Purpose of Processing Personal Data in the Whistleblower Scheme

Purpose of Processing Personal Data in the Whistleblower Scheme

This privacy policy aims to establish the framework for the processing of personal data in TeeShoppen's whistleblower scheme. The purpose of processing personal data in TeeShoppen's whistleblower scheme is to uncover knowledge of serious matters, including suspicion or knowledge of illegal, unethical or unregulated behavior, in order to prevent, contain and follow up on such matters throughout the organization.

TeeShoppen is the data controller for the personal data processed in the whistleblower scheme. The information comes from the circle that can make a report to the scheme, i.e.,

• - TeeShoppen employees

• - Self-employed individuals (with whom TeeShoppen collaborates)

• - Members of the board of directors

• - The main board

• - Volunteers in TeeShoppen

• - Paid or unpaid interns in TeeShoppen

• - Individuals who work under the supervision and management of TeeShoppen's contractors, subcontractors, and suppliers

• - Individuals who report or disclose information that they have gained access to in an employment relationship with TeeShoppen that has since ceased

• - Individuals whose employment relationship with TeeShoppen has not yet begun and who report violations that they have gained access to during the employment process or other pre-contractual negotiations.

Categories of Personal Data Processed

A report may contain personal data, including both non-sensitive and sensitive information about the reporter (whistleblower) themselves. Reports may also contain non-sensitive and sensitive personal data regarding the person(s) reported on (the affected parties), as well as information about other individuals.

Regarding the reporter, information about their name and contact details, if provided in connection with the report, will be processed. In addition, any other personal data that the reporter has provided about themselves in the report will be processed.

Regarding the affected parties and other individuals who may be involved in the report, the information provided in the report will be processed. The collected information may include the name, position, and any other information about the affected parties and other individuals. A report will typically contain information about the specific serious matter being reported on and how the affected party is alleged to be involved.

A report may include documents in a broad sense, including text, images, and video material.

All personal data collected through the scheme will be treated as confidential to the fullest extent possible.

Especially for the reporter themselves: consent to processing of sensitive personal data

If you as a reporter provide sensitive personal data about yourself, it is necessary for you to consent to TeeShoppen processing this personal data. You consent by answering the question "May we process the sensitive personal data you have provided about yourself in the report?" with a "Yes". You will be asked this question when you make a report.

Sensitive personal data includes, for example, information about your health, race or ethnic origin, your trade union or religious affiliation, or information about sexual relationships and orientation.

You may not provide sensitive personal data about anyone other than yourself.

If you have saved the code you received in connection with the report, you will be able to withdraw your consent by logging into the whistleblower portal and sending a message stating that you are withdrawing your consent to the processing of sensitive personal data.

If you choose to withdraw your consent, it does not affect the legality of the previous processing of your personal data based on your previously given consent and up to the time of withdrawal. If you withdraw your consent, it will only take effect from the time of withdrawal.

Legal basis for processing

Processing of personal data in the whistleblower scheme is necessary in order to investigate and prevent serious matters at TeeShoppen. Processing of information in the whistleblower scheme is therefore necessary for TeeShoppen to pursue a legitimate interest, which is considered as a starting point to outweigh the data subject's interest in protecting the relevant personal data, cf. Article 6(1)(f) of the General Data Protection Regulation.

Information about criminal offenses, including alleged criminal offenses, is processed pursuant to Section 8(3) of the Data Protection Act, under which processing may take place if it is necessary for the legitimate interests pursued by the controller, provided that those interests do not override the interests or fundamental rights and freedoms of the data subject.

In some cases, a report may contain sensitive personal data, such as trade union affiliation, political beliefs, religious beliefs, health information, sexual relationships and biometric data.

Such information is processed only about the reporter themselves and only if the reporter has given consent to the processing in connection with the report, pursuant to Article 6(1)(a) and Article 9(2)(a) of the General Data Protection Regulation, as explained in the section "Especially for the reporter themselves: consent to processing of sensitive personal data" above.

It should be noted that all categories of personal data processed in connection with reports are only kept for as long as necessary for the investigation of the reported matter and the further process, as explained in the section "Storage and deletion of personal data" below.

Rights

If the report concerns one or more named individuals, they will generally receive notification about:

• - The subject matter of the reported issue

• - The outcome of the report, including whether it has been rejected as groundless or made the subject of further investigation

• - The legal basis for the processing of their personal data as well as other information that must be provided under data protection law

• - Which individuals within TeeShoppen are aware of the report or may become aware of it

• - The intended period during which personal data will be stored or alternatively, the criteria used to determine this period

• - How the individual can exercise their right to access and correct the report

Notification will be made as soon as possible and no later than 14 days after the above information has been obtained.

If it is deemed appropriate that the interests of the individual(s) concerned in the information should give way to compelling public or private interests, including the protection of the rights of others, notification may be postponed or omitted until the risk no longer exists in accordance with the rules of section 22 of the data protection law.

If the report contains information about other identifiable individuals besides the affected person, these individuals will be notified as described above. This notification must not contain identifiable information about the affected person being reported on.

Catalogue of rights

When TeeShoppen registers information about the affected individuals being reported on, information about the reporter themselves or other individuals mentioned in the report, those individuals have the right to access the personal data processed about them.

However, the right to access does not apply if the individual's interest in obtaining information about themselves is found to be outweighed by significant public or private interests, according to section 22 of the data protection law.

The individual concerned also has the right to object to the processing of information as well as to request that information be corrected, restricted or deleted in accordance with the prevailing data protection legislation.

Storage and Deletion of Personal Data

Personal data processed in connection with reports will be kept for as long as necessary for the investigation of the reported matter and its further processing.

If the initial screening of the reported matter shows that the report is not covered by TeeShoppen's whistleblower scheme or that there is no evidence of the reported matter, the report will not, as a general rule, need to be kept and will therefore be deleted by TeeShoppen as soon as possible. However, the length of time it is necessary to keep the report will always depend on a specific assessment.

If the initial screening of the reported matter indicates that it is not unlikely that the reported matter has taken place, TeeShoppen will conduct a thorough investigation and delete the report and the personal data contained therein only when the investigation is completed.

Disclosure and Transfer of Personal Data

As a general rule, TeeShoppen does not disclose personal data collected through the whistleblower scheme to third parties.

The following types of disclosure may, however, take place after a specific assessment:

• - Disclosure to external advisors, such as lawyers or auditors, for the purpose of further investigating the reported matters

• - Transfer to relevant authorities, including the police and prosecution authorities for possible legal action

• - Disclosure required by law or regulations

Complaint

You have the right to file a complaint with the Danish Data Protection Agency if you are dissatisfied with the way we process your personal data. You can find the contact information for the Danish Data Protection Agency at www.datatilsynet.dk.

Contact Information

Questions about your rights etc. in connection with the processing of personal data in the scheme should be directed to:

• TeeShoppen

  CVR: 42629804

  Phone: +45 53 63 92 10

  Adress: C.W. Obels Plads 16, 9000 Aalborg