The personal data collected are subject to processing, which responsible is Chronofresh, 3 boulevard Romain Rolland, 75014 Paris, acting as Data controller, within the meaning of the General Data Protection Regulation.
The purpose of the processing of personal data is:
- Reception and entering whistleblowing alerts into the platform;
- Investigation and alert follow-up;
- Development of activity data (statistical) from anonym data.
The lawfulness for this processing is based on a legal obligation regarding whistleblowing systems, such as law n° 2016-1691 of December 9th 2016 and law n° 2017-399 of March 27th 2017.
Personal data are also processed based on the legitimate interest of Chronofresh, to handle whistleblowing alerts in case of situations contrary to the Code of Conduct of Chronofresh and/or to the policies and procedures of Chronofresh.
These data will be kept for:
- 30 days after receiving the alert if it’s not admissible;
- 2 months after closing the alert if it’s admissible but doesn’t result into any disciplinary or legal actions;
- 2 months after the decision taken following the investigation if the alert results into disciplinary or legal actions, unless further retention is legally requested by the proceedings.
The use of the Whistleblowing system is optional.
However, when it’s used, the alert may contain personal data necessary to qualify the facts and to allow Chronofresh to handle the alert pursuant to the legal and regulatory obligations and the whistleblowing procedure of Chronofresh.
The data processed by Chronofresh are shared through the Safecall tool following your alert on their online platform or via their phone line.
You can choose the level of anonymity of your alert.
Depending on it, Safecall will only share with Chronofresh the information on your identity you accept Chronofresh know.
The recipients of personal data shared through the Whistleblowing system are the Chief Compliance Officer - Ethics Officer of Chronofresh or any person authorised to handle alerts within Chronofresh, and as part of the rights of the defence, the person concerned by the alert.
You have the following rights on your personal data:
- Right of access, of rectification and of limitation;
- Right to erasure of your personal data provided the alert is related to a situation contrary to the Code of Conduct of Chronofresh and/or to the policies and procedures of Chronofresh
- Right of opposition to the processing when you alert is related to a situation contrary to the Code of Conduct of Chronofresh and/or to the policies and procedures of Chronofresh, unless:
- if there are legitimate and imperatives motives prevailing on the data subject’s rights; or
- if the processing is necessary for the recognition, exercise, or defence of a right.
- Right to give instructions related to the retention, erasure and sharing of your data after your death.
Persons whose Personal Data is thus processed may exercise their rights by contacting the Data Protection Officer of Chronofresh at the following address: dpo.dataprotection@chronofresh.fr
Some of your personal data are transferred to the United Kingdom where Safecall datacenters are located.
United Kingdom is considered as an adequate country, guaranteeing a sufficient level of protection of personal data.
If you believe, after having contacted us, that your rights with regard to your data have not been respected, you may submit a complaint to the Commission Nationale de l'Informatique et des Libertés (CNIL).