Directive Whistleblower Protection Act
Directive Whistleblower Protection Act
The EU Whistleblower Directive protects persons who report or publish violations of applicable law and are therefore often referred to as whistleblowers. In the future, employees of a company should have the possibility to report such violations to their own company anonymously. Therefore, since the end of 2021 the Directive requires companies to set up reporting channels for whistleblowers and to establish procedures for the processing of reports and the management of follow-up procedures.
There is a risk for every organisation that from time to time something will go wrong or that employees will unknowingly or knowingly behave in an unethical or illegal manner. A culture of openness and accountability is essential to prevent such situations from occurring or to manage them if they do occur.
It is very important to us to receive tips about potential misconduct and to encourage reporting of potential misconduct without fear of sanction or discrimination.
This policy applies to all employees, trainees, interns, board members, managers, freelancers and other employees (hereinafter collectively referred to as “employees”).
In addition, the policy applies mutatis mutandis to all other persons entitled to report, such as applicants, former employees, all business partners such as suppliers, service providers and customers, shareholders, commercial agents, intermediaries and all other relevant stakeholders who have knowledge of misconduct in the company.
2. How can potential misconduct be reported?
We welcome whistleblowers to first report a whistleblower internally to give us the opportunity to internally investigate and remedy potential misconduct. This can be reported in person or in writing to the appropriate supervisor or human resources department. It may be possible to find a solution quickly and effectively.
2.1. CONFDNT whistleblowing system
Whistleblowers can also report potential misconduct via our whistleblowing system CONFDNT. Tips can be given as follows:
Online via our website by telephone via out hotline:
team x GmbH:
Tel: +4989143777305 (en), +498962824799 (de)
The website for notices and the hotline for notices are provided by the provider CONFDNT.
The following options can be selected for a notice via the notice web page:
Anonymous
No data on the identity of the whistleblower is recorded, but the status of the processing of the whistleblowing can still be tracked anonymously at any time via a QR code or a link. In this way, further additional information on the facts of the case can be provided anonymously.
Confidential
Whistleblowers can provide contact details, e.g. their email address, and will then be kept informed about the status of their whistleblowing and the whistleblower in the company can ask questions about the facts, which can simplify and speed up the clarification of the facts.
In the case of confidential information, the contact data and information on the identity of the whistleblower are processed exclusively by the provider of the whistleblowing system CONFDNT and are not forwarded to the whistleblower in the company. This is clearly contractually agreed with CONFDNT and CONFDNT is not allowed to forward this information to the company. CONFDNT acts as an anonymisation level between the whistleblower and the whistleblower in the company.
Transparent
In the case of transparent whistleblowing, the contact details or information on the identity of the whistleblower are passed on by the provider of the whistleblowing system CONFDNT to the whistleblowers in the company and direct communication can take place between the whistleblowers and the whistleblowers in the company.
2.2 External references to the competent authorities
You can also always contact the relevant authorities in case of potential misconduct.
2.3 Anonymous or confidential references
The company will also follow up on anonymous tips as long as this does not jeopardise the priority processing of anonymous reports. A proper investigation could be more difficult or impossible in these cases if no further supplementary information on the respective facts can be obtained from the whistleblowers.
The whistleblowing system CONFDNT provides the possibility to give confidential information without revealing the identity of the whistleblowers to the whistleblowers in the company, since the identity of the whistleblowers is only known to the provider of the whistleblowing system CONFDNT and CONFDNT will not and may not reveal the identity of the whistleblowers to the company.
A confidential tip thus combines the advantages of anonymity with the possibility of communication between the whistleblower and the company.
2.4 Telephone advice and personal meeting
Telephone tips or tips given during a personal conversation are recorded with the consent of the person giving the tip or the conversation is recorded. The person giving the information will then be provided with the record of the conversation for review and correction, and he/she can confirm the record by signing it.
3. Who can report potential misconduct?
All current and former employees of our company, all applicants, business partners such as suppliers, service providers and customers, shareholders, commercial agents, intermediaries and all other relevant stakeholders who have knowledge of misconduct in the company are entitled to report.
4. What can and should be reported?
All grievances within the company, all misconduct by employees, all potential violations of applicable law and/or company policies, etc., including the respective suspicion, can and should be reported.
