Last updated: September 12, 2024
Dear Interested Party, in implementation of the articles. 13 and 14 of the GDPR 2016/679 (European Regulation on the protection of personal data) this information is provided regarding the processing of personal data relating to the "Management of Whistleblowing Reports" processing area.
If the report comes from a person linked by a working and/or collaboration relationship with Polymers Recycle d.o.o. This information must be understood as supplementary and not replacing the information already provided to staff for the management of the employment and/or collaboration relationship.
1) IDENTITY AND CONTACTS OF THE OWNER:the Data Controller is the Company Polymers Recycle d.o.o. Simonetija - Simonetia, 59 52460 Kaldanija - Caldania - Buje (HR) Croatia - OIB: 50498801803 / VIES:HR50498801803. info@polymers-recycle.eu.
2) DATA PROCESSED: the personal data being processed are, if the Reporter decides to reveal his/her identity, the personal data of the Reporter and his/her contact details (as well as any further information possibly provided in the context of the Whistleblowing Report), as well as the identification data of the reported subject and/or the names of other subjects who can report on the facts which are the subject of a Whistleblowing Report (Persons Involved), as well as to any information and fact connected to the Whistleblowing Report which may also be obtained from the attached documents and files. Furthermore, in the context of the reports, data falling within the so-called “special categories of personal data” pursuant to art. 9 of the GDPR (such as data suitable for revealing racial and ethnic origin, religious, philosophical or other beliefs, political opinions, membership of parties, trade unions, associations or organizations of a religious, philosophical, political or union, as well as personal data suitable for revealing the state of health and sexual life) and in the so-called “judicial data” pursuant to art. 10 of the GDPR (such as data relating to criminal convictions and crimes). In general, the Reporter is invited not to provide these categories of his or third party data, unless this is strictly indispensable and necessary for the purposes of the Whistleblowing report.
3) SOURCE OF DATA: the data of the Reporter, those of the reported party and/or third parties are provided directly by the Reporter himself and/or by third parties during the investigative activities.
4) PURPOSE OF THE PROCESSING AND LEGAL BASIS OF THE PROCESSING: we process personal data in accordance with the provisions of the General Regulation (EU) n. 2016/679 on data protection for the following purposes:
5) RECIPIENTS OF PERSONAL DATA: Personal data will be processed by the members of the Supervisory Body pursuant to Legislative Decree 231/01 in office, as subjects expressly authorized to process, authorized subjects who are responsible for the preliminary assessment regarding the validity and adequacy of the report, together with the subsequent management and carrying out of the investigative activities related to it, as well as by the competent public authorities (e.g. also judicial) who will treat them as autonomous data controllers. If investigative needs require any sharing for the purposes of investigation, analysis, examination, correct evaluation of the report and documentation produced by the Reporter with other company functions and/or with external professionals (e.g. consultants, law firms, professional firms, etc.) , the same is carried out in compliance with the Procedure and the Whistleblowing Decree, as well as with the utmost attention to protecting the confidentiality of the Whistleblower, after obscuring the data and information that could reveal, even indirectly, the identity of the Whistleblower
6) PROCESSING METHODS: The data will be processed in compliance with current regulations, using computerized and manual tools, with logic strictly connected to the purposes indicated above, in order to guarantee the security and confidentiality of the data themselves. Furthermore, specific technical-organisational measures are adopted, pursuant to art. 32 GDPR, to guarantee the protection of the identity of the interested parties, as well as the possible anonymity of the Reporter.
7) DATA TRANSFER: the management and storage of personal data takes place on servers located within the European Union.
8) DATA CONSERVATION: the Data Controller stores and processes personal data for a maximum period of five (5) years from the date of communication of the final outcome of the reporting management procedure, except for the establishment of judicial or disciplinary proceedings following the reporting itself. In this case, the data will be kept for the entire duration of the procedure, until its conclusion and the expiry of the deadlines for appeal actions, in compliance with the provisions of the art. 14, paragraph 1 of Legislative Decree 24/2023 and art. 5, paragraph 1 of the GDPR
9) PROVISION OF DATA:: the provision of Data for the purposes referred to in point 4) "Purpose of processing and related legal bases" is optional. In particular, with regard to the identification data of the Reporting party, we remind you of the right to also send a Whistleblowing Report in anonymous form, which will also be taken into consideration and analysed; with reference to the identity of the reported subject, the provision of his/her data is similarly optional but, in this case, the Whistleblowing Report may not be taken into consideration to the extent that the minimum necessary information is not available..
10) RIGHTS OF THE INTERESTED PARTY: in accordance with articles 15 et seq. of Regulation (EU) 2016/679, the interested party can exercise his rights by writing to the Data Controller at the above address or by email to the address privacy@sipol.com. Pursuant to article 2-undecies of the Privacy Code (implementing article 23 of the GDPR), we inform you that the aforementioned rights cannot be exercised by interested parties (with a request to the Data Controller or with a complaint pursuant to article 77 of the GDPR) if the exercise of these rights could result in an effective and concrete prejudice to the confidentiality of the identity of the Reporter.
11) WITHDRAWAL OF CONSENT: in accordance with articles 15 et seq. of Regulation (EU) 2016/679, the interested party can exercise his rights by writing to the Data Controller. With reference to art. 7 of the GDPR 2016/679, the interested party can revoke the consent given at any time. If you have given consent to the disclosure of your identity in the context of disciplinary proceedings, you have the right to revoke this consent at any time, without however prejudice to the lawfulness of the processing, based on consent, carried out before the revocation.
12) RIGHT TO SUBMIT A COMPLAINT: The interested party has the right to submit a complaint to the Supervisory Authority of the state of residence.
13) AUTOMATED DECISION-MAKING PROCESSES: the data collected by means of electronic/telematic tools will not be subject to automated decision-making processing as specified in the art. 22 of the GDPR.