Merck KGaA, Darmstadt, Germany Frankfurter Straße 250 64293 Darmstadt Germany
Phone: +49 6151 72-0 Telefax: +49 6151 72-2000
www.emdgroup.com
service@merckkgaa-darmstadt-germany.com
Details
Legal form: Corporation with general partners Commercial Register: AG Darmstadt HRB 6164 Registered Office: Darmstadt Chairman of the Supervisory Board: Dr. Wolfgang Büchele
Executive Board:
Belén Garijo, MD (Chair & CEO) Dr. Kai Beckmann (CEO Electronics) Peter Guenter (CEO Healthcare) Dr. Matthias Heinzel (CEO Life Science) Dr. Marcus Kuhnert (CFO)
Value Added Tax Identification Number (VAT ID): DE 811850788 Competent Governmental Authority: Regierungspräsidium Darmstadt (Germany)
Legal form: Corporation with general partners Commercial Register: AG Darmstadt HRB 6164 Registered Office: Darmstadt Chairman of the Supervisory Board: Dr. Wolfgang Büchele
Data Protection Statement for the use of whistleblowing Systems
Thank you very much for your interest in the processing of personal data at Merck KGaA, Darmstadt, Germany. We take the issues of data protection and confidentiality very serious and follow the applicable national and European data protection regulations.
This Data Protection Statement explains how we process your data when having obtained it from you or someone else through our whistleblowing system ("SpeakUp-Line"), e.g. via an e-mail sent to us/ via fax/ letter or as part of a transcript of either a personal or telephone conversation.
Controller and Data Protection Officer
Controller within the meaning of Article 4 No. 7 of the European General Data Protection Regulation ("GDPR") is:
Merck KGaA, Darmstadt, Germany
Frankfurter Straße 250
64293 Darmstadt
You can reach our Data Protection Officer at:
Merck KGaA, Darmstadt, Germany
Konzern-Datenschutzbeauftragter
Frankfurter Straße 250
64293 Darmstadt
privacy@merckkgaa-darmstadt-germany.com
Subject of Data Protection and Attributability of your Personal Data
The subject matter of data protection is personal data. According to Art. 4 no. 1 GDPR, this includes any information relating to an identified or identifiable natural person. This can be your name in particular, but also a documented behaviour that is associated with your person.
We process your personal data within the whistleblowing system in case you give us information yourself and tell us your name or if a reference to your person arises from a notice given by a third party. The latter is possible when you are accused of misconduct or your person is only mentioned by the whistleblower in the context of an alleged misconduct of another person.
Processed Categories of Data
When using the whistleblowing system, we process your name, if it is given to us, as well as the content of the respective notice. Depending on the chosen communication channel, we may also store data relating to this medium (your e-mail address, fax number, etc.).
If we receive the information from another undertaking of the group, we also store the source of the data.
Purposes of Processing
We process your data for the prevention of and investigations on possible infringements of applicable laws, our Code of Conduct or other guidelines applicable to us (cf. clause 10 of this Data Protection Statement).
Legal Bases
Processing of personal Data of internal Employees
Data processing regarding the prosecution of criminal offences by internal employees in the context of their employment is carried out on the basis of Section 26 para. 1 sentence 2 of the German Federal Data Protection Act ("FDPA") and in the event of other misconduct (such as possible violations of an applicable code of conduct) on the basis of Art. 6 para. 1 lit. f GDPR. The investigation and prevention of possible infringements of applicable laws, our Code of Conduct or other guidelines applicable to us represents our legitimate interest in processing your personal data.
Processing of Third Parties' personal Data
If you are not an employee of ours and you use the whistleblowing system or your person is mentioned by a third party within a notice to us, the processing of your personal data is carried out on the basis of Art. 6 para. 1 lit. f GDPR.
The investigation and prevention of any illegal and/ or business-damaging actions represents also our legitimate interest in processing your personal data.
Processing of personal Data in Case of Cooperation with Authorities
In exceptional cases, we may be obliged to cooperate with authorities (e.g. in the prosecution of criminal offences). The legal basis for associated data processing activities is Article 6 para. 1 lit. c GDPR. If we cooperate with authorities to investigate possible criminal offences without such obligation, this is done on the basis of Art. 6 para. 1 lit. e GDPR. By processing data in these circumstances, the public interest in the prosecution and detection of criminal offences is safeguarded.
No Obligation to provide Data and Option to stay anonymous
You are not obliged to provide us with personal data. In this case, however, we may not or only insufficiently be able to pursue a misconduct.
The whistleblowing system offers you the option of communicating information either anonymously or not anonymously. Before referring to your identity, please consider carefully whether you would like to provide corresponding information anonymously. Please also remember that conclusions about your person can be made not only through your name, but also in other ways. This may be the case, for example, if only you can be considered as a witness to an event, for instance, due to your position in the undertaking, your physical presence or a special access authorization. If you are an employee of an undertaking of the group, you will find further information on the possibility of transmitting your data anonymously on the intranet.
Source of Data and Measures taken to ensure Anonymity
We receive your personal data from whistleblowers as far as this arises from the respective notice. We also receive personal data in connection with notices received by undertakings of the group, from these undertakings.
