PRIVACY POLICY OF GRUPO PIKOLINOS’ WHISTLEBLOWER CHANNEL
1. Introduction
The purpose of the PIKOLINOS GROUP Privacy Policy and Whistleblower Channel (hereinafter, "PIKOLINOS" and the "Channel") is to inform you of how we will process the data of a personal nature collected when you report a potential infringement on the Channel.
PIKOLINOS fully complies with the currently applicable regulations on the protection of data of a personal nature, especially Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and Spanish Organic Law 3/2018 of 5 December on the protection of data of a personal nature and guarantee of digital rights.
2. The Data Controller
The Data Controller (the entity responsible for processing your personal data) is Pikostore S.L. as the owner of the Website, holder of Tax Identification Number (NIF) B-53906590 and with registered address at Calle Galileo Galilei 2, Elche, province of Alicante, Spain.
3. Processing of your personal data and legitimate interest
The data of a personal nature collected in the Whistleblower Channel will be processed for the sole purpose of managing the reports received through the same and to investigate the reported incident or conduct, as required.
Both the whistleblower and any natural persons subject of a report will be duly informed as to the specific identity of the people and/or legal entities to which their data will be disclosed, with special attention to potential non-disclosure of the whistleblower's identity to the reported person or persons.
Data within the framework of the Whistleblower Channel will be processed to perform a task in the public interest, namely, managing an internal Whistleblower Channel aimed detecting and preventing potentially illicit conduct that contravenes both the currently applicable legislation and PIKOLINOS' internal regulations. This includes, in particular, illicit conduct that, depending on the circumstances under which it is carried out, could entail the criminal liability of PIKOLINOS. All the above complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and Organic Law 3/2018 of 5 December on the protection of data of a personal nature and guarantee of digital rights.
4. Data Retention Period
The data of a personal nature processed for these purposes shall only be stored in the Whistleblower Channel for the time absolutely necessary to decide whether to initiate an
must have been deleted three months after they were entered. In the event of an investigation, the data of a personal nature of the persons involved will be stored in a file external to the Whistleblower Channel. If the investigation results in the adoption of legal measures against the reported person or persons, their data may be retained for as long as the associated actions are in progress.
Once the relevant retention period ends the data will be duly blocked and retained in order to substantiate compliance with the regulations that govern the provision of an ethical and compliance model in accordance with the requirements of article 31 bis of the Criminal Code.
5. To whom will your data be disclosed?
If necessary or required, your data may be disclosed to third parties to whom we are legally obliged to provide them such as the public authorities and judges of the law courts
PIKOLINOS may disclose your data to certain third parties to which the Data Controller engages to conduct all or part of the investigation of the reported incident or conduct. These natural or legal persons will act under a duty of secrecy and confidentiality at all times.
6. Exercise of rights
You have the following rights that you may exercise, as required, within the terms and scope provided for under the currently applicable legislation if your data of a personal nature has been included in a report submitted through the Whistleblower Channel:
a) The right to obtain confirmation from PIKOLINOS as to whether your personal data is being processed (within the framework of management of the Whistleblower Channel) and to request rectification of any inaccurate data or, as appropriate, request deletion of all said data when it is no longer required for management of the Whistleblower Channel, among other reasons.
b) The right to access your personal data except, in the case of the reported person or persons, the identity of the person who submitted the report.
c) To revoke any consent you may have granted and to exercise the rights of access, rectification, erasure, objection, restriction, portability and the right not to be subject to automated decisions by submitting a written request to the following postal address: Calle Galileo Galilei 2, Elche (Alicante) or by email at rgpd@pikolinos.com. The full name of the Data Subject; a copy of their Spanish Identity Document, passport or other valid identification document and, if applicable, of their representative (and proof of said representation); address for notification purposes and specification of the reasons for the request.
d) You may also file a complaint with the Spanish Data Protection Agency (the competent supervisory authority in data protection-related matters), especially if you feel that we have not responded in a satisfactory manner to your request to exercise your rights, by sending a written request to the Spanish Data Protection Agency at C/ Jorge Juan 6, 28001-Madrid, or by visiting the website https://www.aepd.es.
7. Principle of proportionality and data minimization: The data of a personal nature collected within the scope of the Whistleblower Channel:
- shall be limited to the data strictly and objectively necessary to process the reports and to verify the truth of the reported facts, as required;
- shall be processed at all times in accordance with the currently applicable data protection regulations and for specific, legitimate purposes related to investigations that may arise as a result of a report;
-shall not be used for incompatible purposes;
- shall be suitable for and shall not exceed the needs of the aforesaid purposes.
8. Limitation of access to your data
Access to the data contained in these systems will be limited exclusively to internal and – exceptionally – external bodies legally or contractually entrusted with carrying out internal control and compliance-related tasks
9. Security measures and confidentiality
PIKOLINOS will ensure that all the required technical and organisational measures are taken to safeguard the security of your personal data in order to protect them from unauthorised disclosure, tampering or access.
For these purposes, PIKOLINOS has taken the appropriate steps to safeguard the confidentiality of all data and will ensure that whistleblowers’ identity data are not disclosed to the person or persons subject of a report during the investigation, thus respecting the fundamental rights of said person(s) without prejudice to actions that the competent judicial authorities may take.