This includes, but is by no means limited to, the following areas in particular:
• Fraud and misconduct in relation to accounting or internal accounting controls
• Corruption, bribery and venality
• Banking and financial crime
• Auditing offences
• Money laundering, financing of terrorist activities,
• Prohibited insider trading
• Infringements of cartel law
• Infringements of competition law
• Violations of data protection law
• Betrayal of secrets, breaches of confidentiality obligations
• Falsification of contracts, reports or records
• Misuse of company assets, theft or embezzlement
• Violations of human rights
• Discrimination against our employees
• Risks to the health and safety of our employees
• Violations of rights of employees or representative bodies
• Environmental hazards
Violations or suspected violations by any employee, including the company’s executive bodies and managers, can and should be reported. The same applies if a third party carries out an action that is directed against our company (for example, attempted bribery by service providers and suppliers).
4.2. Reasonable suspicion
All cases where there is a reasonable suspicion that an incident relevant under this Directive has occurred should be reported.
It will not always be clear to the whistleblower whether a particular action or behaviour constitutes malpractice or a breach of law and/or company policy. The whistleblower should consider this carefully before making a report. However, it is clearly in the interest of the company to report a suspected case, even if whistleblowers are not 100% sure that it is indeed a case of malpractice that requires company action.
In case of doubt, the potential whistleblower can discuss the case or his/her suspicion abstractly with his/her superior without naming names and agree whether it is a relevant case to be reported.
4.3. Concrete and conclusive
Each report should be as specific as possible. The whistleblower should provide as detailed information as possible about the facts to be reported so that the reporting officer can assess the matter properly. In this context, the background, the course of events and the reason for the report as well as names, dates, places and other information should be given. Documents should be provided if available. Personal experiences, possible prejudices or subjective views should be identified as such.
In principle, the whistleblower is not obliged to conduct his or her own investigations; an exception may apply if he or she is obliged to do so under the terms of his or her employment contract.
4.4. Good faith or abuse of the whistleblower system
A tip should be made in good faith. If a review of the tip reveals, for example, that there is no reasonable suspicion or that the facts are insufficient to substantiate suspicion, whistleblowers who report a tip in good faith will not be subject to disciplinary action.
The same applies to whistleblowers who deliberately misuse the whistleblowing system to make false reports; they must expect disciplinary measures. Impairment of the whistleblowing system through, for example, manipulation, cover-up or breach of secrecy or confidentiality obligations may also result in disciplinary measures and possibly civil or criminal consequences.
4.5. Obligation to inform
If employees have reason to believe that a matter related to the company constitutes a criminal offence or is likely to cause serious damage to the company or third parties, they have a duty to inform the company. This duty to inform does not apply if the facts are already known to the company or if there is no duty to testify according to the Code of Criminal Procedure.
5. What happens after a report or how are reports processed?
5.1. Acknowledgement of receipt
Whistleblowers will receive an acknowledgement of receipt within seven days of receipt of their whistleblowing, unless the whistleblowing was done anonymously.
When using our whistleblowing system CONFDNT, the confirmation of receipt and the status of processing can also be retrieved for anonymous reports via the QR code or link to the respective report.
Every tip-off is treated confidentially and in compliance with the applicable data protection laws. Impartial reporting officers are appointed within the company to process the information.
After receipt of a report, the reporting officers acknowledge receipt of the report within 7 days at the latest. The reporting officers carry out an initial check of the plausibility and relevance of the report.
If the reporting officer believes that further investigation should take place, he/she documents this and forwards the information to the unit(s) in the company responsible for further investigation. They then conduct the internal investigation(s).
The name of the whistleblower will only be communicated and disclosed within the company if the whistleblower has given his or her express approval.
All employees are obliged to support the body responsible for the investigation in its enquiries and to cooperate to the best of their ability in clarifying the suspicion. They are obliged to maintain confidentiality.
The information obtained is documented, with only the necessary data being collected and processed.
The investigation will be carried out as quickly as reasonably possible.
The unit(s) responsible for internal investigations shall keep the Reporting Officer informed of the progress of the investigation.
The whistleblower will be informed by the Reporting Officer about the progress of the procedure and will receive feedback on the processing status or the measures taken in connection with the whistleblowing within an appropriate time frame, at the latest within three months after receipt of the whistleblowing.
5.3. Conclusion of the investigations and measures
The body or bodies responsible for internal investigations shall inform the respective persons authorised to make decisions after the investigations have been completed if a tip-off proves to be accurate and relevant.
