Privacy policy - Whistleblowing Channel
Ethical Channel Privacy Policy and Important Information
Important information on the Ethical Channel
1. Purpose of the Ethical Channel:
The Ferrer Ethical Channel is an information system designed for reporting conducts, events and incidents with indications of the appearance of infringement created to encourage compliance with the Code of Ethics, Ferrer values and principles, and the regulatory framework that binds the company. Ferrer staff and stakeholders (vendors, customers, patients and other third parties, where applicable) who are aware of potentially irregular actions that could be a crime or could contravene the Group's ethical principles can use this tool to voice their concerns.
We use the Ethical Channel to collect personal data (hereinafter, “data” or “personal data”) of different types which may sometimes contain sensitive information. In such data you may be referred to as a claimant or data subject with regards a report or complaint, although your data will always be processed in accordance with the obligations established under the data protection laws in force.
2. Confidentiality and anonymity:
If you provide us with your identity, we will keep it in the utmost confidentiality throughout the process and never disclose it to respondents nor make it available to unauthorised parties unless required by the public authorities and regulatory bodies, courts or tribunals. If you supply third party personal data, these parties will have the opportunity to comment on these reports and may be informed of this, and even in these cases your identity as claimant will be maintained. We will never divulge information on your identity to the parties concerned so long as there is no legal impediment and your anonymity does not entail the assumption of a risk by Ferrer.
However, you may if you wish to submit your report or complaint and enclose the documentation you consider appropriate anonymously. In these cases, all personal information will be erased from the enclosed documentation to preserve your anonymity.
3. Abuse of the system, false reports and commitment to non-retaliation
People who use the Ethical Channel in good faith will face no reprisals as a result of employing the system and will not be subject to any type of sanction by Ferrer.
Ferrer guarantees suitable protection of privacy and personal data and the preservation of honour, the presumption of innocence and the right to defence of respondents, in particular against unfounded or false complaints or ones filed in bad faith, and the company will, where applicable, adopt suitable disciplinary measures.
You must also guarantee that the information you supply over the Ethics Channel is true, accurate, complete and current.
Personal data protection
1. Data controller and DPO contact details:
As data controller, GRUPO FERRER INTERNACIONAL, S.A. (hereinafter, “Ferrer”) will process the data received over the Ethical Channel pursuant to Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons in relation to the processing of personal data (hereinafter, the “GDPR”), Organic Law 3/2018 of 5 December 2018 on data protection and the safeguard of digital rights (hereinafter, “LOPDGDD”) and Law 2/2023 of 20 February 2023 regulating the protection of people who report regulatory breaches and the fight against corruption (“Informant Protection Law”), as well as other applicable data protection regulations. To that end, Ferrer’s identification details are:
-
Owner: GRUPO FERRER INTERNACIONAL, S.A.
-
Registered address: Av. Diagonal nº 549, 5ª planta, 08029, Barcelona, Spain
-
Tax ID code (C.I.F.): A61738993
-
Email address: lopd@ferrer.com
For any questions or queries, please contact our data protection officer at dpo@ferrer.com.
2. Types of data processed
We will process the following personal data whether you supply it directly or via a third party:
| Type of data subject | Data categories and types of data subject to processing |
|---|---|
|
Named complainant |
a) Identification data: full name. |
|
Anonymous complainant (The claimant may supply the following data or none of the data) |
a) Pseudonym, if used. |
|
Respondent |
a) Identification data: full name. |
|
Witness |
a) Identification data: full name. |
|
Third party |
a) Identification data: full name. |
3. Processing purposes
We will process your personal data, the information and documents you supply in order to process, investigate and propose resolutions on the reports and complaints related with potentially criminal activities or regulatory/ethical breaches received over the Ethical Channel, pursuant to the Ferrer Whistleblowing Management System Procedure and Policy, as well as Ferrer’s Code of Ethics.
4. Grounds for processing
The legal grounds legitimising the processing of your data lies in the performance of a legal obligation, pursuant to article 30 of the Informant Protection Law. If the data are considered to be of a special category, their processing will be excepted pursuant to article 30 of the Informant Protection Law in relation to article 9.2.g) of the GDPR since they will be required for reasons of substantial public interest.
5. Data storage period in the Ethical Channel
Personal data processed for this purpose will be stored in the Ethical Channel solely for the time required to decide whether to open an investigation into the allegations. They must in any event be erased from the Ethical Channel three months after they are entered. If an investigation is opened, the data will be stored outside of the Ethical channel for as long as the investigation lasts. If the investigation leads to the adoption of particular measures against the investigated parties, the data will be kept so long as the applicable legal actions persist.
When the storage period has ended, the data will be duly blocked and kept to prove compliance with the regulations on Ferrer’s availability of an Ethics and Compliance model in accordance with art. 31 a) of the Criminal Code.
6. Data recipients
In general, data access will be restricted exclusively to the members of compliance-related corporate governance bodies (Ferrer Corporate Ethics and Compliance Committee and, where applicable, the Ethics and Compliance Advisory Board) and/or any parties tasked with internal or external investigations (as data processors). When it is necessary to take disciplinary measures against Ferrer personnel, this access will also be enabled for staff with management and control functions in the Ferrer People area.
Your data will never be assigned, sold, leased or made available in any other way to any third party except service providers to receive reports over the channel and, where applicable, to manage and conduct any investigations as required, and these parties will never process the data for their own purposes.
Notwithstanding the above, the personal data in complaints may be disclosed to law enforcement agencies, courts or tribunals and any other competent body if required in compliance with the laws in force.
In particular, in the case of Ferrer company personnel located outside the European Economic Area, international data transfers may be conducted when strictly necessary to settle a case reported over the Ethical Channel. In this case, Ferrer will adopt suitable measures to ensure your personal data remain protected in the manner established herein and apply the mechanism required in each case in accordance with the GDPR when transferred outside the EEA. We also ensure that any third party recipient of your data has appropriate security measures in place to protect your data.
7. Automated decisions and profiling
Ferrer will never adopt automated decisions with your data nor perform profiling.
8. International transfers
Ferrer has different subsidiaries and it may happen that, if a specific case must be reviewed, after conducting the pertinent investigation, your data may be processed outside the European Union or European Economic Area.
In any event, Ferrer will ensure that such processing is always protected with suitable safeguards which may include, among others, the signing of standard contractual terms approved by the European Commission. These clauses consists of Commission-approved contracts that provide sufficient safeguards to ensure that the processing complies with GDPR requirements. If you would like to obtain a copy of or further information on the suitable or appropriate guarantees for a particular case, please write to lopd@ferrer.com.
9. Exercise of rights
You may exercise your rights of access, rectification, erasure, restriction of processing, data portability or objection at any time and free of cost, expressly indicating which right from among them you wish to exercise. You may send your request to the following addresses:
-
By email to lopd@ferrer.com.
-
By postal mail to Ferrer at Av. Diagonal nº 549, 5ª planta, 08029, Barcelona (Spain).
We will consider all requests and answer within the term established by the laws in force. However, please remember that your rights of erasure and objection may be limited while the allegations are being investigated or actions in or out of court are being exercised in their regard, in which case your identity must be kept to satisfy Ferrer’s interests or to meet a legal obligation.
In any event, you may file a complaint with the Spanish Data Protection Agency (www.aepd.es), with registered office at C/Jorge Juan núm. 6, 28001 Madrid if you believe Ferrer has breached the rights recognised to you under the applicable laws.