This policy describes the processing of personal data collected by Jerónimo Martins, SGPS, with its head office at Rua Actor António Silva, n.º 7, in Lisbon, registered on C.R.C. Lisbon under single registration and tax number 500 100 144, hereinafter Jerónimo Martins, as Data Controller, within the scope of managing the communications of irregularities (complaints) submitted to the complaints channel of the Jerónimo Martins Ethics Committee. The Ethics Committee of Jerónimo Martins SGPS functions as the Company’s whistleblowing channel as well as the whistleblowing channel shared with the Group’s companies with fewer than 250 employees (including entities that would not be obliged to do so) and an alternative whistleblowing channel for the other companies of the Jerónimo Martins Group.
DATA COLLECTED, PURPOSES AND WITHHOLDING PERIODS
When submitting a report to the Ethics Committee, the personal data collected, namely email address, name and phone contact (if shared), will be processed, based on the legal obligation of establishing whistleblowing channels arising from Law 93/2021 of 20th December, which establishes the general regime for the protection of whistleblowers and the terms and conditions under which whistleblowing channels must be made available. To fulfil this legal obligation, the personal data of third parties provided by whistleblowers is also processed, which is necessary for the management of the processing process and response to the report submitted.
Complaints received, as well as data related to them, must be recorded, and kept for at least five years and, regardless of this period, in the following cases:
• the pendency and until the conclusion of legal or administrative proceedings relating to the complaint; or
• by virtue of a legal or regulatory obligation determining a different conservation period.
Within the scope of Jerónimo Martins’ legitimate interests, and always safeguarding the rights and freedoms of the users of the Ethics Committee platform, personal data may also be processed for the following purposes:
i) analysis of the platform integrity,
ii) network and information security,
iii) development and maintenance of the platform,
iv) providing technical assistance.
Personal data that are clearly not relevant to the handling of the report are immediately deleted.
RIGHTS OF THE DATA SUBJECTS AND MEANS OF EXERCISING RIGHTS
Under the terms of the legislation in force, data subjects are guaranteed the right to access, rectify, oppose the processing of, portability, erasure and limitation of the processing of their personal data. You can exercise any of these rights, subject to the limitations set out in the applicable legislation, by emailing comissao.etica@jeronimo-martins.com or directly via the whistleblowing platform, if you have created an account (Link to the platform). The data subject also has the right to lodge a complaint with the Supervisory Authority in Portugal (CNPD).
SECURITY MEASURES
In its commitment to ensure the security of the subjects’ personal data, Jerónimo Martins has implemented technical, organizational measures deemed necessary for the processing activities.
COMMUNICATION OF PERSONAL DATA
Your personal data may be shared with the other companies of the Jerónimo Martins Group, which are companies owned directly or indirectly by Jerónimo Martins and which are dedicated, as the case may be, to food distribution, food and specialised retail, catering, livestock production, dairy farming, aquaculture, tourism and training under the terms of the law, only to the extent necessary for the purposes of managing the complaints submitted. The integrity, confidentiality of the identity or anonymity of the complainants, the confidentiality of the identity of third parties mentioned in the complaint, the prevention of access by unauthorised persons, as well as the absence of conflicts of interest in the processing and follow-up of the complaints submitted will always be guaranteed. Jerónimo Martins also uses external partners, namely for the development, maintenance, and hosting of IT systems. In these cases, Jerónimo Martins ensures that its partners comply with the technical and organisational measures appropriate to the processing activity. In this context, the data collected may be transferred to entities located in third countries (outside the European Union), ensuring that the appropriate security measures are taken in accordance with the legislation in force. In any case, in the performance of the related functions, the same guarantees mentioned in the previous paragraph will be ensured. In any case, the same guarantees mentioned above will be guaranteed, where applicable. Personal data may also be shared with other organisations if this is the result of a legal obligation or court decision.
GOOGLE ANALYTICS
This website uses Google Analytics, a web analysis service provided by Google, to better understand your use of our websites and services. Google Analytics collects information such as how often users visit the sites, which pages they visit and which other sites they used prior to their visit. Google uses the data collected to track and analyse the use of the websites, prepare reports on their activities and share them with other Google services. Google may use the data collected on the sites to contextualise and personalise the ads of its own advertising network. IP anonymisation has been activated on this site, which means that the IP address of Google users in the Member States of the European Union is abbreviated beforehand. Only in exceptional cases will a full IP address be sent to a Google server in the United States of America. Google’s ability to use and share the information Google Analytics collects on the websites you visit are governed by Google Analytics’ Terms of Service and by its Privacy Policy, which you should read to clear up any doubts you may have related to this service or to learn how to turn off Google Analytics on your computer or device.
DATA PROTECTION OFFICER
Jerónimo Martins has a Data Protection Officer, whom you may contact for any issues related to the processing of your personal data, by sending an email to dpo.portugal@jeronimo-martins.com.
AMENDMENTS TO THE DATA PROTECTION POLICY
Jerónimo Martins reserves the right to amend this data protection policy, at any time, with the amendments being duly published in the whistleblowing platform.
Date of last update: June 17, 2024