Data protection information of Labor LS SE & Co. KG for the whistleblower system according to Art. 13 f. GDPR
Dear Sir or Madam
Labor LS SE & Co. KG (hereinafter: LS) ensures compliance with applicable laws through an appropriate compliance organization. This includes, among other things, the establishment of an internal reporting office (whistleblower system), which can be used to receive confidential information and complaints from employees and external parties regarding possible misconduct at LS. The internal reporting office (whistleblower system) can be found at the Internet address https://Labor-ls.hinweis.digital. To ensure the confidentiality required by law, an ombudsperson is active for LS.
Having said this, we inform you in accordance with Art. 13, 14 of the General Data Protection Regulation (hereinafter: GDPR) about the processing of personal data relating to you within the framework of the whistleblower system. LS will process personal data in the context of the whistleblower system only in accordance with applicable data protection law, in particular the provisions of the GDPR and the Federal Data Protection Act (hereinafter: BDSG).
Personal data in this sense means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
In detail, this includes:
1. Name and contact details of the controller, data protection officer, ombudsperson
- The controller for the processing of your data pursuant to Art. 4 para. 7 GDPR is:
Laboratory LS SE & Co. KG
Mangelsfeld 4, 5, 6
97708 Bad Bocklet-Großenbrach
Germany
Phone: +49(0)9708/9100-0
Fax: +49(0)9708/9100-36
E-mail: labor@labor-ls.de
(see also our imprint at https://www.labor-ls.de/impressum/)
- You can contact our data protection officer by mail or fax at the above address (please add the note "for the attention of the data protection officer" when contacting us) or by e-mail at datenschutz@labor-ls.de.
- As stated at the beginning, LS appoints an ombudsperson in connection with the establishment of the internal reporting office (whistleblower system). LS's ombudsperson is:
Marc Oliver Giel
Lagerstrasse 11 a
64807 Dieburg
Germany
The ombudsperson manages the mailbox of the whistleblower system for LS, receives the tips, sifts through and checks incoming tips, handles communication with the whistleblower, obtains and manages consent forms, and forwards the tips and findings from the fact-finding process to the responsible offices.
2. Which data/data categories do we process and from which sources do these data originate?
Which data/data categories are processed in connection with a notification depends on the circumstances of the individual case:
- Initially, the relevant information is that which the whistleblower communicates from himself or herself or from third parties via the whistleblowing system. Considered are:
- Salutation, title
- First name
- Surname
- Date of birth
- Address details
- Telephone number (landline and/or mobile)
- a valid e-mail address
- Company function (e.g. employee) or relationship to the company (e.g. business partner) and other information about your activity
- Description of the facts/content of the report
- In the course of a report, data of third parties, such as witnesses or respondents, may also be processed.
3. For what purposes and on what legal basis is the data processing carried out?
- LS must ensure compliance with applicable laws (e.g. requirements under criminal and regulatory offences law, tax law, labor law and data protection law) in the course of its business operations. In order to avoid the disadvantages that could result from non-compliance with applicable laws, LS shall take appropriate measures, including the introduction and operation of a whistleblower system, through which violations of legal requirements by LS or LS employees can be reported. On the basis of the report, the necessary clarification measures can be carried out and necessary measures can be derived.
- Data processing within the framework of the whistleblower system is based on the following legal grounds:
aa) The processing of personal data of the whistleblower is usually based on consent. In these cases, the legal basis is Art. 6 para. 1 lit. a GDPR.
bb) Furthermore, the processing of personal data may be necessary for the implementation and termination of an employment relationship of employees of LS, if, for example, clarification measures are carried out with regard to breaches of duty under the employment contract. The legal basis is then Section 26 para. 1 sentence 1 BDSG (in the case of breaches of duty under the employment contract that do not constitute a criminal offense) or Section 26 para. 1 sentence 2 BDSG (in the case of breaches of duty under the employment contract where factual indications to be documented give rise to the suspicion that the person concerned has committed a criminal offense in the employment relationship).
cc) In addition, LS is subject to various statutory duties. Clarification measures that are carried out on the basis of a notice can therefore also be carried out to implement legal obligations. The legal basis is then Art. 6 para. 1 lit. c GDPR.
dd) Furthermore, personal data may also be processed to protect the legitimate interests of LS or third parties. This includes, for example, educational measures that are also carried out in order to avert damage to LS, e.g. by asserting or defending legal claims, or to relieve the burden on data subjects. In such cases, the legal basis is Art. 6 para. 1 lit. f GDPR).
4. How long will the data be stored?
The personal data mentioned in section 2. will be stored for the period of time required for the clarification and assessment of your notice. Subsequently, the personal data will generally be deleted after 3 years, unless one of the cases mentioned below applies and there are no legal requirements to the contrary (e.g. storage and documentation obligations).
If your tip leads to the initiation of official, judicial or labor law proceedings or measures, the data may be retained until the final/legal conclusion of such proceedings/measures.
In addition, personal data may be retained in this context for the period during which claims may be asserted by or against us; the statutory limitation periods are between 3 and 30 years.
If your data is no longer required for the above-mentioned purposes and all retention periods have expired, it will be permanently deleted.
5. Who is the recipient of your data?
- Your personal data is only accessible to those persons who need to know it on the basis of the processing purposes outlined above. In this context, it may be necessary to disclose your personal data to external advisors of LS, such as lawyers. Any person who is given access to your personal data is bound by contract and/or by law to maintain confidentiality.
In this context, it should also be noted that the operation and use of the (digital) whistleblower portal is carried out by datamog, Lagerstraße 11 a, 64807 Dieburg. LS has concluded a data processing agreement with datamog.
- As a matter of principle, your personal data will not be disclosed unless this is required for the purposes of official, judicial (in particular criminal prosecution) or labor law proceedings or measures or on the basis of statutory provisions or by order of state bodies (e.g. authorities, courts).
6. Is there automated decision-making, including profiling?
No automated decision-making pursuant to Art. 13 para. 2 lit. f GDPR takes place when processing your data.
7. What are the data subject rights?
As a person affected by data processing, you are entitled to various data subject rights if the respective legal requirements are met, in particular:
- Right of access pursuant to Art. 15 DSGVO
- Right to rectification pursuant to Art. 16 DSGVO
- Right to erasure ('right to be forgotten') pursuant to Art. 17 DSGVO
- Right to restriction of processing pursuant to Art. 18 DSGVO
- Right to complain to a supervisory authority pursuant to Art. 77 DSGVO.
8. Miscellaneous
If you have any questions about the above data protection information, we or our data protection officer will of course be happy to answer them at any time.
Status 09.07.2023
