Data Protection Policy for the Whistleblowing Channel

1. Who is the data controller? 

HABITUS GLOBAL RETAIL, S.L.U. (hereinafter, HABITUS or the Company) is the data controller for the personal data obtained in connection with the Reporting Channel.  
HABITUS respects the fundamental rights and freedoms of individuals, including the fundamental right to the protection of personal data. Privacy is a fundamental pillar for HABITUS. It processes personal data in accordance with the legislation in force on the protection of personal data, privacy and information security. To this end, it has adopted the necessary technical and organisational measures to prevent the loss, misuse, alteration, unauthorised access to and theft of the personal data provided, taking into account the state of technology, the nature of the data and the risks to which they are exposed.

2. Why do we process your personal data?

Personal data will be processed for the purpose of managing the Reporting Channel information system and, specifically, to manage, process and investigate any acts or omissions contrary to ethics or the law, ensure compliance with them, adopt the appropriate disciplinary or legal measures and, where applicable, prosecute criminal offences and enforce criminal penalties in relation to the Report received, as well as process and resolve it. 

3. What personal data will we process? 

Personal data that is not necessary for processing specific information will not be collected. If such data are collected accidentally, they will be deleted immediately.

Reports submitted under this Procedure may be anonymous, and the reporting person does not need to identify themselves. Notwithstanding the foregoing, personal data obtained in connection with the Report and the internal investigation will be processed confidentially and solely for managing and monitoring this Procedure, applying the appropriate legally required privacy safeguards and measures.

Personal data obtained in connection with the Report and the internal investigation will be processed confidentially and solely for managing and monitoring this Procedure, applying the appropriate legally required privacy safeguards and measures.

The categories of data processed according to the different data subjects are identified below:

  • Reporting person: the personal data provided in the Report will be processed.
  • Reported person: identification data, social circumstances, employment details and, potentially, specially protected data, together with the information provided in interviews or statements, will be processed.
  • Witness: identification data, together with the information provided in interviews, will be processed.

The Company does not request or process any special category of personal data, such as health information, information about racial or ethnic origin, religious or ideological beliefs, trade union membership or sexual orientation. However, because the form contains free-text fields, you may voluntarily disclose such special categories, as well as personal data of third parties referred to in your communication. In any event, pursuant to Article 9.2(g) of the GDPR, special categories of data may be processed for reasons of substantial public interest.

4. What is the legal basis for processing your personal data?

The legal bases for processing personal data are as follows: 

  • For managing a Report through an internal channel:
    • Compliance with the legal obligations applicable to the data controller (Article 6.1(c) of the GDPR), regarding the obligation to have a reporting channel, in accordance with Articles 24 and 8 of Organic Law 3/2018 on Personal Data Protection and the Guarantee of Digital Rights, and Article 30.2 of Law 2/2023.
    • Alternatively, where necessary for the performance of a task carried out in the public interest (Article 6.1(e) of the GDPR), in relation to the prosecution of offences or crimes that may affect the Company. 
  • For verifying the operation of the system.
    • Compliance with a legal obligation applicable to the data controller (Article 6.1(c) of the GDPR). 

5. Who will have access to your personal data? 

The reporting person’s identity will only be disclosed where necessary to the judicial authority, the Public Prosecutor’s Office or the competent administrative authority in the context of a criminal, disciplinary or sanctioning investigation. In such cases, the reporting person will be informed before their identity is disclosed, unless such information could jeopardise the investigation or judicial proceedings. When the competent authority informs the reporting person, it will send them a written explanation of the reasons for disclosing the confidential data in question.

To the extent permitted by law, the affected person will not receive any information relating to the identity of the reporting persons.

Appropriate technical and organisational measures will be taken to protect the identity of the affected persons and guarantee its confidentiality, as well as the confidentiality of any third parties who may be mentioned in the information provided.

Access to the data is strictly limited to those who, whether or not they are part of the Company, perform internal control and regulatory compliance functions, or to any processors appointed for this purpose, as well as to the Data Protection Officer or the person appointed for this purpose. However, personal data may, where strictly necessary, be disclosed to interested third parties, such as members of the Prevention body, the organisation’s employees, external advisers or public authorities, for the purposes of investigating and clarifying the reported facts; to those responsible for legal services, for determining liability and implementing corrective measures; and, where applicable, for bringing the legal and disciplinary actions required before the competent bodies in each case.

Without prejudice to notifying the competent authority of facts constituting a criminal or administrative offence, access to the data by personnel responsible for managing and supervising human resources will only be permitted where disciplinary measures against Employees may be appropriate.

With the processor responsible for technically implementing the Reporting Channel on our behalf, which does not have access to the information submitted and with which a data processing agreement has been entered into. 
Under no circumstances will the Company carry out automated transfers based on the data submitted.

Your personal data will not be subject to international data transfers.

6. How long will we retain your personal data?

The data will be retained for the time strictly necessary to decide whether it is appropriate to initiate an investigation into the reported facts. If it is established that all or part of the information provided is untrue, it will be deleted immediately once this circumstance becomes known, unless the lack of truthfulness may constitute a criminal offence, in which case the information will be retained for the time necessary while the judicial proceedings are conducted.

In any event, three (3) months after receipt of the Report, if no investigation has been initiated, the data will be deleted, unless it is necessary to retain them as evidence of the operation of the system. Under no circumstances will communications and internal investigations be retained for more than ten years. If it is necessary to retain the data in order to continue the investigation, they will be transferred to the Company body responsible for investigating the reported facts, which may continue processing them; no copy of the data will be retained in the internal reporting information system. Reports that have not been followed up may only be recorded in anonymised form and will not be subject to the blocking obligation provided for in Article 32 of Organic Law 3/2018.

7. What are your rights?

The rights of access, rectification, erasure, restriction, portability and objection may be exercised, under the terms specified in the applicable legislation, by sending a written request to HABITUS GLOBAL RETAIL, S.L.U. at the following address: Carrera de Sant Esteve 29, 08173, San Cugat del Vallés, Barcelona, Spain, or by email to contact@muymucho.com, indicating the specific right you wish to exercise. Likewise, if you believe that the Company has not processed your personal data in accordance with the applicable legislation, you may contact the Data Protection Officer at the above address and/or lodge a complaint with the Spanish Data Protection Agency.

However, these rights may not be exercised in the following circumstances:

  • The exercise of the right of access by the reported person does not include disclosure of the reporting person’s identifying data. The right of access to the information contained in the case file will be limited to information relating to the individual’s own personal data being processed; it does not include data relating to the reporting person.
  • If the person under investigation exercises the right to object, they will be informed that they may not exercise it because, pursuant to Article 21.1 of the GDPR, there are compelling grounds legitimising the continuation of the processing, and pursuant to Article 31.4 of Law 2/2023.
  • The right to erasure may not be exercised by any participant during the investigation.