Privacy Policy

DATA PROCESSING FOR PARTIES INVOLVED IN THE INTERNAL WHISTLEBLOWING CHANNEL

Purpose of Processing:

At ESTABLIMENTS ANDREU, S.L., we process the information provided by interested parties to manage the internal whistleblowing channel and protect individuals reporting regulatory violations or corruption. This is done to inform the responsible party of any actions or conduct within the entity or by contracting third parties that may contravene applicable general or sectoral regulations. If you do not provide your personal data, we cannot fulfill the purposes described.

No automated decisions will be made based on the provided data.

Data Retention Period:

Data will only be retained in the information system for the time necessary to determine whether to initiate an investigation into the reported events (up to three months). If it is determined that the information provided, or part of it, is not truthful, it must be immediately deleted as soon as this is verified, unless the inaccuracy constitutes a criminal offense, in which case the information will be retained for the duration of the legal proceedings.

Three months after receiving the communication without investigation, the data will be deleted, unless retention is necessary to demonstrate the system’s functionality. Non-processed communications may be anonymized, exempting them from the blocking requirement in Article 32 of Organic Law 3/2018, of December 5. Data will be kept in the information record for a necessary and proportionate time, up to a maximum of ten years.

Legal Basis for Data Processing:

· Compliance with a legal obligation: Directive (EU) 2019/1937 of the European Parliament and Council of October 23, 2019, concerning the protection of individuals reporting violations of Union law (art. 8; requirement to establish internal whistleblowing channels - Law 2/2023, of February 20, regulating protection for individuals reporting regulatory violations and anti-corruption).

· Consent of the data subject: For the storage, recording, and/or transcription of complaints made through phone lines and voice messaging systems, and for recording/transcription of requested personal meetings for complaints (Directive (EU) 2019/1937; art. 18.2 and 4).

Data Recipients:

· State Security Forces; Judicial Bodies; Public Prosecutor’s Office, to report the commission of a possible crime (legal requirement).

· Data Processors: Providers of whistleblowing channel software, business management software, and legal advisors for the company.

Data Transfers to Third Countries:

No data transfers to third countries are anticipated.

Data Source:

The personal data we process at ESTABLIMENTS ANDREU, S.L. are provided by the reporting individuals with an employment, commercial, or service relationship with the entity.

Data categories processed include:

• Identification data.
• Commercial information.
• Financial data.
• Potential irregularities/offenses.

Special category data, such as health information, may be processed if necessary.