Data protection information
- Controller
- Exceltrop, S.L., tax ID B93148625, Camino de Algarrobo, 87, 29700 Vélez-Málaga (Málaga), Spain.
- Purpose
- To receive and handle reports submitted to the Internal Reporting System, decide on their admission and investigate the facts reported.
- Legal basis
- Compliance with a legal obligation (Art. 6(1)(c) GDPR) and a task carried out in the public interest (Art. 6(1)(e) GDPR), under Articles 30 et seq. of Spanish Law 2/2023.
- Who has access
- Only the System Manager or, where a report concerns her, the company's Administrator; each sees only the reports assigned to them. Where applicable, the courts, the Public Prosecutor or the competent authority. The reporting person's identity is not disclosed to the people concerned.
- Retention
- Only as long as needed to decide whether to investigate. If no investigation is opened, data is deleted 3 months after receipt, except anonymised evidence of how the system operates. Never more than 10 years.
- Security
- Reports, identities, messages and files are stored encrypted on servers located in the European Union. This channel uses no analytics or advertising cookies, loads no third-party resources, and the application does not store your IP address. The hosting provider may keep technical connection logs for a limited time; the company does not use them to identify reporters.
- Your rights
- You may exercise your rights of access, rectification, erasure, restriction, objection and portability in writing at the above address, subject to the limits in Article 31 of Law 2/2023. A person concerned by a report cannot learn the reporter's identity through the right of access. You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).