As a responsible company, we attach great importance to the careful handling of personal data in compliance with the law. This also applies, in particular, to data in conjunction with information made available when using the reporting system. The following information shows you how we handle your personal data in the context of notifications when using the reporting system for the preventive prevention of violations of applicable law or company guidelines (e.g. fraud or corruption as well as other criminal offences) and/or to identify such violations. The term personal data applies to any information relating to an identified or identifiable natural person (hereinafter “Data subject”). Therefore, personal data includes, for example, first and last name, address, date of birth, e-mail addresses or telephone numbers.
1. Contact details of the controllers
Agrarhandel Fallersleben GmbH & Co. KG, Ständeplatz 1-3, D-34117 Kassel, Tel.: +49 (0) 561 71 22 0, E-mail: info@rw.net
Beck Energie GmbH, Dieselstraße 5, D-61184 Karben, Tel.: +49 (0) 6039 3404 or +49 (0) 6039 76 06, E-mail: info@beck-energie.de
Bernhard Kree Energie & Logistik GmbH & Co. KG, Westerhaar 14, D-58739 Wickede (Ruhr), Tel.: +49 (0) 2377 78 71 90, E-mail: info@kree-lange.de
Bennewitzer Raiffeisen Handels GmbH, An der Mulde 6, D-04828 Bennewitz, Tel.: +49 (0) 3425 89 46 0, E-mail: bennewitz.info@brh-gruppe.de
Bake Beteiligungs GmbH, Dülwaldstraße 4, D-31655 Stadthagen, Tel.: +49 (0) 5721 70 41 00, E-mail: info@hagebau-stadthagen.de
Brennstoff-Handel Schwalmstadt GmbH, Horschmühlenweg 1, D-34613 Schwalmstadt, Tel.: +49 (0) 6691 25335, E-mail: energie-treysa@rw.net
DHT Dämmstoff Handel + Technik Stockstadt GmbH, Friedrich-Ludwig-Jahn-Straße 22-24, D-64589 Stockstadt
Frisch vom Hof GmbH, Ständeplatz 1-3, D-34117 Kassel, Tel.: +49 (0) 561 71 22 0, E-mail: info@rw.net
Georg Altenburg GmbH & Co. KG, Dülwaldstraße 4, D-31655 Stadthagen, Tel.: +49 (0) 5721 70 41 00, E-mail: info@hagebau-stadthagen.de
Hagebaumarkt Pößneck GmbH: Weidenäckerstraße 2, D-07381 Pößneck, Tel.: +49 (0) 3647 4479360, E-mail: kontakt@hbm-poessneck.de
Kaiser Energie GmbH, Nehdener Weg 9, D-59929 Brilon, Tel.: +49 (0) 2961 78 10 or +49 (0) 2961 78 15 0, E-mail: info@kaiser.rw.net
MTB Marienthaler Baustoffhandels GmbH, Olzmannstraße 41, D-08060 Zwickau, Tel.: +49 (0) 375 59 51 0, E-mail: info@mtb-baustoffe.de
Raiffeisen Energie Verwaltungs GmbH, Ständeplatz 1-3, D-34117 Kassel, Tel.: +49 (0) 2377 78 71 90, E-mail: info@kree-lange.de
Raiffeisen-IT GmbH, Wolfsschlucht 15, D-34117 Kassel, Tel.: +49 (0) 561 71 22 0, E-mail: info@rw.net
Raiffeisen Mischfutter Aktiv GmbH, Raiffeisenstraße 18, D-34497 Korbach, Tel.: +49 (0) 05631 5730910, E-mail: info@raiffeisen-aktiv.de
Raiffeisen Technik HSL GmbH, Rögen 1, D-23843 Bad Oldesloe, Tel.: +49 (0) 4531 17 24 0, E-mail: technik-oldesloe@rw.net
Raiffeisen Technik Nord GmbH, Ständeplatz 1-3, D-34117 Kassel, Tel.: +49 (0) 561 71 22 0, E-mail: technik@raiffeisen-kassel.de
Raiffeisen Technik Nord-Ost GmbH, Dorfstraße 52, D-17129 Kruckow, Tel.: +49 (0) 39999 75 30, E-mail: technik-kruckow@rw.net
Raiffeisen Technik Ostküste GmbH, Rosseer Weg 19-23, D-24340 Eckenförde, Tel.: +49 (0) 4351 75 63 0, E-mail: technik-ostkueste@rw.net
