1. Whistleblow

We want to do what is right – Our whistleblowing service

At Lumene Group reliability and long-term success are built on ethically sustainable operations, the basic principles of which are documented on our Code of Conduct. 

The whistleblowing service provides an opportunity to our employee or external party to communicate anonymously and confidentially on suspected wrongdoings or illegal activities affecting people, our organisation, society, or the environment. The whistleblowing service makes wrongdoings less likely to occur in the first place and shows our commitment to operate in a fair way.

You can raise your concern anonymously or openly by using our Reporting channel, managed by a third-party, WhistleB. You do not need proof of your suspicions, but all messages must be made in good faith.

Access to reporting channel, allowing anonymous messaging and dialogue here.

Whistleblowing reports are available to the Lumene whistleblowing team and other selected and trusted parties, when necessary. Cases are handled taking the interests of all the persons involved into account. Personal data is deleted or anonymised when the case is closed or no longer needed.

The Reporting channel can be reached on any device, including smart phones.
For more information, please see:

LUMENE OY – WHISTLEBLOWING PRIVACY POLICY

Lumene Oy (“Lumene”, “we”, “us” or “our”) acts as a controller to the personal data that is collected and processed through our whistleblowing system. As a controller, we carry the ultimate responsibility for the processing of personal data processed in connection with whistleblowing process. Privacy is about trust, and protecting your privacy and your personal data is of utmost importance to us. Therefore, we collect your personal data only to the extent we need the data to investigate the matters reported through our whistleblowing system.

This Privacy Policy describes the means and purposes of processing of personal data within our whistleblowing process, considering both the whistleblower who reports a matter through the whistleblowing system and the person subject to such whistleblowing notification as well as other persons involved in the process (such as witnesses). Please note that if the notification is made on anonymous basis, we do not process the personal data concerning whistleblower, unless the notification includes such data which could lead to indirect identification and is considered as personal data in that sense.

1 DATA CONTROLLER AND CONTACT PERSON

Tiina Bensky
Lumene Oy
PL 27 02781
Espoo FINLAND
+358 503503793
tiina.bensky@lumene.com

2 WHY WE PROCESS YOUR PERSONAL DATA

The purpose of the whistleblowing system is to obtain information on any occurred or alleged violation or misconduct. The related personal data is used to investigate the matters reported through the whistleblowing system and, when allegation is validated to be true, to execute the required measures to rectify the circumstances and to seek for remedies.
Processing is conducted on the following basis:
(i) processing is necessary for compliance with our legal obligations to which the communication is related;
(ii) processing is necessary for the purposes of legitimate interests pursued by Lumene when a communication on alleged misconduct is submitted; and
(iii) processing is necessary for the performance of a task carried out in the public interest (such as reports of breaches of laws in the areas serving an important objective of general public interest).

3 PROCESSING OF PERSONAL DATA

Lumene collects personal data provided in the whistleblowing communications made via the whistleblowing system, by phone or by e-mail. In addition, during any investigation of the matter, personal data are collected, to the extent necessary, from our internal systems and from third parties, such as authorities, our customers and cooperation parties, encompassing also information that is given prior to the investigation and relates to the alleged misconduct.
We process only personal data that is necessary for investigating of the reported matters, including:
(i) Basic Information, such as name, contact details, date of birth and position within Lumene;
(ii) Reported information that includes all information provided in the whistleblowing notification, such as the subject of the notification, description of alleged misconduct, basis for such allegation and any other information related thereto; and
(iii) Investigation information that means any information required to investigate the alleged misconduct.
If the notification includes clearly unnecessary information, we process such information solely for its erasure.
No sensitive personal data (such as racial or ethnic origin, religious or similar beliefs, sexual life and orientation, health, political affiliations, trade union membership) is generally processed in connection with the whistleblowing procedure. In case any sensitive data is to be processed, the processing is carried out in accordance with the local and EU laws, for example if the processing is necessary for the establishment, exercise or defence of legal claims.

4 DISCLOSURES AND TRANSFERS OF YOUR PERSONAL DATA

4.1 Disclosures of Personal Data

Within Lumene the personal data is accessed and processed by Lumene’s personnel who are in charge of or conduct the investigations. Such access is limited to persons who have a strict need-to-know basis for the processing of personal data for the abovementioned purposes. Our aim at all times is to ensure as far as possible the confidentiality of the information received and to protect the whistleblower’s identity and all other persons involved.
We may transfer or disclose your personal data to other companies within the Lumene group or to external service providers, such as entities providing the whistleblowing system, legal advisors and external auditors. We will only provide these partners the information they need to deliver the services agreed, and we require that these parties agree to process personal data based on our instructions and in compliance with this Privacy Policy. We use a third-party vendor for technical implementation of the whistleblowing system. We have concluded data processing agreements with our data processors to ensure data protection.
In addition, we may disclose your personal information without notice only if we are required to do so by law or if we in in good faith believe that such action is necessary to conform to the provisions of the law or comply with legal process served on Lumene; to protect and defend the rights or property of Lumene; or to act in urgent circumstances to protect safety of the public.

4.2 International Transfers of Personal Data

We use partners in business activities requiring the processing of personal data, and in this context, we or our partners may, in accordance with applicable legislation, process personal data anywhere in the world and thus transfer the personal data also outside EU or EEA area. In regard to transfers of personal data to countries where the local data protection legislation does not provide adequate level of data protection, the transfers are based on appropriate safeguards, such as standard contractual clauses approved by the European Commission or a competent supervisory authority.
To learn more about the appropriate safeguards we use, please send us an email the contact address above.

5 RETENTION OF DATA

After the investigations are completed and the case is definitively closed, the material gathered during the investigation is safely stored until the relevant claim period pursuant to law has expired, after which the material is destroyed. As a general rule, the data will be retained for up to two (2) years as of the completion of the investigation. To ensure integrity of data and non-discrimination the same general rule is applied to all notifications. The information may be retained for a longer period if necessary to comply with any mandatory legal requirement, such as laws regarding to safety at work, corruption, ethical matters and accounting or due to an ongoing criminal or disciplinary investigation, trial or authoritative investigation or to safeguard the rights of the whistleblower or the person subject to the notification.
In case the allegations are entirely unsubstantiated and without merit, the data regarding the subject of the communications will be deleted without undue delay.

6 DATA SUBJECT’S RIGHTS

Each whistleblower and person whose acts have been reported have a right to request:
(i) obtain from the controller confirmation as to whether or not personal data concerning him/her are being processed and a copy of such personal data;
(ii) rectification of data concerning him/her, in case there are errors or if the data is inaccurate or deficient;
(iii) personal data concerning him/her to be erased; and
(iv) for restriction of the processing his/her personal data.
Please notice that aforementioned rights are subject to preconditions provided by law, and Lumene may have right to refuse a request, for example if it could adversely affect the rights and freedoms of others, such as encumber the investigation of suspected infringements. In case the request is refused, the requestor shall be informed of basis for such refusal.
The request on aforementioned rights must be in writing and sent to the contact address above. The requestor should be prepared to provide evidence on his/her identity.
In addition, you as a data subject have the right to file a complaint with the competent supervisory authority (Finnish Data Protection Ombudsman) regarding our processing of personal data.

7 CHANGES TO THE POLICY

We reserve the right to update and modify this privacy policy. Unless otherwise provided by mandatory applicable legislation, we may not personally post changes to this Privacy Policy to the data subjects in person, and therefore we prompt you to check this policy from time to time for possible changes.
If for some reason you believe that we have not adhered to the foregoing, please notify us by email to the contact address above, and we will do our best to determine and correct the problem promptly.