Informant Channel Privacy Policy
Data Controller
Controller: SMILEAT, S.L. (hereinafter, SMILEAT).
Postal address: Calle Gran Vía, 62, 5º D – 28013 Madrid
Email: info@smileat.com
Purposes of the processing
SMILEAT tprocesses the data with the purpose of providing data subjects with an internal information system and carrying out monitoring, investigation, and resolution, if applicable, of the information about actions or omissions reported by them through the channels established for this purpose by SMILEAT.
Within their functions and competencies, the persons designated for this purpose by SMILEAT in accordance with applicable regulations, may contact the data subjects to the extent that they provide their data for this purpose and with the aim of investigating and/or resolving the information and/or complaint provided in any case.
Legal basis for processing your data
The legal basis for processing your data is compliance with a legal obligation applicable to SMILEAT as data controller in accordance with the provisions of Law 2/2023, of February 20, regulating the protection of persons reporting regulatory violations and fighting corruption.
Likewise, the processing derived from public disclosures will be legitimized in the fulfillment of a mission in the public interest.
SMILEAT, to achieve the purposes described above, will act with all guarantees of confidentiality, integrity, and legality. Likewise, SMILEAT will adopt the necessary measures to preserve the identity and guarantee the confidentiality of the data relating to the persons affected by the information provided, especially the whistleblower, if identified.
Recipients
No data communications to third parties are foreseen, except those required by legal obligation to public bodies and/or entities that must necessarily be recipients of the data so that SMILEAT pcan comply with the legal obligations and requirements applicable in each case and can manage the information and/or complaint made through the internal information system provided by this entity.
Such communications will be made, in any case, complying with all legally established guarantees. To this end, access to the data will be limited exclusively to those who perform internal control and compliance functions, or to the data processors who may be designated for this purpose.
However, access by other persons, or even communication to third parties, will be lawful when necessary for adopting corrective measures or processing the procedures that may apply. If the possibility of transferring your data under other circumstances is contemplated, SMILEAT will request your explicit consent or another legal basis.
Processed data
The data processed by SMILEAT will be the data provided by the interested complainant (employee, former employee, client, contractor, supplier, or others), when they do not choose to do so anonymously: personal data relating to the complainant, the accused, and third parties related to the transmitted information. Data provided during the investigation by the accused in their defense, witnesses, publicly accessible sources, etc. The categories of personal data processed by SMILEAT are as follows: (i) Basic data: Name, surname (ii) Contact data: Phone number and email (iii) Data provided by the complainant and other data that may be necessary depending on the type of complaints that will be classified by categories according to the investigation.
Data accuracy.
You guarantee that the data provided is true, accurate, complete, and up to date, being responsible for any direct or indirect damage or harm that may result from failure to comply with this obligation.
International data transfer
SMILEAT informs you that no international transfers of your data are planned.
If international data transfers are necessary, they will have the guarantees provided for in Article 46 of the GDPR, and you may exercise any rights and legal actions you consider appropriate in exercising your rights. Such guarantees will be provided by any of the instruments provided for in the mentioned article, so no express authorization from the supervisory authority is required.
Exercise of Rights
SMILEAT informs you of the possibility to exercise the rights of access, correction, deletion, objection, restriction of processing, data portability, and not to be subject to automated individual decisions.
- Access: allows the data subject to obtain information about whether SMILEAT processes personal data that concerns them or not and, in such case, the right to obtain information about their personal data subject to processing.
- Correction: allows correcting errors and modifying data that prove to be inaccurate or incomplete.
- Deletion: allows the data to be deleted and no longer processed by SMILEAT unless there is a legal obligation to retain them and/or other legitimate reasons for their processing prevail by SMILEAT in accordance with current regulations.
- Restriction: under legally established conditions, allows the data processing to be halted, so that it is avoided by SMILEAT its processing in the future, which will only retain them for the exercise or defense of claims.
- Objection: allows the holder, under certain circumstances and for reasons related to their particular situation, to object to the processing of their data. SMILEAT dwill stop processing the data, except for legal reasons, or the exercise or defense of possible claims.
- Portability: allows the data subject to receive their personal data and transmit them directly to another controller in a structured, commonly used, and machine-readable format. To exercise this right, the data subject must provide a valid email address.
You can exercise your rights by any means that allows proof of sending and receiving your request. The request must be addressed to SMILEAT through the data included in the "Data Controller" section indicating the reference "Data Protection." The request must include: Name, surname, the request specifying your application, and address for notification purposes. If they are
in case of doubts about your identity, any procedure that allows the person to be verified should be used, but without requiring a copy of the ID.
If you are not satisfied with the response from SMILEAT when exercising their rights, has the right to file a complaint with the Supervisory Authority, Spanish Data Protection Agency, for their protection
Without prejudice to the above, anyone has the right to obtain confirmation about whether SMILEAT is processing personal data concerning you or not.
Retention
The data will be kept for SMILEAT as long as it is necessary according to the purpose and legal basis of the processing for which they were collected. For this purpose, employee, whistleblower, and third-party data will be kept for the time necessary to decide whether to start an investigation in the whistleblowing channel, and in any case no longer than three months from the inclusion of the data; after this period, the data will be deleted. However, even after this time, the data may continue to be processed for the investigation of the reported facts, and only if this leads to the adoption of certain measures against the reported person, it would be possible to keep the data for a longer period according to legal prescription periods, otherwise they must be deleted.
In the event of processing data to provide evidence of a complaint in the internal information system, it could only record it anonymously.
In accordance with industry standards, SMILEAT informs you that it maintains technical and organizational measures against accidental or illegal destruction, accidental loss or alteration, unauthorized disclosure or access, and other illegal forms or procedures. In this meaning, SMILEAT will adopt the appropriate security measures to prevent unauthorized alteration, loss, processing, or access to data. Likewise, it will inform those who have access to their data about their security, confidentiality obligations, and duty of secrecy.