Information clause for a whistleblower
With the purpose of ensuring the fulfillment of your rights under the Regulation (EU) 2016/679 Of The European Parliament And Of The Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as “GDPR”), in compliance with the article 13 of GDPR, hereunder we provide you with information compliant with the obligation to provide information:
- The Controller of your personal data is MOTOROL AUTOMOTIVE spółka z ograniczoną odpowiedzialnością based in Kraków, Poland, ul. Bociana 19, 31-231 Kraków, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for Kraków-Śródmieście
in Kraków XI Commercial Division of the National Court Register under no KRS 0000940634, NIP
6760033853, e-mail address: odo@motorol.pl, phone number.: (12) 420-44-00 (hereinafter referred to as “Controller”). Controller have designated Data Protection Officer, who can be contacted in regard to all matters related to processing of your personal data, e-mail address: katarzyna.chmiel@motorol.pl - Your personal data may be used for the purpose of:
- receiving, handling, assessing, verifying, investigating reports received by Controller from whistleblowers i.e. in the scope necessary for performing internal procedure of reporting on violations of the law applying at the Controller’s and follow-up actions, i.e. complying with legal duties of Controller on the basis of article 6(1) point c) of GDPR, in connection with the Act on the protection of whistleblowers of 14th June 2024 and on the basis of article 9(2) point g) of GDPR in connection with Act on the protection of whistleblowers of 14th June 2024 – provided whistleblower’s report contains such personal data,
- receiving, handling, assessing, verifying, investigating of report and concluding internal investigation, in regard to personal data of whistleblowers, of which processing is not a legal duty of Controller, i.e. processing of personal data carried out by the Controller for purposes of their legitimate interests, i.e. on the basis of article 6(1) point f of GDPR,
- pursuing claims and defending against claims, i.e. processing of personal data carried out by the Controller for purposes of their legitimate interests, i.e. on the basis of article 6(1) point f of GDPR,
- processing of personal data on the basis of voluntary consent for disclosure of identity, provided you decide not to preserve your anonymity, i.e. on the basis of article 6(1) point a) of GDPR
- Your personal data may be disclosed to contractors of Controller – entities cooperating on the basis of contract for entrusting the processing of personal data, within the scope required for performing aforementioned purposes, and to entities providing ongoing advisory services (i.e. law firms, IT services, device service companies, document disposing companies, postal services, delivery services) and to public authorities, institutions or third parties who have legal right to access or obtain personal data.
- Your personal data may be transferred to outside of European Economic Area (hereinafter: “EEA”). The above might be applicable in the event of violation report referring to entities based outside of EEA, or in the event of Controller outsourcing certain services to entities based outside of EEA, or to entities processing personal data outside of EEA. Your personal data may be transferred to countries outside of EEA (hereinafter: “third countries”) or entities based in third countries solely if those countries or entities have been deemed by the decision of the European Commission to be providing an adequate level of data protection or if agreements with those entities include standard data protection clauses. With regard to data transfer outside EEA, you may demand Controller to disclose additional information about security measures applied to that data, demand to be provided with a copy of aforementioned security measures with addition of information about the place of their disclosure, by contacting Controller via communication channels provided hereto
- Your personal data will be processed for the period of time necessary for registering and processing of the report, and afterwards stored for the time necessary for documenting performed measures, including, for the event of revelation of new circumstances regarding the report, obligation to disclose data to law-enforcement authorities, supervisory authorities, judicial authorities or in the event of possible claims for the period necessary for their resolving. As a general rule, your personal data will be stored for the period of time determined by the law for archiving of documents and the period of limitation of claims.
- You have a right to access the content of your data. You also have the right to have your data rectified, erased, to demand restriction of processing of your data, to file an objection to processing your data by the Controller on the basis of Controller’s legitimate interests. If the data is processed on the basis of consent, the consent can be withdrawn at any time, without affecting the legitimacy of the processing of data carried out before the withdrawal.
- In the event of acknowledging that processing of your data may violate provisions of GDPR, you are eligible to lodge a complaint to Personal Data Protection Office.
- Providing your personal data in the report form is voluntary, but necessary for accomplishing stated goals of processing data and taking action by Controller.
- Your personal data will not be subject to automated processing or profiling.