Information clause on the processing of personal data for the purposes of receiving reports and taking follow-up actions by VTS Group S.A.
1. The controller of your personal data is VTS GROUP S.A., a public limited company (société anonyme) incorporated under Luxembourg law, with its registered office at 20 rue de l’Industrie, L-8399 Windhof, Grand Duchy of Luxembourg, registered in the Luxembourg business register under number B123449, email address: contact@vtsgroup.lu, phone: +352 20 60 22 41 (hereinafter: the "Controller").
2. You may contact the Controller regarding issues related to the processing of personal data and the exercise of rights under the GDPR using the contact details above or by contacting the Controller’s designated Data Protection Officer at iod@vtsgroup.com.
3. Your personal data will be processed for the purpose of receiving a report and taking follow-up actions in accordance with the Act on Whistleblower Protection of June 14, 2024. The legal basis for processing personal data is Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Controller in handling reports of violations of the law.
4. The Controller will process the following categories of personal data: first name, last name, workplace, and contact details.
5. The Controller ensures the confidentiality of your data in connection with the received report. As such, data may only be disclosed to entities authorized by law or to entities to whom the Controller has entrusted data processing under data processing agreements concluded for this purpose.
6. Special cases where data may be disclosed: In connection with investigations conducted by public authorities or preparatory or judicial proceedings conducted by courts, your data may be disclosed when such action is a necessary and proportionate obligation under the law.
7. Personal data processed in connection with the receipt of a report or follow-up actions, as well as documents related to this report, are stored for 3 years after the end of the calendar year in which the report was submitted, follow-up actions were completed, or proceedings initiated by these actions were concluded. Personal data that is irrelevant to the processing of the report will not be collected, and if collected, will be immediately deleted. The deletion of such data will occur within 14 days from the moment it is determined that the data is irrelevant to the case.
8. You have the right to access your personal data and to rectify (correct) it. You also have, with limitations specified in the GDPR, the right to request deletion or restriction of processing, as well as the right to object to processing, provided that further processing is not necessary for the Controller to fulfill a legal obligation, and there are no other overriding legal grounds for processing.
9. You have the right to file a complaint regarding the Controller's processing of your data with the National Data Protection Commission (Commission Nationale pour la Protection des Données – CNPD).