The protection of your personal data (hereinafter "data") is very important to us.

According to the Whistleblower Protection Act, the German entities of the xxx Group are obliged to set up a system for receiving confidential note and complaints (hereinafter: information) regarding possible misconduct. This function is performed centrally by RAMPF Holding GmbH & Co. KG (hereinafter "Rampf"). The submission, management and follow-up of information’s necessarily involves the processing of personal data by Rampf. For information on the processing of your personal data and your rights under the General Data Protection Regulation, please refer to the following list.

The data controller within the meaning of data protection legislation, in particular the EU General Data Protection Regulation (GDPR), is:

RAMPF Holding GmbH & Co. KG
Albstraße 37
72661 Grafenberg, Germany

If you have any questions about data protection, you can contact our data protection officer at any time:

By E-Mail: datenschutz@rampf-group.com

By Mail:
Telekom MMS GmbH
Postfach 10 02 24
01072 Dresden

Data processing includes the processing of the initial information, any subsequent communication with you as well as measures that are necessary to process the information within the scope of the purpose of the whistleblowing system. The data processing may also include the bringing together of the information with intell from other sources, insofar as this is necessary for the intended processing of the information. The data processing serves the detection and internal clarification of wrongdoing and in connection with Rampf as well as the prevention of damage and liability cases.

These purposes represent legitimate interests of Rampf, which entitle it to process personal data of the whistleblower and other persons concerned according to Art. 6 para. 1 p. 1 lit. f) DSGVO. Insofar as the receipt of a information as well as its processing and follow-up for the aforementioned purposes corresponds to a legal obligation for Rampf, the personal data will be processed to the necessary extent in accordance with Art. 6 para. 1 sentence 1 lit. c) DSGVO. If the reported grievance is a criminal offence or serious misconduct within the scope of the employment relationship of one of Rampf's employees, the data processing may be based on Section 26 (1) sentence 2 BDSG (Bundesdatenschutzgesetz).

The processing within the scope of the whistleblowing system affects first of all the person submitting the information. Furthermore, third parties may also be affected by the data processing, provided that personal data is processed in the whistleblowing system that can be attributed to this third party.

Which data is processed depends largely on the information you provide via the whistleblower system.

In the scope oft he internal processing of the information, your data will be disclosed solely to the employees of the Legal Department, in compliance with the principles of confidentiality.

By category, we may share data with the following groups of further recipients:

• If applicable, attorneys at law who conduct audits on our behalf
• Authorities, insofar as your information prompts us to do so and has been received by us
• Other government agencies

Furthermore, your personal data may be processed to external parties if this is necessary for the above-mentioned purposes in accordance with the principle of data protection.

The data controller processes your personal data for as long as this is necessary for the purpose of clarifying and processing the reported information. The data will be deleted in accordance with data protection law after the purpose of processing has been achieved and any relevant statutory retention periods have expired.

An exemption exists only if either your data is required in accordance with Art. 17 para. 3 lit. e GDPR for the assertion of legal claims or for the defense against legal claims of third parties or the further processing is permissible for us in accordance with Art. 6 para. 1 sentence 1 lit. f) GDPR.

You have the following rights at any time:

• Your right of access to the data being stored by us and information about its processing (Art. 15 GDPR)
• Your right to rectification of inaccurate personal data (Art. 16 GDPR)
• Your right to erasure of your personal data being stored by us (Art. 17 GDPR)
• Your right to restrict processing of your personal data if we are not yet able to delete it due to legal obligations (Art. 18 GDPR)
• Your right to portability of your data being stored by us, provided that you have given your consent for the processing of your data or have entered into a contract with us (Art. 20 GDPR)

You can revoke any consent pursuant to Art. 6 para. 1 lit. a) GDPR at any time. To do so, please contact the data protection officer. Please not that in the event of a revocation, any notification of the outcome of the investigation cannot be provided or the investigation may not be able to proceed.

You can lodge a complaint at any time by contacting a supervisory body, e.g. the competent supervisory authority for the federal state in which you are resident or the competent authority applicable to us as the data controller.

You can find a list of supervisory authorities (for the non-public sector) and their contact details here: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

In addition, you have the right to object to data processing for reasons arising from your particular situation at any time (Art. 21 GDPR), if the processing is based on Art. 6 para. 1 lit. f) GDPR. You can send your objection, which may also only relate to contact by e-mail or by mail, to the contact details provided under Section 2.