Raiffeisen Technik RMF GmbH, Ständeplatz 1-3, D-34117 Kassel, Tel.: +49 (0) 561 71 22 0, E-mail: rmf@raiffeisen-technik.de
Raiffeisen Technik Westküste GmbH, Bredstedter Straße 37, D-25813 Husum, Tel.: +49 (0) 4841 83 63 0, E-mail: technik-husum@rw.net
Raiffeisen-Techni-Trak GmbH, Am Feldschlößchen 8, D-99439 Am Ettersberg, Tel.: +49 (0) 36451 73 33 30, E-mail: info@raiffeisen-technik.de
RaiffeisenVolt GmbH, Auf’m Brinke 15, D-59872 Meschede, Tel.: +49 (0) 291 32 19 800, E-mail: info@raiffeisenvolt.de
Raiffeisen Waldeck-Marsberg GmbH, Raiffeisenstraße 20, D-34497 Korbach, Tel.: +49 (0) 5631 80 93, E-mail: info@rwm.raiffeisen.de
Raiffeisen Waren GmbH, Ständeplatz 1-3, D-34117 Kassel, Tel.: +49 (0) 561 71 22 0, E-mail: info@rw.net
RHV Raiffeisen Handels- und Vermittlungsgesellschaft mbH, Am langen Acker 17, D-36124 Eichenzell-Welkers, Tel.: +49 (0) 6659 96 44 0, E-mail: info@raiffeisen-rhv.de
Schmidt & Thürmer Holzbau GmbH & Co. KG, Lindenallee 4b, D-17498 Behrenhoff, Tel.: +49 (0) 38356 5040, E-mail: info@schmidt-thuermer.de
Schmidt & Thürmer Holzbau Verwaltungs GmbH, Lindenallee 4b, D-17498 Behrenhoff, Tel.: +49 (0) 38356 5040, E-mail: info@schmidt-thuermer.de
Schmidt & Thürmer Holzhandlung, Säge- und Hobelwerk GmbH & Co. KG, Lindenallee 4a, D-17498 Behrenhoff, Tel.: +49 (0) 38356 5040, E-mail: info@schmidt-thuermer.de
Schmidt & Thürmer Holzhandlung, Säge- und Hobelwerk Verwaltungsgesellschaft mbH, Lindenallee 4a, 17498 Behrenhoff, Tel.: +49 (0) 38356 5040, E-mail: info@schmidt-thuermer.de
SFW Solar GmbH, Ständeplatz 1-3, 34117 Kassel, Tel.: +49 (0) 561 71 22 0, E-mail: info@rw.net
Strauch GmbH, Himbacher Straße 18-22, 63694 Limeshain, Tel.: +49 (0) 6047 80 08 0, E-mail: mail@strauch.org
2. Contact details of the data protection officer of the controller
IBS data protection services and consulting GmbH
– Data Protection Officer –
Zirkusweg 1
D-20359 Hamburg
Germany
E-mail: dsb-kunden@ibs-data-protection.de
3. Purposes of processing of personal data
3.1 As part of entering and processing reports in the reporting system, we process the following types of personal data, among others:
• Information for personally identifying the whistleblower, such as first and last name, gender, address, telephone number and e-mail address;
• Employee status at the company to which the report refers;
• Information about data subjects, i.e. natural persons who are stated in a report as a person who committed the offence or with whom the designated person is associated. Such information includes, for example, first and last name, gender, address, telephone number and e-mail address or other information that enables identification;
• Information about offences that may allow conclusions to be drawn about a natural person.
3.2 We process the personal data for the purpose of investigating the reports to prevent, identify and/or follow-up on violations of applicable law or company policies (such as measures to verify the validity of the allegations made in the report and, if necessary, take action against the reported violation, including by way of internal enquiries, investigations, prosecutions, measures to (re)recover funds or conclude the proceedings).
