COMPLIANCE CHANNEL OF SANLUCAR FRUIT, S.L.U.
In accordance with the provisions of Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption, all companies with more than 50 employees are obliged to have an internal information channel that allows for the reporting of facts that may involve a serious criminal or administrative offence, or an infringement of EU law.
In addition, the regulations include the obligation to make information available to interested parties on the use of any internal information channel, as well as the essential principles of the procedure.
To ensure compliance with the above, we make the following available to you:
SANLUCAR FRUIT, S.L.U., informs:
COMPLIANCE CHANNEL
This Compliance Channel guarantees compliance with the provisions of the aforementioned regulations in accordance with the provisions of articles 7 and 9 of the same.
ANONYMOUS COMMUNICATIONS AND PERSONAL DATA
Communications may be anonymous, with the identification of the informant not being obligatory, and will be answered through the same channel through which they were received, for which purpose it will be necessary to save the tracking code that will be assigned in the message of receipt of the complaint.
Anonymity shall only be lifted with the express consent of the informant or where it constitutes a necessary and proportionate obligation imposed by Union or national law in the context of an investigation carried out by national authorities or in the framework of judicial proceedings, in particular to safeguard the rights of defence of the person concerned.
During the process, compliance with current data protection legislation (LOPD and RGPD) will therefore be guaranteed.
USE OF THE COMPLIANCE CHANNEL
When you go to file a complaint, you will notice that you are directed to an on-line tool external to the SANLUCAR FRUIT, S.L.U. domain. The message is transmitted to the tool of an external provider with the aim of guaranteeing total objectivity and transparency in the complaint management process.
In any case, the external supplier will comply with the instructions established by SANLUCAR FRUIT, S.L.U. and always in accordance with current legislation on data protection, ensuring compliance with the obligations under Art. 28 of the RGPD.
Therefore, this tool may be used by any employee of SANLUCAR Group companies or any other third party who may have knowledge of unethical, fraudulent or illegal conduct committed within our organisation.
This Compliance Channel is not the appropriate channel for issues relating to your terms and conditions of employment or disciplinary matters. In that case you should follow your organisation’s established policies.
Through different links you can access the Compliance Channel enabled for each of the SANLUCAR Group companies:
MAMARITZ SLU: Click here to access the Compliance Channel.
THE ROETZER FAMILY SLU: Click here to access the Compliance Channel.
SANLUCAR FRUIT SLU: Click here to access the Compliance Channel.
AGRICOLA DEHESA DE BAÑOS SL: Click here to access the Compliance Channel.
SANLUCAR CANARIAS SLU: Click here to access the Compliance Channel.
UNIQUA FRUIT SL: Click here to access the Compliance Channel.
NATURE ORIGIN FRUIT SLU: Click here to access the Compliance Channel.
GRUPO FRUTAS AQUA SL: Click here to access the Compliance Channel.
EL PUNTAL AGRARIA SA: Click here to access the Compliance Channel.
AGRICOLA PONY SL: Click here to access the Compliance Channel.
BASIC INFORMATION ON PERSONAL DATA PROTECTION
The person responsible for the processing of the data is SANLUCAR FRUIT, S.L.U. which will process the information collected through the channel in compliance with a legal obligation provided for in Law 2/2023, of 21 February, regulating the protection of persons who report regulatory infringements and the fight against corruption, in order to manage the complaints received through the channel, guaranteeing the confidentiality of the complainant’s data, by keeping them anonymous and not disclosing them to third parties unless their identification constitutes a necessary and proportionate obligation imposed by EU or national law in the context of an investigation carried out by national authorities or in the framework of judicial proceedings, in which case it must be communicated to the authorities competent in the matter.
Your data will be kept for a maximum period of 3 months from the time the data is entered into the channel, but may remain blocked when it is necessary to demonstrate the functioning of the crime prevention model or may be required by the competent authority for the initiation of the corresponding investigation of the facts.
For more information about the processing of your data or how to exercise your rights, please refer to our Privacy Policy.
