Data protection information for the whistleblower system in accordance with Art. 13 and 14 GDPR.
The Lindner Group takes the protection of your privacy very seriously. Therefore, we would like to let you know which data we process when you make a report via our whistleblower system as well as in the course of any subsequent communication.
Responsible party within the meaning of the EU General Data Protection Regulation (GDPR):
Lindner Group KG
Telephone: +49 8723 20- 0
Fax: +49 8723 20-2147
You can reach our data protection officer by post or electronically using the following contact details:
Lindner Group KG
Data Protection Officer
Telephone: +49 8723 200
E-mail: data protection officer[at]Lindner-Group.com
Handling of personal data
Personal data is any information relating to an identified or identifiable natural person (hereinafter "data subject").
Users of the whistleblowing system
Which of your data we process depends largely on the information you provide to us via the whistleblower system.
This may include:
- Information about your person as well as your relationship to the group of companies (employee, business partner, etc.)
- Information about your whereabouts at a particular time
- Information about your activity
Please note our information on confidentiality in the whistleblower system when making a report.
The Lindner Group operates the whistleblower system in order to receive and clarify reports of possible misconduct in a confidential manner. Therefore, information about you will only be disclosed to a strictly limited group of persons for the necessary processing of your report.
In some cases, however, we may be required by data protection law to disclose your personal information.
Therefore, please only provide us with the information about yourself that is essential for processing the notification. In most cases, we can dispense with mentioning your name.
A legal obligation to disclose your data may exist, on the one hand, in cases where the person affected by your notification asserts his or her right to information pursuant to Art. 15 GDPR and we are legally obligated to disclose your data.
On the other hand, we are generally obligated under Art. 14 (3) (a) of the GDPR to inform the accused person about the report. This may also include naming the identity of the whistleblower or information that suggests the identity of the whistleblower.
Confidentiality cannot be guaranteed in the case of deliberately denunciatory reports.
Purpose and legal basis of data processing
Data processing includes the processing of the initial report, any subsequent communication with the whistleblower, and measures required to process the report within the scope of the purpose of the whistleblower system.
Data processing may also include the merging of the notification with information from other sources to the extent necessary to process the notification in accordance with its intended purpose.
The purpose of data processing is the detection and internal clarification of wrongdoing in connection with the Lindner Group of Companies and the prevention of damage and liability cases for the Lindner Group of Companies. These purposes represent legitimate interests of the Lindner Group of Companies, which entitles it to process personal data of the whistleblower and other data subjects pursuant to Art. 6 para.1 lit. f GDPR. In order to pursue these purposes, we process your personal data for the necessary processing of the report.
If the reported grievance is a criminal offense or serious misconduct within the scope of the employment relationship of one of our employees, the data processing may be based on Section 26 (1) sentence 2 BDSG.
If you disclose your identity to us, e.g. by giving us your name or a personalized e-mail address, we will process your information for the above-mentioned purposes on the basis of your declaration of consent under data protection law in accordance with Art. 6 Para.1 lit. a GDPR. You have the right of revocation according to Art. 7 GDPR. You can assert this revocation without giving reasons. The revocation can be asserted a maximum of one month after the declaration of consent has been made, since after this period accused persons may have to be informed about the notices (See above Confidentiality).
Passing on your data
The whistleblower system can be used to submit reports that concern all companies of the Lindner Group. Consequently, your data may be passed on to other companies of the group of companies if your report concerns one of these companies and the passing on of data is necessary for processing the matter.
Furthermore, if necessary for the above-mentioned purposes, your personal data may be passed on to external bodies (legal counsel, authorities, other government agencies, etc.).
Deletion of personal data
We process your personal data for as long as is necessary for the purpose of clarifying and processing the reported facts. The data will be deleted 2 months after completion of the processing in accordance with data protection regulations. An exception exists only if either your data is required in accordance with Art. 17 para. 3 lit. e GDPR for the assertion of legal claims or for the defense against legal claims of third parties or the further processing is permissible for us in accordance with Art. 6 para.1 lit. f GDPR.
Provision of the service
The whistleblower solution is provided to us by the service provider iComply GmbH, Große Langgasse 1a, 55116 Mainz, Germany. iComply GmbH acts on our behalf within the scope of commissioned processing pursuant to Art. 28 GDPR and is obligated by a contract for commissioned processing pursuant to Art. 28 Para. 3 to process data strictly in accordance with instructions.
Data subject rights
Right to information
In accordance with Art. 15 GDPR, you have the right to request information from the controller as to whether personal data concerning you is being processed.
For this purpose, Lindner Group KG will provide an overview of the processing purposes, the categories of personal data processed, the respective recipients or categories of recipients, and a copy of the stored data.
Rights to rectification, erasure and restriction of processing
In accordance with Art. 16 DS-GVO, you have the right to demand the correction of any inaccurate personal data concerning you without undue delay. Taking into account the purposes of the processing, you also have the right to request the completion of incomplete personal data.
In accordance with Art. 17 DS-GVO, you have the right to demand from Lindner Group KG that personal data concerning you be deleted without delay, insofar as no other legal requirement precludes such deletion.
In accordance with Art. 18 DS-GVO, you have the right to demand the restriction of processing if
- you dispute the accuracy of your personal data,
- the processing is unlawful and the data subject objects to the erasure of the personal data and requests instead its limited use,
- the controller no longer needs the personal data for the purposes of processing, but the data subject needs it for the assertion, exercise or defense of legal claims,
- you object to the processing pursuant to Article 21 DS-GVO.
Right of withdrawal
You have the right to revoke your given consent na above conditions in whole or in part for the future. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.
Right of objection
You have the right to object at any time to the processing of your personal data based on Art.6 (1) lit. (e) and lit. (f) GDPR. The Lindner Group KG shall then no longer process the personal data, unless it can demonstrate compelling legitimate grounds which override the interests, rights and freedoms of the data subject.
You are not obliged under data protection law to submit a report via the whistleblower system or to include specific information in the report. However, without specific information, it may not be possible to process your report.
You also have the right to complain to the competent supervisory authority about data processing by our company.
The data protection authority responsible for our company is:
State Office for Data Protection Supervision
Promenade 27 (Castle)
91522 Ansbach, Germany
Status of data protection information
Constant development makes it necessary to adapt our data protection principles from time to time. We reserve the right to make appropriate changes at any time.