Please read carefully the information regarding the processing of personal data for the management of reports and complaints concerning SA8000:2014 Social Accountability.
Information regarding the processing of personal data pursuant to Art. 13 of European Regulation no. 679/2016 ("GDPR") in relation to the management of SA8000 reports and complaints
Good morning,
we hereby wish to provide appropriate information pursuant to Art. 13 of EU Reg. no. 679/2016 ("GDPR") regarding the fundamental elements of the processing carried out on data provided following a report or complaint concerning SA8000:2014 Social Accountability, for the purposes of managing the same.
The personal data collected will be processed according to principles of correctness, lawfulness, transparency, minimization, and protection of confidentiality and the rights of the data subjects.
The report may also be submitted anonymously. Should the reporter decide to indicate their name and surname, such data will be processed exclusively for purposes related to the management of the report and will not be disclosed.
Data collected
The data collected may include common data of the non-anonymous interested party, such as name and surname, date of the report, as well as data and information relating to the facts subject to the report or complaint.
The report could contain, even incidentally, special categories of personal data or data relating to criminal convictions and offenses, if included by the reporter in the description of the event or in the attachments.
Purpose and legal basis of processing
The data collected by Gruppo Millepiani S.p.A. will be processed for the receipt, investigation, verification, and management of SA8000 reports or complaints, for the fulfillment of legal and/or organizational obligations related to the SA8000 Social Accountability Management System, as well as for the establishment, exercise, or defense of a right in court, where necessary.
The legal basis for processing is identified, depending on the case, in the fulfillment of legal obligations, in the legitimate interest of the Controller in the prevention and management of non-compliant conduct, and, where applicable, in the consent of the data subject for specific processing methods.
Duration of processing and data retention
The data will be kept for the time necessary to manage the report or complaint and any subsequent activities, in compliance with the principles of proportionality and storage limitation, unless further retention is necessary for legal obligations or for the protection of the Company's rights.
Processing methods
Processing is carried out using electronic and/or paper tools, adopting technical and organizational measures suitable for protecting the confidentiality, integrity, and availability of the data.
The content of the report and the possible identity of the reporter are managed with criteria of confidentiality and limited access only to subjects authorized by reason of their respective functions.
Nature of data provision
The provision of the reporter's identifying data is optional. The provision of information relating to the reported facts is necessary to allow the evaluation and management of the report; incomplete or unsubstantiated information could make the investigation impossible or difficult.
Categories of subjects who may have access to the data
The data may be processed by subjects authorized by the Controller and, where necessary, communicated to consultants, professionals, subjects in charge of maintaining IT systems, public or judicial authorities, certification or accreditation bodies, within the limits strictly necessary for the management of the report and applicable obligations.
Personal data will not be disclosed.
Rights of the data subject
The data subject may exercise, within the limits provided by applicable legislation, the rights referred to in Art. 15 et seq. of the GDPR, including access, rectification, erasure, restriction, objection, and portability, as well as lodge a complaint with the Data Protection Authority.
Data Controller
The Data Controller is Gruppo Millepiani S.p.A., with registered office in Misinto (MB), Via Della Longura n. 21, VAT no. 02731550121.
For further information or to exercise privacy rights, you can write to the address: privacy@millepiani.com.
*I declare that I have read the information regarding the processing of personal data pursuant to Art. 13 of European Regulation no. 679/2016 ("GDPR") in relation to the management of SA8000 reports and complaints.
SA8000:2014 Ethical Channel
SA8000 Ethical Reporting
Fill out the form to submit a report or complaint regarding SA8000 Social Accountability aspects. You can proceed anonymously or indicate your name and surname.
Online form
SA8000 Reports and Complaints
The fields follow the structure of the MSR301B model. Fill in the information relating to the area subject to the report and describe the event. The identifying data of the interested party are optional.