PRIVACY POLICY COMPLIANCE CHANNEL
In compliance with Article 13 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, Article 11 of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights and article 31 of Law 2/2023 of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption, we detail below the information on personal data protection with regard to the processing of data in the Internal Information System:
- DATA CONTROLLER
The person responsible for the processing is SANLUCAR FRUIT, S.L.U., with NIF B96128590, address at Sera Llarga, 24, 46530 Puzol (Valencia), Spain, and telephone (+34) 96 142 40 40.
Your personal data will be treated in the strictest confidence by authorised personnel only.
- ORIGIN OF THE DATA
If you have chosen to identify yourself, your personal data have been obtained through the form you have filled in on the Compliance Channel set up by SANLUCAR FRUIT.
- PURPOSE OF PROCESSING
The personal data provided by you through the form and those contained in the documentation you submit in support of your communication will be processed for the sole purpose of managing the complaints received through the channel and processing the investigations of the alleged facts reported, or, where appropriate, to respond to the query raised, as well as to adopt, where appropriate, protective measures and/or measures to prevent retaliation, all in compliance with the provisions of the Internal Information System Policy and the Compliance Channel Management Protocol.
- LEGITIMISATION OF THE PROCESSING
The legal basis for the processing of your personal data in the management of the Internal Information System will be that set out in art. 6.1.c of the GDPR, insofar as the processing is necessary for compliance with a legal obligation applicable to the controller in accordance with the provisions of Law 2/2023 of 20 February, regulating the protection of persons who report breaches of the law and the fight against corruption.
- CONSERVATION PERIODS
The data processed may be kept in the information system only for the time necessary to decide whether or not to open an enquiry into the facts reported.
If it is established that the information provided or part of it is not truthful, it must be immediately deleted as soon as this circumstance comes to light, unless this lack of truthfulness could constitute a criminal offence, in which case the information will be kept for the time necessary during the legal proceedings.
In any case, if three months have elapsed since receipt of the communication without any investigation having been initiated, the communication must be deleted, unless the purpose of storage is to leave evidence of the operation of the system. Communications that have not been processed may only be recorded in anonymised form, without the obligation to block provided for in article 32 of Organic Law 3/2018, of 5 December, being applicable.
In no case shall personal data be processed that are not necessary for the knowledge and investigation of the actions or omissions to which Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption, applies, proceeding, where appropriate, to their immediate deletion. Likewise, any personal data that may have been communicated and that refer to conduct that is not included in the scope of application of the aforementioned law shall be deleted.
If the information received contains personal data included in the special categories of data, it shall be deleted immediately, without being recorded and processed.
Personal data relating to information received and internal investigations contained in the register-book shall only be kept for such period as is necessary and proportionate to comply with the aforementioned Act. In no case may the data be kept for a period of more than ten years.
- RECIPIENTS OF THE DATA
We inform you that your identity, in the event that it is provided or identifiable, will in all cases be kept confidential, and will not be communicated to the persons to whom the facts reported refer or to third parties outside the management and processing of the communication, except when it is necessary for the adoption of corrective measures in the entity or the processing of sanctioning or criminal proceedings which, where appropriate, may be applicable, in which case the competent authorities in the matter must be informed.
The personal data processed in the Internal Information System may be communicated to the judicial authority, the Public Prosecutor’s Office, the State Security Forces and Corps, or the competent administrative authority, in the context of an investigation they are carrying out or in the framework of judicial proceedings. They may also be communicated to the competent state or regional whistleblower protection authorities.
In the event of outsourcing the management of the internal information system, the information provided through the online channel may be processed by the external third party, as a data processor, in accordance with the provisions of Article 6 of Law 2/2023 of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption.
There are no plans for international transfers of data by transfer or commissioning of processing.
- RIGHTS OF THE PERSONS CONCERNED
Informants have the right to access their personal data, as well as to obtain the rectification of inaccurate or incomplete personal data, to request the deletion of their personal data and to urge the limitation of processing, by sending a letter to the postal address indicated above or to the e-mail address rgpd@sanlucar.com, at any time and free of charge. In addition, you have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), if you consider that a breach of data protection legislation has been committed with regard to the processing of your personal data.