Speak Up Process Privacy Statement
(Last updated: May 2nd, 2023)
- Data Controller
- Amadeus IT Group S.A. (hereinafter “Amadeus”) that has implemented and/or may use the BKMS® System system as part of the Speak Up Process.
- Purpose of Personal Information Processing
- To find out any irregularities or violations against any applicable law or regulation related to business practices or ethical conduct, or the topics set forth in the Amadeus Speak-Up policy.
- Legal Grounds for Processing
- Legal obligation insofar as Amadeus is subject to the obligation of deploying a whistleblowing scheme.
Legitimate interest of Amadeus when the above legal obligation does not exist in the applicable jurisdiction. - Who will see your Personal Information
- People handling and administering the Speak-Up Channel and the BKMS® System system, the Corporate Compliance team, the Investigating Team, internal or external, and people forming part of the Ethics Committee, as explained in the Speak Up Policy available at https://amadeusworkplace.sharepoint.com/Sites/CorporatePolicies_official
Note: To access the link, please copy and paste the link into your browser - Data subject's rights
- You have a right to access, review and restrict processing of Personal Information and the right to lodge a complaint with a supervisory authority, but all interests involved should be balanced in such request, including of the whistleblower and the person(s) accused.
You may exercise your rights via e-mail: ethics@amadeus.com or by sending your request to our registered office: Calle Salvador de Madariaga, 1, 28027 Madrid, Spain
Introduction
The Speak Up Process serves the purpose of securely and confidentially receiving, processing and managing reports regarding violations of the compliance rules of Amadeus. The system allows any employee (or contractor) belonging to any Amadeus entity to report any violation of applicable laws, Amadeus Group compliance or business ethics policies (the Code of Ethics and Business Conduct, the Anti-Bribery & Corruption Policy, the Anti-Fraud Policy, the Speak-Up Policy). The system also allows third parties, such as vendors or distributors to file reports securely and confidentially.
The reporting system used within the Speak Up Process is operated by a specialised company, EQS Group AG, Bayreuther Str. 35, 10789 Berlin in Germany, on behalf of Amadeus.
Amadeus is committed to protecting the privacy of personal data it collects and processes. Amadeus will act in compliance with applicable data protection legislation. We want you to be familiar with how we collect, use and disclose information that identifies or may identify you as an individual (hereinafter, “Personal Data”). Please read this data privacy information carefully before submitting a report.
What Personal Information do we collect and what is the legal basis for the processing of the Personal Data
The Personal Data we process is the name of the reporting party (unless the reporting party chose to report anonymously), whether such party is employed at Amadeus, the name of the person they are making the report against, the incident itself, and depending on the request, the allegation may contain other Personal Data to the extent other third parties are named in the report.
This information will be included in the BKMS® System system (hereinafter, the “Speak Up Tool”).
In case an investigation is conducted we will process the above mentioned Personal Data in order to conduct investigations arising from the report; and keeping this data in our confidential repository that is not part of the Speak Up Tool, until necessary pursuant to applicable data protection laws.
The legal basis for the processing of the Personal Data is the compliance of a legal obligation in jurisdictions where the deployment of a whistleblowing scheme is required by applicable laws.
When the above legal obligation does not exist in the applicable jurisdiction, the legal basis for processing of the Personal Data is Amadeus’ legitimate interest.
Who is collecting and processing the Personal Data and who is the Personal Data shared with?
Amadeus IT Group, S.A., as headquarters, is the owner of the process and therefore, the controller of the Personal Data included in the Speak Up Tool and the Personal Data arising from the following investigations and processes.
As a global organization with global IT systems, Personal Data may be transferred to, stored and shared within the Amadeus group companies and third parties.
As part of the Speak Up Process incoming reports are received by a small selection of expressly authorised and specially trained employees of Amadeus and are always handled confidentially on a need to know basis. The appointed employees of Amadeus will evaluate the matter and perform any further investigation required by the specific case. .
