In accordance with the principles of its Code of Ethics, CEDC International attaches great importance to the observance of ethical standards in the workplace
To this end, we have launched confidential communication channels for whistleblowers, both those who are our employees and those representing CEDC partners or suppliers.
Information on the processing of personal data of the “whistleblower” at CEDC International sp. z o.o.
- Data Controller
The Controller of your personal data is CEDC International sp. z o.o. with its registered office in Oborniki, ul. Kowanowska 48, 64-600 Oborniki (hereinafter referred to as “CEDC”).
- Contact with the Controller
For any issues related to the processing of your personal data by CEDC, please contact the Data Protection Officer at the email address: iod@cedc.com or by traditional mail to the address listed in point 1, with the annotation “personal data”.
- Report process
With regards to a report of a violation, CEDC will process the personal data of the reporting person in the following scope, depending on the form of the report:
- Hotline – recorded voice recording, phone number;
- Email inbox – email address, only if it allows you to be identified.
The above scope of personal data is the minimum scope which due to the nature of the technologies used cannot be limited by you.
In addition, CEDC may process personal data provided by the reporting person and relating to:
- witnesses;
- the person to whom the report relates;
- additional personal contact details as the reporting person (including name, email address, phone number).
In this case, personal data are provided strictly voluntarily by the reporting person.
- Purpose and legal basis of processing
Personal data will be processed to the extent indicated in point 3 above on the basis of the legitimate interest of CEDC (based on Article 6 (1)(f) of the GDPR, which is the necessity for CEDC to verify the information received from you to carry out an internal investigation procedure and to contact the reporting person in connection with Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons reporting breaches of EU law.
- Recipients of personal data
Your personal data may only be transferred to entities that are entitled to receive them by mandatory legal regulations, as well as to entities that provide IT services to CEDC.
Personal data will not be transferred outside the European Economic Area.
- Data retention period
The time during which CEDC processes personal data relating to the report depends on the actions taken by CEDC.
In cases where:
- data are processed only for verification of the report, as a result of which no internal investigation is conducted and the case is not reported to authorised external bodies – the processing period is 1 year starting from the next year after which the report was made;
- the data are processed for the purpose of carrying out internal proceedings but are not transferred to authorised external bodies – the processing period depends on the duration of the proceedings but no longer than until the end of the next year after which the report occurred;
- data are processed in connection with proceedings conducted by authorised bodies – the processing period continues until the legal conclusion of such proceedings.
- Rights of data subjects
In connection with the processing of your data by CEDC, you have the following rights:
- to access your data and receive a copy of it;
- to rectify (correct) your personal data;
- to restrict processing of your personal data;
- to request deletion of your personal data (right to be forgotten).
At any time you have the right to object due to your particular situation in cases where CEDC processes personal data on the basis of a legitimate interest.
You have the right to lodge a complaint (in Polish) with the Supervisory Authority, which in Poland is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.
- Information on the requirement to provide data
The provision of your personal data is voluntary, but necessary to initiate actions related to the consideration of the reported irregularity.
- Profilowanie
Your personal data is not subject to automated decision-making, including profiling.