Privacy policy

Cookie consent with cookie notice 

Our website uses Cookie Notice for GDPR to obtain your consent to store certain cookies on your terminal device and to document this in a data protection compliant manner. 

Cookie Notice is installed locally on our servers, so it does not connect to third-party servers. Cookie Notice & Compliance for GDPR stores a cookie in your browser in order to be able to assign the consents granted to you or their revocation. The cookie is deleted after the end of the session. 

Cookie Notice is used to obtain the legally required consents for the use of cookies. The legal basis for this is Art. 6 para. 1 lit. f DSGVO. The purpose of the data processing is the user-friendly and legally compliant design of our website. We want to make it as easy as possible for you to give or withdraw consent and increase the transparency of data processing using cookies, pixels, tag or similar on our website. In the purpose of data processing also lies our legitimate interest. 

For more information, please visit the page: https://legal.hubspot.com/cookie-policy

What cookies do we use? 

Google Analytics 

Google Analytics uses cookies that enable an analysis of your use of our website. The information collected by means of the cookies about your use of this website is usually transferred to a Google server in the USA and stored there. 

Due to IP anonymization, your IP address will be truncated by Google within Member States of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google. 

During your website visit, your user behavior is recorded in the form of "events". Events can be: 

• Page views 
• First visit to the website 
• Start of session 
• clicks on external links 
• internal search queries 

• your approximate location (region) 
• your IP address (in shortened form) 
• technical information about your browser and the end devices you use (e.g. language setting, screen resolution)
• the referrer URL (via which website/ via which advertising medium you came to this website) 

On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity. The reports provided by Google Analytics are used to analyze the performance of our website and the success of our marketing campaigns.

Recipients 

Recipients of the data are/may be Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor according to Art. 28 DSGVO). Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA Alphabet Inc, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA It cannot be ruled out that US authorities may access the data stored by Google. 

Third country transfer 

Insofar as data is processed outside the EU/EEA and there is no level of data protection corresponding to the European standard, we have concluded EU standard contractual clauses with the service provider to establish an appropriate level of data protection. The parent company of Google Ireland, Google LLC, is based in California, USA. A transfer of data to the USA and access by US authorities to the data stored by Google cannot be ruled out. The USA is currently considered a third country from a data protection perspective. You do not have the same rights there as within the EU/EEA. You may not be entitled to any legal remedies against access by authorities. 

Storage period 

The data sent by us and linked to cookies are automatically deleted 24 months. Data whose retention period has been reached is automatically deleted once a month. 

Legal basis 

The legal basis for this data processing is your consent pursuant to Art. 6 para. 1 p. 1 lit. a DSGVO.

Revocation 

You can revoke your consent at any time with effect for the future by clicking the "Revoke cookie consent" button below on the ALUCA website and changing your selection there. The lawfulness of the processing carried out on the basis of the consent until the revocation remains unaffected. 

Alternatively, you can prevent the storage of cookies from the outset by configuring your browser software accordingly. However, if you configure your browser to reject all cookies, this may restrict functionalities on this and other websites. 

For more information on the terms of use of Google Analytics and data protection at Google, please visit https://marketingplatform.google.com/about/analytics/terms/us/ and https://policies.google.com/?hl=en

Google Tag Manager 

For reasons of transparency, we would like to point out that we use the Google Tag Manager of the provider Google Ireland Limited (registration number: 368047), Gordon House, Barrow Street, Dublin 4, Ireland. The Google Tag Manager itself does not collect any personal data. The Google Tag Manager makes it easier for us to integrate and manage our tags. Tags are small code elements that are used, among other things, to measure traffic and visitor behavior, to record the impact of online advertising and social channels, to set up remarketing and targeting, and to test and optimize websites. We use the Tag Manager for the Google Analytics service. If you have made a deactivation, this deactivation will be taken into account by Google Tag Manager. 

For more information on the Google Tag Manager see:https://www.google.com/intl/de/tagmanager/use-policy.html

Purposes of the processing of personal data

ALUCA GmbH processes the following types of personal data, among others, as part of the entry and processing of reports in the internal reporting system:

• Information for personal identification of the whistleblower, such as first and last name, gender, address, telephone number and e-mail address;
• Employment status at ALUCA GmbH;
  
• Information on data subjects, i.e. natural persons designated in a report as a person who has committed the offence or with whom the designated person is associated. Such information includes, for example, first and last name, gender, address, telephone number and e-mail address or other information that enables identification;
  
• Information about offences that may allow conclusions to be drawn about a natural person.
  

ALUCA GmbH processes the personal data for the purpose of investigating the reports in order to prevent or detect violations of applicable law or company guidelines and/or to take follow-up measures (such as measures to verify the validity of the allegations made in the report and, if necessary, to take action against the reported violation, including through internal enquiries, investigations, criminal prosecution measures, measures to (re)collect funds or conclude the proceedings).

Legal basis

1. We only process information for the personal identification of the whistleblower if the whistleblower has given us consent to do so in accordance with Art. 6 para. 1 lit. a GDPR. According to this, processing is only lawful if the data subject has given their consent to the processing of their personal data for one or more specific purposes.
2. We process information on employee status, information on data subjects and other information that allows conclusions to be drawn about natural persons on the basis of Art. 6 para. 1 lit. f GDPR. Accordingly, processing is lawful if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. Depending on the specific individual case to be examined, our legitimate interest lies in the processing of reports in order to be able to carry out follow-up measures, such as measures to verify the validity of the allegations made in the report and, if necessary, to take action against the reported violation, including through internal enquiries, investigations, criminal prosecution measures, measures to (re)recover funds or conclude the proceedings. Whether the interests or fundamental rights and freedoms of the data subject conflict with such data processing is examined on a case-by-case basis, including with regard to the breach.
3. We may process personal data of employees on the basis of Section 26 (1) sentence 2 BDSG. Accordingly, personal data of employees within the meaning of Section 26 (8) BDSG may be processed to uncover criminal offences if there are factual indications to be documented that justify the suspicion that the person concerned has committed a criminal offence in the employment relationship, the processing is necessary for detection and the employee's legitimate interest in the exclusion of processing does not outweigh this, in particular the type and extent are not disproportionate with regard to the occasion.
   
   

General information on the recipients or categories of recipients

The personal data processed as part of a notification is processed by lawcode GmbH, Universitätsstraße 3, 56070 Koblenz, Germany, on behalf of and in accordance with the instructions of ALUCA GmbH.
Personal data will only be transferred to third parties if there is a legal basis for this. This is particularly the case if the transfer serves to fulfil legal requirements according to which we are obliged to provide information, report or pass on data, if you have given us your consent to do so or if a weighing of interests justifies this.
In addition, external service providers, such as external data centres or telecommunications providers, process personal data on our behalf as processors.
Depending on the focus of responsibility of the report and for the effective initiation of follow-up measures, the personal data may be passed on to our relevant specialist departments.
Under certain circumstances, we may also pass on the personal data to state security and/or law enforcement authorities, other competent authorities and/or persons obliged to maintain confidentiality, such as auditors/lawyers.

General information about the retention period

Data is generally stored until the follow-up measures have been completed. As a rule, the data from a report is deleted after 2 months after the procedure has been finally concluded, unless the initiation of further legal steps requires further storage (e.g. initiation of criminal proceedings or disciplinary proceedings). Personal data in connection with reports will be deleted by us immediately if we consider them to be manifestly unfounded.

Information pursuant to Art. 13 para. 2 lit. e GDPR