What is the process for submitting a report? What is a postbox and how do I set up one?

To submit an anonymous or personalised report, start by clicking the “Submit Report“ button at the top of our introduction page.

There are 4 steps to the report process:

1. First, you will be asked to read some information on the protection of your anonymity and to respond to a security query.
2. On the following page, you will be asked about the category of your report.
3. On the report page, you can elaborate on your report in your own words and answer questions about the incident by simply selecting responses. You can type up to 5000 characters into the free text field, which corresponds to a full A4 page. You may also submit a file of up to 5 MB to support your report. Please do bear in mind that documents can contain information about the author. Following the sending of your report, you will receive a reference number as confirmation that you have forwarded this report.
4. Please subsequently set up your own secured postbox. You will receive feedback from us via this postbox, including answers to questions and information about the progress of your report.

If you already have a secured postbox, you can access it directly via the ”Login“ button. First, you will have to answer a security query.

As long as you do not enter any data from which conclusions about your person can be drawn, the technology of the BKMS^® Incident Reporting will protect your anonymity.

Please rest assured that we are interested only in the incident you are reporting. Malpractices should be revealed and financial losses prevented.

How do I receive feedback and remain anonymous at the same time?

The overriding principle of the BKMS^® procedure in use is the protection of the whistleblower. The system's anonymity privacy function is certified by an independent body.

When setting up your secured postbox, please select your own pseudonym/ user name and password. These login credentials are not visible for anyone but yourself. Your report is kept anonymous through encryption and other special security routines. If you want to submit your report anonymously, you do not have to provide any personal details. Do not submit any information that can be traced back to you. Please do not use a computer that has been provided by your employer to submit your report.

Via the secured postbox, an examiner will provide you with feedback on what is happening with your information or pose questions if details still need to be clarified - you will also remain anonymous during the dialogue. We are interested in reports to avoid damages, not in you as a whistleblower.

Is there additional information related to the processing of reports?

Additional information pursuant to Section 10 of the Austrian Whistleblower Protection Act [HSchG]¹

Information on confidentiality, the duty to maintain secrecy, and protection of identity:

FFG protects the identity of whistleblowers in accordance with the statutory provisions.

This protection extends to all data and information that could identify whistleblowers and, in principle, to any other person affected by the information provided.

FFG and its employees are subject to comprehensive obligations to maintain secrecy and will disclose data and information only to the competent internal contact persons (e.g. Compliance Office) or the competent authorities in accordance with the statutory requirements.

When submitting a report please note that business secrets are only used for the purposes of reporting and verifying the report. Business secrets may only be used or disclosed by FFG and the whistleblowers to the extent required.

For more information on this topic see, among others, the website of the Federal Bureau of Anti-Corruption (https://www.bak.gv.at).

Information on the processing of personal data:

To the extent that personal data is processed as part of submitting a report or as part of verifying the report, such processing is done exclusively to the extent permitted by statutory requirements. In this context it is important to note the requirements of the HSchG, the GDPR and the Austrian Data Protection Act [Datenschutzgesetz/DSG].

In particular, FFG must observe the processing principles defined in Article 5 GDPR and Section 37 DSG.

Processing of the personal data contained in the report is done for the purposes of the HSchG. In particular, this includes checking the information reported and punishing violations of the law.

Personal data is saved by FFG for ten (10) years and, beyond that, for as long as it is required to conduct administrative or legal proceedings that have already been initiated, or for preliminary investigations pursuant to the Austrian Code of Criminal Procedure [StPO].

Personal data that is no longer required for processing a report may not be collected or will be erased if it has been collected unintentionally.

Please note that you may not assert those rights under data protection law or that you may only do so to a limited extent for as long as and insofar as it is necessary to protect the identity of the involved persons or to facilitate attempts to prevent, circumvent or delay reports or follow-up measures based on reports.

1. Right to information;
2. Right to access;
3. Right to rectification;
4. Right to erasure;
5. Right to restriction of processing;
6. Right to object;
7. Right to information about a personal data breach.

Please also note that FFG may not provide information or access to information to a person concerned by a report given under these conditions either.

¹Austrian Federal Act on the Procedure and Protection in the Case of Reports of Violations of the Law in Specific Legal Areas (Whistleblower Protection Act) [HinweisgeberInnenschutzgesetz/HSchG], BGBl. [Federal Law Gazette] I No. 6/2023