GGM Gastro internal reporting office in accordance with the German Whistleblower Protection Act (Hinweisgeberschutzgesetz / HinSchG)

The German Whistleblower Protection Act (HinSchG) entered into force in Germany on 2 July 2023 and serves to transpose the requirements of the EU Whistleblower Directive (Directive (EU) 2019/1937) into German law. As such, its main aim is to ensure comprehensive protection for persons who report legal violations and violations of rules in companies and public bodies.

The establishment of an internal reporting office is a voluntary, optional measure under the German Whistleblower Protection Act. GGM has chosen to undertake this measure to ensure that employees, suppliers and customers of GGM have the opportunity to report potential serious misconduct in the workplace or violations of human and environmental rights in confidence.

When you report potential misconduct or violations via the internal reporting office, you enable us to investigate the matter and take appropriate action. We recognise that reporting such information can be daunting and that you may worry about experiencing negative consequences. This is why the German Whistleblower Protection Act exists. It stipulates a mandatory level of protection for reporting persons, also known as ‘whistleblowers’. Individuals who report whistleblowing information are protected by law from being disadvantaged as a consequence of their report. It is prohibited for professional reprisals such as warnings, dismissals, discrimination for promotions or any other form of discrimination to occur in connection with a whistleblowing report.

Persons who wish to report potential violations have the option to contact either an internal or an external reporting office.

If you believe that effective action can be taken internally against the violation(s) in question, please contact the internal reporting office in the first instance. By doing so, you help to maintain the integrity of GGM Gastro International GmbH and to ensure that our conduct complies with rules and with the principles of fair cooperation. Please note that even after an internal report has been submitted, the option to submit an (additional) external report remains.

• According to § 2 of the German Whistleblower Protection Act, the internal reporting office is responsible for:

1. offences that are punishable by law;
2. offences that are punishable by a fine, in cases where the violated rule or regulation serves to protect life, limb or health or to protect the rights of employees or their representing bodies;
3. other violations of federal and state law or of directly applicable legal acts of the European Union and the European Atomic Energy Community.

       These laws and provisions cover, among other things:

• combating money laundering and terrorist financing;
• product safety and conformity;
• road safety;
• environmental protection;
• radiation protection and nuclear safety;
• promoting the use of energy from renewable sources and energy efficiency;
• food and feed safety;
• consumer rights and consumer protection;
• protection of privacy in the electronic communications sector, protection of the confidentiality of communications, protection of personal data; and
• information technology security.

The internal reporting office is also responsible for reports relating to:

• violations of federal and EU regulations on the awarding of contracts and concessions, and to legal protection during these procedures once the relevant EU thresholds have been reached; and

• violations of financial and tax law.

Please note that:

• The internal reporting office is not responsible for general complaints.
• If you become aware of a suspected breach of data protection, please report this directly to the GGM Gastro International GmbH’s Data Protection Officer.
• The internal reporting office is not intended to deal with acute emergencies or hazardous situations.

• What happens after your report is received

Your report will be acknowledged by the Internal Reporting Officer within 7 days of receipt, then reviewed and assessed within 3 months of submission. You will be informed of any follow-up measures taken or planned, provided that the provision of this information does not jeopardise any internal investigations or enquiries and does not infringe the rights of persons named in the report or the subject of the report.

• How your data is processed

As a general rule, your data will be treated confidentially and not passed to third parties. However, if it is necessary to disclose personal information to third parties due to a legal obligation or to further investigate the offence you have reported, we will notify you of this in advance.

It is not mandatory to provide your personal data when making a whistleblowing report. However, providing contact details can facilitate communication between you and the reporting office and speed up the process for clarifying the report. If you do not wish to provide contact details, the internal reporting office will also handle anonymous reports.

If you choose to provide personal data:

By submitting the report, you consent to us processing and storing this information for the purpose of contacting you and clarifying any questions about the report. You have the right to withdraw your consent for the future at any time.

• Data privacy

By providing this data privacy notice, GGM Gastro International GmbH fulfils its duty, pursuant to Articles 13 and 14 of the EU General Data Protection Regulation (GDPR), to provide information on the processing of personal data by the internal reporting office in connection with the German Whistleblower Protection Act. For other terms used (“personal data”, “processing”, “data controller”, “third party”, etc.), please refer to the definitions in Article 4 of the EU GDPR.

1. Contact information

1.1. Name and contact information of the data controller

GGM Gastro International GmbH

Managing directors: Ferit Inan & Ömer Elma

Weinerpark 16,

D - 48607 Ochtrup

Telephone: +49 (0) 2553 – 72 20 – 0

Fax: +49 (0) 2553 – 72 20 20 – 200

Email: info@ggmgastro.com

www.ggmgastro.com

1.2. Internal reporting office

Email: trustme@ggmgastro.com
Tel.: +49 (0) 2553 7220 123

1.3. Getting in touch via letter/email

If you contact the internal reporting office by letter, please also mark your letter as confidential on the envelope. If you contact the office by email and wish to do this anonymously, you may set up a private email account under a fictitious name that does not allow the email to be traced back to you. If you would like to meet a representative of the office in person, please request this using one of the above-mentioned channels.

1.4. Getting in touch with the Data Protection Officer

Our Data Protection Officer can be contacted by post at the above address of the data controller and by email at datenschutz@ggmgastro.com.

1. Personal data processed and purposes of processing

When you submit a report for processing by the internal reporting office, your personal data is collected and processed for the following purposes.

For processing the report:

• your name and contact information (where applicable);
• any personal data contained in the content of the report.

For the initiation of follow-up measures:

• any personal data required for the company to initiate appropriate follow-up measures.

1. Legal basis for data processing

The legal basis for the processing of personal data for the above-mentioned purposes is Art. 6 (1) c) of the EU GDPR in conjunction with § 10 of the German Whistleblower Protection Act.

1. Data transfer

Personal data processed by GGM Gastro International GmbH for the purposes mentioned in paragraph 2 will generally not be passed on to third parties. In exceptional cases, data may be transferred to third parties due to a legal obligation; for example, data may be passed to law enforcement authorities for the investigation of criminal offences on the basis of the provisions of the German Code of Criminal Procedure (StPO).

1. Deletion periods

Data processed for the purposes stated in paragraph 2 is generally deleted (or, where data is provided on paper documents, destroyed) three years after the conclusion of the reporting procedure in accordance with §11 (5) of the German Whistleblower Protection Act.

1. Your rights as a data subject

You as a data subject are entitled to assert the rights granted to you by the EU GDPR at any time. These include:

• the right to obtain confirmation as to whether your personal data are being processed and, if so, to access the personal data concerned (Art. 15 EU GDPR);
• the right to rectify inaccurate personal data or to have incomplete personal data completed (Art. 16 EU GDPR);
• the right to obtain the erasure of your personal data in accordance with the provisions of Art. 17 EU GDPR; and
• the right, in accordance with the provisions of Art. 18 EU GDPR, to obtain the restriction of processing.

You also have the right to lodge a complaint with the competent data protection supervisory authority (Art. 77 EU GDPR).