This application is not part of the MTU-Websites or the MTU-Intranet
During the use of BKMS® System, a text file (called a “session cookie”) is saved on your computer containing only the number of your session. This is necessary for technical reasons in order to establish the connection to a security-certified server. The “session cookie” does no damage to your computer, it does not access your data and has no relation to the contents of your report. If you close all browser windows after submitting your report, the “session cookie” will expire and be automatically deleted.
Dear whistleblower,
We would like to inform you that our whistleblower system is now accessible via the following link:
https://mtu.integrityline.app/?lang=en
MTU Aero Engines AG
Dachauer Straße 665
80995 Munich
GERMANY
Telefon: +49 89 1489 - 0
Fax: +49 89 1489 - 5500
e-mail: info@mtu.de
Lars Wagner (Chief Executive Officer, CEO)
Peter Kameritsch (Member of the Executive Board, Chief Financial Officer and Chief Information Officer)
Dr. Silke Maurer (Member of the Executive Board, Chief Operating Officer)
Michael Schreyögg (Member of the Executive Board, Chief Program Officer)
Amtsgericht München, Nr. HRB 157206
DE 81 44 00 965
MTU Aero Engines AG (hereinafter referred to as “MTU”) takes the protection of personal data very seriously. We process personal data in full compliance with all applicable legal regulations on data protection and data security. Please read this data protection information carefully before submitting a report.
The controller, as defined in the European General Data Protection Regulation (“GDPR”), the German Federal Data Protection Act (“BDSG”) and other data protection regulations, is:
The data protection officer of the controller is:
Personal data are pieces of information about the personal or material circumstances of a specific or identifiable natural person (i.e. the data subject). This includes the person's name, address, telephone number, date of birth and email address, for instance. Information that cannot be linked to a specific individual (or only linked to a specific individual with disproportionate efforts), e.g. anonymised information, do not constitute personal data.
We only collect and use personal data of users of iTrust to the extent that is necessary for processing a report.
Your personal data are not used for any other purposes, in particular, advertising purposes. We will never disclose your personal data to any third parties without your consent, except in the situations described below or if we are legally obliged to do so.
If necessary, we may share personal data with companies that are affiliated with MTU Aero Engines AG as per Section 15ff AktG for the purposes listed in Section 5.
We may also share personal data with courts of law, supervisory authorities (especially aviation safety authorities) or legal advisors in order to comply with the law or assert, exercise or defend against legal claims if necessary.
iTrust serves the purpose of securely and confidentially receiving, processing and managing reports concerning criminal or illegal conduct and human rights violations in connection with our business activities. The processing of personal data within the framework of iTrust is based on the legitimate interest of our company in discovering and preventing abuses and thereby averting damage to MTU, its employees and business partners. We further have a legitimate interest in processing personal data to secure the legality of our company's business. The legal basis for our processing of personal data is Article 6(1)(f) of the GDPR (General Data Protection Regulation). In cases where we are obliged to process personal data in order to comply with a legal obligation to which our company is subject, Section 6 Paragraph 1(c) GDPR shall provide the legal foundation.
Your personal data will be erased or blocked as soon as the original purpose of their storage ceases to apply. In cases where the European or national legislator requires further storage through Union directives, laws or other regulations to which the data controller is subject, the data may be stored beyond that point in time. Personal data are also blocked or erased if the statutory storage period stipulated by any of the specified standards expires, unless the continued storage of the data is required to conclude or fulfil a contract.
Within the scope of the reporting procedure, we primarily process personal data for the following purposes:
All use of iTrust is entirely voluntary. When you submit a report via iTrust, we collect the following personal data and information:
The BKMS® System is operated by a specialised company, EQS Group GmbH, Karlstraße 47, 80333 Munich in Germany, on behalf of MTU.
Personal data and information entered into the whistleblowing system are stored in a database operated by EQS Group GmbH in a high security data centre. Only MTU can see the data. EQS Group GmbH and other third parties do not have access to the data. This is ensured in the certified procedure through extensive technical and organisational measures.
