PRIVACY POLICY FOR WHISTLEBLOWER ARRANGEMENT
This Privacy Policy explains how Advance A/S (“Advance”, "we" or "us") processes personal information in connection with reports to Advance's Whistleblower Arrangement.
Below is a description of the personal data processing that takes place and the rights you have if you are reported through the Whistleblower Arrangement, as well as your rights if you use the Whistleblower Arrangement to report another person.
Reference is also made to Advance's Whistleblower Policy, containing information about who can submit reports and who can be reported.
This policy only concerns the handling and the investigation of reports submitted through the Whistleblower Arrangement. Therefore, this policy must - in relation to employees - be seen in connection with Advance's other relevant policies and procedures.
1 DATA CONTROLLER
The legal entity responsible for the processing of your personal information is:
Advance A/S
CVR.no.: 25763858
Landemærket 29
DK-1119 Copenhagen
Email: gdpr@advance.dk
2 DESCRIPTION OF THE PROCESSING
2.1 Voluntary Whistleblower Arrangement
The following is a description of how Advance will process information on the person who is reported about (the "Reported Person") as well as the person who is submitting the report (the "Whistleblower") in connection with reports to Advance's voluntary Whistleblower Arrangement.
Purpose
#1
Handling and investigation of reports under the Voluntary Arrangement of Advance regarding:
- The Reported Person
Sources
We can collect information from the following sources:
- Plesner Law Firm
- Employees of Advance
- Self-employed persons
- Shareholders and members of the executive board, board of directors, or similar governing body in the undertaking
- Volunteers
- Paid and/or unpaid trainees
- Persons working under the supervision and management of contracting parties, suppliers, and sub-suppliers
- Persons who are reporting information to which they have gained access in a work-related relationship that has ceased since then
- Persons in work-related relationships that have not yet commenced, who report information on violations to which they have gained access during the course of the recruitment process or other pre-contractual negotiations
Categories of Personal Data
We can process the following personal data categories about you:
Ordinary personal data:
- Name, email, telephone number,
- Other information included in the report.
Sensitive information, including information on sexual matters, may be included in the processing.
Information on criminal offences or possible criminal offences may also be included in the processing.
Legal Basis for the Processing
We process your personal data on the following bases:
- GDPR, Article 6.1.f: Necessary for the purposes of the legitimate interests pursued by Advance to investigate reports under the Whistleblower Arrangement;
- GDPR, Article 9.2.f: Necessary for the establishment, exercise, or defence of legal claims;
- Section 8 of the Danish Data Protection Act regarding information on criminal offenses and convictions.
Recipients
We can share your personal information with:
- Plesner Law Firm
- IT suppliers
- External advisors
- The police
- Public authorities, e.g., the Danish Financial Supervisory Authority, the Danish Data Protection Agency, or relevant tax authorities.
Data Retention
We will retain personal data for as long as it is necessary for the purposes listed.
- The data are retained for as long as the investigation is in progress. The retention period depends on the outcome of the investigation.
- Reports submitted to the Arrangement are in principle deleted after 45 days, unless Advance has legitimate reasons for continued retention.
- Reports falling outside the scope of the Arrangement, but not appearing to be unfounded, will be passed on to Henrik Hertz where they will be processed in accordance with Advance's relevant policies and procedures.
- Reports turning out to be unfounded will be immediately closed in the Arrangement and deleted within 45 days after having been deemed to be unfounded.
- If a report is conveyed to the police or another public authority, the data will be retained for at least as long as the investigation is in progress at the police/public authority.
- Otherwise, the data will be stored in accordance with Advance's deletion policy.
Purpose
#2
Handling and investigation of reports under the Voluntary Arrangement of Advance regarding:
- The Whistleblower
If there is suspicion of the report being deliberately false, this purpose also comprises investigation of the Whistleblower.
Sources
We can collect information from the following sources:
- Plesner Law Firm
- You
Categories of Personal Data
We can process the following categories of personal data about you, provided that your report is not anonymous:
Ordinary personal data:
- Name, email, telephone number,
- The contents of your report.
