Pursuant to articles 13 and 14 of EU Regulation 2016/679 (hereinafter "G.D.P.R."), Cementir Holding N.V. (hereinafter "Cementir Holding" or the "Data Controller") - with registered office in Amsterdam, the Netherlands - 36, Zuidplein, 1077 XV, and secondary and operational offices in Rome, Corso di Francia, 200, 00191 - as Owner of the processing of personal data, in the person of the legal representative, in relation to the "whistleblowing management procedure", informs that the personal data of the interested parties - reporting, reported and any third parties involved - will be processed by Cementir Holding itself through manual or electronic or automated, IT or telematic processing, with logic strictly related to the purposes listed below and, in any case, in order to guarantee the security and confidentiality of the data.
This information is valid only in cases where the report is not anonymous.
Identity and contact information of the Data Controller
The Data Controller is Cementir Holding NV, in the person of its legal representative, and can be contacted by registered mail to be sent to the secondary and operational office in Corso di Francia, 200, 00191 Rome, or by e-mail to the e-mail address: privacy@cementirholding.it.
Source from which personal data originate
Personal data are collected through direct conferment by the Data Subject or by third parties. In the latter case, personal data may also be related to a third party with respect to the reporting party: name, other elements of personal identification, telephone contacts, email address.
Purpose and lawfulness of the processing
Personal data are processed by the Data Controller pursuant to art. 6 of the G.D.P.R . The specific purpose of the processing is indicated below together with the relative legal basis:
| Purpose of the processing | Legal Basis |
| Complaints reported by employees or third parties for whistleblowing | Legal obligation |
Nature of the provision and consequences of the refusal
The provision of data is mandatory for the fulfillment of legal obligations. Therefore, any refusal to provide these data will make it impossible to pursue the processing purposes referred to in this Notice.
Categories of recipients of personal data
Personal data may be disclosed to third parties, belonging to the following categories:
a) Law enforcement and judicial authorities;
b) Legal advisors;
c) Subsidiaries or in any case of the Cementir group.
All subjects belonging to the categories to which the data can be communicated will be used as "Data Processors" specifically appointed by Cementir Holding, pursuant to art. 28 of the GDPR or as autonomous "Data Controllers".
Personal data will also be processed by subjects authorized to process by the Data Controller. Personal data processed by Cementir Holding are not disclosed.
Extra EU transfers
For the pursuit of the processing purposes described above, personal data may be transferred to the recipients indicated above in Italy and abroad. In no case will personal data be transferred outside the European Union.
Personal Data storage period
Personal data processed by Cementir Holding will be stored:
- at the servers of the Data Processor who performs site maintenance for the 72 hours following the compilation of the Web Form;
- at the secondary and operational office of Cementir Holding for the period of time necessary for the purposes for which they were collected or subsequently processed, in accordance with the provisions of legal obligations, or in any case to allow the protection of own rights and interests or third parties (e.g. defense in court).
Once these terms have elapsed, personal data will be anonymized, unless it is necessary to keep it for other and different purposes provided for by express law provision.
Below, the detail concerning the time period for which the data will be stored for the purposes described above:
| Purpose of the processing | Personal Data category | Time limits for erasure |
| Complaints reported by employees or third parties for whistleblowing | Name, address, other elements of personal identification Phone contacts Email address | The data will be stored by Cementir Holding for the period of time necessary for the purposes for which they were collected or subsequently processed, in accordance with the provisions of legal obligations or in any case to allow the protection of rights and interests. |
Rights of the data subject
Pursuant to and in accordance with the GDPR, Data Subject is recognised the following rights which may be exercised with respect to Data Controller:
- right to obtain from the Data Controller confirmation as to whether or not personal data of Data Subject are being processed, and, where that is the case, access to the personal data and the information set forth in Article 15 and specially on the purposes of the processing, categories of personal data concerned, recipients or categories of recipient to whom the personal data have been or shall be disclosed, period for which the personal data shall be stored, etc.;
- right to have your personal data rectified if inaccurate as well as supplemented when deemed incomplete again in relation to the purposes of the processing (Article 16);
- right to erasure of data (“right to be forgotten”), in one of the circumstances set forth in Article 17;
- right to restriction of processing, in the cases envisaged in Article 18;
- right to data portability pursuant to Article 20;
- right to object to processing pursuant to Article 21 except for the existence of legitimate reasons prevailing on the interests, rights and freedoms of the interested party, except for the assessment, exercise or defense of a right in court or other legal obligations that the Data Controller must fulfill or any other possible provision of the judicial authorities or police bodies.
Such rights may be exercised by sending a request by registered letter with advice of receipt to the Data Controller at the following address: Corso di Francia, 200, 00191 Rome, or by email to the email address: privacy@cementirholding.it.
Data Subject has the right to submit a complaint to the Personal Data Protection Authority or to another Supervisory Authority pursuant to art. 13, par. 2, letter d) of the G.D.P.R.
Pursuant to art. 2 undecies of Legislative Decree no. 196/2003, as updated by Legislative Decree n. 101/2018, the aforementioned rights cannot be exercised if this could result in an actual and concrete prejudice to the employee's confidentiality that signals an illegal conduct, pursuant to law no. 179/2017, which he became aware of due to his office.
Changes to this disclosure
The Data Controller reserves the right to modify and update this disclosure over time.
