SPEAK UP PRIVACY POLICY
This Privacy Policy explains how GEODIS collects, uses and shares personal data for speak up purposes. This includes any personal data relating to the person making a report, as well as personal data about those individuals against whom an allegation has been made or those who have been identified as having information about the allegation.
Data controllers
GEODIS is the data controller of the speak up processes which are operated on behalf of itself and its operating companies within GEODIS.
When handling a speak up report, personal data may be collected or processed by, or transferred to other entities of the GEODIS Group, for example, the entity where the relevant Employee, External Staff, or Stakeholder is employed or located. In this case, these entities also act as data controller. All GEODIS entities shall process personal data for the purposes outlined in this Privacy Policy.
Purpose of data processing
Personal data is collected and processed for the purposes of assessing the admissibility of the speak up report, of checking facts and taking appropriate measures, if necessary. It also enables GEODIS to comply with its legal obligations and to protect its legitimate interests (respect of the law and of GEODIS’s ethical principles).
GEODIS may process your personal data;
- To administer the GEAS (Geodis Ethics Alert System) and assess and follow-up on submissions to the GEAS.
- To administer the speak up Report and assess and follow-up on its submission
- To investigate alleged violations.
- To take any necessary follow up action upon the completion of an investigation.
- To create anonymous reports for our Company’s management.
In addition to its legal obligations, our Company shall use your personal data in line with GEODIS Data Protection Principles, which refers to the purpose of ‘the use of employee personal data for activities such as those involving the protection of the interest of GEODIS and its employees and for protecting the interests of GEODIS and employee assets’.
Processing of personal data
When making a speak up report, a GEODIS Employee, External Staff or Stakeholder may communicate to GEODIS personal data relating to them and also relating to the person(s) implicated by the speak up report and/or the person(s) who could provide information necessary for the handling of the speak up report.
At the emission stage, the following personal data categories might be collected:
- Identity, function and contact detail of the reporter
- Identity, function and contact detail of the person(s) implicated by the speak up report
- As well as any other information voluntarily communicated by the reporter or resulting from the handling of the speak up report
During the management of the speak up report, the following personal data categories might be collected:
- Identity, function and contact detail of the reporter
- Identity, function and contact detail of the person(s) implicated by the speak up report
- Facts are reports related to the alert
- Personal data and details collected for verification and enquiries purposes
- Control and verification reports
- Reports follow up and conclusion
- As well as any other information voluntarily communicated by the reporter or resulting from the handling of the speak up report
During the management of the speak up report, the following personal data categories might be also be collected:
- sensitive data, in particular those which reveal ethnic or allegedly racial origin, political opinions, religious or philosophical convictions or union membership of a person, data concerning health or data concerning a person's sexual life or sexual orientation
- data relating to offenses, convictions and security measures concerning natural persons
Data recipient
Persons who may access personal data communicated or collected are the person to whom the speak up report has been sent, the Director of ethics or the Group Compliance Director in the case of the GEAS, persons appointed by him/her to handle a speak up report and more generally all persons to which he/she may have recourse in order to receive and/or handle a speak up report or to take appropriate measures, in compliance with the Group speak up Privacy Policy. This may include individuals within GEODIS or its entities.
If a speak up report was made through GEAS, the secure GEODIS speak up website (https://alert.geodis.com ou https://www.bkms-system.com/geodis), GEODIS’s external service provider is also considered as data recipient.
All these persons are bound by a strict confidentiality obligation.
We may also permit selected third-party experts, such as forensic accountants, external lawyers or consultants, to access to your personal information for the purpose of conducting internal investigations in relation to (suspected) violation(s) of our Code of ethics and/or its policies.
Furthermore, personal data collected for speak up purposes will only be disclosed to any other party if our Company is under a duty to disclose or share your personal data in order to comply with any legal obligation or when necessary to report criminal offenses.
When handling a speak up report, personal data may be transferred from GEODIS Headquarter in France to the persons handling the speak up report based in the relevant entities. The purpose of this transfer is to allow the handling of the ethics alert report.
Data retention
Subject to document retention requirements of local legislation, the elements of the speak up report will be deleted or archived in compliance with the following principles:
- The data relating to an alert considered by the recipient as not falling within the scope of the speak up report, are destroyed without delay or anonymized.
- When no action is taken on an alert falling within the scope of the system, the data relating to this speak up report is destroyed or anonymized by the recipient responsible for managing the alerts, within two months of the closure of the verification operations. For the purposes of these standards, the expression "closure" means any decision taken by the organization to draw conclusions from the alert. It may involve the adoption or modification of the internal rules (internal regulations, code of ethics, etc.) of the organization, a reorganization of the operations or services of the company, the pronouncement of a sanction or the implementation of legal action.
- When disciplinary or contentious proceedings are instituted against a person implicated or the author of an abusive alert, the data relating to the alert may be kept by the recipient for managing the alerts until the end of the procedure or the prescription of appeals against the decision.
- It is mentioned that the data can be kept longer, in intermediate archiving, if GEODIS is bound by an applicable legal obligation (for example, to meet accounting, social or tax obligations).
Your rights
Data subjects have:
- the right of access to their personal data
- the right to rectify inaccurate personal data and to complete incomplete personal data
- the right to ask for personal data to be deleted, also called “right to be forgotten”
- the right to restrict the processing of the personal data
- the right to give instructions about the conservation, the deletion and communication of their personal data after their death
The rights mentioned above cannot be used to prevent GEODIS from fulfilling its legal obligation to handle speak up reports, protect of reporters or fulfil a legal obligation or its legitimate interest. Data subjects have the right to lodge a complaint with the competent supervisory authority.
Contact
To obtain more information on how personal data is collected and processed by GEODIS, data subjects may exercise their rights by using dpo@geodis.com or the following address:
For European based and World Users:
GEODIS
Data Protection Officer
26 Quai Charles Pasqua
Espace Seine
92300 Levallois-Perret
France
For USA based Users:
GEODIS Logistics LLC
Data Protection Officer
7101 Executive Center Drive
Suite 333
Brentwood - TN 37027
USA