Persons authorised to make decisions are persons who have the power to act within the company to remedy, prosecute, punish etc. grievances. As a rule, this will be the management.
The persons authorised to make decisions then decide on the necessary measures in the interest of the company, based on the ascertained facts.
As far as necessary on the basis of the results obtained, the competent authorities are subsequently also involved and the corresponding data are transmitted to them.
If a tip turns out to be false or cannot be sufficiently substantiated with facts, this will be documented accordingly and the procedure will be discontinued immediately. There must be no consequences for the employees concerned; in particular, the case will not be documented in the personnel file.
The Company will, moreover, endeavour to use the findings and suggestions of any investigation in such a way that misconduct can be corrected to the extent possible under the existing circumstances.
5.4. Complaint about the way the tip was handled
The company attaches great importance to ensuring that all advice is fully processed and appreciated and that it is always dealt with fairly and appropriately.
If whistleblowers are not satisfied with the way a whistleblower has been dealt with, they can contact their supervisor or the management directly.
6. How are whistleblowers protected?
6.1. Confidentiality and secrecy
The protection of whistleblowers is ensured by the confidential treatment of their identity. Confidentiality also applies to all other information from which the identity of the whistleblower can be directly or indirectly deduced.
In principle, the name of a whistleblower will not be disclosed; otherwise, the identity of the whistleblower may be disclosed if the whistleblower allows the disclosure or if there is a legal obligation to do so.
Whistleblowers shall be informed before their identity is disclosed, unless such information would jeopardise the relevant investigation.
The same applies to confidentiality with regard to whistleblowers as to persons who have assisted in the clarification of a suspicion.
6.2. Protection from reprisals
Any person who gives a tip-off in good faith or cooperates in the clarification of a corresponding suspicion does not have to expect disadvantageous measures and reprisals or the threat or attempt of disadvantageous measures and reprisals as a result of the tip-off or cooperation, whereby this includes in particular the following disadvantageous measures and reprisals:
• Suspension, dismissal or comparable measures
• Downgrading or refusal of a promotion
• Transfer of tasks, change of place of work, reduction of salary, change of working hours
• Refusal to participate in further training measures
• Negative performance appraisal or issuance of a poor employer’s reference
• Disciplinary measure, reprimand or other sanction including financial sanctions
• Coercion, intimidation, bullying or exclusion
• Discrimination, disadvantageous or unequal treatment
• Damage (including reputational damage), especially on social media, or causing financial loss (including loss of orders or revenue)
• Early termination or cancellation of a contract for goods or services
• Withdrawal of a licence or permit
This may not apply if the person is involved in the incident to be investigated.
If a whistleblower or a person involved in the investigation of a suspicion believes that he/she is or has been subject to reprisals as a result, he/she must report this to his/her respective superior or, if the superior is or was involved in the potential reprisal, to the management.
There is a presumption that a whistleblower or a person who has assisted in the investigation of a suspicion who has suffered a reprisal has suffered this reprisal because of the whistleblowing or the assistance. It is up to the person who took the adverse action to prove that this action was based on sufficiently justified reasons and did not constitute a reprisal due to the tip-off or cooperation.
The company will not tolerate any discrimination, harassment or similar treatment of whistleblowers or whistleblowers. The Company will consider the circumstances of each case and may take temporary or permanent measures to protect the whistleblower(s) or cooperator(s) and to protect the Company’s interests.
Any employee or supervisor who dismisses, demotes, harasses or discriminates against a whistleblower or any person who cooperates in the investigation of a relevant suspicion on the basis of the whistleblowing or cooperation shall be subject to disciplinary action which, in the most extreme case, may lead to dismissal.
Protection against reprisals also extends to third parties associated with a whistleblower who may suffer reprisals in a professional context, such as colleagues or relatives of the whistleblower, legal entities owned by or for which the whistleblower works, or with whom the whistleblower is otherwise associated in a professional context.
7. How are reported persons protected?
7.1. Information of the reported person
Any person affected by a tip-off shall be notified of the suspicions directed against him or her in due course, taking into account the requirements of data protection law, unless such notification would significantly impede the progress of the proceedings to establish the facts. The notification shall be made at the latest after the investigation has been completed.
