Whistleblowing regulations

PRIVACY NOTICE ON WHISTLEBLOWING THROUGH AN INTERNAL CHANNEL

INFORMATION ON THE CONDITIONS AND PROCEDURE FOR INTERNAL WHISTLEBLOWING

PRIVACY NOTICE ON WHISTLEBLOWING THROUGH AN INTERNAL CHANNEL

We at EnduroSat EAD (“we”, “us”) pay serious attention to the privacy of all individuals reporting or publicly disclosing information about violations.
Please read this Notice to understand how and why personal data is processed in connection with the operation of our internal whistleblowing channel.

The data subject in relation to the signal may be:

• the author of the signal (also called the whistleblower);
• the person against whom the signal is lodged or persons related to him (persons concerned);
• the witness(es) and other persons whose personal data may come to light in the course of the verification.

WHAT ARE THE PURPOSES OF PROCESSING PERSONAL DATA?

Personal data is processed for the purposes of receiving, recording, verifying and taking action on reports of alleged violations committed by persons on our staff.

When you provide your personal data in a report, we will collect and store your personal data in order to investigate your signal and carry out an investigation into it. The information you provide to us will be kept strictly confidential and secure.

In certain cases, we may also need to process your data in connection with legal disputes, as set out in the How long we keep your personal data section, and for the purposes set out elsewhere in this Notice.

 

We will notify you in the event that we wish or need to use your personal data for purposes and in a manner significantly different from that for which we have informed you and, if necessary, seek your consent.

ON WHAT GROUNDS DO WE PROCESS PERSONAL DATA?

In the context of the operation of our internal whistleblowing channel, we process personal data in compliance with our obligations under the Law on the protection of persons reporting or publicly disclosing information about violations (Whistleblowing protection act). The legal basis we rely on is Article 6, paragraph 1, item c of the GDPR.

If the information we receive in connection with the whistleblowing contains special category data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, data concerning health, sex life, sexual orientation of the natural person, etc., the legal basis on which we will process this personal data is Article 9, paragraph 2, item g GDPR because the processing is necessary for reasons of important public interest based on Union and Bulgarian law.

We may also process your personal data on the basis of our legitimate interest in connection with the possibility of initiating criminal, civil and administrative proceedings in relation to the signal and the actions taken on it.

 

WHAT PERSONAL DATA DO WE PROCESS AND WHERE DO WE COLLECT IT FROM?

We only process such personal data that is strictly necessary for the above purposes.

We get the data from signals submitted through our internal channel. In particular, we may receive such data because you give it to us (by making a signal), or because other whistleblowers on our staff or our suppliers and contractors or other third parties give it to us (e.g. if you appear in a signal as a potential infringer or witness).

If necessary, we may ask for further information so that we can investigate all the grounds for your report, together with any supporting documents or evidence.

We may process the following types of personal data in the process of receiving, recording, verifying and acting on the alert:

• the name, job title/position, telephone number, email address and other contact details (e.g. address) of the whistleblower;
• signature, electronic signature or other identification of the sender of the signal;
• names, position and contact details of persons named in a tip-off;
• names, position and contact details of persons verifying the signal;
• personal data in relation to the circumstances that are the subject of the signal and those collected during its verification;
• personal data in relation to measures taken in response to the signal.

The processing of the personal data referred to above is necessary for the regularity of the signal and the verification of the information contained therein. Failure to provide these data would prevent the processing of the signal and the related investigation.

Under the Whistleblowing Protection Act, no proceedings are initiated in respect of anonymous whistleblowers.

WHO WILL HAVE ACCESS TO YOUR PERSONAL DATA?

Personal data collected in connection with a whistleblower report (and in particular data about the identity of the whistleblower) shall be treated in the strictest confidence as required by the Whistleblowing Protection Act. This personal data will only be available to the persons designated by the company to receive and investigate the whistleblowing. These individuals are specifically trained and aware of their duty of confidentiality regarding all aspects of the investigation.

The identity of the whistleblower shall not be disclosed to the persons against whom the allegations are made.

