When should the notification be submitted?
For example, you can report suspected bribery, fraud, or other illegal activities; occupational safety or environmental violations; harassment or discrimination; and other unethical conduct.
You don't have to be certain about it. It is enough that you have a reasonable basis for suspecting misconduct. No retaliatory measures may be taken against someone who has reported the matter in good faith.
Confidentiality
All reports are handled confidentially. You can file a report anonymously, and you do not need to reveal your identity at any point.
- Notifications, messages, and attachments are stored in encrypted form.
- Only the processors designated by the company, who are bound by a duty of confidentiality, can access the reports. The system administrator does not have access to the content of the reports.
- Processors log in using two-factor authentication, and all processing activities are recorded in the event log.
- This channel does not store your IP address or browser information. Location and device information are automatically removed from images.
If you want to remain anonymous, do not include any information in your report that could identify you. Preferably, use your own device and network instead of your employer's devices and network.
Tracking a Report
After submitting your report, you will receive a report ID and a secret code. You can use these to track the status of your report, respond to questions from the person processing it, and add information or attachments. Save the ID and code in a safe place, as they cannot be recovered if lost.
You will receive confirmation of receipt of your report within 7 days and information on next steps within 3 months at the latest. Check the status of your report regularly, as the processor may request additional information.
If you wish, you can provide your email address when submitting a report. We will then send you your login credentials and notify you when there are updates to your report. Please note, however, that an email always leaves a trace in the server logs, so your report will not be 100% anonymous. If you wish to remain completely anonymous, leave the email field blank.
Processing of Personal Data
Gebwell is the data controller for the personal data register associated with the reporting channel.
If you provide your own identifying information in the report or if the report concerns another person, personal data will be processed solely for the purpose of investigating the matter and taking the necessary follow-up actions. The processing complies with the EU General Data Protection Regulation, the Data Protection Act, and the Whistleblower Protection Act.
Personal data that is not relevant to the investigation will be deleted without delay. Processed reports and their attachments will be automatically deleted once the retention period specified by the company has expired. For more information, please refer to the data controller’s privacy policy.