4. Legal basis
4.1 We only process information for personally identifying the whistleblower if the whistleblower has granted us consent in accordance with Article 6 (1) letter a GDPR. Accordingly, processing is only lawful if the data subject has granted consent to the processing of their personal data for one or more specific purposes.
4.2 We process information about employee status, information about data subjects and other information that permits conclusions to be drawn about natural persons based on Article 6 (1) letter f GDPR. This states that processing is lawful if processing is required for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
Depending on the specific individual case under review, our legitimate interest lies in processing reports to adopt follow-up measures, such as measures to review the validity of the allegations made in the report and, if necessary, to take action against the reported violation, including by way of internal enquiries, investigations, criminal prosecution measures and measures to (re-)recover funds or conclude the proceedings. Whether the interests or fundamental rights and freedoms of the data subject conflict with such data processing will be reviewed on a case-by-case basis, including in respect of an offence.
4.3 We may process personal data of employees on the basis of Section 26 (1) sentence 2 BDSG (German Data Protection Act). Accordingly, personal data of employees within the meaning of Section 26 (8) BDSG may be processed to uncover criminal offences if there are factual indications to be documented that justify the suspicion that the person concerned has committed a criminal offence in the employment relationship, processing is required for identification and the employee’s legitimate interest in the exclusion of processing does not outweigh this, in particular the type and extent are not disproportionate with regard to the reason.
5. Your rights
5.1 You have the following rights in dealings with us in respect to your personal data:
• Right of access by the data subject (Article 15 GDPR, Section 34 BDSG),
• Right to rectification (Article 16 GDPR) or erasure (Article 17 GDPR, Section 35 BDSG),
• Right to restriction of processing (Article 18 GDPR),
• Right to data portability (Article 20 GDPR),
• Right to object to processing (Article 21 GDPR).
• Furthermore, we draw attention to the fact that you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
5.2 In addition, irrespective of any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data relating to you infringes the GDPR (Article 77 GDPR). You can contact any supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. You can find the address via the following internet link: (by clicking on this link you will leave the protected area of the Raiffeisen Waren Group) www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html
6. General information about the recipients or categories of recipients
6.1 Our complaints processors and our data protection officer have access to personal data that are processed as part of our digital whistleblowing system, insofar as they are authorised to process reports.
6.2 With regard to the technical provision of the digital whistleblowing system, we use Trusty AG, which processes personal data on our behalf and in accordance with our instructions (Article 28 GDPR). Furthermore, other external service providers, such as external data centres, process personal data as processors.
6.3 As a matter of principle, personal data are only transferred to third parties if there is a legal basis for this. This is the case, in particular, if the transfer is aimed at meeting legal requirements according to which we undertake to furnish information, report or pass on data, if you have granted us your consent to do so or if weighing the interests justifies such action.
6.4 Depending on the focus of responsibility of the report and for the effective initiation of follow-up measures, the personal data may be passed on to the responsible and authorised persons in the companies to which the report relates.
6.5 Under certain circumstances, we may also disclose the personal data to state security and/or law enforcement authorities, other competent authorities and/or persons under obligation to maintain confidentiality, such as auditors or lawyers.
6.6 There are no plans to transfer personal data to third countries outside the EU/EEA.
7. General information about the storage period
As a matter of principle, data are stored until the follow-up measures have been completed. The data from a report will usually be deleted 2 months after the final conclusion of a procedure, unless the initiation of further legal steps requires further storage (e.g. initiation of criminal proceedings or disciplinary proceedings). We shall delete personal data in conjunction with reports without delay if we consider them to be clearly unfounded.
8. Information in accordance with Article 13 (2) letter e, f, GDPR
Making data available via a report is neither contractually required nor necessary for entering into a contract. Depending on the individual case, filing a report to us may apply in accordance with legal obligations. However, the data are to be processed to properly process and review the report. There is no automated decision-making including profiling (Article 22 (1), (4) GDPR).