The notification usually contains the following information:
• the details of the message submitted
• the purposes of the processing
• the legal basis for the processing and the legitimate interests of the company underlying the processing
• the categories of personal data that are processed
• the departments informed of the notification and the persons authorised to access the data
• the recipients or categories of recipients
• the intention to transfer the data to a recipient located in an unsafe third country and the legal basis for the transfer
• Information on the identity of the whistleblower or the source, if the whistleblower has consented to the disclosure of his/her identity or if this is necessary to protect the interests of the data subject.
• the duration of the storage of the data or the criteria for determining the duration
• the rights of the data subject to information, correction, blocking or deletion or any rights of objection
• Rights of appeal to the supervisory authority
The person concerned must be heard by the body responsible for internal investigations before conclusions are drawn at the end of the procedure explained above, naming the person. If a hearing is not possible for objective reasons, the competent body shall invite the person concerned to formulate his or her arguments in writing.
If the suspicion asserted in the notification is not confirmed, the data subject has the right to have his/her data stored by the company in this context deleted.
7.4. Right to complain to the works council
The reported person may exercise his or her right of appeal under sections 84, 85 of the Works Council Constitution Act (BetrVG) and involve the works council.
8.1. Legal conformity and legal basis
Personal data provided by whistleblowers or collected in the course of internal investigations are processed in compliance with data protection regulations.
The data collected will only be used for the purposes described in this policy. The data is provided in particular to ensure the legal obligations of the company or compliance within the company. The data is processed on the basis of Section 26 (1) of the German Federal Data Protection Act (BDSG) for the fulfilment of contractual obligations or on the basis of the overriding legitimate interests of the company pursuant to Article 6 (1) f) of the German Data Protection Regulation (DSGVO). These legitimate interests are ensuring compliance in the company, in particular the detection and clarification of wrongdoing in the company, behaviour that is harmful to the company, white-collar crime, etc., as well as the protection of employees, business partners, customers and other stakeholders.
Whistleblowers are provided with the necessary information on data processing and data protection when the data is collected.
All persons whose data are processed by the company within the framework of the procedure (e.g. whistleblowers, reported persons or persons assisting in the clarification) have the right, pursuant to Art. 15 GDPR, to receive information from the company about the data stored by the company about them and further information, such as the processing purposes or the recipients of the data.
Notices will not be retained longer than is necessary and proportionate to meet the requirements set out in this policy or legal retention periods.
The deletion of the collected data shall generally take place after the conclusion of the internal investigation. However, if criminal, disciplinary or civil court proceedings are instituted as a result of misconduct within the meaning of this Directive or abuse of the whistleblower system, the storage period may be extended until the respective proceedings have been finally concluded.
Personal data that is obviously not relevant for the processing of a specific tip will not be collected or will be deleted immediately if it was collected unintentionally.
8.4. Technical and organisational measures
The data collected and processed as a result of a notice are stored separately from the other data processed in the company. Appropriate authorisation systems and adequate technical and organisational measures ensure that only the persons responsible in each case have access to this data.
8.5. Transfer to third countries
The data is processed exclusively within the EU or the EEA. Only in the case of non-European circumstances may a transfer to unsafe third countries be necessary. In this case, appropriate guarantees are provided in accordance with Art. 46 et seq. DSGVO are provided.
All persons whose data are processed by the company within the framework of the procedure have the right to have their incorrect data corrected, the right to have their data completed, the right to have their data blocked or to have their data deleted, provided that the requirements of Art. 16 ff. DSGVO are present. A request for deletion is justified, for example, if the data has been processed unlawfully or the data is no longer needed for the purposes for which it was collected.
If data are processed on the basis of legitimate interests of the company, the person concerned by such processing may object to the processing of his/her data by the company at any time on grounds relating to his/her particular situation. The company will then either demonstrate overriding legitimate grounds allowing the processing or it will no longer process the data. For the time of this review, the data required for these purposes will be blocked.
Persons involved in the procedure, including the whistleblowers themselves, can contact the company’s data protection officer at any time to have it checked whether the rights existing on the basis of the relevant applicable provisions have been observed.
8.9. Right of appeal to the data protection supervisory authority
If a data subject is of the opinion that the company is not processing the data in accordance with the applicable data protection law, a complaint can be lodged with the competent data protection supervisory authority.
9. Consequences in the event of infringements
A violation of this policy may result in measures under labour law, including termination of employment without notice or, in the case of freelancers, termination of the cooperation without notice. Criminal sanctions and civil law consequences such as compensation for damages are also possible