Why should I submit a report?

We seek to be a reliable and trustworthy partner for you. Compliance with applicable laws is of key significance for this. Therefore it is important to us that we target and counteract potential misconduct as early as possible. To do so, we depend on concerns being reported.

Which issues can be addressed through the online reporting system?

The online reporting system was set up for reporting compliance-related issues.

Firstly, you can use this tool to report potential compliance violations resulting in serious consequences for the company. This includes criminal and civil penalties. Therefore, we are particularly interested in information on the following topics:

1. Financial misconduct and property offences
2. Competition and antitrust violations
3. Breaches of data protection laws
4. Violations of human rights, social and environmental standards
5. Suspicion of money laundering
6. Other serious violations

You can also use the online reporting system to clarify specific compliance-related questions with members of the compliance department.

Please note that other matters (e. g. customer magazine not received, complaints) cannot be processed through this system. In such cases, please contact the customer hotline or the customer service on site.

What is the process for reporting a concern or asking a question, how do I set up a postbox?

To submit a report, start by clicking the “Submit Report” button at the top of the introduction page.

The reporting process consists of 4 steps:

1. Initially, you will be asked to read some information on the protection of your anonymity and to answer a security query (a so-called CAPTCHA).
2. On the following page, you will be asked to determine the category of your report.
3. Please outline your concerns or your question in your own words on the reporting page and answer questions by selecting given responses. Upon submission of your report, you will receive a reference number as proof that you submitted this report.
4. Finally, you will be asked to set up your own secure postbox to receive feedback and, where applicable, updates on the progress of your submission.

Should you already have a secure postbox, you can access it directly via the "Login" button. Here, as well, you will have to answer the security query first.

When and how will I receive feedback?

The online reporting system places utmost importance on protecting the whistle-blower.

When setting up your secure postbox, please select your own username and password. Your report will be kept anonymous through encryption and other special security routines. If possible, please do not use a PC provided by your company to submit your report.

Within seven days upon submission, a confirmation of receipt of your report will be sent to your secure postbox together with feedback as to what will happen with your report. Should we need to clarify any details, we will contact you with specific questions.

How will my data be protected when using the online reporting system?

Data protection provisions – online reporting system

Data protection is important to us

We take the protection of your personal data very seriously. The following data privacy notice will inform you of which personal data we process when you visit this website or report a breach.

1. Controller within the meaning of Art. 4 no. 7 GDPR

The data controller that processes the data within the meaning of Art. 4 no. 7 GDPR is the data recipient indicated to you when you report a breach.

2. Reporting breaches via the online reporting system /Contacting Compliance

Purpose of data processing and legal basis

This online reporting system was set up for reporting compliance-relevant matters. You can use it to report potential compliance breaches that could have serious consequences for the company, including criminal penalties or administrative fines.

You can also use the online reporting system if you have specific questions on compliance matters you would like to have answered by Compliance staff.

The legal basis for this data processing is Art. 6 (1) sentence 1 f) GDPR.

Type of data processed

Use of the online reporting system is voluntary. The data we process depends on the information you provide us with. We normally process the following data:

• Your name and contact details, if you have provided us with this information.
• Whether you are employed with us, if you want to tell us.
• The names of individuals and other personal data related to an individual, depending on what you report to us.

Recipients/ Categories of recipients

The data you have sent us is processed by the controller and only in the Compliance department. As a matter of principle, we rule out any disclosure of the data to third parties. It may be that we need to share the data that you sent us with other departments within the controller or with other Schwarz Group companies if this is necessary to investigate the matter.

Data is also processed on our behalf by processors, such as the operator of this online reporting system, EQS Group GmbH, Bayreuther Strasse 35, 10789 Berlin, Germany. This processor and any other processors are carefully selected, and are also audited and bound by contract in accordance with Art. 28 GDPR.

We are legally obliged to inform the accused individual that we have received a report concerning them as soon as informing them thereof no longer risks prejudicing the investigation of a report. However, your identity as a whistle-blower is not revealed to the person against whom the compliance allegations were made, to the extent to which this is legally permissible.

Storage period/ Criteria for determining the storage period

Data is stored for as long as is necessary to fulfil the aforementioned purposes, namely to conclude the investigation of the report and carry out anonymised reporting on the nature and origin of the report and the communication channel used to make the report. ,and as is necessary under applicable law. Criteria that determine this period include the complexity of the matter reported, the length of time it takes to investigate it and the subject of the allegation. The data is deleted once the purpose for collection has been fulfilled.

3. Use of the online reporting system

Communication between your device and the online reporting system takes place via an encrypted connection (SSL). Your IP address is not stored. A cookie containing a session ID (session cookie) is stored on your computer for the sole purpose of maintaining the connection to the online reporting system. This cookie is valid for the duration of your session and is then deleted.

4. Your rights as data subject

You have the right, pursuant to Art. 15 (1) GDPR, upon request to receive information free of charge on the personal data about you that have been stored in the controller's system.

If the statutory requirements are met, you also have the right to rectification, erasure and restriction of processing of your personal data.

If data is processed on the basis of Art. 6 (1) e) or f) GDPR, you have the right to object. If you object to data processing, it will not be processed in future unless the controller can prove compelling legitimate grounds for further processing that prevail over the data subject's interest.

If you have provided the data yourself, you have a right to data portability.

If data is processed on the basis of your consent in accordance with Art. 6 (1) a) or Art. 9 (2) a) GDPR, you can withdraw your consent at any time with future effect without affecting the lawfulness of prior processing.

In the above-mentioned cases, if you have any further questions or wish to file a complaint, please contact our Data Protection Officer in writing or by e-mail; see section 5.

You also have the right to file a complaint with the competent data protection supervisory authority.

5. Contact the data protection officer

If you have any further questions concerning the processing of your data or exercising your rights, you can contact the responsible controller's data protection officer:

• Kaufland Stiftung & Co. KG
  z.Hd. Datenschutzbeauftragter
  Rötelstraße 35
  74172 Neckarsulm
  Deutschland
  datenschutz@kaufland.com

• ”Кауфланд България ЕООД енд Ко“ КД
  Ул. „Скопие“ 1А
  София 1233
  България
  dataprotection@kaufland.bg

• Kaufland Romania SCS
  Str. Barbu-Vacarescu 120-144
  Sect.2. Bucuresti
  România
  protectiadatelor@kaufland.ro

• Kaufland Hrvatska k.d.
  Službenik za zaštitu podataka
  Donje Svetice 14
  10 000 Zagreb
  Hrvatska
  E-mail: gdpr@kaufland.hr

• Kaufland Česká republika v.o.s.
  Právo a Compliance
  Bělohorská 2428/203
  169 00 Praha 6
  Česká republika
  oou@kaufland.cz

• Kaufland Slovenská republika v.o.s.
  Právo a Compliance
  Adresa: Trnavská cesta 41/A, 831 04 Bratislava
  Slovenská
  dataprotection@kaufland.sk

• Kaufland Polska Markety sp. z o.o. sp. k.
  Al. Armii Krajowej 47
  50-541 Wrocław
  Polska
  daneosobowe@kaufland.pl