Data protection for whistleblowers

Data protection

The protection of your privacy rights during the processing of personal data is important to Scania. We process personal data in compliance with the provisions of the EU General Data Protection Regulation (GDPR) and in accordance with the national legal provisions.

Controller and point of contact

The controller as defined by data protection law for the data processing relating to the receipt, assessment, and investigation of the tip-off are:

Scania CV AB

SE-151 87 Södertälje, Sweden

In case of possible serious regulatory violations, Scania acts as joint controller with:

TRATON SE
Hanauer Str. 26
80992 Munich, Germany

To contact Scania’s Data Protection team or to exercise your data subject rights, please use the contact form.

Purpose
Scania processes your data for the following purposes:
Assessing and processing your tip-off and conducting necessary investigations against the affected person(s) associated therewith, and, where appropriate, for communication with authorities and courts in connection with your tip-off, communication with international attorneys and auditors or other investigating persons engaged by Scania or TRATON SE.

No obligation to provide your personal data
You can submit a tip-off without sharing your personal data (anonymous tip-off). You are therefore under no obligation to provide your personal data.

Type of personal data collected
We collect the following personal data and information when you submit a tip-off:

• your name and/or private contact and identification data, should you disclose your identity (non-anonymous tip-off)

• your professional contact and (professional) organization data, if disclosed by you (non-anonymous tip-off), and, where applicable

• the names of persons and other personal data of the persons named in your tip-off.

Legal basis

The processing of your personal data is justified by the following legal basis:

• Collection, processing, and disclosure of personal data of the persons included in your tip-off and in case the whistleblower chooses not to be anonymous: for the purposes of safeguarding the legitimate interests pursued by the controller or by a third party (point (f) of Article 6(1) of the GDPR ). It is a legitimate interest of Scania to identify, process, rectify, and sanction violations of the law and severe breaches of duty of employees throughout the company in an effective manner with a high level of confidentiality to avert damage and liability risks for Scania.

• Disclosure of personal data in case of non-anonymous tip-off to other recipients: processing is necessary for compliance with a legal obligation (point (c) of Article 6(1) of the GDPR).

In certain cases, your personal data may be transmitted to other recipients: in substantiated individual cases, while processing a tip-off, or as part of an internal investigation, it may be necessary to share information with other employees of Scania or TRATON Investigation Office . If required by the investigation, information can be shared with TRATON GROUP subsidiaries in a country outside the European Union or the European Economic Area, based on appropriate data protection guarantees designed to protect those affected (e.g., EU standard data protection clauses or other exceptional derogations according to Article 49 of the GDPR).

In the event of a corresponding legal obligation or if Scania or a third party has a legitimate interest in investigating the information, further possible categories of recipients are criminal prosecution authorities, antitrust authorities, other administrative authorities, courts as well as international attorneys and auditors engaged by Scania or TRATON SE.

In certain cases, Scania  is obliged by data protection legislation or applicable national legislation to inform the suspects of the charges made against them. This is a legal requirement in cases where it can be objectively established that the disclosure of information to the suspect can no longer have an adverse effect on the investigation in question. If you disclosed your name or other personal data (non-anonymous tip-off), your identity as a whistleblower will not be disclosed, as far as it is legally possible, and steps will also be taken to ensure that no conclusions can be drawn as to your identity as the whistleblower.

Personal data will be stored for as long as it is required for the purposes of the investigation and the subsequent assessment, and, in addition, for as long as we are obliged to store it under national legal, contractual, or statutory retention periods. The following retention periods are adopted for Scania:

1. For cases closed as unfounded, case files will be deleted after one year from case completion;
2. For cases investigated as “Other Regulatory Violations”, case files will be deleted after three years from case completion;
3. For cases investigated as “Serious Regulatory Violations”, case files will be deleted after seven years of case completion; and
4. For cases that contain documents concerning legal proceedings, case files will be deleted after eleven years after the end of the legal proceeding.
   

If there is a legal obligation, the above timelines may be reasonably extended.

Once the report has been processed, the data will be deleted or anonymized in accordance with the national legal requirements. In case of anonymization, the reference to your identity as a whistleblower is permanently and irreversibly removed.

In addition to the right to be informed about the data that relates to you, and the right to have your data rectified, you also have the right to demand erasure and restriction of processing (blocking) of your data, insofar as there are no legal provisions to the contrary. Furthermore, you have the right to data portability. If we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time with effect for the future. Your withdrawal does not affect the lawfulness of the collection and processing of your name based on your consent until then, nor does it affect the processing of your name on any other legal basis (e.g., law or legitimate interests). If we have already disclosed your data to authorities or courts, you must contact these authorities in order to assert your rights. If necessary, we need to verify your identity before we can process your respective request.

If you believe your personal data is being processed in a manner not consistent with current regulations, please report it to us as soon as possible. You also have the right to file a complaint with the Data Protection Authority.

To revoke your consent (in case of a tip-off that is not anonymous) or to exercise your rights regarding your personal data, please use Scania’s contact form.

Information on the right to object to processing of your personal data at any time pursuant to Article 21(4) in conjunction with (1) of the GDPR.

You have the right to object at any time to processing of personal data that we base on legitimate interest or task carried out in the public interest. Please use the contact form provided under “Controller and point of contact” to raise an objection and state its grounds.

We will assess whether we are obliged to erase your data due to your objection on the basis of the reasons you have provided. Please note that a further processing of your personal data might be necessary despite your objection. This is the case if compelling legitimate grounds override your interests, rights, and freedoms or if we have to establish, exercise, or defend legal claims. We will inform you about the result of our assessment.