Whistleblower system - Data protection notice

With the following information, we would like to inform you about the processing of personal data within the whistleblower system when you submit a whistleblower report to Salzgitter AG by e-mail, phone call, letter or personal appearance.

1. Who is responsible for processing your personal data and whom can you contact?

a) If you submit a notice to Salzgitter AG by e-mail, phone call or on-site appearance, the person responsible for data processing is:

Salzgitter AG Compliance Management / Group Legal Department of Salzgitter AG
Eisenhüttenstrasse 99
38239 Salzgitter / Germany
Phone: +49 5341 / 21-9229

You can reach our data protection officer at:

Salzgitter AG 
Data Protection Officer
Eisenhüttenstrasse 99
38239 Salzgitter / Germany

b) If you give information to the ombudswoman, she will be responsible for data processing:

Mrs. Nina Weigel-Grabenhorst, attorney at law
SQR Rechtsanwälte LLP
Wolfenbütteler Straße 45
38124 Braunschweig / Germany
Phone: +49 531 310 7 3177

2. Which data do we use and how do we collect it?

We only use the following data and information voluntarily provided by you when reporting:

  • Your name, if you disclose your identity,
  • Your contact information, if you provide it to us for further contact,
  • the fact that you have made a report via the whistleblower system,
  • the fact whether you are employed by the Salzgitter Group, and
  • the personal facts described by you
  • if applicable, the names of persons as well as other personal data of persons named by you in the report.

3. For which purposes and on what legal basis?

The purpose of the whistleblower system is to enable employees, business partners and all other persons affected by the activities of the Salzgitter Group to confidentially report (possible) violations of the law or other violations, which are then processed by the reporting office for further clarification.

The processing of personal data within the scope of the whistleblower system is based on Salzgitter AG's legitimate interest in the detection and prevention of wrongdoing and the associated prevention of damage and liability risks for the Salzgitter Group. The legal basis for processing in this respect is Art. 6 (1) lit. f of the EU General Data Protection Regulation (DSGVO) in conjunction with Sections 30, 130 of the German Code of Criminal Offenses (OWiG).

If a tip received concerns an employee of Salzgitter AG or a Salzgitter Group company, the processing also serves to prevent criminal offenses or other legal violations that are related to the employee relationship. The legal basis for processing in this case is Section 26 (1) of the German Federal Data Protection Act (BDSG).

Since the submission of notices can also be made anonymously, the processing of personal data to identify you is based on a consent to be provided by you. The legal basis is Art. 6 para. 1 lit. a DSGVO. This consent can only be revoked within one month of receipt of the notification, as Salzgitter AG is obliged in certain cases under Art. 14 (3) lit. a DSGVO to inform the accused person of the allegations made against him and the investigations carried out within one month. The obligation to inform the accused person includes the storage of the data, the type of data, the purpose of the processing, the identity of the controller and - if legally required - the identity of the notifier, so that after information has been provided, it is no longer possible to stop data processing or delete the identification data. The revocation period may be further shortened in certain cases, e.g. if the nature of the notification requires the immediate involvement of an authority or a court. In this case, your identification data will be disclosed directly to the authority or court and stored in the procedural files there.

4. Who is your data given to?

All information is treated confidentially and is only accessible to those employees, who need to have access to this data in order to process the case.

The compliance employees dealing with the report or the ombudswoman will examine the reported facts and, if necessary, carry out further case-related clarification of the facts; the data will always be treated confidentially.

In certain cases, Salzgitter AG has an obligation under data protection law to inform the accused person of the allegations made against him or her. This is required by law, if it is objectively established that the provision of information to the accused person can no longer affect the concrete clarification of the information at all. In doing so, your identity will not be disclosed to the reporting person - as far as legally possible - and it will also be ensured that no conclusions can be drawn about your identity in the process.

We would like to point out that in the case of knowingly false information with the aim of discrediting a person (denunciation), the confidentiality and protection of the reporting person can no longer be ensured.

In the course of processing a report or conducting an investigation, it may be necessary to pass on information to other Salzgitter AG employees or employees of Group companies, e.g. if the information relates to processes at Salzgitter AG subsidiaries. If necessary for the clarification, a transfer may be made to subsidiaries of the Salzgitter Group in a country outside the European Union or the European Economic Area, but always on the basis of suitable or appropriate data protection guarantees for the protection of data subjects. For data transfers to third countries in which there is no appropriate level of data protection, it is ensured before the transfer that either an appropriate level of data protection exists at the recipient (e.g. on the basis of an adequacy decision of the European Commission or by agreement of so-called EU – standard contractual clauses of the European Union with the recipient) or an express consent of the data subjects has been obtained.

We always ensure that the relevant data protection regulations are observed when passing on notices.

In the event of a corresponding legal obligation or data protection law necessity for the clarification of information, further conceivable categories of recipients include law enforcement authorities, antitrust authorities, other administrative authorities, courts and international law and auditing firms commissioned by the Salzgitter Group.

We ensure that any person who gains access to the data collected as part of a tip-off is obligated to maintain confidentiality.

5. How long is your data stored?

The collected personal data will be stored as long as it is necessary for the clarification and final assessment of the reported case, a legitimate interest of the company or a legal requirement exists. Afterwards, this data will be deleted in accordance with the legal requirements. The duration of storage depends in particular on the seriousness of the suspicion and the reported possible breach of duty.

6. Which data protection rights do you have?

Every data subject has the right to information under Article 15 of the GDPR, the right to rectification under Article 16 of the GDPR, the right to erasure under Article 17 of the GDPR, the right to restriction of processing under Article 18 of the GDPR, the right to object under Article 21 of the GDPR, and the right to data portability under Article 20 of the GDPR. With regard to the right to information and the right to erasure, the restrictions pursuant to Sections 34 and 35 BDSG apply. In addition, there is a right of appeal to the competent data protection supervisory authority (Art. 77 DSGVO in conjunction with § 19 BDSG):

State Commissioner for Data Protection Lower Saxony
Barbara Thiel
Prinzenstraße 5
30159 Hanover / Germany
Phone: +49 511 120 45 00

7. Information on the right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) DSGVO (data processing in the public interest) and Article 6(1)(f) DSGVO (data processing based on a balance of interests). The objection can be made form-free and should, if possible, be sent to the contact details listed in this data protection notice under 1. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims. Data that is no longer required will be deleted immediately.

You can also revoke your consent at any time. In this context, please note the information under "For what purposes and on what legal basis?"

Image with link to information on data protection for applicants


Privacy Data Information for Applicants

Imgae with link to data privacy information for business partners

Business partners

Data privacy information for business partners

Image with link to privacy social media

Social media channels

Privacy policy for our social media channels

Teaser of the global locations

Global locations of the Salzgitter Group