The identity of the whistleblower shall only be disclosed if the whistleblower consents to it, or if disclosure of the whistleblower’s identity is required in criminal proceedings, or if the whistleblower has made a false report for malicious purposes.

Personal data may be disclosed to third parties, such as public authorities or external inspectors, where this is a necessary and proportionate obligation imposed by Bulgarian or European Union law in the context of investigations by national authorities or legal proceedings, including with a view to ensuring the right of defence of the person concerned. In these cases, we will notify the whistleblower of the need for disclosure before disclosing the identity or information relating to the whistleblowing. The notification shall be in writing and shall state the reasons. The whistleblower shall not be notified where doing so would jeopardise the investigation or legal proceedings.

 

TRANSFER OF PERSONAL DATA OUTSIDE BULGARIA

We will not transfer your personal data to anyone outside the EU or EEA.

HOW LONG DO WE KEEP YOUR PERSONAL DATA?

Personal data that is the subject of a signal that is anonymous shall be deleted immediately.

If the signal contains personal data that are not necessary for its verification, such personal data shall also be deleted immediately.

We store your personal data for a period of 5 years after the conclusion of the examination of the signal, except in the case of criminal, civil, labour and/or administrative proceedings initiated in relation to the signal submitted pursuant to Article 8 of Regulation No. 1 of 27 July 2023 on the keeping of the register of signals under Article 18 of the Whistleblowing Protection Act and the referral of internal signals to the CPDP.

The alert does not concern this procedure	The alert did not lead to any consequences	Where disciplinary or legal proceedings have been initiated
Data is destroyed immediately	The data shall be destroyed within 5 years after the conclusion of the examination of the alert	The data shall be destroyed at the end of the procedure or of the limitation period for appealing the decision

 

After the retention period, the personal data shall be destroyed or anonymised. In the latter case, this means that it will be impossible to identify you by this data. 

HOW DO WE PROTECT YOUR PRIVACY?

We highly value your privacy and take the security measures of the personal data we have collected and store very seriously.

We use a variety of physical, electronic, and organizational measures appropriate to the sensitivity of the information we maintain to protect your personal information from unauthorized access, use, or disclosure. For example, we use passwords, have firewalls and antivirus programs, and more. We have adopted data protection policies and procedures.

Only persons specifically designated to verify an signal received will have access to the personal data contained in the signal.

WHAT RIGHTS DO YOU HAVE?

You have the following rights:

• Right of access to personal data relating to you;
• Right to object to the processing of your personal data where we rely on our legitimate interest;
• The right to request the rectification of inaccurate personal data relating to you;
• The right to request erasure of personal data relating to you (“right to be forgotten”);
• The right to request restriction of the processing of personal data relating to you;
• The right to lodge a complaint with the Commission for Personal Data Protection, with the address of Sofia, 1592, 2 “Tsvetan Lazarov” Bulv. You may also seek protection of your rights in court. 

 

HOW TO CONTACT US?

• The personal data controller is “EnduroSat” EAD, UIC 203367904, registered office and registered address. Head office and registered office. 1404, 1A Flora str.
• If you have any questions about this notice or in relation to how we process your personal data, please contact our Data Protection Officer at legal@endurosat.com

INFORMATION ON THE CONDITIONS AND PROCEDURE FOR INTERNAL WHISTLEBLOWING

This information is provided pursuant to Article 12(4) of the Law on the protection of persons reporting or publicly disclosing information about violations, promulgated in Official Gazette No. 11 of February 2, 2023, effective May 4, 2023 (“Whistleblowing protection act“).

1. Who has the right to report?

• current or former employees;
• persons working under a civil contract;
• persons exercising freelance professions or crafts;
• volunteers and trainees;
• contractors, subcontractors or suppliers;
• candidates for employment or participants in competitions for a particular post;
• all persons who, in a work context, have become aware of information about violations.

Important! Anonymous signals are NOT considered.

 

2. What violations can you report?

For violations of Bulgarian and European legislation in various areas, including:

• public procurement;
• public health;
• transport safety;
• consumer protection;
• privacy and data protection;
• security of networks and information systems;
• violations related to cross-border tax schemes;
• a crime of a general nature;
• labour legislation;
• legislation relating to the performance of public service;
• the rules for payment of outstanding public state and municipal claims, and other areas specified in the Whistleblowing protection act.

