ÍNDEX
1. DATA CONTROLLER
2. MOTIVATION
3. PERSONAL DATA PROCESSED
4. PURPOSES OF DATA PROCESSING
5. LEGITIMACY FOR DATA PROCESSING
6. RECIPIENTS OF THE INFORMATION
7. TIME LIMITS FOR THE STORAGE OF DATA
8. USER RIGHTS
9. SECURITY MEASURES
10. ACCURATE AND TRUTHFUL INFORMATION
1. DATA CONTROLLER
This Whistleblowing Channel is the responsibility of RESIDENCIAS DE ESTUDIANTES S.L., with TAX number B60109188, company domiciled at Calle Serrano nº 41 4ª planta 28001 Madrid, entity registered in the Mercantile Registry of Madrid at Book 37046, Page 153, sheet M-661.710 ] (hereinafter, RESA).
2. MOTIVATION
RESA makes this Whistleblower Channel available to its stakeholders in compliance with the recent Law 2/2023 regulating the protection of persons who report regulatory infringements and the fight against corruption (hereinafter, " Whistleblower Protection Law ").
Additionally, RESA fully complies with the current regulations on the protection of personal data; specifically, with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, " GDPR ") and Organic Law 3/2018, of 5 December, on data protection and guarantee of digital rights (hereinafter, " LOPD ").
3. PERSONAL DATA PROCESSED
RESA's Whistleblower Channel allows the submission of anonymous reports. However, if the informant wishes to submit the complaint in a nominative way, RESA may collect, within the framework of a communication, the following types of data from the informant and, if applicable, from the persons involved in the communication:
· Identification data : Name and surname.
· Contact details: Telephone and e-mail.
· Professional data: Professional position.
Additionally, RESA may process other types of data by virtue of the allegedly criminal or irregular facts reported and of the supporting documentation that may be appropriate to investigate the reported conduct.
No personal data will be collected whose relevance is not evident in order to process specific information. In the event that irrelevant data is accidentally collected, such data shall be deleted from the Whistleblower Channel without undue delay.
If it is proven that the information provided or part of it is not truthful, it will be deleted immediately as soon as this circumstance becomes known. In the event that this lack of truthfulness may constitute a criminal offense, the information will be kept for the necessary time during the legal proceedings..
4. PURPOSES OF DATA PROCESSING
RESA will process the data to which it may have access as a consequence of the communications received for the following purposes:
· To receive and decide on the admission for processing of the communications received through the Whistleblowing Channel.
· Once the communications have been admitted for processing, to carry out the investigation of the reported facts and to adopt, if appropriate, the pertinent corrective measures.
· Keeping the complainant informed about the admission, or not, to process the communication as well as the progress and results of the investigation process in case there are sufficient grounds to admit it for processing.
5. LEGITIMACY FOR DATA PROCESSING
In view of the conduct denounced through the present Whistleblower Channel, RESA has the following legitimate bases for the processing of the data:
· Compliance with legal obligations applicable to RESA if the communication refers to the breaches foreseen in the Whistleblower Protection Law:
o Breaches of European Union law,
o Commission of crimes or serious or very serious administrative offences or any infringements of the regulations for the prevention of money laundering;
· Legitimate interest of RESA in ensuring that the corporate behaviors provided for in RESA's Code of Ethics or Code of Conduct are respected, without the processing of data in this framework entailing an imbalance for the rights of the data subjects and without the processing being likely to cause them prejudice.
· RESA's public interest when the Complaints Channel is not mandatory or the processing is carried out within the scope of public disclosure.
6. RECIPIENTS OF THE INFORMATION
The data to which RESA may have access on the occasion of the communications received through the Whistle-blower Channel may be communicated to:
· Public bodies or institutions, judges and courts when necessary for the adoption of disciplinary measures, for the processing of the judicial proceedings that, if any, may be applicable or in those cases in which it is legally required.
· To the Public Prosecutor's Office, when the proceedings fall within its competence.
