Whistleblowing channel privacy notice
As described in SKF Vertevo's General privacy notice, SKF Vertevo processes personal data in connection with its business activities, including through its Group Ethics & Compliance Reporting Line ("Whistleblowing channel"). This Privacy notice provides additional information about the processing of personal data in connection with whistleblowing reports and related investigations and should be read together with the General privacy notice as information pertaining to international transfers, data subject rights, and security measures are available there.
Who is the data controller
SKF Vertevo AB, company registration number 556007-3495, with registered address Sven Wingquists Gata 2, SE-415 05 Gothenburg, Sweden, is the controller of personal data processed in connection with whistleblowing reports submitted through Whistleblowing channel. Personal data may be shared with other SKF Vertevo group companies on a strict need-to-know basis where it is necessary to assess, investigate and address a reported concern. Please see a list of SKF Vertevo’s legal entities here.
Categories of personal data we collect
Reports submitted through the Whistleblowing Channel are likely to contain personal data (information which directly or indirectly relates to an identified or identifiable individual). Personal data may relate to the person who has made the report, and/or to a person suspected of the alleged wrongdoing, a witness or someone else who has relevance for the reported concern.
Personal data that is typically processed when a report is received and investigated include:
- Reporting and Investigation data: Information contained in reports, complaints, disclosures and supporting documentation, including any information related to the reported facts, individuals involved, witnesses, investigations, case management activities and related communications. If the reporter chooses not to be anonymous, we will also collect personal data such as identification data and contact data about the reporter.
- Compliance and Security data: Information necessary to comply with legal obligations, perform security checks, investigate incidents, prevent fraud, manage cybersecurity risks, and protect our systems, facilities, employees, and business operations.
SKF Vertevo will only process and collect personal data that is relevant to the investigation. Special categories of personal data, such as information relating to an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health, sex life or sexual orientation may not be submitted, unless essential for the reported issue, and will be erased unless legal to process and deemed absolutely necessary for the investigation.
Why we collect your personal data, the legal basis for processing, and how long we keep your personal data
PURPOSE | DATA SOURCE | LEGAL BASIS | DATA RETENTION |
|---|---|---|---|
Any personal data collected via the Whistleblowing Channel or during the investigation of the alleged misconduct will be processed for the purpose of handling and investigating a report. | Personal data may be collected directly from the reporting individual, from participants of the investigation or from a third-party evidence source. | The processing is based on SKF Vertevo’s legal obligation to establish reporting channels and procedures for reporting and investigating. The processing may also be based on our legitimate interest in ensuring compliance with applicable law and the SKF Vertevo Code of Conduct, our policies, directives and other governing documents. For processing of special categories of personal data, the processing is necessary for the reasons of substantial public interest, on the basis of Union or Member State law or, where necessary, for the purposes of carrying out obligations and exercising specific rights in the field of employment and social security and social protection. For processing of personal data relating to criminal convictions or offences, the processing is necessary to fulfil the legal obligation to establish reporting channels and procedures for reporting. | The personal data which is compiled and processed will not be retained longer than is necessary for the purpose of carrying out an investigation and to address the breach reported. Complaints, reports, and information regarding misconduct that has been investigated will be deleted at the latest within two years of the conclusion of the investigation. If an allegation or suspected misconduct is determined to be unfounded or cannot be substantiated, any personal data relating to the matter will be deleted or anonymized no later than six months after the investigation has been concluded. Longer retention periods may apply where legal, regulatory, or disciplinary actions are initiated, or where applicable laws require us to retain personal data for a longer period. |
Personal data may also be processed for the purpose of taking action in response to investigated allegations. | See above. | The processing is based on SKF Vertevo’s legitimate interest in processing personal data in order to assess and respond to the reported concern, deal with and take action on discovered misconduct, take appropriate corrective actions, enforce company policies and protect the organization. To the extent such processing includes special categories of personal data or data relating to criminal convictions or offences, we do so on the basis that it is necessary for the establishment, exercise or defense of a legal claim. | See above. |
How we access and share your personal data
SKF Vertevo is committed to ensuring that personal data is handled with a high level of security and confidentiality. To safeguard personal data against loss, destruction, damage, unauthorised access, or disclosure, SKF Vertevo has implemented appropriate technical and organisational measures. Access to personal data contained in reports and throughout the investigation is restricted to a small team of authorised employees and contractors only.
SKF Vertevo is a global organization and depending on where the incident has taken place and what investigative measures are necessary, personal data may be shared and transferred to other companies within the group. Any transfers of personal data between SKF Vertevo affiliates are governed by an intracompany agreement. See a full list of legal entities within the SKF Vertevo group here.
Service providers
The whistleblowing system “WhistleB” is provided by NAVEX Global UK Limited (registered in the United Kingdom with company registration number 12011655). Navex is responsible for the whistleblowing system, including processing of encrypted data, such as whistleblowing messages. Neither Navex nor any sub-suppliers can decrypt and read messages. As such, neither Navex nor its sub-processors have access to readable content.
Third parties
If necessary for taking actions on the findings of a case, personal data may be transferred to the police or other law enforcement authorities, forensic companies, or external auditors. Those third parties will process your personal data as independent controllers for their own purposes and in accordance with applicable laws.
International transfers and data subject rights
For information about how we manage international transfers and data subject rights, please see SKF Vertevo’s General privacy notice.
How to contact us
For any questions related to SKF Vertevo’s processing of your personal data you may contact our Group Data Privacy Officer by e-mail at privacy@skfvertevo.com
Alternatively, you may send your correspondence by post to SKF Vertevo's registered office at:
SKF Vertevo AB
Compliance and Ethics Dep.
SE-415 05 Gothenburg · Sweden