Whistleblowing Data Protection Information

1. Purpose of processing

The purpose of processing is to implement the Whistleblower Protection Act (HSchG), which came into force on February 25, 2023, in the Austrian federal theaters and thereby comply with the legal obligation. The purpose of the law is to uncover misconduct within the meaning of the HSchG and thus ensure compliance with the law.

2. Legal basis

Art. 6 (1) (c) GDPR (compliance with a legal obligation)

3. Type of data processed

• Contact details of the whistleblower (optional)
• Report submitted by the whistleblower
• Personal data contained in the report (e.g., in the body text or in documents)

The provision and processing of this data is required by law.

4. Affected persons

• Employees (including before the start and after the end of the employment relationship) as well as persons who belong to the management body of a company, temporary workers, volunteers, and interns
• Employees who work under the supervision and direction of contractors, subcontractors, suppliers, and contractual partners
• Contractors, subcontractors, suppliers, and contractual partners
• Third parties associated with the whistleblower

5. Recipients

• Sage GmbH (processor)
• Jank Weiler Operenyi Rechtsanwälte GmbH | Deloitte Legal (subprocessor)

6. Retention period

• Personal data must be retained by a controller for five years from the date of its last processing or transmission and for as long as necessary to carry out administrative or judicial proceedings or preliminary investigations under the Code of Criminal Procedure. Once the retention obligation has expired, personal data must be deleted.
• Processing operations that have actually been carried out, such as changes, queries, and transmissions, must be logged. Log data relating to these operations must be retained by a controller for three years after the retention obligation has ceased to apply, starting from the date of the last processing or transmission.

7. Rights of data subjects

As a data subject, you have the right to request information about the origin, any recipients, the purpose of data processing, the rectification or correction, the restriction of processing, the blocking or deletion of your processed personal data, and the transfer of data. If you believe that the processing of your personal data has been unlawful, you can object to the processing of your personal data.

In addition, you have the right to lodge a complaint with the competent data protection supervisory authority. In Austria, the Data Protection Authority (www.dsb.gv.at) is responsible for this. Reports should be sent to dsb@dsb.gv.at.

Please note that exercising some of these rights may hinder the effectiveness of the Whistleblower Protection Act, in particular the submission of reports, the implementation of follow-up measures, and the guarantee of anonymity for a whistleblower. Against this background, the Austrian legislature has taken measures to restrict the exercise of certain data protection rights of data subjects.

V 1.2 valid from: July 2023