Privacy and data protection policy
The notices sent in the service are only readable by the specified persons. In the case of Spectre A/S, these persons are the Group Director People & Culture, the Group Responsible Business Director. All notifications will be treated confidentially.
Privacy policy for handling reports of wrongdoing (Whistleblowing Channel)
1. Controller Spectre A/S
Address: Orionvej 1-3, 7430 Ikast, Denmark
Contact person: Group Finance director; mail@spectre.dk
2. Purpose and legal basis of processing
The Whistleblowing Channel is designed to give all employees of the Group as well as external stakeholders a means to report suspected cases of wrongdoing anonymously. Personal data need to be processed in order to investigate such reports and to decide on and implement any resulting penalties.
Abuse of the Whistleblowing Channel is prohibited and may result in legal action.
The controller is committed to protecting the data subjects’ privacy and to only using personal data collected by means of the Whistleblowing Channel as permitted by data protection laws and good data protection practice.
Legal basis:
The processing of whistleblowers’ personal data is based on consent (GDPR, Art 6.1(a) and Art 9.2(a)).
The processing of personal data pertaining to the subjects of whistleblowing reports and the persons responsible for processing the reports is based on the controller’s legitimate interest (GDPR, Art 6.1(f)). All processing is based on Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (OJ L 305/34 of 26 November 2019), which is due to be transposed into Finnish law by the end of 2021. The processing of special categories of personal data is necessary for the purposes of carrying out the obligations of the controller in the field of employment law (GDPR, Article 9.2(b)).
3. Data sources
Potential whistleblowers include employees of the Group as well as external stakeholders. The controller also collects information that is necessary for investigating reports of wrongdoing from the interested parties themselves as well as from other individuals or organisations that may be involved.
4. Categories of data subjects and data
1. Whistleblowers
As a rule, whistleblowers report their suspicions anonymously. Some whistleblowers also include personal information (such as their name, location and certain financial information). Some reports contain pictures or video footage. Information provided by whistleblowers themselves may also contain special categories of personal data (such as information about a person’s health). The circumstances of the case may make it possible to identify the whistleblower indirectly.
2. Subjects of reports
Reports of wrongdoing may contain information about the subject (such as their name, location, certain financial information, pictures or video footage), their behaviour and circumstances as well as other personal information. Some reports also contain special categories of personal data (such as information about a person’s health).
3. Processors
The following personal data are collected from the persons responsible for processing whistleblowing reports: - name, title, usernames, log data
4. Access to and disclosure of personal data
Only employees specifically assigned by the controller to process whistleblowing reports and investigate reported cases have access to the personal data relating to such reports.
The administrator of the controller’s Whistleblowing Channel is an external service provider (Plan Brothers Ltd). The controller and the service provider have signed an agreement to ensure that the service provider only uses personal data collected by means of the Whistleblowing Channel as permitted by the applicable data protection laws.
Personal data may be disclosed to third parties, such as the authorities or external auditors, as per the law.
6. Transfers of personal data to non-EU/EEA countries
The external service provider acting as the administrator of the Whistleblowing Channel has subcontractors who provide technical data processing services and some of whom are based in the United States and thereby outside of the EU.
Spectre A/S has implemented the appropriate contractual safeguards to ensure adequate protection of any data transferred to non-EU/EEA countries as well as compliance with the laws governing the processing of personal data and stipulated that the service provider incorporate the standard contractual clauses for data transfers adopted by the Commission as referred to in Article 46.2(c) of the General Data Protection Regulation into its own subcontracting agreements.
The latest versions of the standard contractual clauses can be found on the European Commission’s website.
7. Data storage periods
As a rule, data are kept for no longer than two (2) years after the end of each investigation. Longer storage periods may be necessary due to mandatory legal obligations arising from, for example, criminal procedure or occupational safety laws.
8. Rights of data subjects
Data subjects always have the right to
1. obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data;
2. request from the controller rectification of their personal data;
3. request from the controller restriction of processing of their personal data in the circumstances referred to in Article 18 of the General Data Protection Regulation; and
4. lodge a complaint with the Data Protection Ombudsman.
Data subjects also have the right to
5. request from the controller erasure of their personal data; or 6. withdraw their consent at any time, where the processing of the data subject’s personal data is based on their consent.
If the processing is based on the controller’s legitimate interest, data subjects have the right to
7. object to the processing of their personal data in the circumstances referred to in Article 21 of the General Data Protection Regulation.
Data subjects can request access to their data or exercise their other rights by contacting Group Finance director; email: mail@spectre.dk
Data can only be disclosed to individuals who are able to reliably prove their identity.
9. Enquiries concerning the processing of personal data
Should you have any questions about the processing of personal data, please contact Group Finance director; email: mail@spectre.dk