The responsible party within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is:
Rhenus SE & Co. KG
Rhenus Place 1
59439 Holzwickede
Germany
Phone: +49 (0)2301 29-0
E-mail: info@de.rhenus.com
Website: https://www.rhenus.group
Data Protection Officer
Rhenus Place 1
59439 Holzwickede
Germany
E-mail: datenschutz@de.rhenus.com
Website: www.rhenus.group
In order to carefully protect your privacy and to ensure comprehensive confidentiality in the handling of your data, we would like to provide you with some notes and information below:
The Rhenus Integrity Line enables you to contact us and report possible indications of compliance and legal violations as well as data breaches. The Integrity Line also supports the implementation of the EU Whistleblowing Directive. Here, the confidentiality of the information you provide is our top priority.
The whistleblowing system is used to report (suspected) violations of the law or serious internal rules against Rhenus SE & Co. KG in a secure and confidential manner.
Personal data of our users is only collected and used with the consent of the user. An exception applies in those cases in which it is not possible to obtain prior consent for factual reasons and the processing of the data is permitted by legal regulations; this applies in particular if a report is made anonymously via the Rhenus Integrity Line. As a matter of principle, we collect and use personal data of our users only insofar as this is necessary for the provision of a functional website as well as our contents and services. The collection and use of our users' personal data only takes place with the user's consent. An exception applies in those cases in which it is not possible to obtain prior consent for factual reasons and the processing of the data is permitted by legal regulations; this applies in particular if a report is made anonymously via the Rhenus Integrity Line.
The processing of personal data in the context of the whistleblower system is based on the legitimate interest of Rhenus SE & Co. KG in the detection and prevention of wrongdoing and the associated prevention of damage and liability risks for Rhenus SE & Co. KG (Art. 6 para. 1 lit. f DSGVO). Point 4.1.3. of the German Corporate Governance Code also requires the establishment of a whistleblower system in order to provide employees and third parties with the opportunity to report legal violations within the company in a protected manner. The processing of the whistleblower's identification data is based on a consent to be given (Art. 6 para. 1 lit. a DSGVO). The voluntary nature of the consent is given by the fact that the notice can also be given anonymously. However, the consent can generally only be revoked within one month of receipt of the notification, as Rhenus SE & Co. KG is obliged in certain cases under Art. 14 (3) lit. a DSGVO to inform the person accused of the allegations made against him or her and the investigations carried out within one month, including the storage, the type of data, the purpose of the processing and the identity of the person responsible and, if applicable, the whistleblower, and it is then no longer possible to discontinue the data processing of the whistleblower's identification data. In addition, the processing of the data has already progressed so far after that point that deletion is no longer possible. However, the revocation period may also be shortened, sometimes considerably. This is the case if the nature of the notification requires the immediate involvement of an authority or a court. As soon as we have disclosed the name to the authority or court, it is in our procedural files as well as with the authority or court and can no longer be deleted.
The personal data of the data subject will be deleted or blocked as soon as the purpose of the storage no longer applies. Storage may also take place if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the person responsible is subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfilment of a contract.
You can use the Rhenus Integrity Line without providing any personal data. However, you can voluntarily provide information about your identity.
In this case, you agree to the processing of this personal data. In this case, too, we have a comprehensive obligation to maintain confidentiality. The information about your identity will only be processed by specially authorised persons at Rhenus. If the information you provide relates to criminal conduct, it may be necessary under certain circumstances for us to pass on your personal data to state investigating authorities such as the public prosecutor's office.
The following personal data and information will be collected:
- Your name, if provided
- Your contact details, if provided
- The fact that you have made a report on the Integrity Line
- whether you are an employee of Rhenus SE & Co. KG
- the notice you provide may also contain personal data of third parties to whom you refer in your notice ("data subjects").
Data subjects will be given the opportunity to comment on the notice. In this case, we will inform the data subjects about the notice. In this case, too, your confidentiality is protected, as no information about your identity will be given to the affected person - as far as legally possible - and your notice will be used in such a way that your anonymity is not endangered.
The technical implementation of the Rhenus Integrity Line is carried out on our behalf by EQS Group AG, Karlstraße 47, 80333 Munich, Germany ("EQS").
The Rhenus Integrity Line contains an option for anonymous communication via an encrypted connection. When using it, your IP address and your current location are not stored at any time. After sending a notice, you will receive access data to the Rhenus Integrity Line so that you can continue to communicate with Rhenus in a protected manner.
We maintain appropriate technical measures to ensure data protection and confidentiality. The data you provide will be stored on a specially secured database of EQS. All data stored on the database is encrypted by EQS in accordance with the current state of the art.
Access to the stored data is only possible for specially authorised persons at Rhenus or administrators at EQS Group AG. If absolutely necessary, specially authorised persons from our subsidiaries may also be entitled to inspect the data. All persons specifically authorised to inspect the data are expressly obliged to maintain confidentiality.
The specially authorised persons will check the information you have provided and, if there is cause to do so, will carry out further investigations into the matter. In the process, we may have further questions for you. For this purpose, we exclusively use communication via the Rhenus Integrity Line.
For the technical implementation, we transfer personal data to EQS Group AG to the extent described above. For this purpose, we have concluded an order data processing agreement to ensure data protection with EQS. Processing by EQS takes place exclusively in Winterthur, Switzerland.
According to European data protection law, you and the persons named in the notice have the right to information, correction, deletion, restriction of processing as well as the right to object to the processing of your personal data and, in certain cases, the right to data portability.
Your right to object: You have the right to object to the processing of your personal data on grounds relating to your particular situation. The prerequisite for this is that the data processing is carried out in the public interest or on the basis of a balancing of interests. The objection can be made form-free and should, if possible, be sent to the contact details listed in this data protection notice. If the right of objection is exercised, we will immediately check the extent to which the stored data is still required; in particular for the processing of a notice. Data that is no longer required will be deleted immediately. You can also revoke your consent at any time. In this context, please note the information under "Purpose of the whistleblowing system and data processing".
Further information and the possibility to assert your rights can be found at:
- Homepage: Data Protection Policy Rhenus SE & Co. KG | RHENUS Group
You also have the right to lodge a complaint with a competent supervisory authority:
State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.
Homepage link: LDI NRW
Holzwickede, 07.02.2022