Privacy Policy for the Whistleblower Scheme

Purpose

This privacy policy explains how Team Rynkeby Fonden processes personal data in connection with reports to Team Rynkeby Fonden's whistleblower scheme.

Below is a more detailed description of which personal data processing takes place and which rights you have if a report is made about you via the whistleblower scheme, as well as your rights if you use the whistleblower scheme to make a report about another person.

Reference is also made to separate guidelines for the whistleblower scheme, of which, among other things, it appears who can make reports and who can be reported on. This policy only concerns the handling and investigation of reports to the whistleblower scheme, and the policy regarding employees must therefore be seen in conjunction with Team Rynkeby Fonden's other relevant policies and procedures.

1 DATA RESPONSIBLE

The legal entity responsible for the processing of your personal data is:

Team Rynkeby Fonden, Vestergade 30, 5750 Ringe, Denmark, CVR: DK35318798

2 DESCRIPTION OF THE TREATMENT

#1 Handling and investigation of reports to the whistleblower scheme regarding the person being reported on

Categories of personal data

We may process the following categories of personal data about you:

General personal data:

  • Name, e-mail, telephone number
  • Other information included in the report

Sensitive information and information about legal offenses or possible legal offenses may be included in the processing.

Sources

We may collect information from the following sources:

General personal data:

  • Employees and associated consultants
  • Team Managers, steering group and other Team Rynkeby participants as well as previous participants in the project
  • Former employees
  • Board or management members
  • Auditors
  • Lawyers
  • Suppliers
  • Possibly others who use the whistleblower scheme

Basis of treatment

We process your personal data based on the following processing basis:

  • GDPR, Article 6(1)(f) (necessary for the pursuit of Team Rynkeby Fonden's legitimate interests by being able to investigate reports via the whistleblower scheme)
  • GDPR, article 9(2)(b) (necessary for the purpose of complying with work, health and social law obligations), cf. Data Protection Act § 7(2) and § 12.
  • GDPR, Article 9(2)(f) (necessary for legal claims to be established, asserted or defended)
  • Section 8 of the Data Protection Act regarding information on criminal offenses and criminal convictions
  • Section 11 of the Data Protection Act regarding CPR number

Recipients

We may share your personal data with:

  • External advisers
  • The police
  • Public authorities

Storage

We will store personal data as long as it is necessary for the purposes mentioned.

  • The information is kept as long as the investigation is ongoing. The retention period will then depend on the outcome of the investigation.
  • If the report falls outside the whistleblower scheme, but otherwise does not appear unfounded, the information is passed on to Team Rynkeby Fonden's General Manager, where it is processed in accordance with Team Rynkeby Fonden's relevant policies and procedures.
  • If a report is made to the police or another authority, the information will be stored at least as long as the investigation is ongoing with the police/authority.
  • If, based on the information collected, a disciplinary sanction is implemented against the reported person or there are other reasons why it is factual and necessary to continue to store the information about the reported person, the information will be stored in the personnel file of the person in question, if the reported person is employed and is deleted in accordance with the deletion policy for employee data.
  • If the report turns out to be groundless, the report is terminated immediately, and the personal data is deleted within 45 days from the finding that the report was deemed groundless.
  • In other situations, it is concretely assessed whether there are factual reasons for storing the information and, if so, for how long.

#2 Handling and investigation of reports to the whistleblower scheme regarding the person who made the report

This purpose does not include the processing of the reported information - see above about this. If it is suspected that there is a deliberate false report, this purpose also includes investigating the reporter in such situations.

Categories of personal data

We may process the following categories of personal data about you if you do not choose to make an anonymous report:

General personal data:

  • Name, e-mail, telephone number
  • Content of your report
  • Supplementary information from the circle of people mentioned under "Sources" in cases where it is suspected that a deliberately false report has been made.

As a rule, sensitive information and information about legal offenses and criminal convictions about you are not processed as part of the handling of the whistleblower report itself - unless you yourself choose to include such information about yourself in the report. However, information about legal offenses or possible legal offenses may be included in the processing if it is suspected that a knowingly false report has been made.

