We, Argen Dental GmbH, have implemented an internal whistleblowing system for the detection and prevention of violations of applicable law and internal company policies.
This whistleblowing system is available at all times to employees and business partners, including customers and suppliers.
Our whistleblowing system gives you the opportunity to report suspected violations, including anonymously.
If, as a reporting person, you do not wish to remain anonymous, you may voluntarily provide your first and last name as well as your contact details, such as your telephone number, email address and postal address.
When you submit a report, it is necessary for us to process the information you provide concerning the incident as well as any contact details you may provide, such as your telephone number, email address or postal address, for the purpose of investigating violations of applicable law or internal company policies or preventing such violations. Where necessary, this information may be disclosed confidentially to third parties, such as external auditors and/or lawyers.
If you upload files as supporting evidence for your report, please ensure beforehand that they do not contain any unwanted metadata or personal data that could compromise your anonymity when submitting an anonymous report.
Information on data protection can be found in our Privacy Policy.
1. Introduction
The following information is intended to provide you, as a data subject, with an overview of the processing of personal data in connection with our whistleblowing system and of your rights under applicable data protection laws.
2. Controller and Data Security
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Argen Dental GmbH
Fritz-Vomfelde-Str. 12
40547 Düsseldorf
Germany
The whistleblowing system is operated on our behalf by our processor, audatis Group GmbH, Luisenstraße 1, 32052 Herford, Germany. Only we are able to access the data stored in our whistleblowing system.
Access to all data is strictly regulated and restricted to a limited group of expressly authorised persons.
3. Data Protection Contact
For data protection enquiries, please use our contact form at:
https://www.argen.de/kontakt/datenschutz/
or contact us by email at:
datenschutz@argen.de
4. Purpose of the Whistleblowing System and Legal Bases for Processing
The whistleblowing system is used to receive reports concerning actual or suspected violations within the company of statutory provisions or internal company policies.
Where information relating to an individual's status as an employee, information concerning the person affected by a report, or other information from which natural persons may be identified is processed, such processing is carried out either for compliance with legal obligations under the German Whistleblower Protection Act (Hinweisgeberschutzgesetz – HinSchG) pursuant to Article 6(1)(c) GDPR or, where the whistleblowing system is provided voluntarily, on the basis of our legitimate interests pursuant to Article 6(1)(f) GDPR.
Our legitimate interest consists in processing reports in order to take appropriate follow-up measures. The processing is also carried out in pursuit of the company's legitimate interest in fulfilling its supervisory obligations pursuant to Article 6(1)(f) GDPR in conjunction, in particular, with Section 130(1) of the German Act on Regulatory Offences (Ordnungswidrigkeitengesetz – OWiG).
Legal measures taken to sanction violations are based on Section 26(1), sentence 2, of the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). Where competent authorities are involved, the processing is based on the company's legitimate interest in fully investigating violations and preventing future violations pursuant to Article 6(1)(f) GDPR or, where there is a corresponding legal obligation, on Article 6(1)(c) GDPR in conjunction with the relevant statutory provision.
Where we obtain consent, such consent constitutes the legal basis for processing for the purposes specified in the relevant declaration of consent pursuant to Article 6(1)(a) GDPR.
5. Personal Data We Collect and Information Regarding Attachments
In connection with the receipt and processing of reports through our whistleblowing system, we process the following personal data:
the IP address used to access the whistleblowing system; this is completely deleted immediately after the connection has ended;
the username selected by the reporting person;
the identity and contact details of the reporting person, where voluntarily provided;
the date, time and content of the report, including, for example, times, locations, persons involved and possible violations.
6. Recipients of Personal Data and Transfers to Third Countries
For the purpose of processing, investigating and further pursuing a report submitted through our whistleblowing system, and in order to remedy any violations identified, it may be necessary to inform additional persons or departments about the contents of a report.
Any disclosure of information outside the restricted group responsible for handling whistleblowing reports is made strictly in accordance with the “need-to-know” principle. This means that only persons whose involvement is strictly necessary will be informed, and only to the extent required for the relevant purpose.
Following receipt of a report, it may be necessary to involve, in addition to management, the legal department, external advisers such as law firms and/or auditing firms, competent authorities such as law enforcement agencies or competition authorities, and courts.
Where a subsidiary is involved in the reported violation, for example because the report concerns activities within that subsidiary, it may also be necessary to inform employees of that subsidiary.
In certain cases, data protection law may also require the employee accused in a report to be informed of the allegations made against them. Where legally permissible, the identity of the reporting person will not be disclosed, either directly or indirectly.
This does not apply where a report has deliberately been made abusively, in particular where knowingly false information has been submitted with the intention of causing harm to the person concerned.
7. Retention Period for Personal Data
Personal data processed within the whistleblowing system will be retained for as long as necessary to assess, process and, where applicable, further pursue the report and to enforce any claims of the company.
In accordance with Section 11(5) HinSchG, documentation relating to reports will generally be deleted three years after completion of the relevant procedure, unless a longer retention period is necessary for the clarification of further legal steps.
Personal data may be retained beyond the periods stated above where and to the extent that the company is legally required to retain such data or can demonstrate an overriding legitimate interest in its continued retention.
8. Automated Decision-Making
No automated decision-making or profiling of any kind takes place.
9. Your Rights as a Data Subject
Subject to the requirements of the relevant statutory provisions and taking into account any limitations to these rights under the GDPR and the BDSG, you have the following rights as a data subject:
Right to Confirmation
You have the right to obtain confirmation from us as to whether personal data concerning you is being processed.
Right of Access – Article 15 GDPR
You have the right to obtain from us, free of charge and at any time, information about the personal data stored concerning you and to receive a copy of such data in accordance with the applicable legal requirements.
Right to Rectification – Article 16 GDPR
You have the right to request the rectification of inaccurate personal data concerning you.
You also have the right, taking into account the purposes of the processing, to request that incomplete personal data be completed.
Right to Erasure – Article 17 GDPR
You have the right to request that personal data concerning you be erased without undue delay where one of the statutory grounds for erasure applies and insofar as the processing or storage of the data is no longer required.
Right to Restriction of Processing – Article 18 GDPR
You have the right to request restriction of the processing of your personal data where one of the statutory requirements is met.
Right to Data Portability – Article 20 GDPR
You have the right to receive personal data concerning you which you have provided to us in a structured, commonly used and machine-readable format.
You also have the right to transmit such data to another controller without hindrance from us.
In addition, where technically feasible and provided that this does not adversely affect the rights and freedoms of others, you have the right to have personal data transmitted directly from one controller to another.
Right to Object – Article 21 GDPR
You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you where such processing is based on Article 6(1)(e) GDPR, relating to processing carried out in the public interest, or Article 6(1)(f) GDPR, relating to processing based on a balancing of legitimate interests.
If you object to the processing, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims.
Withdrawal of Consent
You have the right to withdraw your consent to the processing of personal data at any time with effect for the future.
Where the consent relates to the processing of the reporting person's identity data, the consent may only be withdrawn within one month after the report has been submitted.
After expiry of this period, it may generally be necessary to inform the employee accused in the report about the processing of their personal data, including the source of the report. Accordingly, the processing can generally no longer be discontinued after expiry of the one-month period.
In exceptional cases, for example where statutory notification periods apply, the period within which consent may be withdrawn may be shorter.
Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint with a competent data protection supervisory authority regarding our processing of your personal data.