Reports will be handled as follows:
- The Corporate Compliance team. The Corporate Compliance team receives all reports filed through the Speak-Up Tool, performs a preliminary review and decides what resources will be best placed to investigate. Unless your report is against someone in the Corporate Compliance department, in which case the report will be automatically redirected to Director of Internal Audit, the Corporate Compliance team will review your report.
- The Director of Group Internal Audit. If you do not wish the Corporate Compliance team to receive and assess your report, either because (i) the report is against someone on the Corporate Compliance team; or (ii) you do not wish for the Corporate Compliance team to be involved for another substantive reason, then the Director of Group Internal Audit can review your report. This option needs to be specifically selected upon filing a report.
- The P&C team. If your report is concerning a P&C issue, such as discrimination or harassment, then the report will be received directly by the P&C team. Unless your report is concerning a P&C issue, against someone in the P&C department, in which case the report will be automatically redirected to Corporate Compliance.
- The investigation team. Depending on the scope of the report, the subject matter and/or geographical location of the claim, the team receiving the report will rely on a pre-identified internal or external team to perform the investigation into the allegations in the report. The identity of the person filing the report, if disclosed at the time of making the report, will only be shared if it is strictly necessary in order to perform the investigation or with that person’s consent.
If your report is not subject to the Speak-Up policy, then the Corporate Compliance department will ask for your permission to forward the report to the right division.
Please read carefully the Speak Up rules and guidelines to understand the whole process. Under certain circumstances, Amadeus might report the allegations to the authorities as required by law, or to a third party should it be necessary to assist with the investigation.
We will only allow affiliated companies and third party service providers to use Personal Data for specified purposes and in accordance with Amadeus’ instructions.
Amadeus may also disclose personal data as required by law, subpoena, or regulation; when requested by government or law enforcement authorities or as otherwise required or permitted by law.
International Transfer of personal data
When Amadeus shares Personal Data with its affiliates and third-party service providers who process personal data on behalf of Amadeus, this may involve transferring personal data outside the European Economic Area (“EEA"). When personal data is transferred to a third country, it will continue to receive adequate protection through contractual or other arrangements put in place with Amadeus´ affiliates and third party service providers. For these transfers, at least one of the following appropriate safeguards will be implemented:
- Personal data will be transferred to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission;
- Standard contractual clauses as approved by the European Commission which, together with supplementary measures, will ensure personal data transferred will retain the same protection it has in EEA;
Further information on the appropriate safeguards used when transferring personal data outside the EEA can be requested through the contact details set out below in the section legal rights. When requesting this information please make a reference to the transfer of personal data outside the EEA.
For what purpose is your Personal Data used?
Personal Data will be used to investigate the allegations to discover any potential violation against applicable laws or regulations related to Amadeus group compliance or business ethics policies. To be able to conduct an investigation, it is necessary to know the identity of the person against which allegations are made..
Personal Data you provide through the Speak Up Tool and gathered during the investigation process will be used for:
- Conducting necessary investigations
- Keeping it in a confidential repository
- Take any corrective measures to address any potential infringement.
Security and Integrity of Personal Data
Amadeus has taken appropriate technical and organizational measures to ensure the confidentiality, availability and integrity of the Personal Data.
Retention of Personal Data
Any investigation that does not result in any action or that is dismissed will be maintained for three months after which the information, including personal data, will be archived and stored duly blocked as required by applicable law.
For all other investigations, we will keep the Personal Data for the duration of the investigation and two more years in the Amadeus internal files in case it would be necessary to address any complaints. After this period, the information, including personal data, will be archived and stored duly blocked.
Contacting us
If you have any questions regarding this Privacy Statement, please contact us by e-mail at ethics@amadeus.com. Please indicate “Confidential-Speak-Up related data processing request” in the subject line of your email.
Your rights
You may exercise your rights of access, review and to restrict the processing of Personal Data by sending a request via email to: ethics@amadeus.com or by sending your request to the applicable registered office. All interests involved should be balanced in such request, including of the whistleblower and the person(s) accused.
Although Amadeus intends to carefully address any request and/or claim from you, as well as carefully process your Personal Data, you are entitled to file any claim or complaint before the relevant data protection authorities.
