Information for the data subject on personal data protection and the exercise of rights in relation to claims processed locally in Spain through the Redtrust Ethics Channel
Rights regarding Personal Data Protection.
Data Controller
- Identity: EVOLIUM TECHNOLOGIES, S.L.U
- TAX ID: B66168543
- Registered Office: Calle Ausias March 7, 1ª Planta, 08010 Barcelona
- Email: [email protected]
- Phone: +34 919 05 11 58
Purpose of Data Processing
The personal data provided in the communication will be processed with the purpose of addressing and analyzing the report, investigating the reported facts, and implementing the appropriate corrective measures, whether disciplinary or contractual, to ensure Redtrust’s due diligence and compliance.
Categories of Personal Data
The personal data that Redtrust will process includes the information provided by the reporter through the communication, as well as any additional data that may be collected as a result of the investigation initiated in accordance with the procedure established for the Redtrust Ethics Channel.
Anonymity and Confidentiality
The reporter may choose to identify themselves, but they can also report any incident anonymously. In any case, both personal data and information will be treated confidentially.
The reporter may also choose to identify themselves at a later stage after submitting the report or provide additional documentation or information at a later stage of the process.
The involvement of witnesses and affected parties will remain strictly confidential.
Legal Basis for Data Processing
The processing of personal data of the data subjects by Redtrust is legitimized based on public interest (Art. 6.1.e GDPR) and the fulfillment of a legal obligation (Art. 6.1.c GDPR).
The processing of special categories of personal data for reasons of essential public interest will be carried out in accordance with Article 9.2(g) GDPR.
Data Retention
The information provided through the Ethics Channel will be retained for as long as necessary to determine whether an investigation into the reported facts should be initiated, and, if applicable, for the additional time required to comply with applicable legal or internal regulations.
The personal data of the person submitting the report and all parties involved will only be retained for the time necessary to decide whether to initiate an investigation into the reported facts, which will never exceed three (3) months from the submission of the report. Once this maximum period has elapsed without an investigation being initiated, the personal data will be deleted from the Ethics Channel, unless the purpose of retention is to record its operation, in which case the data will be anonymized.
If it is proven that the information provided, or part of it, is not truthful, it must be deleted immediately as soon as this circumstance is known, unless such lack of truthfulness could constitute a criminal offense, in which case the information will be retained for as long as necessary while the legal procedure is ongoing.
Data Disclosure
- Authorities that may be involved in the investigation or potential legal proceedings.
- Individuals who may be involved in the investigation itself.
- State Security Forces and competent Courts.
- Third parties that Redtrust may rely on to manage the Ethics Channel, such as data hosting platforms, individuals who may be delegated to conduct a detailed investigation, lawyers, or other types of advisors, among others.
Ejercicio de derechos
- Rights of the reporter: At any time, the reporter may exercise their rights of access (to their own personal data, but not to those of other potential participants or individuals affected by the investigation), rectification, erasure, objection, restriction, and portability concerning the personal data provided. These rights can be exercised by postal mail to the indicated address or via email at [email protected], identifying themselves as a user of the Ethics Channel service, within the limits established by applicable regulations.
- Rights of the Person Involved in the Reported Facts: They have the right to be informed as soon as possible that they are part of an investigation resulting from a report related to them or their actions. This communication will include, at a minimum, the procedure for handling the report, as well as all information related to the processing of their data as outlined in the previous section. They have the right to access the registered data, except for the identity of the reporter and the personal data of other individuals affected by the case, and the right to rectify any inaccurate or incomplete personal data. They also have the right to be informed of the resolution or closure of the alert, if applicable. When notifying the person involved about the report may compromise Redtrust’s ability to investigate or collect evidence effectively—due to the risk of destruction or alteration of evidence by the person affected—this duty of information may be delayed.
The person involved in the reported facts may also exercise other rights provided by data protection regulations: erasure (in accordance with the data retention periods established by current legislation), restriction, and portability of their personal data. These rights can be exercised by postal mail to the indicated address or via email at [email protected], identifying themselves as affected by an internal investigation, provided it is compatible with the proper conduct of the investigation.
If any of these rights are considered violated, a complaint may be filed with the Spanish Data Protection Agency (www.aepd.es).
Security and Confidentiality Measures
The internal information system has the necessary technical and organizational measures to protect the identity of the affected individuals and any third parties mentioned in the provided information. These measures are designed to ensure the confidentiality of the data, with special emphasis on protecting the identity of the reporter in the event that they have been identified.
