Information on data protection
The protection of personal data is very important to us. The processing of your personal data therefore takes place according to the applicable provisions of data protection law, in particular the EU General Data Protection Regulation (GDPR) and the German Data Protection Act (BDSG). Please read this data protection information carefully before submitting a report.
Responsible parties
The party responsible for data protection in the whistleblowing system is:
KERN CHERKEH Rechtsanwälte Partnerschaft mbB Königstrasse 7, D-30175 Hannover, Germany
Tel: 0049 (511) - 89 76 57 - 0
Fax: 0049 (511) - 89 76 57 - 22
Email: kanzlei@kern-cherkeh.de
(hereafter also: "KERN CHERKEH")
Purpose and legal basis of the whistleblowing system
The whistleblowing system (BKMS® System) serves for securely and confidentially receiving, processing and managing reports concerning sports betting fraud and manipulation of sports competitions.
The processing of personal data within the framework of BKMS® System takes place in accordance with Art. 6(1)(1)(a) GDPR on the basis of your consent in connection with the voluntary submission of your report in the whistleblowing system and in accordance with Art. 6(1)(1)(f) GDPR on the basis of our legitimate interest in the fulfilment of the contract as the reporting office of the whistleblowing system acting on behalf of the government.
Functioning and use of the whistleblowing system
The whistleblowing system (BKMS® System) is technically operated by a specialised company, EQS Group GmbH, Bayreuther Str. 35, 10789 Berlin, Germany, on behalf of the government.
Personal data and information entered into the whistleblowing system are stored in a database operated by EQS Group GmbH in a high-security data centre. Only KERN CHERKEH employees can see the data. EQS Group GmbH and other third parties do not have access to the data. This is ensured in a certified procedure through extensive technical and organisational measures.
All data are stored encrypted with multiple levels of password protection according to a system of permissions so that access is restricted to a very small selection of expressly authorised persons at KERN CHERKEH.
Communication between your computer and the whistleblowing system takes place over an encrypted connection (SSL). Your IP address will not be stored during your use of the whistleblowing system. In order to maintain the connection between your computer and BKMS® System, a cookie is stored on your computer that merely contains the session ID (a session cookie). This cookie is only valid until the end of your session and expires when you close your browser.
It is possible to set up a secured postbox within the whistleblowing system with an individually chosen pseudonym/user name and password. This allows you to send reports to the respectively responsible KERN CHERKEH employee either by name or in an anonymous, safe way. This system only stores data inside the whistleblowing system, which makes it particularly secure. It is not a form of regular email communication.
Type of personal data collected
Use of the whistleblowing system is voluntary. When you submit a report via the whistleblowing system, we collect only the personal data that you provide:
- Your name, if you choose to reveal your identity
- Other personal data that are included in your report
- The names and other personal data of persons whom you list in your report, if applicable.
Confidential handling of reports and sharing of data
Incoming reports are received by a small selection of expressly authorised and specially trained lawyers at KERN CHERKEH and always handled in confidence. The lawyers of KERN CHERKEH will evaluate the matter and carry out any further investigation that may be required by the specific case. All persons who receive access to the data are obligated to maintain confidentiality.
If your report gives reason to suspect a crime, your report will be subsequently forwarded to the competent law enforcement authorities, provided you consented to this during the reporting process.
If your report does not give reason to suspect a crime but appears nonetheless valuable, your report will be forwarded to the relevant sports association, provided you consented to this on the reporting page.
Personal data of the whistleblower or concerning the whistleblower's identity will only be shared with the law enforcement authorities or a sports association if and to the extent that you have expressly consented to this as part of the reporting process.
Rights of the data subjects
Pursuant to European data protection legislation, you have the right
- according to § 21 GDPR, to object to the data processing if the processing takes place for the performance of a task carried out in the public interest (Art. 6(1)(1)(e) GDPR) or based on a legitimate interest (Art. 6(1)(1)(f) GDPR). If the right to object to the processing of the personal data is exercised, the necessity of the stored data for the examination of a report will be evaluated immediately. In this case, further processing will only take place if we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms;
- according to Art. 7(3) GDPR, to withdraw your granted consent for the processing of your data with respect to us. This has the consequence that we may no longer continue any data processing that was based on this consent;
- according to Art. 15 GDPR, to demand access regarding your personal data processed by us. In particular, you may access information on the purposes of the processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of complaint, the origin of your data (if not collected by us) as well as the existence of automated decision-making including profiling and, if applicable, meaningful information about its details;
- according to Art. 16 GDPR, to demand the immediate rectification of incorrect personal data or the completion of your personal data stored by us;
- according to Art. 17 GDPR, to request the erasure of your personal data stored by us unless the processing is necessary to exercise the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims;
- according to Art. 18 GDPR, to demand the restriction of processing of your personal data in cases where you dispute the accuracy of the data, where the processing of data is unlawful but you object to its erasure, where we no longer need the data, but you require it to assert, exercise or defend legal claims, or where you have objected to processing according to Art. 21 GDPR;
- according to Art. 20 GDPR, to receive personal data that you have provided to us in a structured, current and machine-readable format, or to request its transfer to another data controller;
- according to Art. 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, with this aim in mind, you can contact the supervisory authority of your usual place of residence or work or of our registered office.
Retention period for personal data
According to the retention periods applicable to the legal profession as per § 50 Federal Lawyers' Act (BRAO), personal data are erased after the elapsing of six years from the end of the year in which processing of the case by the reporting office ends, unless we are obligated by Article 6(1)(1)(c) GDPR to store the data for longer due to tax- or trade-related retention and documentation obligations (arising from the German Commercial Code [HGB], Criminal Code [StGB] or Fiscal Code [AO]) or you have consented to such extended storage as per Art. 6(1)(1)(a) GDPR.
Note on sending attachments
When submitting a report or an addition, you can simultaneously send attachments to the responsible KERN CHERKEH employee. If you wish to submit an anonymous report, please note the following security advice: Files may contain hidden personal data that could jeopardise your anonymity. Please remove all such information before sending a file. If you are unable to remove such data or are uncertain about how to do so, copy the text of your attachment into your report text or send the printed document anonymously to the address listed in the footer, citing the reference number received at the end of the reporting process.
Version: 01 March 2022