Privacy Notice
In order to receive and process your complaint, you must confirm that you have read this Privacy Notice. If you do not agree to the terms and conditions in the notice, you will not be able to make a report.
Remember that this channel is not intended to communicate emergencies.
The whistleblowing channel is managed by GPF Partners SGEIC, S.L., (hereinafter, the COMPANY), using the ithikios platform, owned by Digital Products Development SL, a company specialized in offering internal whistleblowing channel management systems for companies. It maintains a contractual relationship with the COMPANY in charge of the processing for the purpose of receiving, storing and sending communications to the Company's Compliance team. Ithikios guarantees security and confidentiality for the purpose of the contracted processing.
Here is some basic information about how we process your personal data:
Privacy and data protection basics
Data Controller
GPF Partners SGEIC, S.L. (hereinafter, the COMPANY) with registered office at
C/ Velázquez, 86d 1º - Madrid - 28006 (Madrid) and with NIF B87074910 . It is registered in the Mercantile Registry of Madrid, volume 32795, folio 180, page number M-590.311.
Data Protection Officer
You can contact us by email: [email protected]
Data subject to processing and origin
They will be:
• your contact details, if you provide them (first and last name, email, telephone number)
• Name and position of the persons reported in the complaint
• information (regardless of their nature) of the facts denounced
Purpose of the processing and Legitimation
In accordance with current data protection regulations, the Company informs you that your personal data will be collected and processed for the purpose of:
• To analyze, process, and investigate the facts reported confidentially.
• Manage the query you ask us.
• Exchange information in order to complement your application.
• Interview you to clarify the facts reported, if applicable.
The basis for the lawful processing of your data will be compliance with a legal obligation applicable to the data controller, on the occasion of the entry into force of Law 2/2023, of 20 February, regulating the protection of persons who report regulatory breaches and the fight against corruption.
Recipients of assignments
Only the person responsible for the System and whoever manages it directly will be able to access the information you provide through this internal information channel. Access to the personal data contained in the channel will be limited to the appropriate party, within the scope of their powers and functions, in accordance with the provisions of Article 32 of Law 2/2023. Your identity will be withheld and will not be communicated to the persons to whom the facts disclosed refer or to third parties, unless it must be communicated to the competent judicial authority, the Public Prosecutor's Office or the competent administrative authority in the context of a criminal, disciplinary or disciplinary investigation. In addition, in the course of an investigation it may be necessary for us to share the facts you report with another company in the group, if that company is involved; In any case, we will always keep your anonymity. In accordance with Organic Law 8/2021, on the Comprehensive Protection of Children and Adolescents, if the facts reported refer to a situation of violence or a data protection infringement committed against a person under 14 years of age, both you and the COMPANY, once the communication has been received, must report it to the Security Forces and Bodies, the Public Prosecutor's Office or the judicial authority, or before the Spanish Data Protection Agency, as appropriate. In addition, the COMPANY has Digital Products Development, S.L. as the data processor, provider of the ithikios platform, with which it has signed the corresponding data processor contract.
Personal data will not be transferred to other third parties, unless legally obliged.
Retention period
Your data will be kept in the internal information channel for the time necessary to decide on the appropriateness of initiating an investigation into the facts reported. If it is proven that the information provided is not true, it will be immediately deleted, unless this may constitute a criminal offence, in which case it will be kept during the course of the judicial proceedings. In any case, after three months from the receipt of the communication, the data will be deleted or anonymised, except in cases of special complexity that justify extending the period for up to another three additional months. The data related to communications and investigations will be kept, in any case, in the COMPANY's information logbook for the time necessary to comply with Law 2/2023 and, in no case, for a period exceeding ten years.
International Transfer Recipient
No additional international data transfers will take place; however, if they are carried out, you will be informed in advance. In this case, the transfer will be made to recipients in countries that have a level of protection appropriate to that of the European Union. If any recipient is located in a third country without an adequacy decision by the European Commission or adequate guarantees, the COMPANY will guarantee the protection of your data by means of standard contractual clauses adopted by the European Commission, together with complementary technical, organisational and contractual measures that guarantee an essentially equivalent level of protection. The servers that support the ithikios platform are located in data centers in European territory.
Information to the person reported
If you have been the subject of a communication received through the channel, you will be informed of the facts attributed to you (the actions or omissions reported), provided that this does not alter or hinder the ongoing investigation, in accordance with Article 24.1 of Law 2/2023. In no case will you be informed of the identity of the person who submitted the communication.
Rights of data subjects
You have the right to obtain confirmation as to whether we process personal data concerning you, to access them, to request their rectification when they are inaccurate or their deletion when they are no longer necessary for the purpose for which they were collected, to request the limitation of their processing, to portability and to object to the processing. The exercise of these rights may be limited when necessary to guarantee the confidentiality of your identity as a whistleblower or not to compromise the ongoing investigation, in accordance with Article 24 of Law 2/2023. You have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe that your rights have been infringed.