Loading...
SIE SIND HIER:

Privacy information for whistleblowers and further persons involved in cases handled via the whistleblower system

as per General Data Protection Regulation (GDPR)

With this document we inform you about the processing of your personal data by the ATG Entertainment GmbH as well as all participating companies and about the rights you are entitled to according to data protection law.

Responsible party / data protection

The responsible body for data processing is the respective participating company to which the notification refers:

ATG Entertainment GmbH, Hans-Imhoff-Str. 2, 50679 Köln
ATG Theater GmbH, Lippeltstr. 1, 20097 Hamburg
HP Theater Produktionsgesellschaft mbH, Hans-Imhoff-Str. 2, 50679 Köln
Moulin Rouge Musical Produktions GmbH, Goldgasse 1, 50668 Köln
Starlight Express GmbH, Stadionring 24, 44791 Bochum
ATG Productions GmbH, Hans-Imhoff-Str. 2, 50679 Köln
ATG Touring GmbH, Röntgenstr. 7, 68167 Mannheim
ATG Marketing GmbH, Röntgenstr. 7, 68167 Mannheim
ATG Ticketing & Sales GmbH, Lippeltstr. 1, 20097 Hamburg
ATG Service Center GmbH, Bahnstr. 50, 40699 Erkrath

Categories / origins of data

If you make a report via our whistleblowing system, the personal data you provide will be processed in order to handle your report and, if necessary, to take further action. In principle, you have the option of making anonymous reports. The personal data processed depends on the content of your report.

We may process your personal data in the event that you are an accused person or other person involved in the matter in order to check the report made via the whistleblower system and to investigate the alleged compliance and legal violations. Which data is processed depends on the specific report in each individual case and also on the information that was provided about you, e.g. by a whistleblower. For example, the following data may be processed:

  • Contact data (e.g. private address, if applicable mobile or landline number,
    e-mail address).
  • Master data (surname, first name, name affixes, date of birth)
  • Photos / video recordings
  • Time recording data
  • Special types of personal data:
    • Health data

Purposes and legal basis of data processing

When processing your personal data, we always comply with the provisions of the GDPR, the BDSG and all other legal provisions (such as BetrVG, ArbZG, etc.).

If you are a reporting person, your data will be processed on the basis of your voluntary information as well as within the framework of the legal provisions according to the Whistleblower Protection Act, Art. 6 para. 1 p. 1 lit. a, lit. c GDPR (in Germany additionally in conjunction with § 10 HinSchG, 8 LkSG) and, in the event that you are employed by us, according to Art. 88 GDPR (in Germany additionally in conjunction with § 26 para. 2 BDSG.) If we provide the whistleblower system without being legally obliged to do so, the processing of your data is based on Art. 6 para. 1 sentence 1 lit. f GDPR.

Furthermore, we process your personal data as a data subject, if this is necessary to protect the legitimate interests of the company or a third party (Art. 6 para. 1 lit. f, lit. c GDPR in Germany additionally in conjunction with § 10 HinSchG, § 8 LkSG or § 130 OWiG). We have a legitimate interest in processing personal data for the prevention and detection of violations and abuses that are reported via the whistleblower system. In addition, your personal data is processed insofar as this is necessary for the fulfilment of legal obligations.

Data retention

As soon as your data is no longer required for the above-mentioned purposes and no further storage obligations exist, it will be deleted.

Data recipients / categories of data recipients

In our company, we ensure that only those persons receive your data who need them to process the whistleblower submitted via the whistleblowing system.

The internal whistleblowing system is operated by atarax. Further information on the processing of your data can be found at https://www.atarax.de/de/datenschutz

Furthermore, in certain cases, service providers (e.g. IT service providers) assist us in fulfilling our tasks. The necessary data protection contracts have been concluded with all service providers.

Depending on the focus of responsibility of the report as well as for the effective initiation of follow-up measures, the personal data may be passed on to our competent specialist departments.

Furthermore, in cases prescribed by law, we are obliged to pass on certain information to bodies such as investigating authorities.

Third country transfer / intention to transfer data to third countries

Data is only transferred to third countries (outside the European Union or the European Economic Area) if this is absolutely necessary for processing the notification, if it is required by law or if you have given us your consent to do so.

We do not (currently) transfer your personal data to any service provider or group company outside the European Economic Area.

Rights of the data subjects

Your rights as a data subject are standardized in Art. 15 - 22 GDPR.

This includes:

  • The right to information (Art. 15 GDPR)
  • The right to rectification (Art. 16 GDPR)
  • The right to erasure (Art. 17 GDPR)
  • The right to restriction of processing (Art. 18 GDPR)
  • The right to object to processing (Art. 21 GDPR)
  • The right to data portability (Art. 20 GDPR)

Insofar as you have voluntarily provided data as the reporting person, you may withdraw your consent for any data processing at any time with effect for the future. To withdraw consent and assert the other rights, please contact: compliance@atarax.de. The same applies if you have questions about data processing in our company. In addition, you can lodge a complaint against data processing with a data protection supervisory authority.

If we process your data to protect legitimate interests, you can object to this processing at any time for reasons arising from your particular situation.

We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

Automated individual case decisions

We do not use solely automated processing to reach a decision.