On behalf of the group the whistleblowing system “SpeakUp Line” is run by the specialised and thoroughly selected company EQS Group GmbH, Bayreuther Str. 35, 10789 Berlin, Germany. If the whistleblowers provide information by telephone via the "Speak Up Line" or via a specially set up mailbox, this data is stored encryptedly at a high-security data processing center operated by EQS Group GmbH. Only authorized examiners at the group can decrypt the data and interpret it. Neither the EQS Group GmbH nor other third parties can decrypt data or interpret it. This is guaranteed through a certified procedure by comprehensive technical and organizational measures.
All data is encrypted and stored through a multiple password protection, so that the access is limited to only authorized persons of the group.
EQS Group must process the data exclusively for the purposes specified by us and in accordance with our instructions and has been contractually obliged by us to treat your data exclusively in accordance with the applicable data protection laws.
EQS Group will, if necessary, use further service providers bound by instructions to provide the described services. In this case, EQS Group will obligate service providers strictly to the confidentiality of personal data.
Data Recipients and Third Country Transfers
We transfer your personal data without your consent in cases permitted by law. Such data transfer may be legally permissible, in particular, if processing is necessary to fulfil a legal obligation and/ or to clarify a criminal offence, for example due to a corresponding request for disclosure from authorities.
In addition, as described above, we may enter personal data in an encrypted form into the BKMS® System (especially via the mailbox) in order to communicate with the whistleblower in the event of queries as well as to other undertakings of the group in order to communicate with them about the information received there and/ or the information concerning them.
In order to ensure the protection of your personal rights, the company will only transfer your data to countries outside the European Economic Area, if an adequate level of data protection equivalent to the GDPR is ensured. If this is not the case, the company will make use of one of the mechanisms laid down in Art. 44 et seq. GDPR, in particular via the conclusion of standard data protection clauses adopted by the Commission pursuant to Art. 46 para. 2 lit. c GDPR. These can be viewed at any time at https://eur-lex.europa.eu/legal-content/ DE/ ALL/?uri=celex%3A32004D0915.
Retention Period
Retention Period for unfounded Accusations
If we receive information, we clarify facts with necessary sensitivity. If it turns out that an accusation is not sufficiently substantiated, we will erase the data in connection therewith immediately, but at the latest within two months after the investigation has ended, if the retention cannot be carried out in a permissible manner on any other legal basis.
Retention Period for founded Accusations
If the accusations prove to be founded, we will retain the data for as long as it is necessary to clarify the facts and prosecute them. Beyond pending proceedings, this will regularly not exceed a period of three years after completion of the investigations.
Possible Consequences of Misuse of the System/ intentional Accusation
Please be careful when using the whistleblowing system to report misconduct. If you have any doubts about certain incidents, we request to inform us about them so as not to create the impression of false certainty.
If you knowingly provide us with false information about the alleged misconduct of another person, this may result in serious consequences under labour, civil and criminal law.
We also strive to promote an atmosphere of trust and cooperation within the group and to avoid denouncing employees for minor alleged misconduct. Please limit your references to suspected infringements of applicable laws, the Code of Conduct or other internal guidelines.
Behaviour that is only perceived as inappropriate (such as unfriendliness towards customers, private behaviour in leisure time, inappropriate clothing, etc.) should not be reported via the whistleblowing system, beyond extreme cases that also represent a violation of rules. In such cases, please contact your supervisor.
If you are an employee of an undertaking of the group, you will find further information on this on the intranet.
Your rights as Data Subject
Right to Access
You have the right to request from us at any time access to the personal data relating to you and processed by us to the extent set forth in Art. 15 GDPR under the restrictions set down in Section 34 FDPA. Your claim is legally restricted in particular if the access is opposed by the overriding interests of a third party, e.g. a whistleblower (Section 29 para. 1 sentence 2 FDPA).
Right to Rectification
In accordance with Art. 16 GDPR, you have the right to demand that we immediately rectify your personal data if it turns out to be inaccurate or incomplete.
Right to Erasure
You have the right to demand that we erase the personal data relating to you under the prerequisites described in Art. 17 GDPR. These prerequisites apply in particular if the personal data are no longer necessary for the purposes for which they have been collected or otherwise ceases to apply and in case we process your data unlawfully, if you have successfully objected (Secion ), and in cases where there is an obligation to erase under the law of the European Union or the law of the Member States governing us exists. This right is subject to the restrictions set down in Section 35 FDPA, according to which the right to erasure may in particular be waived if, in the case of non-automated data processing, there is a disproportionate effect for the erasure and your interest in the deletion is to be regarded as rather low.
Right to Restriction of Processing
In accordance with Art. 18 GDPR, you can request that we process your personal data only to a restricted extent. This right exists in particular if the accuracy of the personal data is disputed, if you demand restriction of processing instead of erasure under the conditions of a justified request for erasure (Clause 11.3); furthermore if the data is no longer necessary for the purposes pursued by us, but you need the data to assert, exercise or defend legal claims and if the success of an objection is still disputed.
Right to Object
Exercise of these Rights
If you wish to exercise these rights, please contact us, for example via e-mail:
privacy@merckkgaa-darmstadt-germany.com.
Right to lodge a Complaint
You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, of your workplace or of the place where the alleged infringement occurred, if you consider that the processing of your personal data violates applicable data protection law.