Sources

We may collect information from the following sources:

  • You
  • Employees and associated consultants
  • Team Managers, steering group and other Team Rynkeby participants as well as previous participants in the project
  • Former employees
  • Board or management members
  • Auditors
  • Lawyers
  • Supplier
  • Possibly others who use the whistleblower scheme

Basis of treatment

We process your personal data as described above based on the following processing basis

  • Article 6(1)(f) of the Personal Data Regulation (Necessary for the pursuit of Team Rynkeby Foundation's legitimate interests by being able to investigate reports via the whistleblower scheme)
  • Article 9(2)(b) of the Personal Data Regulation (necessary for the purpose of complying with work, health and social law obligations), cf. Data Protection Act § 7(2) and § 12.
  • Article 9(2)(f) of the Personal Data Regulation (necessary for legal claims to be established, asserted or defended)
  • Section 8 of the Data Protection Act regarding information on criminal offenses and criminal convictions
  • Section 11 of the Data Protection Act regarding CPR number

Recipients

We may share your personal data with:

  • External advisers
  • The police
  • Public authorities

Storage

We will store personal data as long as it is necessary for the purposes mentioned.

  • The information is kept as long as the investigation is ongoing. The retention period will then depend on the outcome of the investigation.
  • If the report falls outside the whistleblower scheme, but otherwise does not appear to be unfounded, the information is passed on to Team Rynkeby Fonden's General Manager, where it is processed in accordance with Team Rynkeby Fonden's relevant policies and procedures.
  • If a report is made to the police or another authority, the information will be stored, at least as long as the investigation is ongoing with the police/authority.
  • If, on the basis of the collected information, a disciplinary sanction is implemented against the person who made the report, or there are otherwise reasons why it is factual and necessary to continue to store the information about the person who made the report, the information is stored in the personnel file of the person in question, if the reporter is employed.
  • If the report turns out to be groundless, the report is terminated immediately, and the personal data is deleted after 45 days from the finding that the report was deemed groundless.
  • In other situations, it is concretely assessed whether there are factual reasons for storing the information and, if so, for how long.

3 ORIENTATION TO THE REPORTED AND RECTIFICATION

If you are subject to a report via the whistleblower scheme, you will be notified as soon as possible after a preliminary investigation has taken place and all relevant evidence has been secured, and you will receive information about:

  • The identity of the person(s) responsible for investigating the report
  • A description of the content of the allegations
  • Who has seen the report

As set out below in the section on your general rights, you have the right to access the report submitted about you. If we are aware of the reporting party's identity, you also only have the right to be informed of the identity if you have the right to do so according to the law. However, you do not have the opportunity to be informed of the identity of the person who submitted the report, if the reporter is anonymous

If it is concluded that this is a deliberately false report, you will be able to find out who filed the report against you if the identity of the reporter is known.

You also have the right to request the correction of information in the review that you believe is incorrect, misleading, incomplete or out of date. If your request cannot be met, the information will be supplemented with your comments.

4 CONSEQUENCES OF THE TREATMENT

Reporting to and investigation of reports in the whistleblower scheme can have significant consequences for the person reported, as reports relate to violations or suspected violations of the legislation, as the scheme is otherwise defined in the separate guidelines for the scheme. Correspondingly, reporting to the whistleblower scheme can have significant consequences for the person who made the report if it is a deliberate false report. Such cases can, among other things, have criminal consequences.

5 TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA

As a rule, your personal data is not transferred to countries outside the EU/EEA. However, this may be the case if the inquiry involves Team Rynkeby activities in countries outside the EU/EEA.

6 YOUR GENERAL RIGHTS

You have the following rights:

  • You have the right to request access to, correction of or deletion of your personal data.
  • You also have the right to object to the processing of your personal data and to have the processing of your personal data restricted.
  • In general, you have an unconditional right to object to the processing of your personal data for use in direct marketing.
  • If the processing of your personal data is based on your consent, you have the right to revoke your consent at any time. Your revocation will not affect the legality of the processing carried out prior to your revocation of your consent.
  • You have the right to receive the personal data that you have submitted yourself in a structured, commonly used and machine-readable format (data portability).
  • You can always file a complaint with a data protection supervisory authority, e.g. The Danish Data Protection Agency. In addition, you have the right to object to our processing of your personal data:
  • If our processing of your personal data is based on Article 6(1)(e) (public interest or exercise of public authority) or Article 6(1)(f) (balancing of interests), see above under processing basis, you have the right to object to such processing at any time for reasons that may relate to your particular situation. There may be conditions or limitations to these rights. It is, therefore, not certain that you, for example, has the right to have information about you deleted in the specific case, this depends on the specific circumstances in connection with the processing activities. You can exercise your rights by contacting legal@oestermarkgrouting.com.

7 RIGHT TO JUDICIAL TRIAL

If legal action is taken against you as a result of a report and subsequent investigation, you have the right to take the matter to court.

8 QUESTIONS

If you have any questions regarding this policy, please contact us here team-rynkeby@team-rynkeby.com

Updated October 2022