Whistleblower Data Protection Information
Privacy Policy
In compliance with Article 13 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, Article 11 of Organic Law 3/2018 of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights and Article 31 of Law 2/2023, of February 20, regulating the protection of persons who report regulatory infringements and the fight against corruption, we detail below the information on personal data protection with respect to the processing of data in the Internal Information System:
1. PERSON IN CHARGE OF THE TREATMENT
The Data Controller is EMICELA, S.A., with NIF A35081785, domiciled at Canal Izquierdo (subida), number 5, Polígono Industrial Arinaga, 35118, Agüimes, Las Palmas de Gran Canaria, Spain.
Your personal data will be treated with the strictest confidentiality, only by authorized personnel.
2. ORIGIN OF THE DATA
In case you have chosen to identify yourself, your personal data have been obtained through the form filled in by you from the complaints channel enabled by EMICELA, S.A. or, where appropriate, through the following e-mail: canaldenuncias@emicela.es.
3. PURPOSE OF THE TREATMENT
The personal data provided by you through the form and those contained in the documentation you submit in support of your communication, will be processed for the sole purpose of managing the complaints received through the channel or mail and process the investigations of the alleged facts reported, or, where appropriate, to respond to the query raised, as well as to adopt, if appropriate, protective measures and / or prevention of retaliation, all in compliance with the provisions of the Internal Information System Policy and the Protocol for managing the complaints channel.
4. LEGITIMACY OF THE TREATMENT
The legal basis for the processing of your personal data in the management of the Internal Information System will be that established in art. 6.1.c of the RGPD, insofar as the processing is necessary for compliance with a legal obligation applicable to the data controller in accordance with the provisions of Law 2/2023, of February 20, regulating the protection of persons who report regulatory infringements and the fight against corruption.
5. CONSERVATION PERIODS
The data processed may be kept in the information system only for the time necessary to decide whether to initiate an investigation into the facts reported.
If it is proven that the information provided or part of it is not truthful, it shall be immediately deleted as soon as such circumstance comes to light, unless such lack of truthfulness may constitute a criminal offense, in which case the information shall be kept for the necessary time during the legal proceedings.
In any case, if three months have elapsed since the receipt of the communication and no investigation has been initiated, it must be deleted, unless the purpose of the conservation is to leave evidence of the operation of the system. Communications that have not been acted upon may only be recorded in anonymized form, without the obligation to block provided for in Article 32 of Organic Law 3/2018 of December 5 being applicable.
In no case will personal data that are not necessary for the knowledge and investigation of the actions or omissions to which Law 2/2023, of February 20, regulating the protection of persons who report regulatory violations and the fight against corruption, will be processed, proceeding, if necessary, to their immediate deletion. Likewise, any personal data that may have been communicated and that refer to conduct that is not included in the scope of application of said law will be deleted.
If the information received contains personal data included in the special categories of data, it will be immediately deleted, without the registration and processing of such data.
Personal data relating to information received and internal investigations contained in the log-book will only be kept for the period necessary and proportionate to comply with the aforementioned Law. In no case may the data be kept for a period of more than ten years.
6. RECIPIENTS OF THE DATA
We inform you that your identity, in the event that it is provided or identifiable, will in any case be reserved, and will not be communicated to the persons to whom the facts reported refer or to third parties outside the management and processing of the communication, except when it is necessary for the adoption of corrective measures in the entity or the processing of disciplinary or criminal proceedings, if any, in which case it must be communicated to the competent authorities in the matter.
The personal data processed in the Internal Information System may be communicated to the judicial authority, the Public Prosecutor’s Office, the State Security Forces and Corps, or the competent administrative authority, in the context of an investigation they are carrying out or in the framework of a judicial process. They may also be reported to the competent state or regional authorities for the protection of the informant.
In the event of outsourcing the management of the internal information system, the information provided through the online channel may be processed by the external third party, as a data processor, in accordance with the provisions of Article 6 of Law 2/2023 of February 20, regulating the protection of persons who report regulatory violations and the fight against corruption.
There are no plans for international transfers of data by assignment or commissioning of processing.
7. RIGHTS OF INTERESTED PERSONS
The informants have the right to access their personal data, as well as to obtain the rectification of inaccurate or incomplete personal data, to request the deletion of their personal data and to urge the limitation of processing, by sending a letter to the postal address indicated above or to the e-mail address dpo@emicela.es, at any time and free of charge. In addition, you will have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), if you consider that a breach of data protection legislation has been committed with respect to the processing of your personal data.
