Privacy Policy whistleblower system

1.      Identity and contact details of the controller

2.      Contact details of the data protection officer

3. Collection and storage of personal data/type and purpose of use

3.1. When visiting this website (kind.whizzla.com)

3.2. When using the whistleblower system (incl. internal reporting portal according to HinSchG)

4.      Duration of storage

5.      Mandatory and voluntary information

6.      Rights of the data subject

1. Identity and contact details of the controller

KIND GmbH & Co. KG

Kokenhorststrasse 3-5

30938 Burgwedel

Germany

info@kind.com

(hereinafter “KIND”)

2. Contact details of the data protection officer

KIND GmbH & Co. KG

Datenschutzbeauftragter

Kokenhorststrasse 3-5

30938 Burgwedel

Germany

Datenschutzbeauftragter@kind.com

3. Collection and storage of personal data/type and purpose of use

3.1. When visiting this website (kind.whizzla.com)

The provider of these pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and browser version
• operating system used
• Referrer URL
• Host name of the accessing computer
• Time of server request
• IP address

This data is not merged with other data sources.

This data is collected on the basis of Art. 6 Para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of his website. The server log files are recorded for this purpose. We continuously delete these server log files every 12 hours.

This website is hosted by an external service provider based and server located in Germany (hoster). A so-called Data Processing Agreement („DPA“), which was concluded with this hoster, ensures that the personal data of the users of this website is only processed according to instructions and in compliance with the GDPR.

The hoster is used for the purpose and in the interest of a secure, fast and efficient provision of the online whistleblower portal by a professional provider (Art. 6 Para. 1 lit. f GDPR).

Our hoster will only process your data to the extent necessary to fulfill its performance obligations and will follow our instructions in relation to this data.

3.2. When using the whistleblower system (incl. internal reporting portal according to HinSchG)

3.2.1 Data categories/data origin/information on sending attachments

The whistleblower system is used on a voluntary basis. If you submit a report via the whistleblower system, we collect the following personal data and information:

• Your name, if you disclose your identity;
• whether you are employed by KIND and if applicable
• names of people and other personal data of the people you name in your report.

When submitting a report or sending a supplement, you have the option of sending attachments. If you wish to submit a report anonymously, please note the following security advice: Files may contain hidden personal data that may jeopardize your anonymity. Remove this data before sending. If you cannot remove this data or are unsure, copy the text of your attachment to your report text or send the printed document anonymously to the address listed in the footer, quoting the reference number that you will receive at the end of the reporting process.

3.2.2  Processing purposes and legal basis

Our internal whistleblower system is used to securely and confidentially receive, process and manage information that falls within the material scope of the Supply Chain Due Diligence Act and the Whistleblower Protection Act. The processing of personal data as part of our whistleblower system is based on a legal obligation, as we are legally obliged to set up a whistleblower system. The legal basis for this processing of personal data is Art.6 para. 1 sentence 1 lit. c GDPR. If, exceptionally, it is a matter of information outside the scope of the above-mentioned laws, the processing is based on our legitimate interest in uncovering rule violations and avoiding damage to the detriment of KIND as well as uncovering and prosecuting misconduct. The legal basis for this processing of personal data is Art. 6 para. 1 sentence 1 lit. f GDPR.

3.2.3 Recipients of the personal data/software

Incoming information will only be processed by expressly authorized employees who are separately obligated to maintain confidentiality and will always be treated confidentially.

We implement our whistleblower system using software from lexato GmbH, Hauptstraße 28, 63619 Bad Orb (hereinafter: "lexato").

Personal data and information entered into the whistleblower systems are stored in an access-protected manner in a database operated by Lexato GmbH in a data center in Germany. lexato and other third parties have no access to the data.

Communication between your computer and the respective whistleblower system takes place via an encrypted connection (SSL). The IP address of your computer is not stored beyond the necessary, temporary processing when accessing the website (see section 3.1) while using the whistleblower portal.

To maintain the connection between your computer and the software, a cookie is stored on your computer that only contains the session ID (so-called session cookie). The cookie is only valid until the end of your session and becomes invalid when the browser is closed.

You have the option of setting up a protected mailbox in the whistleblower system with a pseudonym/user name and password of your choice. In this way, you can send reports to the Human Rights Commissioner and his staff securely, either by name or anonymously. With this system, the data is stored exclusively in the respective whistleblower system and is therefore particularly secure. This is not an ordinary e-mail communication.

4. Duration of storage

We process the data as long as this is necessary for the respective purpose. Insofar as there are legal storage obligations, the relevant personal data will be stored for the duration of the storage obligation.

5. Mandatory and voluntary information

The collection of the above-mentioned data is required for the recording of your report. There is no obligation to provide this data, but it will not be possible to process your report if it is not provided.

6. Rights of the data subject

As a data subject, you have the following rights:

• according to Art. 15 GDPR, the right to request information about your personal data processed by us to the extent specified there,
• according to Art. 16 GDPR, the right to immediately request the correction of incorrect or incomplete personal data stored by us,
• according to Art. 17 GDPR, the right to have your data stored by us deleted to request personal data, unless further processing
  • to exercise the right to freedom of expression and information;
  • to comply with a legal obligation;
  • for reasons of public interest or
  • to assert, exercise or defend legal claims is required;
• according to Art. 18 GDPR, the right to demand the restriction of the processing of your personal data, insofar as
  • the accuracy of the data is contested by you;
  • the processing is unlawful but you oppose its erasure;
  • we no longer need the data, but you need it to assert, exercise or defend legal claims or
  • you have lodged an objection to the processing in accordance with Art. 21 GDPR
• according to Art. 20 GDPR, the right to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request transmission to another person responsible,
• according to Art. 77 GDPR the right to complain to a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or work or our company headquarters.

If you have any questions regarding the collection, processing or use of your personal data, for information, correction, restriction or deletion of data, as well as revokation of any consent given or objection to a specific use of data, please contact our company data protection officer at the above-mentioned contact address.

July 2023