PRIVACY POLICY
JOSE LUIS JOYERÍAS, S.L. (hereinafter referred to as JOSE LUIS JOYERÍAS), with tax identification number (CIF) B15052277, as the Data Controller for the Internal Reporting System of JOSE LUIS JOYERÍAS, S.L., uses the Ethics Channel tool to manage communications related to the Internal Reporting System, in accordance with Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, and with Law 2/2023, of 20 February, governing the protection of persons who report regulatory violations and the fight against corruption (hereinafter referred to as the Whistleblower Protection Directive and Law).
The Ethics Channel is hosted on secure servers owned by DIGITAL PRODUCTS DEVELOPMENT SL (Ithikios), to ensure the confidentiality, integrity, and availability of the information contained therein. We inform you that the data you provide through the Ethics Channel (including any personal data about other individuals you may disclose) will be processed with the utmost confidentiality and in compliance with current data protection legislation. The data will be used to manage reports of violations or irregularities relating to acts or omissions that may constitute breaches of European Union law, as established under the Whistleblower Protection Directive and Law, with the purpose of conducting preliminary reviews, processing, investigation, resolution, and, where appropriate, disciplinary actions, communications with relevant authorities, and management of any applicable judicial proceedings.
WHO IS RESPONSIBLE FOR PROCESSING YOUR DATA?
Data Controller: JOSE LUIS JOYERÍAS, S.L. (JOSE LUIS JOYERÍAS). B15052277
Postal Address: Parcela B-41, Polígono de Bergondo, 15165 Bergondo, A Coruña, Spain
Data Protection Email: [email protected]
PURPOSE OF PROCESSING YOUR PERSONAL DATA
We process the personal data you provide (as well as personal data of third parties you may disclose) via the Ethics Channel for the following purposes:
To manage your reports and/or communications submitted through the Ethics Channel, in accordance with the "Ethics Channel Management Procedure" described in this Privacy Policy.
To perform a preliminary review, processing, investigation, resolution, and, if appropriate, adoption of disciplinary actions, communication with relevant authorities, and management of judicial proceedings if necessary.
The recipient of the reports will be the Data Controller of the Internal Reporting System of JOSE LUIS JOYERÍAS, who will handle your personal data with maximum confidentiality, care, and protection.
Please note:
In compliance with data protection regulations and whistleblower protection laws, your personal data and any information provided will only be used for the purposes specified herein.
No automated decisions or profiling will be carried out based on the information collected.
DATA RETENTION PERIODS
The data of the whistleblower, the persons affected, and any third parties will only be retained in the Ethics Channel for the time strictly necessary to determine whether to initiate an investigation regarding the reported facts.
In any case, after a maximum period of three (3) months from the initial data entry, the data will be blocked (restricted access) to be preserved as evidence of the proper functioning of JOSE LUIS JOYERÍAS’ Compliance System, pursuant to Article 24 of Spain’s Organic Law 3/2018 on Data Protection (LOPDGDD).
Prior to the end of this period, the data may be exported and archived if necessary for ongoing investigations, legal analysis, or to demonstrate the diligence shown in the communication management.
Personal data not necessary for investigation purposes will be immediately deleted.
Data related to allegations outside the scope of the Whistleblower Protection Directive and Law will also be deleted.
If it is confirmed that the information provided is false (except where it constitutes a criminal offense), it will be immediately deleted.
LEGAL BASIS FOR DATA PROCESSING
The legal bases for processing your personal data through the Ethics Channel are:
Compliance with a legal obligation: JOSE LUIS JOYERÍAS processes your data to meet the requirements of whistleblowing regulations, including duties of prevention, control, and compliance within the organization.
Legitimate interest: In cases where the company may be a harmed party, processing and communicating the data may be necessary to manage regulatory compliance and protect the company’s rights.
User consent: When you voluntarily provide personal data (for instance, by choosing the “Non-Anonymous” option when submitting your report), your unequivocal consent legitimizes the processing of your personal data for the management of your report.
DATA RECIPIENTS
Access to the data contained in the Ethics Channel will be strictly limited to:
Data processors:
Data processors (such as service providers) will only access personal data under strict confidentiality agreements and in accordance with applicable data protection laws. The Ethics Channel is securely hosted by DIGITAL PRODUCTS DEVELOPMENT SL (Ithikios) to guarantee confidentiality, integrity, and availability of the information. Ithikios complies with ISO 27001 Information Security Management Standards, and servers are located within the European Economic Area (EEA), ensuring encrypted storage to minimize intrusion risks.
GUARANTEES REGARDING DATA COMMUNICATION
By accepting this Privacy Policy, users:
Give their unequivocal consent for JOSE LUIS JOYERÍAS to process their personal data to manage reports and/or communications through the Ethics Channel.
Guarantee that the personal data provided are true, accurate, complete, and up to date, committing to inform JOSE LUIS JOYERÍAS of any changes.
Declare that they are over 14 years of age and have the necessary legal capacity to consent. If acting on behalf of a minor or a legally incapacitated person, the user declares to have legal guardianship or representation, proof of which may be requested.
Communications submitted through the Ethics Channel will be treated as confidential and reserved information. Whistleblowers acting in good faith are protected against any form of retaliation.
The identity of the whistleblower will not be disclosed unless:
Required by a judicial or competent administrative authority.
Necessary, under exceptional circumstances, with the whistleblower's explicit consent.
