to report potential rule violations The FFT whistleblower system
The FFT whistleblower system enables employees of FFT Group companies, business partners and stakeholders to report potential breaches of regulations via the reporting office that has been set up. It is also possible to submit a report to an external lawyer as an ombudsman.
The whistleblower system is designed to detect misconduct and risks at FFT in order to prevent harm to employees, the company or external third parties. Use the contact details of the reporting offices to report concerns about misconduct that affects our company or the well-being of employees and third parties.
Get in touch with us. Contact the internal reporting office
Use the contact details of the reporting offices to report concerns about misconduct that affects our company or the well-being of employees and third parties. The contact form will take you to the internal reporting office of FFT Produktionssysteme - Legal & Compliance department. The contact details for the external reporting office can be found in the mandatory information below.
Anonymous reporting is possible:
Even if the fields are offered, you can also send the form anonymously. We only process data that you actively and voluntarily provide to us. We assure all whistleblowers that their information will be processed confidentially . However, failure to provide this information may mean that we are unable to keep you informed about the progress of the investigation and that any information provided cannot be adequately followed up or processed. You can find more information on this in the mandatory information in VI. 1.
On the processing of your data as part of our whistleblower system Mandatory information according to Art. 13 GDPR
The protection of the personal data of our whistleblowers is important to us.
We therefore process personal data in accordance with the applicable legal provisions on the protection of personal data and data security.
I. Contact details of the controller
The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is:
FFT Produktionssysteme GmbH & Co. KG
represented by the general partner FFT GmbH, Fulda.
Managing directors: Tristan Pfurr, Hagen Dickert, Volker Stark
Phone: +49 661 2926-0; e-mail: info(at)fft.de
II Contact details of the external data protection officer
BerIsDa GmbH
Petersberger Straße 57a
36037 Fulda
Telefon: +49 661 29698090
E-Mail: datenschutz(at)berisda.de
III Contact details of the internal reporting offices
Internal: the FFT Production Systems: Legal & Compliance department
Tel: +49 661 2926 -292 or -2921; e-mail: whistleblower(at)fft.de
Outsourced: Law firm Cornea & Franz: Attorney Dr. Stephan Wübbelsmann
Phone: +49 661 901644-0; e-mail: ombudsstelle-fft(at)cornea-franz.de
IV. Description of the processing
1. description and scope of data processing
We offer you the opportunity to contact us via our reporting offices and report possible indications of compliance and legal violations.
We use the information you provide as part of our whistleblower system for the purpose of reviewing and documenting the reports as well as for internal and external investigations (including disclosure to external lawyers, auditors or other professionals bound by professional secrecy) and, if necessary, for disclosure to government agencies.
You can submit your report to the Reporting Office via the outsourced Reporting Office without providing any personal data. If you disclose your identity to the Reporting Office, the following data protection information applies. We only process data that you actively and voluntarily provide to us. You do not have to provide a name or contact details - your report will nevertheless be checked and processed. We guarantee that all whistleblowers will be treated confidentially.
The provision of your personal data is neither legally nor contractually required. There is no obligation to provide your personal data. However, failure to provide it may mean that we are unable to inform you about the progress of the investigation and that any information provided cannot be adequately followed up or processed, e.g. because it would be necessary to disclose your identity on the basis of your consent in order to take follow-up action or because it would be necessary to request further information.
No fully automated decision-making (including profiling) pursuant to Art. 22 GDPR is used to process the data provided by you.
2. legal basis for processing
The legal basis for processing is Art. 6 para. 1 sentence 1 lit. c GDPR, § 10 ff. HinSchG for the fulfillment of a legal obligation to which the controller is subject.
The processing of special categories of personal data by the Notification Office is based on Section 10 HinSchG in conjunction with Art. 9 para. 2 GDPR. The controller is authorized to process personal data if this is necessary to fulfill the tasks under §§ 13 and 14 HinSchG.
The legal basis for the processing of the data and the disclosure of your identity is the existence of the whistleblower's consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR, Art. 9 para. 2 lit. a GDPR, Sections 9 para. 3, 11 para. 2, 16 para. 3 HinSchG. After revocation of your consent, the data will be stored for verification purposes and defense against liability claims (storage of the revocation) on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR. The processing of data within our LECARE system is based on Art. 6 para. 1 sentence 1 lit. f GDPR.
3. purpose of processing
The processing of personal data serves to comply with the legal requirements of the Whistleblower Protection Act (HinSchG). We use the information you provide as part of our whistleblower system for the purpose of reviewing and documenting (Section 11 HinSchG) the reports as well as for internal and external investigations. In addition, the information may be passed on to the competent authorities under the conditions of Section 9 (1) and (2) HinSchG.
If you have given us your consent to disclose your identity, we will pass on information about your identity to the relevant authorities in order to take follow-up measures (Section 9 (3) HinSchG). This also applies in the event that we have received consent from persons who are the subject of a report and from other persons named in the report (Section 9 (4) HinSchG). We will inform you or the persons concerned about this disclosure separately when obtaining consent. The storage of your revocation takes place in order to be able to prove previously given consents even after revocation and thus to ward off any liability claims.
