We want to do what is right – Our whistleblowing service
At Lumene Group reliability and long-term success are built on ethically sustainable operations, the basic principles of which are documented on our Code of Conduct.
The whistleblowing service provides an opportunity to our employee or external party to communicate anonymously and confidentially on suspected wrongdoings or illegal activities affecting people, our organisation, society, or the environment. The whistleblowing service makes wrongdoings less likely to occur in the first place and shows our commitment to operate in a fair way.
You can raise your concern anonymously or openly by using our Reporting channel, managed by a third-party, WhistleB. You do not need proof of your suspicions, but all messages must be made in good faith.
Access to reporting channel, allowing anonymous messaging and dialogue here.
Whistleblowing reports are available to the Lumene whistleblowing team and other selected and trusted parties, when necessary. Cases are handled taking the interests of all the persons involved into account. Personal data is deleted or anonymised when the case is closed or no longer needed.
The Reporting channel can be reached on any device, including smart phones.
For more information, please see:
Lumene Oy (“Lumene”, “we”, “us” or “our”) acts as a controller to the personal data that is collected and processed through our whistleblowing system. As a controller, we carry the ultimate responsibility for the processing of personal data processed in connection with whistleblowing process. Privacy is about trust, and protecting your privacy and your personal data is of utmost importance to us. Therefore, we collect your personal data only to the extent we need the data to investigate the matters reported through our whistleblowing system.
1 DATA CONTROLLER AND CONTACT PERSON
PL 27 02781
2 WHY WE PROCESS YOUR PERSONAL DATA
The purpose of the whistleblowing system is to obtain information on any occurred or alleged violation or misconduct. The related personal data is used to investigate the matters reported through the whistleblowing system and, when allegation is validated to be true, to execute the required measures to rectify the circumstances and to seek for remedies.
Processing is conducted on the following basis:
(i) processing is necessary for compliance with our legal obligations to which the communication is related;
(ii) processing is necessary for the purposes of legitimate interests pursued by Lumene when a communication on alleged misconduct is submitted; and
(iii) processing is necessary for the performance of a task carried out in the public interest (such as reports of breaches of laws in the areas serving an important objective of general public interest).
3 PROCESSING OF PERSONAL DATA
Lumene collects personal data provided in the whistleblowing communications made via the whistleblowing system, by phone or by e-mail. In addition, during any investigation of the matter, personal data are collected, to the extent necessary, from our internal systems and from third parties, such as authorities, our customers and cooperation parties, encompassing also information that is given prior to the investigation and relates to the alleged misconduct.
We process only personal data that is necessary for investigating of the reported matters, including:
(i) Basic Information, such as name, contact details, date of birth and position within Lumene;
(ii) Reported information that includes all information provided in the whistleblowing notification, such as the subject of the notification, description of alleged misconduct, basis for such allegation and any other information related thereto; and
(iii) Investigation information that means any information required to investigate the alleged misconduct.
If the notification includes clearly unnecessary information, we process such information solely for its erasure.
No sensitive personal data (such as racial or ethnic origin, religious or similar beliefs, sexual life and orientation, health, political affiliations, trade union membership) is generally processed in connection with the whistleblowing procedure. In case any sensitive data is to be processed, the processing is carried out in accordance with the local and EU laws, for example if the processing is necessary for the establishment, exercise or defence of legal claims.
4 DISCLOSURES AND TRANSFERS OF YOUR PERSONAL DATA
4.1 Disclosures of Personal Data
Within Lumene the personal data is accessed and processed by Lumene’s personnel who are in charge of or conduct the investigations. Such access is limited to persons who have a strict need-to-know basis for the processing of personal data for the abovementioned purposes. Our aim at all times is to ensure as far as possible the confidentiality of the information received and to protect the whistleblower’s identity and all other persons involved.
In addition, we may disclose your personal information without notice only if we are required to do so by law or if we in in good faith believe that such action is necessary to conform to the provisions of the law or comply with legal process served on Lumene; to protect and defend the rights or property of Lumene; or to act in urgent circumstances to protect safety of the public.
4.2 International Transfers of Personal Data
We use partners in business activities requiring the processing of personal data, and in this context, we or our partners may, in accordance with applicable legislation, process personal data anywhere in the world and thus transfer the personal data also outside EU or EEA area. In regard to transfers of personal data to countries where the local data protection legislation does not provide adequate level of data protection, the transfers are based on appropriate safeguards, such as standard contractual clauses approved by the European Commission or a competent supervisory authority.
To learn more about the appropriate safeguards we use, please send us an email the contact address above.
5 RETENTION OF DATA
After the investigations are completed and the case is definitively closed, the material gathered during the investigation is safely stored until the relevant claim period pursuant to law has expired, after which the material is destroyed. As a general rule, the data will be retained for up to two (2) years as of the completion of the investigation. To ensure integrity of data and non-discrimination the same general rule is applied to all notifications. The information may be retained for a longer period if necessary to comply with any mandatory legal requirement, such as laws regarding to safety at work, corruption, ethical matters and accounting or due to an ongoing criminal or disciplinary investigation, trial or authoritative investigation or to safeguard the rights of the whistleblower or the person subject to the notification.
In case the allegations are entirely unsubstantiated and without merit, the data regarding the subject of the communications will be deleted without undue delay.
6 DATA SUBJECT’S RIGHTS
Each whistleblower and person whose acts have been reported have a right to request:
(i) obtain from the controller confirmation as to whether or not personal data concerning him/her are being processed and a copy of such personal data;
(ii) rectification of data concerning him/her, in case there are errors or if the data is inaccurate or deficient;
(iii) personal data concerning him/her to be erased; and
(iv) for restriction of the processing his/her personal data.
Please notice that aforementioned rights are subject to preconditions provided by law, and Lumene may have right to refuse a request, for example if it could adversely affect the rights and freedoms of others, such as encumber the investigation of suspected infringements. In case the request is refused, the requestor shall be informed of basis for such refusal.
The request on aforementioned rights must be in writing and sent to the contact address above. The requestor should be prepared to provide evidence on his/her identity.
In addition, you as a data subject have the right to file a complaint with the competent supervisory authority (Finnish Data Protection Ombudsman) regarding our processing of personal data.
7 CHANGES TO THE POLICY
If for some reason you believe that we have not adhered to the foregoing, please notify us by email to the contact address above, and we will do our best to determine and correct the problem promptly.