The complaint is proven to be malicious and submitted in bad faith (e.g., using false documents), in which case the identity may be disclosed solely to apply disciplinary measures.
Users are advised not to share their identification, password, or case reference number with anyone.
All third parties and processors involved must have an adequate data protection system compliant with current legislation.
YOUR RIGHTS
Individuals whose data are processed through the Ethics Channel have the following rights:
Right of Access: You have the right to obtain confirmation as to whether JOSE LUIS JOYERÍAS is processing your personal data and, if so, access your data.
Right of Rectification: You may request the correction of inaccurate or incomplete personal data.
Right of Erasure: You may request the deletion of your data when it is no longer necessary for the purposes for which it was collected or if it was processed unlawfully.
Right to Restriction of Processing: In certain cases, you may request the restriction of data processing, meaning that data may only be stored for legal claims or defense.
Right to Object: For reasons related to your particular situation, you may object to the processing of your data. In this case, JOSE LUIS JOYERÍAS will stop processing your data unless legitimate or overriding legal grounds exist.
Right to Lodge a Complaint: You have the right to file a complaint with the competent supervisory authority (Spanish Data Protection Agency – AEPD, www.aepd.es) if you believe your data has been improperly handled.
Important clarification:
In order to protect the whistleblower and avoid potential retaliation, whistleblowers cannot exercise the right of access to information that could reveal their own identity or that of third parties, except where legally allowed (such as disclosure to a judicial authority).
How to Exercise Your Rights:
You can exercise your rights by contacting the designated data protection channel: [email protected]
Please note that some limitations or restrictions on your rights may apply if necessary to preserve the integrity of investigations or the confidentiality of the whistleblower system.
SECURITY MEASURES
In accordance with current data protection regulations, JOSE LUIS JOYERÍAS ensures the implementation of technical and organizational security measures necessary to:
Guarantee the confidentiality, integrity, and availability of personal data.
Prevent unauthorized access, alteration, loss, or destruction of the information.
Specific Measures Adopted:
Hosting of the Ethics Channel on secure servers managed by DIGITAL PRODUCTS DEVELOPMENT SL (Ithikios), compliant with ISO 27001 standards.
Encryption of stored data to minimize the risk of intrusion.
Limited access to personal data: only authorized personnel, such as members of the Internal Reporting System, Human Resources (in case of disciplinary actions), the Legal Department (for legal measures), the Data Protection Officer (DPO), and designated third-party processors under confidentiality agreements, can access the information.
All personnel with access to the Ethics Channel are bound by strict confidentiality obligations.
Scope of Application
Through the Ethics Channel, individuals may report:
Alleged violations of laws or regulations, including actions or omissions that may constitute breaches under the Whistleblower Protection Directive and Law 2/2023.
Irregularities or misconduct that affect compliance with legal or ethical standards within JOSE LUIS JOYERÍAS.
Important:
The Ethics Channel is not intended for general complaints, suggestions, or service inquiries unrelated to regulatory compliance.
Reports must be supported by at least indicative evidence (documents, witness testimony, digital records, etc.) to substantiate the alleged facts.
Prohibition of Retaliation and False Reports
Whistleblowers who report in good faith will be protected against any form of retaliation.
If a report is proven to be maliciously false (e.g., knowingly submitting false documentation), disciplinary measures may be applied against the reporting individual.
Confidentiality, Data Protection, and Rights of Affected Persons
The Ethics Channel is designed to:
Ensure anonymity and confidentiality of whistleblowers.
Limit access only to authorized individuals directly involved in the investigation process.
Maintain confidentiality about the identity of all involved persons (whistleblowers, witnesses, and accused).
Before submitting a report, users must confirm they have read and accepted the Privacy Policy and Management Procedure.
Affected individuals retain their rights to presumption of innocence, defense, and protection of their identity during the investigation.
Processing Reports
Reception of Reports:
Reports received through the Ethics Channel are initially reviewed by the Internal Reporting System Manager of JOSE LUIS JOYERÍAS.
An initial examination will determine whether the report:
Meets the formal requirements.
Falls within the scope of the Ethics Channel.
Presents any conflict of interest risks (the whistleblower may indicate if they suspect anyone involved).
Anonymous Reports:
Users may report anonymously.
Upon submission, an access code and password will be provided to track the report without revealing the user's identity.
If the report is made via voice recording, a transcription will be sent to the whistleblower for confirmation before processing.
If the report is inadmissible:
It will be immediately deleted from the system.
If the report is admissible:
Acknowledgment of receipt will be sent to the whistleblower within seven (7) days.
The preliminary investigation phase will begin.
Investigation of Reported Facts
Once admitted:
An investigation is carried out to verify the facts.
The whistleblower may be contacted to provide additional information.
Resolution Proposal
Following the investigation:
If no irregularities are proven, the case will be closed.
If irregularities are confirmed, measures will be proposed, including (but not limited to):
Modification of procedures or internal controls.
Reporting to relevant authorities.
Termination of contractual relationships.
Initiation of disciplinary proceedings.
Final Decision and Sanction Execution
The final decision rests with the General Management and/or Board of Directors.
The whistleblower will be informed about the conclusion of the process.
The maximum period for completing the investigation and resolution is three (3) months, extendable by an additional three (3) months if the case is particularly complex.
Reporting to Authorities
If the investigation reveals potential criminal activity:
The information will be forwarded to the Public Prosecutor's Office for further action.
Compliance in Spain and Portugal
The JOSE LUIS JOYERÍAS Ethics Channel complies with: