TÜV SÜD Trust Channel privacy policy for Spain
At TÜV SÜD we take the confidentiality and protection of your data very seriously in accordance with the EU General Data Protection Regulation and the Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights. Please read this information on personal data protection carefully before sending a message.
The TÜV SÜD Trust Channel is the information channel for securely and confidentially receiving, processing and managing messages about potential compliance violations at TÜV SÜD.
However, there may be other external reporting channels of the regional administrations and the external reporting channel of the Independent Whistleblower Protection Authority, where any natural person may directly report the commission of any infringement as defined in the scope of application of Law 2/2023 of 20 February, regulating the protection of persons who report regulatory and anti-corruption infringements, without prejudice to prior communication through the TÜV SÜD Trust Channel.
Data controller
TÜV SÜD in Spain (*)
Ronda de Poniente, 4
28760 Tres Cantos (Madrid)
Email: ldpc.es@tuvsud.com
Contact of the Data Protection Officer in Spain: ldpc.es@tuvsud.com - Local Data Protection Coordinator.
(*) TÜV SÜD operates in Spain through the following entities:
- TÜV SÜD ATISAE, S.A.U.
- TÜV SÜD IBERIA, S.A.U.
- TÜV SÜD AMT, S.A.U.
- ATISAE de Castilla y León, S.A.U.
The Spanish parent company of the TÜV SÜD GROUP in Spain, within the meaning of article 42 of the Commercial Code, is the company TÜV SÜD ATISAE, S.A.U. When you send information through the TÜV SÜD Trust Channel, the Data Controller will be the company about which you make your complaint or claim. In the event that it is not possible to identify the company about which the complaint is made, the Data Controller will be TÜV SÜD ATISAE, S.A.U. as the Spanish parent company of the Group in Spain.
Personal data and information entered into the TÜV SÜD Trust Channel is stored in a database in a highly secure data centre. Access to the data and information is limited to a restricted number of specifically authorized employees only. All data is stored encrypted with various levels of password protection.
Data processed and purpose of processing
Use of the TÜV SÜD Trust Channel is voluntary. If you send a message via the TÜV SÜD Trust Channel, we will collect the following personal information:
- your name, if you have decided to reveal your identity,
- your contact details, if you provide them,
- the fact that you have submitted a notice through the TÜV SÜD Trust Channel,
- if you are an employee of TÜV SÜD, and
- the names and other personal information of the persons you mention in your message.
The purpose of the processing of personal data contained in the TÜV SÜD Trust Channel is to receive, process and administer messages about possible compliance violations in a secure and confidential manner.
Legitimation of the processing
In the case of the companies TÜV SÜD ATISAE, S.A.U. and TÜV SÜD IBERIA, S.A.U., the processing of personal data is legitimized in compliance with a legal obligation, specifically in compliance with the requirements established by Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption.
In the case of the companies TÜV SÜD AMT, S.A.U. and ATISAE de Castilla y León, S.A.U. the processing of data is legitimized in the public interest according to article 6.1.e of the General Data Protection Regulation.
The processing of personal data considered to be of special categories is considered appropriate on the basis of the essential public interest as provided for in Article 9.2.g of the above-mentioned Regulation.
Data retention
The personal data processed shall only be stored by TÜV SÜD Trust Channel for as long as is necessary to decide whether or not it is appropriate to initiate an investigation into the facts reported. If the information received contains personal data that fall into special categories of data, they will be deleted immediately, without any further recording and processing.
When the investigation is carried out, the data will be anonymized in the TÜV SÜD Trust Channel and will become part of the investigation system, where it will remain for as long as necessary to clarify the facts reported and take the appropriate measures.
If the information provided or part of it is not true, it shall be deleted from TÜV SÜD Trust Channel as soon as this becomes known, unless the lack of truthfulness could constitute a criminal offence, in which case the information shall be retained for as long as necessary during the legal proceedings in the internal information system.
In any case, if no investigation has been initiated within three months of receipt of the communication, the information shall be anonymized and the communications shall only be kept for the purpose of demonstrating the functioning of the system.
Recipients of the information
Whoever submits a communication has the right not to have his or her identity disclosed to third parties. The internal information system has the appropriate technical and organizational measures in place to preserve the identity and guarantee the confidentiality of the data relating to the persons concerned and any third parties mentioned in the information provided, especially the identity of the informant in case he/she has identified him/herself.
The identity of the informant shall not be disclosed to the person concerned and may only be communicated to the judicial authority, the Public Prosecutor's Office or the competent administrative authority in the context of a criminal or disciplinary investigation.
During the investigation process, it may be necessary to share information about the reported facts with employees of other Group companies or with specialized external investigators. In the event that information is shared with these agents, it will always be ensured that the applicable regulations on personal data protection are complied with.
User rights
We remind you of your right to request access to your personal data, its rectification, deletion, limitation, opposition to processing and portability of your data. You may exercise your rights by e-mail at ldpc.es@tuvsud.com or by post to the address Ronda de Poniente, 4, 28760 Tres Cantos, Madrid, for the attention of the Local Data Protection Coordinator. We also remind you that you have the right to lodge a complaint with the Spanish Data Protection Agency.
Use of TÜV SÜD Trust Channel
Communication between your computer and the TÜV SÜD Trust Channel takes place via an encrypted connection (SSL). Your IP address is not stored while you are using the TÜV SÜD Trust Channel. In order to establish proper communication, a cookie containing only the session identifier (so-called session cookie) will be saved on your computer. This cookie will only be valid until you end the session, and will expire when you close your browser.
You have the option of setting up a mailbox within the TÜV SÜD Trust Channel, access to which is protected by an individually selected pseudonym or user name and password. You can use it to send messages to the responsible TÜV SÜD employee, either with your name or anonymously and securely. This system only stores data within the TÜV SÜD Trust Channel, which makes it particularly secure. It is not a regular e-mail communication system.
When sending a message or additional information, you can send attachments to the responsible TÜV SÜD employee at the same time. If you wish to send an anonymous message, please note the following security warning: Files may contain hidden personal information that could jeopardize your anonymity (e.g. metadata, such as who last saved the file). Remove such information before submission. If you are unable to remove it or do not know how to do so, copy the text of your attachment into the text of the message or anonymously send the printed document to the address indicated in the footer, specifying the reference number that you will receive at the end of the message submission process.
