4.- Treatment of the obtained data
In compliance with the current legislation on data protection, the Privacy Policy corresponding to processing personal data obtained and/or generated by information received through the Confidential Mailbox is detailed below:
PRIVACY POLICY
The personal data you provide will be processed by PLANETA CORPORACION, S.R.L., with VAT No. B61441127 with domicile at Calle Juan Ignacio Luca de Tena, 17, 28027 Madrid, as responsible and manager of the Internal Information System of Grupo Planeta. In the event that the information provided concerns any of the companies that form part of Grupo Planeta, your data may be communicated to said company in order to carry out the appropriate procedures in relation to the matter you have communicated to us.
Additionally, we inform you that the data may be processed in order to resolve your query, receive and manage the complaints or alerts reported and, in its case, carry out the corresponding investigation, as well as offer you the guarantees provided in the Internal Information System Policy. Additionally, we may process the data to prove the proper functioning of our compliance model, and for the defence of the rights of the company.
| Purpose | Description of the purpose and legitimization basis | Legitimization basis |
|---|---|---|
| Resolving queries | We will process the data in order to respond to queries made in relation to the operation and management of the Internal Information System and/or the regulatory compliance model. | Legitimate interest |
| Reception and processing of the complaint or alert that you communicate to us | We will process the data for the reception of complaints, to decide if it is appropriate to initiate or not an investigation of the complaints received, also with the purpose of carrying out the corresponding investigation of the communicated facts, to protect the informant from retaliation, to adopt, if necessary, opportune corrective measures and, in its case, initiate legal actions against the concerned persons and/or third parties. | Legal obligation e public interest |
| Prove the proper functioning of the Internal Information System and keep evidence for the defence of the company | We may retain your data to prove the proper functioning of our compliance model | Legitimate interest and legal obligation |
In the event that your report is about any of the companies of GRUPO PLANETA, we inform you that we may communicate the data, in order to carry out the appropriate procedures in relation to the matter you have communicated to us. We inform you that, in certain cases, the personal data of the complaints may be communicated to the security forces and bodies, Judges or Courts, as well as any other competent body in case of being required to comply with legal obligations.
Furthermore, if there are indications that the reported facts may constitute a crime, there is an obligation to immediately refer the facts to the Prosecutor’s Office. If the reported facts could affect the financial interests of the European Union, said facts should be referred to the European Public Prosecutor’s Office.
We inform you that it is possible for your personal data to be transferred outside the European Union or the European Economic Area. In any case, the controller will ensure that said data processing is always protected with the appropriate safeguards, which may include (i) EU approved Standard Contractual Clauses, or (ii) third-party certifications. It is possible that in some cases your data may be transferred based on one of the exceptions provided for in article 49, such as when (i) you provide your consent to the transfer, (ii) the transfer is necessary for important reasons of public interest or (iii) the transfer is necessary for the formulation, exercise or defence of claims.
The personal data of the complaints admitted for processing will be kept blocked within the Internal Information System for the duration of the investigation and, in general, for the following purposes:
-up to a maximum period of ten (10) years in compliance with the provisions of the whistleblowing legislation.
-When the fact reported is a criminal or administrative offence during the statute of limitations of the offences and the administrative penalties established in the Criminal Code or in the applicable laws of each case.
You may exercise the rights of access, deletion, rectification, opposition, limitation and portability, by writing to the company you are reporting to (PO Box 14036 (08080 - Barcelona or canal@grupoplaneta.info). Additionally, when you consider it appropriate you may file a claim with the Spanish Data Protection Agency.
You can contact our Data Protection Officer by writing to dpo@planeta.es or Grupo Planeta, at: Data Protection Officer, Avda. Diagonal 662-664, 08034 Barcelona.”