Important! Allegations of violations that do not fall under the scope of the HIPAA, as well as signal committed more than two years ago, are not considered.

 

3. How can you report to “EnduroSat” EAD?

You can submit a written report by filling in a standard form in any of the following ways:

• personally – to our responsible person;
• electronically by sending it to the following e-mail address: signals@endurosat.com
• through a dedicated mailbox placed in the company’s building, which can only be accessed by the responsible person;
• by post or by courier service – to the address of “EnduroSat” EAD (1404, Flora Str. №  1A, Obsidian Business Building, Sofia) with an explicit indication of the addressee of the postal/courier item as the person responsible under the Whistleblower protection act or by writing on the postal/courier envelope a text indicating that they contain an signal under the Whistleblowing protection act.

Important! Signals must be signed by the persons submitting them. If submitted electronically, the form must be signed with a qualified electronic signature.

 

Important! The form is NOT mandatory, it is for your convenience and contains the mandatory data you need to fill in. If your signal does not comply with any of the legal requirements, our responsible person will send you a notice to rectify the irregularities within 7 days of receipt of the signal. If the deficiencies are not corrected within this period, the signal and its annexes will be returned to you.

 

It is a good idea to attach any written evidence you have. You may also wish to identify persons who could corroborate the data reported or provide additional information.

You can make a verbal report in any of the following ways:

• to the phone number of our responsible person – +359888732871, +359879385015, +359879320014;
• a personal meeting with our responsible person, which you have arranged in advance on the telephone number provided.

In these cases our responsible person will complete the details on the template form and give you the opportunity to check, correct and agree with the text of the written conversation and the contents of the form by signing them.

4. What happens after the signal?

• We will acknowledge receipt within 7 days and register it with a unique identification number. If the signal does not meet the requirements of the law, we will notify you to correct the irregularity within 7 days.
• The signal will be investigated by a person who has no conflict of interest.
• Within three months of acknowledging receipt of the signal, we will provide you with feedback on the results of the inspection and the action taken.

5. What protection do whistleblowers have?

• Whistleblowers and persons associated with them (e.g. colleagues and relatives) are protected against unwarranted disclosure of their identity, except as permitted by law.
• Retaliatory measures against protected persons are prohibited, namely: suspension, dismissal, demotion, negative performance evaluation, application of financial and disciplinary liability, physical and verbal compulsion, threat, hostility and violation of their dignity, discrimination, etc.

6. What are the conditions for granting protection?

• The whistleblower must have reasonable cause to believe that the information submitted about the breach in the whistleblower’s report was correct at the time of submission and that such information falls within the scope of the Whistleblowing protection act; and
• The violation report was filed under the terms and conditions of the Whistleblowing protection act.

Important! Persons named in the whistleblower report as violators are entitled to compensation for all pecuniary and non-pecuniary damages when it is established that the whistleblower knowingly reported false information.

7. How can you report to the Commission for the Personal Data Protection?

The Commission for Personal Data Protection is the Central Authority for external whistleblowing. You can also submit your whistleblowing directly to it in one of the following ways:

• in writing:

• to e-mail: whistleblowing@cpdp.bg
• by post to. 1592 Sofia, 2 “Proff. Tsvetan Lazarov” Blvd.
• via the Secure Electronic Delivery System

• verbally – on site at the Commission for Personal Data Protection at. 1592 Sofia “Proff. Tsvetan Lazarov” Blvd.

You could use the model whistleblowing form that can be downloaded from the Commission for Personal Data Protection website. The form is optional. However, if you decide to use it, you only need to fill in Parts I to V inclusive and sign it: when sending the form by post, with a handwritten signature; when sending it by e-mail, with a qualified electronic signature.

If you use the Secure Electronic Delivery System, the Commission for Personal Data Protection officer responsible for handling the report will contact you to complete a Report of Violation Registration Form under the Whistleblowing Protection act.