As a rule, no sensitive information about you will be processed as part of the handling of the report - unless you choose to provide such information yourself.
However, information on criminal offences or possible criminal offences may be included in the processing if there is a suspicion that the submitted report is deliberately false.
Legal Basis for the Processing
We process your personal data on the following bases:
- GDPR, Article 6.1.f: Necessary for the purposes of the legitimate interests pursued by Advance to investigate reports under the Whistleblower Arrangement;
- GDPR, Article 9.2.b: Necessary for the purpose of carrying out obligations in the field of employment, social security, and social protection), cf. Sections 7 (2) and 12 of the Danish Data Protection Act.
- GDPR, Article 9.2.f: Necessary for the establishment, exercise, or defence of legal claims;
- Section 8 of the Danish Data Protection Act regarding information on criminal offenses and convictions.
Recipients
We can share your personal information with:
- Plesner Law Firm
- IT suppliers
- External advisors
- The police
- Public authorities, e.g., the Danish Financial Supervisory Authority, the Danish Data Protection Agency, or relevant tax authorities.
Data Retention
We will retain personal data for as long as it is necessary for the purposes listed.
- The data are retained for as long as the investigation is in progress. The retention period depends on the outcome of the investigation.
- Reports submitted to the Arrangement are in principle deleted after 45 days, unless Advance has legitimate reasons for continued retention.
- Reports falling outside the scope of the Arrangement, but not appearing to be unfounded, will be passed on to Henrik Hertz where they will be processed in accordance with Advance's relevant policies and procedures.
- Reports turning out to be unfounded will be immediately closed in the Arrangement and deleted within 45 days after having been deemed to be unfounded.
- If a report is conveyed to the police or another public authority, the data will be retained for at least as long as the investigation is in progress at the police/public authority.
- Otherwise, the data will be stored in accordance with Advance's deletion policy.
3 INFORMATION TO THE REPORTED PERSON AND RECTIFICATION
If you are subject to a report submitted through the Whistleblower Arrangement, you will be notified as soon as possible after an initial investigation has taken place and all relevant evidence is secured. In this connection, you will receive information about:
- The identity of the person(s) who is/are responsible for the investigation of the report
- A description of the contents of the report
As mentioned below in the section about your general rights, you have a right of access to the report that was submitted about you.
You also have the right to request rectification of the information in the report if you believe this to be false, misleading, or incomplete. If your request in this respect cannot be met, the information will be supplemented with your comments.
4 CONSEQUENCES OF THE PROCESSING
Reports and investigation of reports to the Whistleblower Arrangement may have significant consequences for the person who is reported, as reports concern violations or suspected violations of the law, as further outlined in the separate guidelines for the Arrangement.
Likewise, a report to the Whistleblower Arrangement may have significant consequences for the person who has submitted the report in case of a deliberately false report. Such cases may have criminal consequences.
5 TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA
Your personal data will not be transferred to countries outside the EU/EEA.
6 YOUR GENERAL RIGHTS
You have the following rights:
- You have the right to request access to and rectification or deletion of your personal data.
- You also have the right to object to the processing of your personal data and have the processing of your personal data restricted.
- You have the right to receive the personal information provided by yourself in a structured, commonly used and machine-readable format (data portability).
- You may always lodge a complaint with a data protection supervisory authority, e.g. The Danish Data Protection Agency.
You are furthermore entitled to dispute our processing of your personal data in the following events:
- If our processing of your personal data is based on the GDPR, Article 6.1 (e) (public interest or exercise of official authority) or Article 6.1 (f) (balancing of interests), see above under legal basis for the processing, you are, at any time, entitled to dispute such processing for reasons related to your particular situation.
There may be conditions or limitations on these rights, e.g., you may not be entitled to deletion of your personal data in a specific case – this depends on the specific circumstances of the processing activities.
You can make use of your rights by contacting Henrik Hertz, gdpr@advance.dk.
7 QUESTIONS
If you have any questions regarding this policy, please feel free to contact Henrik Hertz, gdpr@advance.dk.
Last updated: 15 May 2023