Whistleblowing
PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA
pursuant to Articles 13 and 14 of Regulation (EU) 2016/679
(General Data Protection Regulation – GDPR)
GENERAL INFORMATION
This notice concerns the processing of personal data collected in the context of internal reports of violations pursuant to Legislative Decree No. 24 of 10 March 2023 – Whistleblowing, including reports submitted through the Whistleblowing Platform (“Platform”), which Probiotical S.p.A. (hereinafter also referred to as the “Company” or “Data Controller”) makes available to individuals – employees, clients, suppliers, business partners, consultants, collaborators, etc. – who wish to submit a report under the aforementioned legislation (“Report(s)”).
PERSONAL DATA TO BE PROCESSED
Through the Report, the Company will collect and process information that may include:
- Personal data of the reporting individual (hereinafter also “Reporter”) such as name, surname, and contact details;
- Personal data concerning the reported individual(s) and, if applicable, other individuals involved or mentioned in the Report;
- Personal data referred to in Article 9 of the GDPR (“Special Categories of Personal Data”), i.e., data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or genetic, biometric, health-related, sexual life, or sexual orientation data of a natural person, and/or data referred to in Article 10 of the GDPR (“Judicial Data”), i.e., data relating to criminal convictions, offenses, or related security measures. Such data may be included in the Report only if essential for its management and assessment.
Reports must not include irrelevant facts for the purpose of their processing.
In any case, to verify the accuracy of the Report, personal data may be supplemented or updated based on information that is: (i) publicly available; (ii) collected from third parties and/or directly from the Reporter; or (iii) already in the possession of the Company.
PURPOSES AND LEGAL BASIS OF PROCESSING
The personal data collected will be processed for the purposes indicated below, based on specific lawful grounds:
- To comply with a legal obligation to which the Company is subject (Article 6(1)(c) of the GDPR, and regarding Special Categories of Personal Data: Article 9(2)(b) of the GDPR), in relation to the management and verification – in particular under Legislative Decree No. 24 of 10 March 2023 – of Reports received regarding alleged conduct, acts, or omissions that harm public interest or the integrity of the Company, as well as any further activities connected and related to the Reports;
- To pursue the legitimate interest of the Data Controller or third parties in exercising or defending rights in judicial, administrative, or out-of-court proceedings, and in disputes arising in connection with the Report, within the limits established by applicable confidentiality laws (Article 6(1)(f) of the GDPR).
CONSEQUENCES OF NOT PROVIDING PERSONAL DATA
Providing personal data of the Reporter is optional: the Reporter may remain anonymous.
Similarly, it is not mandatory to provide the personal data of the reported individual(s), as this does not affect the processing of the Report.
METHODS OF PROCESSING AND RETENTION PERIOD
The processing of personal data will be conducted in accordance with the principles of lawfulness, fairness, and transparency. It may be carried out using IT and telematic tools, including automated ones, as well as paper-based supports, aimed at storing, managing, and, if necessary, transmitting such data.
In any case, the Data Controller has implemented appropriate technical and organizational measures to ensure data security and confidentiality and to prevent loss, destruction, unauthorized access, unlawful use, and dissemination.
The Data Controller will not transfer personal data contained in the Reports to countries outside the European Union; processing will be carried out exclusively within the European Union.
Reports and related documentation are retained for the time necessary to process the Report, and in any case no longer than five years from the date of communication of the final outcome of the reporting procedure. Personal data that are manifestly irrelevant to the management of the Report, if inadvertently collected, will be deleted once their irrelevance is determined.
AUTHORIZED PERSONS AND DATA RECIPIENTS
Within the organizational structure of the Data Controller, authorized personnel, appropriately trained and committed to confidentiality, may access and process the personal data contained in the Report. Such personnel will operate according to their respective roles and solely for the purposes indicated in this notice.
For the purposes of managing and maintaining internal processes and the Platform, the Company may engage IT service providers acting as data processors under specific agreements with the Company pursuant to Article 28 of the GDPR.
The Company may also share personal data with consultants (legal, labor law, etc.) and, if necessary for the management and investigation of the Report or for compliance with legal obligations, with competent authorities, in accordance with Whistleblowing regulations.
Personal data will not be disclosed publicly.
DATA CONTROLLER
The Data Controller is Probiotical S.p.A., with registered office at Via Mattei 3, Novara, Italy, tax code and VAT number 01092820032, PEC email: info@pec.probiotical.it .
DATA SUBJECT RIGHTS
Except in cases where exercising such rights could materially and concretely prejudice the confidentiality of the Reporter’s identity (Article 2-undecies of Legislative Decree No. 196 of 30 June 2003 – Italian Data Protection Code), the Reporter has the right to request from the Company, under the conditions established by applicable law:
- right of access to personal data (Article 15 GDPR): This right allows the Reporter to obtain confirmation as to whether or not their personal data are being processed and, if so, to access such data.
- right to rectification of personal data (Article 16 GDPR): This right allows the Reporter to obtain the correction and/or completion of personal data that are inaccurate or incomplete.
- right to erasure of personal data (Article 17 GDPR): This right allows the Reporter, where the legal conditions are met, to obtain the deletion of personal data.
- right to restriction of processing (Article 18 GDPR): This right allows the Reporter, in specific cases, to request the limitation of the processing of their personal data.
- right to data portability (Article 20 GDPR): This right allows the Reporter, in certain cases and with respect to data provided by themselves, to receive their personal data in a structured, commonly used, and machine-readable format.
- right to object (Article 21 GDPR): This right allows the Reporter to object at any time, for reasons related to their particular situation, to the processing of personal data carried out by the Data Controller for the pursuit of its legitimate interest.
The exercise of these rights is free of charge pursuant to Article 12 of the GDPR. However, in the case of manifestly unfounded or excessive requests, including repetitive ones, the Company may charge a reasonable administrative fee.
If the Reporter believes that the processing of their personal data violates GDPR provisions, they have the right to lodge a complaint with the Italian Data Protection Authority (Garante) or take appropriate legal action.
