmar Hartge
Stahnsdorfer Damm 77
14532 Kleinmachnow
Telephone: 033203/356-0
Fax: 033203/356-49
E-Mail: Poststelle@LDA.Brandenburg.de