Each of the entities/institutions of Construtora Espano-Portuguesa, Lda. that is the subject of a report will be the data controller for the processing of data carried out through its internal whistleblowing channel, namely:
Construtora Espano-Portuguesa, Lda.
Data processing is carried out with complete confidentiality, and access to the personal data collected through the channel is restricted to those responsible for receiving and following up on the reports, as described in greater detail in the Whistleblowing Policy.
The data processing is based on the need to comply with a legal obligation, namely the provisions of Law no. 93/2021 of December 20, and the legitimate interests of each of the entities/institutions of Construtora Espano-Portuguesa, Lda. in promptly identifying and effectively addressing violations committed in the course of their activities.
The personal data collected through the internal whistleblowing channel will be processed exclusively for the purpose of identifying and investigating the violations set out in the Whistleblowing Policy.
In the course of investigating and handling reports, the entities/institutions of Construtora Espano-Portuguesa, Lda. may engage third parties, namely law firms and forensic audit or investigation companies, to whom personal data may be disclosed.
In all cases, it is ensured that third parties accessing personal data are subject to appropriate professional secrecy or confidentiality obligations and offer guarantees of implementing appropriate technical and organizational measures so that the data processing meets applicable security and data subject rights protection requirements.
Personal data may also be processed by subcontractors, on behalf of and under the instruction of the entities/institutions of Construtora Espano-Portuguesa, Lda., namely IT service providers, in particular the software license provider used in the whistleblowing channels.
Personal data may also be disclosed to third parties when (i) required by law; (ii) ordered by a court or public authority; or (iii) the data subject has given express consent.
Personal data processed through the internal whistleblowing channel will be retained for 5 years from the date of receipt of the report and, in any case, for the duration of any judicial or administrative proceedings related to the report. After these periods, only an anonymized record of the report and the measures taken will be retained for historical and statistical purposes, and all personal data in the process will be deleted.
Data subjects whose personal data is processed through the whistleblowing channel have the rights of access, rectification, erasure, restriction of processing, data portability, and objection. These rights may be exercised, subject to the applicable requirements, by sending an email to the Data Protection Officer. A complaint may also be filed with the competent supervisory authority, in Portugal, the Comissão Nacional de Proteção de Dados.
For any questions regarding privacy or the protection of personal data, the Data Protection Officer may be contacted via email at geral@espanoportuguesa.com