GROPYUS AG, Barichgasse 40, 1030 Vienna, Austria (hereafter „GROPYUS AG“) herewith informs you about the processing of personal data within this website for which GROPYUS AG is responsible in the sense of the EU General Data Protection Regulation (GDPR). Questions regarding data protection can also be sent to datenschutz@gropyus.com.

Data protection officer of the GROPYUS Group is attorney Nikolaus Bertermann, daspro GmbH, Kurfürstendamm 21, D-10719 Berlin. You can reach the data protection officer by sending an e-mail to gropyus-dsb@daspro.de.

We publish a link to our whistleblowing system iWhistle in our intranet and on our website. The system serves as a digital internal reporting point for employees and business partners, who can anonymously provide information about malpractices such as corruption, abuse of authority or discrimination via a reporting form. GROPYUS AG is responsible for data processing. The administrator or case handler authorized by us manages the tips received on a dashboard, can make risk assessments in the system and document measures. The system includes a protected reporting channel through which the case handler can enter into an anonymous dialog with the whistleblower in order to further clarify the facts. Access to the system is via a dedicated PIN, which the whistleblower establishes by means of a code received prior to submitting the report.  

(i) The data mentioned below are processed for the purpose of providing a whistleblower system, as well as for tracking reported cases and documenting the procedure. There are no plans to change these purposes. 

(ii) The data processed are:

- Personal master data

- Communication data (e.g. telephone, e-mail)

- contract data

- log data

- Information on criminal offences and suspected criminal offences

Note: The reports are made anonymously. The above data is required for registration in the system and for obtaining the individual access code. They cannot be viewed by our administrators or case handlers. 

(iii) The legal basis for the processing is Article 6 (1) sentence 1 lit. f DS-GVO. There is a legitimate interest in providing a whistleblower system, as this facilitates the fulfillment of our legal obligation to prosecute criminal acts in our company. 

(iv) The data is actively provided by users as part of a report. Log data is collected automatically with the use of the system. 

(v) Recipients of the personal data are IT service providers, which we use under a contract processing agreement. In particular, we use iComply GmbH, Große Langgasse 1A, 55116 Mainz, Germany, as an order processor to provide the whistleblowing system. The iWhistle system is a product of iComply GmbH. 

(vi) If reports have turned out to be false or do not provide grounds for prosecution in the absence of an unlawful act, the data will be deleted immediately after it has been determined that the report will not be pursued further. If a report involves an action that can be prosecuted, but there is no evidence to support prosecution, the data will be deleted after one year. In the case of reports that contain a justified initial suspicion, the data will be deleted after 5 years, but at the latest after the legally binding conclusion of criminal proceedings or other legal proceedings.

(i) We do not use any methods of automated individual decision-making.

(ii) You have the right to request information at any time about all your personal data, which we are processing.

(iii) If your personal data is incorrect or incomplete, you have the right to have it rectified and completed.

(iv) You can request the erasure of your personal data at any time, as long as we are not bound by legal obligations that require or allow us to continue processing your data.

(v) If the applicable legal requirements are met, you can request a restriction to the processing of your personal data.

(vi) You have the right to object to the processing insofar as the data processing is based on profiling or direct marketing purposes.

(vii) If the processing is carried out on the basis of the balancing of interests, you may object to the processing by stating reasons arising from your particular situation.

(viii) If the data processing takes place on the basis of your consent or a contract, you have the right to a transfer of the data provided by you, insofar as the rights and freedoms of others are thereby not impaired.

(ix) If we process your data on the basis of a declaration of consent, you have the right to revoke this consent at any time with future effect. The processing carried out prior to revocation remains unaffected by the revocation.

(x) Moreover, you have the right to file a complaint at any time with a data protection supervisory authority if you believe that data processing has been carried out in violation of the applicable law.

Version: January 4, 2022