The personal data subject to being processed, documents provided and any other information provided in the report that contains personal information, will be processed confidentially by the controllers of the reporting channel in order to comply with the obligation to investigate and manage the report submitted, in addition to complying with the legal obligations laid out in Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption. Personal data will not be collected where its relevance is not evident in order to process specific information or, where collected by accident, that data will be deleted without undue delay.
The processing of personal data will be carried out ensuring compliance with Law 2/2023, of
20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption, with Regulation (EU) No 2016/679 of the European Parliament and of the Council, of 27 April 2016, Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights and Organic Law 7/2021, of 26 May, on the protection of personal data processed for the purposes of the prevention, detection, investigation and prosecution of criminal offences and the execution of criminal sanctions.
Controller: LANZA CAPITAL SGEIC, S.A.
Recipients:
Access to personal data held in the internal information system will be limited to:
a) The System Controller and those who directly manage the system.
b) The human resource manager or the duly designated competent body, only when it is possible to proceed with taking disciplinary measures against a worker. In the case of public servants, the competent body for dealing with this.
c) The entity or body's head of legal services, if legal measures are to be adopted in relation to the evidence established in the report.
d) The data processors that may be appointed.
e) The data protection officer.
The data may be brought to the attention of the Legal Department, Lawyers, Judicial Bodies and the Law Enforcement Authorities if any of the information received is likely to be considered a criminal offence or legal violation of any type.
Legal basis of the processing: The processing of personal data, in cases of internal communication, will be understood to be lawful in accordance with the provisions of Article 6(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, Article 8 of Organic Law 3/2018, of 5 September, and Article 11 of Organic Law 7/2021, of 26 May, where, in accordance with the provisions of articles 10 and 13 of the law, there is an obligation to have an internal information system in place. If it is not an obligation, the processing will be deemed to fall within Article 6(1)(e) of the aforementioned regulation.
The processing of personal data, in cases of external communication channels, will be understood to be lawful in accordance with the provisions of Article 6(1)(c) of Regulation (EU) 2016/679, Article 8 of Organic Law 3/2018, of 5 December, and Article 11 of Organic Law 7/2021, of 26 May.
Rights of the data subject: access, rectification, erasure, limitation, portability and opposition, free of charge via email to: canaldenuncias@firmumcapital.com In cases set out in legislation.
Preservation: Data will be kept for the legally established period in order to process the case (3 months) and for the time required in order to exercise any legal actions or if required as evidence in managing the channel.
In turn, the data subject has the right to file a complaint with the AEPD (Spanish Data Protection Agency) at www.aepd.es to request the protection of their rights.