Menu
With the following information, we would like to inform you in accordance with Art. 12 et seq. GDPR about the processing of your personal data with regard to our whistleblower system.
The body responsible for data protection is
Dr. Hesse Tierpharma GmbH & Co KG
Kieler street 36a
25551 Hohenlockstedt (Germany)
Phone: +49 (0) 4826 – 8610
Fax: +49 (0) 4826 – 8610-10
The controller has appointed a data protection officer. Data subjects can contact the data protection officer directly:
E-mail: datenschutz@drht.de
Personal data of the reporting person will only be processed if this reporting person consciously and voluntarily decides to provide their personal data in the report. In addition, the personal data of third parties named by the reporting person in the course of submitting the report (e.g. parties involved in the reported violation, witnesses, etc.) will be processed.
If you submit a report via the reporting system, we collect the following personal data and information:
We have established a reporting system in accordance with the Whistleblower Protection Act which serves to receive, process, document and manage reports and information regarding possible legal violations in a secure and confidential manner. This is also the purpose of the data processing.
The processing of the reporting person’s personal data is based on consent (Art. 6 para. 1 lit. a GDPR). Consent is given by submitting the notification, stating your name and e-mail address. As shown, consent is voluntary, as is the provision of personal data.
You have the right to withdraw your consent at any time with effect for the future. The revocation can be declared informally at any time using the contact details above.
With regard to the revocation of consent, however, we expressly point out that, depending on the status of the processing of the relevant process, it may no longer be possible to discontinue further processing of the personal data if we, as the person responsible for data processing and the reporting system, have involved authorities or courts due to the content and nature of the report. We would like to point out that in such cases, after withdrawal of consent, we will continue to process the personal data on the basis of legal permissions; specifically on the basis of a possible legal obligation due to our involvement in criminal, administrative or court proceedings (Article 6 (1) (c) GDPR) or on the basis of our legitimate interest (Article 6 (1) (f) GDPR); in these cases, our legitimate interest lies in the detection and prevention of abuses and violations of the law.
If personal data of third parties is transmitted by the reporting person as part of the reporting process (parties involved or witnesses to legal violations), we process this data on the basis of our company’s legitimate interest in the detection and prevention of abuses and thus in the prevention of damage to the controller, its employees and customers (Art. 6 para. 1 lit. f GDPR)
The submission of reports and thus the provision of personal data is neither legally nor contractually required. Failure to submit notifications or personal data within the notification has no effect on any employment relationship between the notifying person and the controller.
Any information received will always be treated in strict confidence. The employees of the internal reporting office and all employees involved in the processing of a report are expressly bound to confidentiality.
The reporting system is operated by a specialized company, Preeco GmbH, Magirus-Deutz-Strasse 14, 89077 Ulm (“preeco”), on behalf of the
responsible persons. The reporting system is provided as a SaaS service and meets all current data protection and IT security requirements. Data processing takes place exclusively in Germany. Access to the data is only permitted to a limited group of employees of the company defined by the controller.
Responsible persons possible. Data security is guaranteed by comprehensive technical and organizational measures in a certified process.
For the function of the internal reporting office acc. Whistleblower Protection Act, we use a specialized service provider, the
FKC CONSULT GmbH
Eschenburgstr. 7
23568 Lübeck
In addition, your personal data will be forwarded to third parties or authorities in individual cases for further investigations if this is necessary to clarify unlawful conduct or for legal prosecution. However, this only happens if there are concrete indications of unlawful or abusive behavior.
This data is passed on on the basis of our legitimate interest in combating misuse, prosecuting criminal offenses and securing, asserting and enforcing claims, provided that your rights and interests in the protection of your personal data are protected.
data do not prevail, Art. 6 para. 1 lit. f GDPR. If we are legally obliged to pass on the information, it is passed on on the basis of Art. 6 para. 1 lit. c) GDPR (legal obligation).
In principle, we are legally obliged under Art. 14 GDPR to inform third parties that we have received information about them. We will comply with this obligation if and as soon as this information no longer jeopardizes further legal action with regard to the reported infringement.
To the extent permitted by law, the identity of the whistleblower is not disclosed.
Data processing within the scope of the reporting system takes place exclusively on servers in Germany. A transfer to third countries does not take place and is not intended.
Your rights as a data subject include the right of access under Art. 15 GDPR, the right to rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR, the right to restriction of processing under Art. 18 GDPR and the right to data portability under Art. 20 GDPR.
You also have the option of contacting the competent supervisory authority. The competent supervisory authority is:
Independent State Center for Data Protection Schleswig-Holstein
P.O. Box 71 16
24171 Kiel
E-mail: mail@datenschutzzentrum.de
Personal data will be stored for as long as is necessary for the clarification and final assessment of the information or for as long as the controller has a legitimate interest or this is required by law.
After the information has been processed, this data is deleted in accordance with the legal requirements.