All data are stored encrypted with multiple levels of password protection so that access is restricted to a very small selection of expressly authorised people at MTU.
Incoming reports are received by a small selection of expressly authorised and specially trained employees of the compliance organisation of MTU and always handled confidentially. The employees of the MTU compliance organisation evaluate the matter and perform any further investigation required by the specific case.
While processing a report or conducting a special investigation, it may be necessary to share reports with additional employees of MTU or employees of other group companies, e.g. if the reports refer to incidents in subsidiaries. The latter may be based in countries outside the European Union or the European Economic Area with different regulations about the protection of personal data. We will always ensure that the applicable data protection regulations are complied with when sharing reports.
All persons who receive access to the data are obligated to maintain confidentiality.
We are legally obligated to inform accused parties of any reports received against them as soon as the disclosure of this information no longer jeopardises the investigation. Your identity as a whistleblower will not be disclosed unless we are legally obliged to do so.
Communication between your computer and the whistleblowing system takes place over an encrypted connection (SSL). Your IP address will not be stored during your use of the whistleblowing system. In order to maintain the connection between your computer and the BKMS® System, a cookie is stored on your computer that merely contains the session ID (a so-called session cookie). This cookie is only valid until the end of your session and expires when you close your browser.
It is possible to set up a postbox within the whistleblowing system that is secured with an individually chosen pseudonym/user name and password. This allows you to send reports to the respectively responsible employee at MTU either by name or in an anonymous, safe way. This system only stores data inside the whistleblowing system, making it particularly secure. It is not a form of regular e-mail communication.
When submitting a report or an addition, you can simultaneously send attachments to the responsible MTU employee. If you wish to submit an anonymous report, please take note of the following security advice: files can contain hidden personal data that could put your anonymity at risk. Remove this data before sending. If you are unable to remove this data or are uncertain about how to do so, copy the text of your attachment into your report text or send the printed document anonymously to the address listed in the footer, citing the reference number received at the end of the reporting process.
If we process your personal data, you may be entitled to certain rights. This may include the following rights:
You can ask the controller whether any of your personal data are being processed and receive confirmation.
If your data have been processed, you can request the following information from the controller:
You have the right to request information about any disclosure of your personal data to recipients in a third country or to an international organisation. In this context, you can demand to be informed about the appropriate safeguards as per Article 46 GDPR.
You have the right to rectification and/or completion of your data by the controller in cases where your personal data are incorrect or incomplete. The controller is obliged to carry out the rectification promptly.
If the following conditions are given, you can request that the processing of your personal data be restricted:
If the processing of your personal data has been restricted, your data may be processed only with your consent – with the exception of their storage – or for asserting, exercising or defending against legal claims, for protecting the rights of another natural or legal person or for reasons of an important public interest of the European Union or one of its member states.
If any of the aforementioned reasons applies and the restriction has been circumvented accordingly, the data controller will inform you before lifting the restriction.
You can demand that the data controller erase your personal data immediately, and the data controller will be obliged to do so provided that one of the following reasons applies:
Where the controller has made the personal data public and is obliged pursuant to Section 17 Paragraph 1 GDPR to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
The right to erasure does not apply if processing is necessary
If you have exercised your right to rectification, erasure or restriction towards the controller, the controller is obliged to inform all recipients to whom your personal data have been disclosed about the restriction or erasure of the data or the restriction of their processing unless this is impossible or only possible with disproportionate effort.
You have the right to be informed about those recipients by the controller.
You have the right to receive the personal data which you have provided to a controller in a structured, commonly used and machine-readable format. You also have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where
In exercising your right to data portability, you also have the right to have the personal data transmitted directly from one controller to another where technically feasible. This must not affect the rights and freedoms of others.
The right to data portability does not apply if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
You have the right to withdraw his or her consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of your personal data infringes the GDPR.