COMPLIANCE

PRIVACY NOTICE – ASH SPEAK UP

This Privacy Notice according to Art. 13/14 GDPR applies to the processing of personal data in connection with the ALDI Reporting Line and the other internal reporting channels.

Group Data Compliance

data-compliancesymbolaldi-suedpunktcom

ALDI SÜD KG

The protection of your personal data is very important to us. Therefore, we would like to inform you transparently about how we process your data when we receive reports, complaints or compliance-related concerns through internal reporting channels, including but not limited to the ALDI Reporting Line, email, direct verbal communication, in-person meetings and direct communication.

1. Information about the Controller

ALDI SÜD Kommanditgesellschaft

Moserstraße 42, 5020 Salzburg, Austria
Group Legal and Compliance
Data Compliance Team
(privacysymbolaldi-suedpunktcom)

2. What data do we process?

Personal data means any data containing individual details about personal or factual circumstances, for example name, address, email address, telephone number, date of birth or other information that allows conclusions to be drawn about a person.

Personal data may relate not only to reporting persons, but also to individuals named in a report, witnesses, people subject to an investigation, and authorised persons involved in case handling.

In individual cases, as part of clarification measures, we may also collect special categories of personal data within the meaning of Article 9(1) GDPR, or personal data relating to criminal convictions and offences. This may be the case, for instance, where a report submitted by you contains such data. We process such data only in accordance with Article 9(2) and/or Article 10 GDPR.

The following categories of personal data may be processed in the context of handling reports, complaints or compliance-related concerns, regardless of the channel through which they are received, where such data is voluntarily provided or contained in the report, complaint, communication or related documentation.

• Identification and contact data of reporter (e.g. name, contact details), where provided voluntarily.

• Content of reports, which may include personal data relating to the reporter and to individuals named or otherwise identifiable in connection with the reported concern.

• Case-related metadata and communication, such as case ID, country of origin, emails, and routing information required for case management and allocation.

• User and role-related data of authorised persons involved in case handling (e.g. case managers, compliance staff, Counsels of Trust), limited to what is necessary for case management and system administration.

• Audio recordings without voice recognition. Where audio recordings are made or voice messages are submitted via a reporting channel, these may be processed for the purpose of documenting and handling the report. Where speech-to-text functionality is used, the recording is used solely to convert spoken words into text and not for voice recognition or language analysis.

• Anonymised and aggregated statistical data derived from cases for global oversight purposes, without personal data access.

• Technical and security-related data, such as IP address information, technical logs and session identifiers, where reports are submitted via digital reporting channels.

• Other case-related personal data voluntarily provided or contained in the report, complaint, communication or supporting documentation, which cannot be determined in advance due to the nature of free-text reports, provided that such data is relevant and necessary for the handling of the matter.

  The provision of personal data is generally voluntary. However, if such data is not provided, the report may only be processed to a limited extent.

3. Purpose of processing

The purpose of the data processing is to fulfil the statutory protection and due diligence obligations concerning ALDI, in particular to comply with the requirements of the Whistleblower Protection Act, Federal Law Gazette I No. 6/2023 as amended ("HSchG"), to identify unlawful conduct and irregularities within the company, and to establish an appropriate compliance structure. In this context, the data disclosed by you may also be processed for the purposes of exercising, enforcing or defending legal claims.

Specifically, we process the above-mentioned personal data for the following purposes:

• Receipt, documentation and assessment of reports, complaints or concerns received through different reporting channels.

• Assessment of reports and determination of responsibility.

• Maintaining confidentiality.

• Implementation of appropriate follow-up measures.

• Communication with reporting persons.

• Fulfilment of information and transparency obligations.

• Fulfilment of documentation and accountability obligations.

4. Legal basis

We process your personal data based on the following legal bases:

• Recording and storing reports and mandatory case data (legally required processing) - Legal Obligation, Art. 6 (1)(c), Art. 9 (2) and Art. 10 GDPR, § 8 HSchG

• Disclosure of the reporter’s identity (consent under whistleblower law) - Consent, Art. 6 (1)(a) GDPR

• Recording and storing reports that are not legally required under whistleblower law (legitimate interest) - Legitimate Interests of ALDI, Art. 6 (1)(f) GDPR; it is in our legitimate interest to identify, investigate and address potential misconduct, compliance concerns or violations of internal policies, and to protect the company, its employees, business partners and other stakeholders from legal, financial and reputational risks.

5. With whom will your data be shared?

Personal data is shared only to the extent necessary for the specific purpose and always in accordance with applicable legal requirements. Access to personal data is limited to authorised persons who require access for the handling, assessment, investigation or follow-up of the respective report and who are subject to appropriate confidentiality obligations.

Personal data may be shared with the following categories of recipients where necessary:

• Other ALDI SÜD business entities, public authorities, courts, and regulatory bodies;

• Internally, by authorised case managers at the national level;

• External consultants and service providers (e.g. software providers, SaaS providers as well as providers in the area of corporate communication, work organisation, whistleblowing, etc.).

Personal data may also be transferred to ALDI SÜD business entities outside the European Economic Area (EEA) where this is necessary for the handling of the report and only where an appropriate level of data protection is ensured.

6. How long do we store your personal data?

Personal data will be retained for as long as necessary to fulfil the purposes described above and to comply with applicable legal obligations. Generally, cases documentation is retained for up to five years, unless a different retention period is required by applicable local legislation. Longer retention may apply where this is necessary to comply with statutory obligations, to conduct or document investigations, or to establish, exercise or defend legal claims. Upon expiry of the applicable retention period, the case may be deleted or anonymised where appropriate.

7. Data subject rights

You have the following rights:

• Right of access to the personal data stored about you (Article 15 GDPR);

• Right to rectification of inaccurate personal data concerning you and, where applicable, the completion of incomplete personal data (Article 16 GDPR);

• Right to erasure, provided that one of the grounds set out in Article 17 GDPR applies;

• Right to restriction of processing, provided that one of the grounds set out in Article 18 GDPR applies;

• Right to data portability pursuant to Article 20 GDPR;

• Right to object, provided that the requirements of Article 21 GDPR are met;

You have the right to withdraw any consent given for the use of your personal data at any time without stating reasons. Please note that any data processing carried out up to that point remains unaffected, and that further data processing may also be based on another legal basis.

Please note that your rights to information, access, rectification, erasure, restriction of processing, your right to object and your right to be notified of a personal data breach may also be restricted in accordance with the requirements of Section 8(9) HSchG.

Please submit such requests to privacysymbolaldi-suedpunktcom.

If you believe that the processing of your personal data infringes applicable data protection law, or that your data protection rights have otherwise been violated, you may lodge a complaint with the competent supervisory authority. In Austria, this is the Austrian Data Protection Authority:

Österreichische Datenschutzbehörde
Barichgasse 40-42,
1030 Vienna.
dsbsymboldsb.gvpunktat