· The company(ies) owner(s) of the residence(s)/establishment(s) with which the parties involved in the communication have a relationship, provided that this communication is essential for the investigation of the reported facts.
With regard to the communication of the informant's personal data, RESA will guarantee that his identity, and all those personal data that RESA may have about his person, will in all cases be reserved and not communicated to the persons to whom the facts reported refer, nor to third parties, respecting in all cases the fundamental rights of the person, without prejudice to the actions that, where appropriate, may be taken by the competent judicial authorities and for which RESA assumes no responsibility .
7. TIME LIMITS FOR THE STORAGE OF DATA
The personal data to which RESA may have had access as a consequence of the communications received through the Whistle-blowing Channel, will be processed for the time necessary to decide on the appropriateness of initiating an investigation on the reported facts and for the management of the communication, provided that the same is admitted for processing.
Specifically, RESA will process the personal data within a maximum period of three months from the receipt of the communication or, if no acknowledgement of receipt was sent to the informant, three months from the expiry of the seven calendar days that RESA has to acknowledge receipt of the communication. The aforementioned period may be extended by a further three months in cases of special complexity.
Once the aforementioned period has elapsed without any investigation actions having been initiated, the data will be deleted from the communication system, except for the purpose of maintaining evidence of the operation of the system and in an anonymized form.
In the case of communications that have not been sent, they shall be kept in an anonymized form, completely eliminating the personal data.
8. USER RIGHTS
The regulations of protection to the informant guarantee to the Users the following rights recognized in the regulations in the matter of protection of data; that will be able to be exercised whenever they turn out to be of application:
· Access : Allows interested parties to know what information is held, from where it has been obtained, to whom it has been provided and for what purposes it has been processed.
· Rectification : Allows interested parties to rectify any erroneous or outdated data.
· Deletion : Allows interested parties to stop the processing of their data.
· Opposition : Allows interested parties to stop the use of their data for a specific purpose. In the case of the person to whom the facts related in the communication refer, it will be presumed that, unless proven otherwise, there are compelling legitimate reasons that legitimize the processing of their personal data.
· Limitation : Allows data subjects to restrict the processing of their data, but in such a way that they are retained for some subsequent purpose.
· Portability : Allows data subjects to obtain a copy of their data in electronic format and, under certain circumstances, to request that it be communicated to another service provider. It is only applicable for computerized processing carried out with the User's consent or for the fulfillment of a contract.
· Revocation of consent : Allows interested parties to withdraw the consent, if any, given for the processing of their data.
However, the exercise of these rights is limited to those informants who have identified themselves at the time of submitting the communication. If RESA has reasonable doubts as to the identity of the informant requesting the right, it may require additional information that will allow it to accredit his or her identity.
Whenever applicable, the aforementioned rights may be exercised before RESA by mail to the above-mentioned address and to the attention of the Ethics Committee or by e-mail to [email protected] .
If the informants wish further information in this regard or consider that their right to data protection has been violated, they may contact the Spanish Data Protection Agency ( www.aepd.es ).
9. SECURITY MEASURES
In compliance with the aforementioned regulations in force, RESA has incorporated the appropriate technical and organizational measures to guarantee the protection of the rights and freedoms of those affected by the processing of their personal data, including those corresponding to the necessary confidentiality and respect for the identity of the informant in the event that the report is nominative, the protection of data and the secrecy of communications, with the aim of avoiding the loss, misuse, alteration and/or unauthorized access to the data provided by the informant.
10. ACCURATE AND TRUTHFUL INFORMATION
RESA informs the informant that the communication transferred through the Whistle-blowing Channel may lead to the initiation of internal or external investigations and may have negative consequences for those affected.
For this reason, he/she must only provide us with information that is believed to be correct, to the best of his/her knowledge and belief, and that is relevant to detect a breach of regulatory compliance and/or of RESA's Code of Ethics or Code of Conduct.
RESA may initiate any disciplinary and/or legal action it deems appropriate whenever the communication is manifestly unfounded or there are, in RESA's opinion, reasonable indications that the information has been obtained through the commission of a crime.