Ethical channel
WHAT IS THIS CHANNEL AND WHAT IS IT FOR?
At Veritas, we provide all our stakeholders with a confidential communication channel to raise concerns, enquiries or complaints related to potential breaches, risks or impacts in the areas of ethics, regulatory compliance, and social, environmental and governance matters.
This channel is primarily intended for third parties, including supplier companies, customers, distributors, collaborators and any individual who maintains a relationship with the company.
WHAT TYPES OF MATTERS CAN BE REPORTED?
The following situations may be reported:
- Breaches of European Union law in areas such as competition, financial interests, the internal market, data protection, the environment or public health.
- Serious or very serious criminal or administrative offences, including those involving financial harm to the Public Treasury or the Social Security system.
- Breaches of Veritas’ internal regulations, as well as its principles and values.
- Conduct that may generate significant risks or impacts on people.
WHAT IS NOT MANAGED THROUGH THIS CHANNEL?
The following will not be processed through this channel:
- Commercial enquiries or routine operational incidents.
- Information consisting merely of rumours or information that is already entirely public.
- Matters relating exclusively to interpersonal conflicts between Veritas employees. In such cases, the specific internal channel established for this purpose must be used.
If a report is deemed inadmissible, the reporting person will be informed of the reasons in a clear and justified manner, unless the report is submitted anonymously or the individual has declined to receive notifications.
Communications submitted through this Ethics Channel will be handled and resolved in accordance with this Policy, always respecting confidentiality and ensuring protection against retaliation for the reporting person.
Personal data will be processed in accordance with the privacy policy available at the top of the page.
The Ethics Channel is intended as a communication mechanism through which any individual may safely, proactively and anonymously report breaches or irregularities related to the rules and policies applicable within the organisation.
PRIVACY POLICY
This Privacy Policy explains how we process personal data submitted through the Ethical Channel of ECOVERITAS, S.A. (hereinafter referred to as the “Organisation”). The Ethical Channel is intended for our stakeholders (supplier companies, customers, distributors and collaborators) and, in general, for any external third party who wishes to report indications of breaches or conduct contrary to applicable regulations or our values.
Personal data is processed in accordance with:
- Regulation (EU) 2016/679, General Data Protection Regulation (GDPR).
- Organic Law 3/2018 on Personal Data Protection and the Guarantee of Digital Rights (LOPDGDD).
- Law 2/2023 on the Protection of Persons Who Report Regulatory Infringements and on the Fight Against Corruption.
1. Data controller.
The controller of your personal data is ECOVERITAS, S.A., with Tax Identification Number (CIF) A62772629 and registered office at c/ Diputació, 247, 08007 Barcelona (Spain), registered with the Barcelona Commercial Registry, Volume 34,407, Folio 12, Sheet B-245540.
For any queries relating to the processing of your personal data, you may contact our Data Protection Officer at: cpd@veritas.es.
2. Sources and Categories of personal data.
Reports may be submitted either on an identified basis or anonymously. In any event, all information provided through the different forms made available by Veritas across its corporate channels will be handled with the same level of diligence.
All personal data relating to reporting persons and affected persons must be adequately protected from the time of collection until its deletion.
The personal data that may be collected includes:
- Identification and contact details of the reporting person, where they choose to provide them: first name, surname(s), email address and telephone number.
- Information relating to the person concerned by the report (reported person) and any involved third parties, including identification data, position/relationship with the Organisation and the reported facts.
- Information contained in the report: description of the facts, date, location, evidence or supporting documentation.
- In exceptional cases, special categories of personal data may be processed where essential for the investigation and voluntarily provided (e.g. health-related data in food safety incidents). In such cases, enhanced safeguards will be applied.
Personal data that are not clearly relevant for handling a specific report will not be collected or, if inadvertently collected, will be deleted without undue delay.
3. Law fullness of processing.
The legal basis for the processing of your personal data is compliance with a legal obligation, pursuant to the provisions of the applicable Whistleblower Protection legislation.
4. Data retention period.
Personal data processed for this purpose will be retained within the Ethical Channel only for as long as necessary to determine whether an investigation into the reported facts should be initiated.
The period for completing the investigation activities arising from the information management procedure may not exceed three months, except in cases of special complexity, in which a duly justified extension of up to an additional three months may be agreed. The Organisation’s Ethical Channel case management policy sets out the different stages and associated timeframes of this procedure.
5. Recipients of your personal data.
As a general rule, access to personal data reported through the Ethical Channel will be restricted, within the scope of their respective functions and responsibilities, to the members of the Organisation’s Ethics Committee.
The processing of such data by other persons, or their disclosure to third parties, shall be lawful where necessary for the adoption of corrective measures within the entity or for the conduct of disciplinary, administrative or criminal proceedings, where applicable.
Without prejudice to the foregoing, personal data contained in reports may be disclosed to law enforcement authorities, courts and tribunals, as well as any other competent authority when required under applicable law.
No international transfers of personal data outside the European Union are carried out unless: a) the recipient is located in a country subject to an adequacy decision by the European Commission; b) standard contractual clauses or another appropriate safeguard are in place; or c) a specific legal basis applies to the particular case.
6. Security and Confidentiality Measures.
The Internal Information System must prevent unauthorised access, preserve identity and ensure the confidentiality of the data relating to the persons concerned and any third parties mentioned in the information provided, particularly the identity of the reporting person where disclosed.
The identity of the reporting person may only be disclosed to judicial authorities, the Public Prosecutor’s Office or the competent administrative authority within the framework of a criminal, disciplinary or sanctioning investigation, and such disclosure shall be subject to the safeguards established by applicable law.
Where the information received contains special categories of personal data, such data will be immediately deleted unless processing is necessary for reasons of substantial public interest in accordance with Article 9(2)(g) of the General Data Protection Regulation, as provided for in Article 30.5 of Law 2/2023.
The Ethical Channel is segregated from ordinary communication channels and incorporates strict access controls, encryption in transit and at rest, access logging, and measures ensuring data integrity and availability.
The principles of data minimisation, pseudonymisation and need-to-know access will be applied throughout the investigation.
7. Rights you may exercise regarding the processing of your personal data.
You have the right to obtain confirmation as to whether the Organisation is processing personal data relating to you.
You also have the right to access your personal data and to request the rectification of inaccurate data or, where appropriate, the deletion of your personal data when, among other reasons, the data are no longer necessary for the purposes for which they were collected.
Under certain circumstances, you may request the restriction of the processing of your personal data. In such cases, we will only retain the data for the establishment, exercise or defence of legal claims.
Under certain circumstances and on grounds relating to your particular situation, you may object to the processing of your personal data. The Organisation will cease processing the data unless compelling legitimate grounds exist or the processing is necessary for the establishment, exercise or defence of legal claims.
You may also exercise your right to data portability and withdraw any consent previously granted at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
You may exercise your rights by contacting cpd@veritas.es or by sending a written communication to the registered address specified in the identification details included in our Website Legal Notice.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) through its website: www.aepd.es.