We, the Deutsches Medizinrechenzentrum GmbH, have implemented an internal whistleblowing system for the detection and prevention of violations of applicable law and company policies.
This whistleblower system is available to employees and business partners (customers, suppliers, etc.) at all times.
With this whistleblower system, we give you the opportunity to report possible violations anonymously.
If you as a whistleblower deliberately do not wish to remain anonymous, you can voluntarily provide your first and last name as well as your contact details (telephone number, e-mail address, postal address).
By submitting the report, it is necessary for us to process your details about the incident and any contact details (telephone number, e-mail address, postal address) for the purpose of investigating violations of applicable law or company guidelines or preventing such violations. This data may be passed on confidentially to third parties, such as external auditors and/or lawyers.
If you add files as supporting documents for your hint, you have ensured in advance that there is no unwanted meta-information or personal data in them that could jeopardise your anonymity if you submit an anonymous report.
Information on data protection can be found in our privacy policy:
1. Introduction
The following information is intended to provide you, as a ‘data subject’, with an overview of how personal data is processed in the context of our whistleblower system and your rights under data protection laws.
2. Controller and data security
The controller within the meaning of the GDPR is:
Deutsches Medizinrechenzentrum GmbH
Werftstraße 16
40549 Düsseldorf
The whistleblower system is operated by our processor, audatis Group GmbH, Luisenstraße 1, 32052 Herford. Only we are able to view the data stored in our whistleblower system.
Access to any data is regulated and restricted to a small group of explicitly authorised persons.
3. Data protection officer
Dr. Volker Herrmann
Dr. Herrmann Datenschutz GmbH
Florensstr. 20
40221 Düsseldorf
datenschutz@dmrz.de
You can contact our data protection officer directly at any time with any questions regarding data protection.
4. Purpose of the whistleblower system, legal basis for processing
The whistleblower system is used to receive reports of (possible) violations within the company of legal regulations and company guidelines.
If information regarding the employee's capacity, information regarding the data subject and other information that allows conclusions to be drawn about natural persons is processed, this is done either to fulfil legal obligations under the Whistleblower Protection Act (HinSchG) in accordance with Art. 6 (1) point c) GDPR or, in the case of a voluntary whistleblower system, on the basis of the legitimate interest in accordance with Art. 6 (1) point f) GDPR. Our legitimate interest lies in the processing of reports in order to be able to carry out follow-up measures. The processing is also carried out to safeguard the company's legitimate interest in fulfilling its supervisory obligations (Art. 6 para. 1 sentence 1 lit. f) GDPR in conjunction with, in particular, Section 130 para. 1 OWiG).
Legal action to sanction violations is taken on the basis of Section 26 (1) sentence 2 BDSG, as well as on the basis of the legitimate interest of the company in fully investigating violations and preventing them in the future ( Art. 6 (1) sentence 1 lit. f) GDPR) or, if a corresponding legal obligation exists, on the basis of Art. 6 (1) sentence 1 lit. c) GDPR in conjunction with the corresponding legal provision.
If we obtain consent, this is the legal basis for the processing for the purposes stated in the corresponding declaration of consent (Art. 6 (1) sentence 1 lit. a) GDPR).
5. What data do we collect, information on systems
When we receive and process reports via our whistleblower system, we collect the following personal data:
The IP address used to access the whistleblower system – this is completely deleted immediately after the connection is terminated.
The username chosen by the whistleblower.
The identity and contact details of the whistleblower, if voluntarily provided by the whistleblower.
Time, date and content of a report (e.g. times, places, persons, possible violations).
6. recipients of personal data, third country transfer
In order to process, investigate and follow up on a report from our whistleblower system, as well as to stop any violations that may have been identified, it may be necessary to inform other groups of people about the contents of a report.
Any information outside the narrow circle of the whistleblower office is provided on a strict ‘need-to-know’ basis, i.e. only those people who absolutely need to be involved are informed, and only to the extent necessary.
When a report is received, it may be necessary to involve not only management but also the legal department, external advisors (e.g. law firms and/or auditors) and/or the relevant authorities (e.g. law enforcement authorities, competition authorities) and courts.
If a subsidiary is involved in the violation, for example because a report refers to events within that subsidiary, it may be necessary to also inform employees of that subsidiary.
In certain cases, it may also be necessary for data protection reasons to inform the accused employee about the allegations against him. If legally permissible, the identity of the whistleblower will not be disclosed either directly or indirectly. This does not apply to cases in which deliberately abusive, i.e. untruthful reports have been submitted with the intention of harming the person concerned.
7. Duration of storage of personal data
Personal data will be stored within the framework of the whistleblower system for as long as necessary for an assessment, processing and, if necessary, prosecution of the report, as well as for the enforcement of any claims of the company. Reports will be deleted within three years of the conclusion of the proceedings in accordance with § 11 (5) HinSchG, unless further storage is necessary for the clarification of necessary legal steps.
Personal data may be stored beyond the specified periods if and to the extent that the company is obliged by law to store personal data or can assert an overriding legitimate interest in storing it.
8. automated decision-making
There is no automated decision-making or profiling of any kind.
9. Your rights as a data subject
Under the conditions set out in the respective regulation and taking into account the restrictions of these rights in accordance with the GDPR and the BDSG, you as the data subject have the following rights:
Right to confirmation
You have the right to request confirmation from us as to whether personal data concerning you is being processed.
Right to information Art. 15 GDPR
You have the right to receive information from us at any time and free of charge about the personal data stored about you, as well as a copy of this data in accordance with the statutory provisions.
Right to rectification Art. 16 GDPR
You have the right to request the rectification of inaccurate personal data concerning you. Furthermore, you have the right to request the completion of incomplete personal data, taking into account the purposes of the processing.
Deletion Art. 17 GDPR
You have the right to demand that we delete the personal data concerning you without undue delay, provided that one of the reasons provided by law applies and insofar as the processing or storage is not necessary.
Restriction of processing Art. 18 GDPR
You have the right to demand that we restrict the processing if one of the legal requirements is met.
Data portability Art. 20 GDPR
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us. Furthermore, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible and where this does not adversely affect the rights and freedoms of others.
Objection Art. 21 GDPR
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6 (1) lit. e (data processing in the public interest) or lit. f (data processing for the purposes of legitimate interests) GDPR.
If you file an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
Revocation of consent
You have the right to revoke your consent to the processing of personal data at any time with effect for the future.
If the consent concerns the processing of the whistleblower's identity data, the consent can only be revoked within one month of submitting the report. After this period has expired, the accused employee must be informed about the processing of his personal data, including the source of the report. Therefore, the processing cannot be stopped after the one-month period has expired.
In exceptional cases – for example, if statutory reporting deadlines apply – the revocation period for consent may be shortened.
Complaint to a supervisory authority
You have the right to complain to a supervisory authority responsible for data protection about our processing of personal data.