Information on data protection within the framework of the Grievance Mechanism of the Facility IFE
Information on data protection
In the following, we would like to inform you about the collection, processing and use of personal data within the framework of the grievance mechanism when you submit a report by e-mail, telephone call, letter or personal appearance at IFE. Please read this data protection information carefully before submitting a report.
Type of personal data
Use of the grievance mechanism is on a voluntary basis. When you submit a report via the grievance mechanism, we collect the following personal data and information:
- Your name, if you disclose your identity,
- Your contact details, if you provide them,
- The fact that you have made a report through the grievance mechanism,
- If applicable, names of persons and other personal data of the persons you name in your report.
Purpose of the grievance mechanism and data processing / legal basis
The purpose of the grievance mechanism is to receive and process reports of (suspected) violations of the law or serious internal rules against IFE in a secure and confidential manner.
The processing of personal data as part of the grievance mechanism is based on the legitimate interest of IFE in the detection and prevention of wrongdoing and the associated prevention of damage and liability risks for IFE (Art. 6 Para. 1 lit. f GDPR).
If a report received concerns an employee of IFE, the processing also serves to prevent criminal offences or other violations of the law in connection with the employee relationship (Section 26 (1) German Federal Data Protection Act-BDSG).
The processing of the reporting party's identification data is based on consent to be given (Art. 6 Para. 1 lit. a GDPR). The voluntary nature of the consent is given by the fact that the notice can also be given anonymously. However, consent can generally only be revoked within one month of receipt of the report, as IFE is obliged in certain cases under Art. 14(3)(a) GDPR to inform the person accused of the allegations made against him or her and the investigations carried out within one month, including the storage, the type of data, the purpose of the processing and the identity of the controller and, if applicable, the reporting party, and it is then no longer possible to discontinue the data processing of the reporting party’s identification data. However, the revocation period may also be shortened, sometimes considerably. This is the case if the nature of the notification requires the immediate involvement of an authority or a court. As soon as we have disclosed the name to the authority or court, it is in our procedural files as well as with the authority or court and can no longer be deleted.
Responsible party
The body responsible for data protection in the grievance mechanism is IFE, Eulenkrugstraße 55-57, 22359 Hamburg, Germany ("IFE"). All data is stored in encrypted form and protected by a multi-level password. Access is restricted to a very narrow circle of expressly authorised persons at IFE.
IFE
Eulenkrugstrasse 55-57
22359 Hamburg
Germany
Data subjects can contact IFE via grievance@ife-invest.com
Confidential treatment of information and disclosure to third parties
Incoming information is received by a narrow circle of expressly authorised and specially trained employees of IFE and is treated confidentially. These employees examine the facts of the case and, if necessary, carry out further case-related clarification of the facts.
In certain cases, IFE has an obligation under data protection law to inform the accused person of the allegations made against him or her.
If there is a significant risk that such information would jeopardise the effective investigation of the allegation or the collection of the necessary evidence, the information to be provided to the accused person may be postponed for as long as this risk exists.
In this case, your identity as a reporting party will not be disclosed - insofar as this is permissible in accordance with Art. 14(3)(a) of the GDPR.
Confidentiality cannot be guaranteed if false information is knowingly provided with the aim of discrediting a person (denunciation).
We always ensure that the relevant data protection regulations are complied with when passing on information.
In the event of a corresponding legal obligation or data protection law necessity for the clarification of information, further possible categories of recipients include law enforcement authorities, cartel authorities, other administrative authorities, courts and international law and auditing companies commissioned by IFE.
Any person who gains access to the data is obliged to maintain confidentiality.
Retention period of personal data
Personal data will be retained for as long as is necessary for the clarification and final assessment or if there is a justified interest on the part of the company or if this is required by law. Afterwards, this data is deleted in accordance with the legal requirements. The duration of storage depends in particular on the severity of the suspicion and the reported possible breach of duty.
Data subject rights
According to European data protection law, you and the persons mentioned in the report have the right to information, correction, deletion, restriction of processing as well as the right to object to the processing of your personal data and, in certain cases, the right to data portability.
Your right to object: You have the right to object to the processing of your personal data on grounds relating to your particular situation. The prerequisite for this is that the data processing is carried out in the public interest or on the basis of a balancing of interests. The objection can be made form-free and should, if possible, be sent to the contact details listed in this data protection notice. If the right of objection is exercised, we will immediately check the extent to which the stored data is still required; in particular for the processing of a notice. Data that is no longer required will be deleted immediately.
You can also revoke your consent at any time. In this context, please note the information on consent to processing of personal data as part of the grievance procedure under: Declaration of consent.
To Grievance Registration Form