Whistleblowing portal and whistleblowing system privacy policy
Name and address of the Controller responsible for processing
The Controller within the meaning of the General Data Protection Regulation and other data protection laws applicable in the Member States of the European Union is:
Die Wiener Volkshochschulen GmbH
Lustkandlgasse 50
1090 Vienna
Email: datenschutz@vhs.at
Purpose of data processing
The purpose of data processing within the whistleblowing system is to receive and investigate reports of violations of rules and regulations as well as the reporting of serious suspected cases at VHS.
Categories of personal data
Use of the whistleblowing system is voluntary. We collect the following personal data and information when you submit a report using the whistleblowing system:
- Details of the accused person (e.g. surname, first name, title, contact details, role and employment details),
- Details of the (alleged) conduct violations and the relevant facts.
- As the whistleblowing system allows reports to be made anonymously, no personal data is collected about the whistleblowers unless they themselves indicate otherwise. Otherwise, personal information such as the name of the person submitting the report, their contact details and the details surrounding their observation, if applicable, may be considered.
Confidential handling of reports
Incoming reports are received by a small selection of expressly authorised and specially trained employees and always handled in confidence. The employees of the compliance department evaluate the matter and carry out any further investigation that may be required by the specific case.
During the processing of a report or the conducting of a special investigation, it may become necessary to forward reports to additional VHS employees.
Information about the accused party
We are legally obligated to inform accused parties of any reports received against them as soon as the disclosure of this information no longer jeopardises the investigation. Your identity as a whistleblower will not be disclosed unless we are legally bound to do so.
Legal bases for the data processing
Whistleblowers’ personal data is usually only processed with their consent (Art. 6 (1)(a) GDPR). In other cases, the processing of personal data in the whistleblowing system is carried out on the basis of Art. 6 (1)(f) to safeguard the overriding legitimate interest of VHS. This legitimate interest lies in preventing and combatting corruption as well as dealing with suspected cases of other violations of rules and regulations in connection with VHS and protecting VHS and its employees from potential harm. As reporting violations helps to avoid legal consequences, e.g. criminal prosecution, claims for damages and considerable image damage, the sensitive interests of the data subjects in the exclusion of processing or use do not outweigh this.
Recipients or categories of recipients of the personal data
VHS fundamentally ensures that your personal data is only accessible to a limited number of authorised persons who are required to know this data in order to carry out the processing purposes mentioned above.
If it becomes necessary to clarify the facts, personal data may be passed on to individual, carefully selected persons at VHS. All persons who receive access to the data are obligated to maintain confidentiality.
Your personal data will not be forwarded or otherwise transmitted to third parties unless this is necessary for law enforcement purposes. In order to ensure an objective and neutral investigation, reports concerning the company management, the highest management body (authorised signatories) and the employees of the compliance department are forwarded to an external law firm, which is obliged to maintain confidentiality due to attorney-client privilege, for further processing. If required by law or by the orders of government bodies, personal data may be disclosed to such bodies.
Data storage period
Personal data and log files are retained for as long as necessary to investigate and make a conclusive evaluation of the report. After the completion of the investigations, personal data and log files are deleted in accordance with the legal requirements (Whistleblower Protection Act). In the event that judicial and/or disciplinary proceedings are initiated, such data may be retained until the conclusion of the proceedings or the expiry of the time limits for appeal. Personal data associated with baseless reports is deleted without delay.
Data security
VHS implements technical and organisational measures to protect the personal data being managed through the use of the whistleblowing system from unauthorised access, disclosure, misuse, manipulation, loss and destruction during its collection, processing and use.
Rights of the data subjects
As a data subject, you have the right to information about the personal data which is stored concerning you. The identity of the whistleblower remains fundamentally excepted from this right of information. If the exercise of this right jeopardises the investigation of the matter or the securing of necessary evidence, VHS has the right to only comply with this right at a later point in time. You also have the right to have incorrect data corrected, amended, blocked or deleted if the legal requirements are met. Furthermore, you have a right to appeal to the competent supervisory authority for data protection at any time. Requests to exercise the rights of the data subject pursuant to Art. 15-21 GDPR may be directed to one of the responsible bodies by the data subject.
Vienna, August 2022