Whistleblower system.

Contact details of the controller

External data protection officer

Internal whistleblowing offices

Internal reporting office

FFT Produktionssysteme – Legal & Compliance Department
Phone: +49 661 2926-292 or -2921
Email: whistleblower@fft.de

Outsourced reporting office

Law firm Cornea & Franz – RA Dr. Stephan Wübbelsmann
Phone: +49 661 901644-0
Email: ombudsstelle-fft@cornea-franz.de

Processing description

1. Description and scope of data processing

We use the information you provide as part of our whistleblower system for the purpose of reviewing and documenting reports, as well as for internal and external investigations. This may include disclosure to external attorneys, auditors or other professionals bound by professional confidentiality and, where necessary, to government agencies.

Via the outsourced external whistleblowing office, you can submit your report without providing personal data. If you disclose your identity, we only process data that you actively and voluntarily provide. You are not required to provide a name or contact details; your report will still be reviewed and processed. We assure all whistleblowers that their reports will be handled confidentially.

Providing personal data is neither legally nor contractually required. However, without contact information, we may be unable to inform you about the progress of an investigation, request further information or adequately follow up on a report where disclosure of your identity based on consent is necessary.

No solely automated decision-making, including profiling pursuant to Art. 22 GDPR, is used to process the data you provide.

2. Legal basis for processing

The legal basis for processing is Art. 6(1)(c) GDPR in conjunction with Sections 10 et seq. of the German Whistleblower Protection Act (HinSchG), for compliance with a legal obligation to which the controller is subject.

The processing of special categories of personal data by the reporting office is based on Section 10 HinSchG in conjunction with Art. 9(2) GDPR. The controller is authorized to process personal data where this is necessary to perform the tasks under Sections 13 and 14 HinSchG.

The processing of data and disclosure of your identity based on your consent is carried out pursuant to Art. 6(1)(a) GDPR, Art. 9(2)(a) GDPR and Sections 9(3), 11(2) and 16(3) HinSchG. Following withdrawal of consent, the withdrawal may be stored for evidentiary purposes and for the defense against liability claims on the basis of Art. 6(1)(f) GDPR.

Data processing within our LECARE system is based on Art. 6(1)(f) GDPR.

3. Purpose of processing

The processing of personal data serves to comply with the requirements of the German Whistleblower Protection Act. Information is used to verify and document reports in accordance with Section 11 HinSchG and to conduct internal and external investigations. Under the conditions of Section 9(1) and (2) HinSchG, information may also be forwarded to competent authorities.

If you have consented to the disclosure of your identity, information about your identity may be disclosed to the competent bodies in order to take follow-up measures in accordance with Section 9(3) HinSchG. The same applies where consent has been obtained from persons who are the subject of a report or otherwise named in it pursuant to Section 9(4) HinSchG. The affected persons will be informed separately when consent is obtained.

Processing within the reporting system also serves to organize and optimize the coordination, handling and tracking of reports, protect whistleblowers and minimize security risks. These purposes constitute our legitimate interests pursuant to Art. 6(1)(f) GDPR.

4. Duration of processing and storage

The personal data collected and the related documentation will generally be deleted three years after completion of the procedure in accordance with Section 11(5) HinSchG.

Data may be processed for longer where this is required by law, necessary to comply with retention obligations or needed to demonstrate compliance with information and notification obligations.

You may withdraw your consent at any time. The withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. Withdrawal may be submitted to the controller by email or post. After the purpose ceases to apply or consent is withdrawn, data may continue to be processed where required by statutory retention obligations or based on legitimate interests. Withdrawn consent may be retained for up to three years in order to demonstrate that consent had previously been given and to defend against liability claims. You may object where your interests override our legitimate interests.

5. Recipients of the data

Only authorized persons in the Legal & Compliance department have access to the internal documentation system. During an investigation, those departments and bodies that require the information to fulfil legal obligations or the purposes described above may receive personal data. This may include management, employee representatives, the data protection officer, the information security officer, the HR department and the reporting office.

Processors, such as IT maintenance service providers, may be engaged in connection with the provision of services. They act only on instructions and are contractually obligated to comply with applicable data protection requirements.

An agreement pursuant to Section 14 HinSchG has been concluded with the external whistleblowing office for the performance of the tasks of an internal reporting office for FFT Produktionssysteme GmbH & Co. KG. Processing is carried out under joint controllership pursuant to Art. 26 GDPR.

If an affected person is employed by another group company, the data may be transferred to the Legal & Compliance Department of FFT Produktionssysteme GmbH & Co. KG for further processing, as processing in connection with the Whistleblower Protection Act is performed centrally for affiliated companies. An agreement governing the performance of the tasks of an internal reporting office under joint controllership pursuant to Art. 26 GDPR has been concluded.

We may disclose personal data to state authorities, including the police, public prosecutor’s office, courts or supervisory authorities, and to external attorneys, auditors or other professionals bound by professional secrecy where there is a legal obligation pursuant to Art. 6(1)(c) GDPR or where this is necessary for the establishment, exercise or defense of legal claims pursuant to Art. 6(1)(f) GDPR and there is no overriding protected interest in non-disclosure.

If information about a whistleblower’s identity or circumstances allowing conclusions to be drawn about that identity is disclosed to law enforcement authorities or on the basis of a court decision, the whistleblower will be informed in advance of the disclosure and the reasons for it, unless the competent authority or court has stated that such information would jeopardize investigations, inquiries or court proceedings. Where possible, information is transferred without personal data.

6. Data transfers to third countries

Information will be transferred to a third country without personal data and only where this is necessary to process a report with a third-country connection. If an investigation concerns group companies in a third country and personal data must be forwarded, you will be informed and your consent will be obtained.

Rights of the data subject

If we process your personal data, you have the following rights against us as the controller, subject to the applicable statutory requirements.

Competent supervisory authority

If you are located in another federal state or outside Germany, you may also contact the data protection authority responsible for your location.