Privacy notice for whistleblowers
pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)
GIFRAB Italia SpA, as Controller of your personal data within the meaning of Regulation (EU) 2016/679 (GDPR), hereby informs you that this legislation protects data subjects with regard to the processing of personal data, and that such processing will be based on the principles of fairness, lawfulness and transparency and on the protection of your confidentiality and your rights. Your personal data will be processed in accordance with the provisions of the above legislation and, in particular, in full compliance with the specific confidentiality obligations laid down by Legislative Decree 24/2023 on the protection of persons who report breaches of Union law and of national legislation.
Data Controller
GIFRAB Italia SpA, with registered office at Via Marco D’Agrate 41, 20139 Milan (MI), Italy, VAT No. 04836890824, is the Data Controller.
Email: info@gifrab.it – Certified email (PEC): gifrabitalia@legalmail.it
Data Protection Officer: rpd@gifrab.it
Purposes of processing
Your personal data will be processed by GIFRAB Italia SpA primarily for purposes connected with compliance with the legal obligations arising from Legislative Decree no. 24 of 10 March 2023, concerning compliance activities and the protection of whistleblowers. In particular, the processing is carried out in order to receive, analyse and handle reports submitted through the official channels (dedicated email address or web form), and to carry out the investigations needed to establish the facts and to adopt any resulting measures.
In addition to these purposes, which are strictly connected with legal obligations, your personal data may be processed, solely with your explicit consent, in order to disclose your identity to persons other than the Confidential Advisor or those responsible for following up reports. Such consent is also required where, in disciplinary proceedings in which the charge is based on the report, knowledge of your identity is absolutely essential for the defence of the accused person, as provided for by Article 12 of Legislative Decree 24/2023.
Legal basis for processing
The main legal basis for processing your personal data for the purpose of handling reports is the need to comply with a legal obligation to which the Company is subject, pursuant to Article 6(1)(c) of the GDPR, read in conjunction with the provisions of Legislative Decree 24/2023. This legislation requires GIFRAB Italia SpA to put in place secure reporting channels and suitable measures to guarantee the confidentiality of the whistleblower’s identity.
As regards the specific disclosure of the whistleblower’s identity to persons other than the Confidential Advisor, or in disciplinary proceedings where knowledge of that identity is essential for the defence of the accused person, the legal basis is solely the express consent of the data subject, pursuant to Article 6(1)(a) of the GDPR and in accordance with the enhanced safeguards provided for by Article 12 of the Italian whistleblowing legislation.
Types of data processed
The Company will process the personal data needed to handle reports submitted under Legislative Decree 24/2023, including the whistleblower’s identification data (first name, surname, job title or professional role within GIFRAB Italia SpA) and contact details. Depending on the content of the report, the Confidential Advisor may become aware of further information concerning the persons involved or named as witnesses, as well as data relating to criminal convictions or offences within the meaning of Article 10 of the GDPR.
Furthermore, where the facts reported so require, the Controller may process special categories of personal data within the meaning of Article 9 of the GDPR (such as political opinions, trade union membership or health data) that may be contained in the description of the wrongdoing or in any supporting documents provided by the whistleblower. Such information is processed with absolute confidentiality, and any data which, after an initial review, is clearly irrelevant or excessive for the purpose of establishing the facts reported is redacted immediately.
Whether provision of data is mandatory and consent
Providing personal data in a report is optional, as it is the whistleblower’s free choice to report unlawful conduct or suspected irregularities. However, providing identification data is necessary if the data subject wishes to benefit from protection against retaliation and from all the legal safeguards expressly provided for by Legislative Decree 24/2023 and by the Company Policy. For the purposes of receipt and handling of the report by the Confidential Advisor, processing does not require the data subject’s consent, since it is based on compliance with a legal obligation.
The express and specific consent of the data subject becomes a mandatory and essential requirement only in the cases provided for by Article 12 of the Decree and referred to in the GIFRAB Italia SpA procedure: to disclose the whistleblower’s identity to persons other than those competent to receive the report, or where such disclosure is absolutely essential for the defence of the accused person in disciplinary proceedings based on the report. Without such explicit consent, the whistleblower’s identity will remain confidential and may not be disclosed to third parties, ensuring the highest level of protection required by the legislation in force.
Processing methods
Your personal data will be processed using electronic means and software systems, including dedicated web applications such as the “Google Forms” form referred to in the company procedure, which ensure high standards of security and confidentiality. Processing may also take place orally or anonymously, where the whistleblower chooses not to disclose their identity from the outset. Every operation is carried out in strict compliance with the principles of lawfulness and security laid down in Articles 6 and 32 of the GDPR, with appropriate technical and organisational measures in place to prevent access by unauthorised persons.
Access to the information and to the whistleblower’s identity is strictly limited to the Confidential Advisor, namely the person appointed by the Director of GIFRAB Italia SpA to receive and handle reports in full compliance with Legislative Decree 24/2023. The data may be shared only with any internal investigation bodies or consultants engaged to establish the facts reported, who always work under a duty of strict confidentiality and are bound not to disclose the whistleblower’s identity without their express consent. GIFRAB Italia SpA ensures that the whistleblower’s identity will also remain confidential towards the person who is the subject of the report, who will only be informed of the nature of the allegations made.
Recipients of personal data
Your personal data will not be disseminated in any way. Data will be disclosed to external parties only where necessary to ensure that the report is handled properly and the facts are established, in full compliance with the confidentiality safeguards provided for by Legislative Decree 24/2023. Data may be sent to the competent authorities, such as the judicial authorities, ANAC (the Italian National Anti-Corruption Authority) and other public bodies where required by law, as well as to any external bodies responsible for investigations. For the technical and IT management of reports, GIFRAB Italia SpA may use providers of specialised digital platforms acting as Processors pursuant to Article 28 of the GDPR, which ensure the security and segregation of the data.
Place of processing and data transfers
Your personal data is processed at the premises of GIFRAB Italia SpA and on servers located within the European Union, managed directly by the Controller or by third-party providers appointed as Processors. With regard to use of the website, personal data may be transferred only to European Union member states, ensuring full compliance with the safeguards provided for by the GDPR. Should it become necessary in future to transfer data to countries outside the EU, the organisation undertakes that such transfers will take place only on the basis of standard contractual clauses approved by the European Commission or other appropriate safeguards provided for by the legislation in force.
Retention period
In compliance with the principles of lawfulness, purpose limitation and data minimisation under Article 5 of the GDPR, the retention period for your personal data is set according to the specific purposes of the processing. In particular, in accordance with Article 14 of Legislative Decree 24/2023 and the Company’s internal rules, reports and related documents will be kept for as long as strictly necessary to complete the investigation and handle the case. In any event, the data will be kept for no longer than five years from the date on which the final outcome of the reporting procedure is communicated. After that period, the personal data and attached documents will be permanently deleted or anonymised, unless further retention is required to comply with specific legal obligations or to protect rights in legal proceedings.
What are your rights?
Under Articles 15 et seq. of the GDPR, whistleblowers may at any time exercise their rights of access to their personal data, rectification, erasure or restriction of processing, as well as the right to object to processing on legitimate grounds. However, in the whistleblowing context, the exercise of these rights is subject to the limits laid down by Article 2-undecies of the Italian Privacy Code and by Legislative Decree 24/2023: the rights of access and data portability may not be exercised where this could cause actual and concrete harm to the confidentiality of the whistleblower’s identity or compromise the conduct of the investigation. Requests may be sent to the Confidential Advisor at confidential.advisor@gifrab.it or to the Data Protection Officer (DPO) at rpd@gifrab.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) if you believe that the processing infringes the legislation in force.