ANERPRO ENERGÍA Y PROCESO, S.L. (hereinafter, ANERPRO), Tax ID (CIF) B70370820, as Data Controller of ANERPRO’s Internal Information System, uses the Ethics Channel tool to manage communications within the Internal Information System, in accordance with Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, and Spanish Law 2/2023 of 20 February on the protection of persons who report regulatory breaches and on combating corruption (hereinafter, the “Whistleblower Protection Directive and Law”).
The Ethics Channel is hosted on secure servers of DIGITAL PRODUCTS DEVELOPMENT SL (Ithikios) in order to ensure the confidentiality, integrity, and availability of the information contained therein.
We inform you that we process the information you provide through the Ethics Channel (as well as any personal data relating to other individuals that you may provide) with the utmost confidentiality and in compliance with current data protection regulations, for the management of reports or irregularities relating to actions or omissions that may constitute breaches of European Union law as established in the Whistleblower Protection Directive and Law. This includes preliminary review, processing, investigation, resolution, and, where appropriate, the adoption of disciplinary measures, reporting to the relevant authorities, and/or management of any applicable judicial proceedings.
Data Controller: ANERPRO, S.L. (ANERPRO) Tax ID (CIF): B70370820 Postal Address: Calle Parroquia de Guisamo, parcela A-10 – Polígono Industrial de Bergondo, 15165, A Coruña, Spain Data Protection Email: [email protected]
For what purpose do we process the personal data you provide?
To process your reports and/or information submitted through the Ethics Channel (hereinafter, “your communications”) in accordance with the Ethics Channel Management Procedure described in this Privacy Policy.
The recipient of the communications/reports will be the Head of ANERPRO’s Internal Information System, who strictly respects the privacy of application users and processes their personal data diligently, securely, and confidentially.
In compliance with personal data protection regulations and whistleblower protection regulations:
Your personal data, the information provided, and the personal data of any third parties you may identify will be processed for the purposes specified in this Privacy Policy.
No automated decision-making or profiling will be carried out in relation to the information and data collected.
The data of the reporting person, the affected person(s), and third parties will be retained in the reporting system only for the time strictly necessary to determine whether to initiate an investigation into the reported facts.
In any case, after three (3) months from the entry of the data, the data will be blocked in accordance with Article 24 of Organic Law 3/2018 of 5 December (LOPDGDD), for the purpose of retaining evidence of the proper functioning of ANERPRO’s Compliance System.
Before the end of this period, data may be archived externally where required by applicable regulations, where an investigation or analysis is ongoing, or to demonstrate due diligence in handling the report.
Personal data that is not necessary for the knowledge and investigation of the information will not be processed and will be immediately deleted. Likewise, any personal data relating to conduct not covered by the Whistleblower Protection Directive and Law will be deleted.
If it is proven that the information provided is false, it will be immediately deleted once this circumstance is known, unless the lack of truthfulness constitutes a criminal offense, in which case it will be retained for the duration of the corresponding judicial proceedings.
The legal basis for processing personal data provided through the Ethics Channel is compliance with a legal obligation applicable to ANERPRO within the framework regulating whistleblowing channels, including duties related to criminal liability prevention and regulatory compliance.
The requested data is necessary for the proper management of the Ethics Channel, based on:
Compliance with a legal obligation; and
The legitimate interest of the Data Controller, particularly in cases where the controller may be the injured party and processing and disclosure of data to third parties is necessary for compliance management and legal defense, as provided in Article 24 of the LOPDGDD.
Where the user voluntarily provides personal data, consent constitutes the legal basis for processing, through the configuration of the communication as “Non-Anonymous,” authorizing the Ethics Channel to process personal data for the purpose of managing reports.
Access to data will be limited to:
Data Processors include collaborators and subcontracted entities managing the Ethics Channel, advisors, consultants, and compliance auditors. The Ethics Channel is hosted on secure servers of DIGITAL PRODUCTS DEVELOPMENT SL (Ithikios).
Law Enforcement Authorities may receive data where necessary for disciplinary, administrative, or criminal proceedings. The identity of the whistleblower may only be disclosed to judicial authorities, the Public Prosecutor’s Office, or competent administrative authorities within the framework of an investigation, and always subject to applicable confidentiality safeguards.
Acceptance of these conditions implies the collection of personal data entered in the Ethics Channel and unequivocal consent for its processing for report management purposes.
Users guarantee that the personal data provided is true, accurate, complete, and up to date.
Communications submitted through the Ethics Channel are confidential. The identity of whistleblowers acting in good faith will be protected against retaliation in accordance with Law 2/2023.
The identity of the reporting person will not be disclosed except when required by judicial or competent authority, when strictly necessary with express consent, or where the report was made in bad faith and disclosure is necessary for disciplinary action.
Data subjects may exercise their rights of access, rectification, erasure, restriction of processing, objection, and lodge a complaint with the Spanish Data Protection Authority (AEPD).
The identity of the reporting person will not be accessible to the reported individual, except where permitted by law under strict confidentiality safeguards.
Rights may be limited where necessary to safeguard the integrity of the investigation or where there is a legitimate interest of the entity.
Requests to exercise rights must be submitted through the designated channel indicated in this Privacy Policy.
ANERPRO and its Data Processors implement appropriate technical and organizational measures to ensure data security and prevent unauthorized access, alteration, or loss.
The Ethics Channel is hosted on secure servers of DIGITAL PRODUCTS DEVELOPMENT SL (Ithikios), certified under ISO 27001 for Information Security Management. Servers are located within the European territory, and data is encrypted to minimize intrusion risks.
Access is restricted to authorized personnel bound by confidentiality agreements.
The Ethics Channel allows reporting of conduct falling within the scope of Directive (EU) 2019/1937 and Law 2/2023.
It is intended exclusively for reporting regulatory breaches and is not a general suggestion or complaint box.
Reports must be supported by preliminary evidence sufficient to substantiate the alleged facts.
Whistleblowers acting in good faith will be protected against retaliation in accordance with Law 2/2023.
If an investigation determines that a report was made in bad faith and knowingly false, appropriate disciplinary measures may be adopted.
Reports are received by the Head of the Internal Information System, who conducts a preliminary analysis within seven (7) days to determine admissibility.
Reports may be anonymous. Anonymous reporters receive an access code and password to monitor the status of their report.
If admitted, an investigation will be initiated. Following investigation, a reasoned proposal will be issued recommending dismissal or adoption of appropriate measures.
The maximum response period is three (3) months, extendable by an additional three (3) months in complex cases.
Where the reported facts may constitute a criminal offense, the information will be referred to the Public Prosecutor’s Office.