The processing is carried out in order to organize and optimize the coordination of the information and the processing and tracking, as well as to protect the safety of our whistleblowers and to minimize security risks In these purposes, our legitimate interest also lies in the processing of personal data in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR.
4. duration of processing and storage, right of objection, revocation and removal
The personal data collected and the documentation will be deleted three years after completion of the procedure (§ 11 para. 5 HinSchG).
In addition, the data provided by you will be processed for as long as required by law or necessary to comply with retention obligations or to prove compliance with notification and information obligations.
You have the right to revoke your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. You can send your revocation to the controller by email or post. After the purpose or your revocation or withdrawal of your consent no longer applies, the data you have provided will be processed to comply with statutory retention obligations or on the basis of our legitimate interests. We may also store revoked consent for up to three years on the basis of our legitimate interest in order to be able to prove that consent was previously given even after revocation. You can object to the storage if your interests outweigh our legitimate interest.
5. recipients of the data
Only the authorized persons of the Legal & Compliance department have access to the internal documentation system. In the course of investigations within our company, those departments and areas may obtain knowledge of your personal data that require it to fulfill our legal obligations or the above-mentioned purposes and that are authorized to process this data. These are in particular the management, the staff representatives, the data protection officer, the information security officer, the HR department and the reporting office.
As part of the provision of services, processors may be commissioned to contribute to the fulfillment of contractual obligations. If we work together with service providers, such as service providers for IT maintenance services (so-called processors). These service providers only act in accordance with instructions and are obliged to comply with the applicable data protection requirements by means of an order processing contract prescribed by data protection law
.
We have concluded a contract with the outsourced internal reporting office in accordance with Section 14 HinSchG for the performance of the tasks of an internal reporting office for FFT Produktionssysteme GmbH & Co KG. The processing is carried out within the framework of joint responsibility in accordance with Art. 26 GDPR.
If data subjects are not employed by FFT Produktionssysteme GmbH & Co. KG, but by another Group company, their data will be transferred to FFT Produktionssysteme GmbH & Co. KG, Legal & Compliance department, for further processing
, as data processing in connection
with the Whistleblower Protection Act is carried out centrally there within our group of companies for the companies affiliated in the group. We have concluded an agreement on the performance of the tasks of an internal reporting office for the employer within the framework of joint responsibility pursuant to Art. 26 GDPR for the data of the data subjects to be processed.
We may transfer personal data to state authorities (such as the police, public prosecutor's office, courts or supervisory authorities) or to external lawyers, auditors
or other professionals bound by professional secrecy in accordance with Art. 6 para. 1 sentence 1 lit. c GDPR, insofar as there is a legal obligation to do so or in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR is necessary for the assertion, exercise or defense of legal claims and there is no reason to assume that our whistleblowers have an overriding interest worthy of protection in not disclosing the data. If information about the identity of a whistleblower or about other circumstances that allow conclusions to be drawn about the identity of this person is passed on to law enforcement authorities or on the basis of court decisions, we will inform you in advance of this disclosure and inform you of the reasons for the disclosure, unless the competent authority or court has stated that the information would jeopardize the relevant investigations, inquiries or court proceedings.
If possible, the disclosure will be made without providing personal data.
6. data transfer to third countries
The data you provide will be transferred to a third country without the disclosure of personal data and only if it is necessary for the processing of the report due to a third country reference. If the investigation also concerns group companies in a third country, we will inform you and obtain your consent to the transfer of your personal data.
V. Rights of the data subject
If we process your personal data, you as the data subject have the following rights vis-à-vis us as the controller:
1. right to information, Art. 15 GDPR
You have the right to (free) information about your collected and stored personal data at any time within the framework of the applicable legal provisions. This includes, among other things, information about the purposes of the processing, its origin and recipients, the storage period and the existence of various rights.
2. right to rectification, Art. 16 GDPR
You have a right to rectification (also in the sense of completion) of your data vis-à-vis the controller if the processed personal data concerning you is incorrect or incomplete for the purpose of processing. The controller must carry out the rectification without undue delay.
3. right to erasure, Art. 17 GDPR
You can request the erasure of your personal data at any time under the conditions of Art. 17 GDPR, unless there are still circumstances that entitle or oblige the controller to continue processing your personal data (e.g. statutory retention obligations).
4. right to restriction of processing, Art. 18 GDPR
If the legal requirements are met, you can request a restriction of the processing of your personal data within the scope of Art. 18 GDPR.
5. right to data portability, Art. 20 GDPR
If you have provided us with personal data, you have the right to transfer the data you have provided to us within the scope of Art. 20 GDPR.
6. right to object, Art. 21 GDPR
You have the right to object to processing based on a balancing of interests, stating reasons arising from your particular situation.
7. right to withdraw your consent, Art. 7 para. 3 GDPR
You have the right to withdraw your declaration of consent under data protection law at any time. The legality of the data processing carried out until the revocation remains unaffected by the revocation. You can send the revocation by e-mail or by post to the person responsible.
8. right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority for data protection, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.
The supervisory authority responsible for us is: The Hessian Commissioner for Data Protection and Freedom of Information Gustav-Stresemann-Ring 1 65189 Wiesbaden. If you are in another federal state or not in Germany, you can also contact the data protection authority there.