Whistleblowing Channel Policy

Who is responsible for the processing of your data?

Identity: RH ROSCLAR, S.L. – CIF: B64035454
Dir. Postal: Calle Muntaner 239, attic – 08021 BARCELONA (SPAIN)
Phone: (+34) 932 173 444
E-mail dpo@rosclar.com

For what purpose do we treat your personal data?

The purpose of the processing is to protect employees and any person related to ROSCLAR who report regulatory violations through the internal whistleblower channel, in accordance with Ley 2/2023 reguladora del a protección de las personas físicas que informen sobre
infracciones normativas y de luchas contra la corrupción.

How long will we keep your data?

Data that have been processed and are not necessary for the knowledge or investigation of the actions or omissions indicated in the Law will be deleted immediately.

In the event of receiving data of special categories, they will be deleted immediately, without the registration and processing of the same.

The data will be kept in the information systems only for the time necessary to decide whether to initiate an investigation. If the information provided is not truthful, it will be deleted immediately. If this lack of veracity may constitute a criminal offence, the information will be kept for the time necessary during the legal proceedings.

In any case, if 3 months have elapsed since the receipt of the communication without initiating investigation proceedings, the information will be deleted. Except if the purpose of the conservation is to leave evidence of the operation of the system.

Communications that have not been followed up may only be recorded in anonymized form (there is no need to apply the blocking obligation).

What is the legitimacy for the treatment of your data?

The legal basis for processing your data is to protect the vital interests of the data subject or of other persons (Article 6.1.c of the GDPR).

The identity of the person submitting the communication will be preserved. This person has the right not to have his or her identity publicized.

To which recipients will your data be communicated?

The data may be transferred to the State Security Forces, as well as to Courts or other public administrations in the field.

The data may be communicated to data processors. We only work with data processors that offer sufficient guarantees of compliance with current data protection legislation.

Under no circumstances will your personal data be processed from a country that does not offer a level of protection comparable to the European one. If it is decided to hire processors located outside the European Economic Area, such contracting will be made in accordance with Chapter V of the General Data Protection Regulation.

No other data communications are foreseen, unless they are necessary to comply with a legal obligation.

What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation about whether in RH ROSCLAR, S.L. we are treating personal data that concerns or not.

ROSCLAR informs you that you have the following rights regarding your personal data:

• Access to your data. You have the right to access your data in order to know what personal data we are processing concerning you.
• Request rectification or erasure of your data. Under certain circumstances, you have the right to rectify inaccurate personal data concerning you which is processed by us or to ask us to delete it if, among other reasons, the data is no longer necessary for the purposes for which it was collected.
• Request the limitation of the processing of your data. In certain circumstances, you have the right to ask us to limit the processing of your data, in which case we inform you that we will only keep them for the purpose of exercising or defending claims as provided by the General Data Protection Regulation.
• Portability of your data. In certain circumstances, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and to transmit it to another data controller.
• Oppose the processing of your data. In certain circumstances and for reasons relating to your particular situation, you have the right to object to the processing of your data, in which case we will stop processing it unless further processing is necessary for compelling legitimate reasons, or for the exercise or defense of any claims. We also remind you that, where appropriate, you may object to the processing of your data for promotional purposes.

The user has the right to withdraw it at any time. This does not affect the lawfulness of processing based on consent prior to withdrawal.

How can rights be exercised?

To request the exercise of personal data rights, please contact the following email dpo@rosclar.com

You may also file a complaint with the Agencia Española de Protección de Datos (AEPD) if you consider that data protection regulations are not being complied with through the following website: www.aepd.es