Gebwell group strives for absolutely ethical and legal procedures in its operations. For this reason, we encourage our staff and partners, as well as other parties dealing with us, to report suspected malpractices, unlawful or unethical behavior.
Report your suspicions about possible dishonest-, illegal-, fraudulent- unethical- or negligent activities, occupational safety violations, or even illegal dismissal. If something worries you about our operations, then you should make a report.
All reports are always handled confidentially. The reporter's identity is protected throughout the process. The channel is fully privacy-protected. We do not collect any information about you that you have not provided yourself. For example, your IP address is not stored.
Reports are handled confidentially by the Gebwell whistleblowing team according to the agreed procedure. Only the team has access to the reports, and its members are bound by confidentiality.
The channel is provided by an external party, Altivo Oy. If the reporter has given their own identifying details or reports another person, personal data is processed in line with data protection principles to investigate the matter. Identifying details are deleted once the case has been closed or the data is no longer needed.
After submitting a report you will receive a report ID and a secret code. Use them to follow the handling of your report and to provide more information if needed. Keep them safe: the ID and code cannot be recovered if you lose them.
The controller of personal data in the whistleblowing channel is Gebwell.
If you provide details that identify you, or if the report concerns another person, the personal data is processed only to investigate the matter and take the necessary follow-up action. Processing complies with the EU General Data Protection Regulation and applicable data protection and whistleblower protection legislation.
Personal data that is not relevant to the investigation is deleted without delay. Handled reports and their attachments are deleted automatically once the retention period set by the company has expired. More information is available in the controller's privacy notice.
