COMMUNICATION OF IRREGULARITIES
This policy describes the processing of personal data collected by Jerónimo Martins, SGPS, S.A., with its head office at Rua Actor António Silva, n.º 7, in Lisbon, registered on the Lisbon Commercial Registry Office under the single registration and tax payer number 500 100 144, hereinafter referred to as Jerónimo Martins, as Data Controller, within the scope of managing the communications of irregularities (complaints) submitted to the complaints channel of the Jerónimo Martins Ethics Committee.
The whistleblowing channel of the Ethics Committee of Jerónimo Martins functions as the whistleblowing channel of said company, as well as the whistleblowing channel shared with the Jerónimo Martins Group’s companies with fewer than 250 employees (including entities that would not be obliged to do so) and an alternative whistleblowing channel for the other companies of the Jerónimo Martins Group.
DATA COLLECTED, PURPOSES AND WITHHOLDING PERIODS
Occurring the presentation of a report to the Ethics Committee, the personal data collected, namely email address, name and phone contact (if shared), will be processed, based on the legal obligation of establishing whistleblowing channels arising from Law 93/2021 of 20th December, which establishes the general regime for the protection of whistleblowers and the terms and conditions under which whistleblowing channels must be made available.
To fulfil this legal obligation, the personal data of third parties provided by whistleblowers is also processed, which is necessary for the management of the processing process and response to the report submitted.
Concerning submissions made by clients, the respective personal data will be processed based on the legitimate interest of the Data Controller, given that such matters do not fall within the scope of fulfilling the legal obligation referred above.
Still within the scope of Jerónimo Martins’ legitimate interests, and always safeguarding the rights and freedoms of the users of the Ethics Committee platform, personal data may also be processed for the following purposes: i) analysis of the platform integrity, ii) network and information security, iii) development and maintenance of the platform, iv) providing technical assistance.
Complaints received, as well as data related to them, must be recorded, and kept for at least five years and, regardless of this period, in the following cases:
• the pendency and until the conclusion of legal or administrative proceedings relating to the complaint; or
• by virtue of a legal or regulatory obligation determining a different conservation period. Personal data that are clearly not relevant to the handling of the report are immediately deleted.
RIGHTS OF THE DATA SUBJECTS AND MEANS OF EXERCISING RIGHTS
Under the terms of the legislation in force, data subjects are guaranteed the right to access, rectification, objection to the processing of, portability, erasure and restriction of the processing of their personal data. Data subjects can exercise any of these rights, subject to the limitations set out in the applicable legislation, by emailing comissao.etica@jeronimo-martins.com or directly via the whistleblowing platform, if an account has been created.
The data subject also has the right to lodge a complaint with the Supervisory Authority in Portugal (CNPD).
SECURITY MEASURES
In its commitment to ensure the security of the data subjects’ personal data, Jerónimo Martins has implemented technical and organizational measures deemed necessary for the processing activities.
COMMUNICATION OF PERSONAL DATA
The personal data whose processing is covered by this Policy may be shared with the other companies of the Jerónimo Martins Group, which are companies owned directly or indirectly by Jerónimo Martins and which are dedicated, as the case may be, to food distribution, food and specialised retail, catering, livestock production, dairy farming, aquaculture, tourism and training under the terms of the law, only to the extent necessary for the purposes of managing the complaints submitted.
The integrity, confidentiality of the identity or anonymity of the complainants, the confidentiality of the identity of third parties mentioned in the complaint, the prevention of access by unauthorised persons, as well as the absence of conflicts of interest in the processing and follow-up of the complaints submitted will always be guaranteed.
Jerónimo Martins also uses external partners, namely for the development, maintenance, and hosting of IT systems. In these cases, Jerónimo Martins ensures that its partners comply with the technical and organisational measures appropriate to the processing activity. In this context, the data collected may be transferred to entities located in third countries (outside the European Union), ensuring that the appropriate security measures are taken in accordance with the legislation in force.
In any case, the same guarantees mentioned above will be guaranteed, where applicable.
Personal data may also be shared with other organisations if this is the result of a legal obligation or court decision.
GOOGLE ANALYTICS
This website uses Google Analytics, a web analysis service provided by Google, to better understand the usage of our websites and services. Google Analytics collects information such as how often users visit the websites, which pages they visit and which other websites they used prior to their visit. Google uses the data collected to track and analyse the use of the websites, prepare reports on their activities and share them with other Google services. Google may use the data collected on the websites to contextualise and personalise the ads of its own advertising network. IP anonymisation has been activated on this site, which means that the IP address of
Google users in the Member States of the European Union is abbreviated beforehand. Only in exceptional cases will a full IP address be sent to a Google server in the United States of America and shortened there.
Google’s ability to use and share the information Google Analytics collects on the websites that are visited are governed by Google Analytics’ Terms of Service and by its Privacy Policy, which should be read to clear up any doubts related to this service or to learn how to turn off Google Analytics on user’s computer or device.
DATA PROTECTION OFFICER
Jerónimo Martins has a Data Protection Officer, whom you may contact for any issues related to the processing of your personal data, by sending an email to dpo.portugal@jeronimo-martins.com.
AMENDMENTS TO THE DATA PROTECTION POLICY
Jerónimo Martins reserves the right to amend this data protection policy, at any time, with the amendments being duly disclosed.
Date of last update: 20th October 2025