Speak Up Privacy Notice

This Privacy Notice (the “Notice”) provides detailed information on when and why we collect your personal data, how we use it and how we keep it secure. This Notice also describes your rights and how to exercise them.

This Notice relates to our Speak Up programme. Speak Up is a confidential helpline that you can use to report any serious matters that you see or experience in the workplace which breaches our Code of Conduct and Ethics. Speak Up can be used by you or any of your colleagues (employees, contractors and consultants – including temporary workers) across all of our Villages (UK, Europe). You can see our Speak Up Policy here.

Introduction

Value Retail is committed to protecting your personal data. It’s your data, and we respect that.

Other privacy notices may also apply to our use of your personal data – for example the Personnel Privacy Notice, which can be found here or in the People Portal.

This Privacy Notice relates to your visit to our Villages, including services you use and other data we collect during your visit. Other Privacy Notices may apply to our use of your personal data, for example when you register with our Membership Programme, use our Websites or the Village App.

Who we are and how to contact us

This Notice explains how Value Retail Management Limited (and its affiliated companies) collect, use and manage your personal data in Speak Up. Please click here to see who we are.

Value Retail Management Limited owns and administers Speak Up and is the controller of your personal data. Depending on the circumstances of the report, one or more of the other Value Retail entities will be asked to conduct or assist the investigation and will become joint controllers of your personal data described in this Notice.

As joint controllers, we have arrangements between us to ensure that we handle your personal data properly and in accordance with relevant data protection laws. These arrangements reflect our respective roles and responsibilities in relation to you and your personal data. This arrangement between us does not affect your rights under relevant data protection laws. You may contact Value Retail Management Limited with any questions relating to this Notice or Speak Up, or to exercise your rights described in this Notice, by emailing SpeakUpContact@ValueRetail.com.

Specific to Germany Wertheim Village and Ingolstadt Village have appointed a Data Protection Officer for Germany, who can be contacted at DatenSchutzBeauftragter@ValueRetail.com

When this Notice applies to you

This Notice will apply to you in the following instances:

if you make a report;
if you are named as a witness in a report;
if your assistance is required to help with an investigation; and
if you are a person implicated or accused of wrongful behaviour in a report.

The types of personal data we collect and how we collect it

We only collect the personal data and information that is necessary to record reports and to carry out appropriate investigations. You can choose whether you wish to provide your identity when making a report. Here below are details of the personal data we collect.

Here are details of the personal data we collect:

Details of personal data we collect

Assisting in establishing facts in an investigation.

Types of personal data
Information in files you upload when making a report, information gathered as part of an investigation such as email, messages and other communications, interviewers’ notes taken in any conversation, meeting or interview with you

Data Sources
Directly from you: when you make a report and you have chosen to identify yourself

Indirectly: when you have been named by a reporter as a witness, implicated person, or asked to contribute to an investigation

Due to the nature of Speak Up, processing could include opinions (which we cannot mitigate as part of any investigation process) and, depending the type of allegation, we expect in some cases that processing will include special categories of personal data (racial or ethical origin, religious or philosophical beliefs, details of sex life or sexual orientation, political opinions or health information), in addition to financial information, which we treat the same as special category personal data.

Reports can be made using the online reporting tool or by telephone to the dedicated telephone numbers provided. Calls are not recorded and when you report online, there is no collection of electronic personal data that could identify you (note: if you use the Speak Up online reporting tool, using your Value Retail device or when connected to the Value Retail network, it would be possible for Value Retail to identify that you have visited that site, but not whether or not you had made a report).

The Speak Up programme does not knowingly collect personal data from children or about children.

Why we collect your personal data and how we use it

If you make an identifiable report using Speak Up, you do so on a voluntary basis and the personal data and associated information you provide will be used to contact you for the purposes of conducting an investigation, assisting with the progress of any report or as information to support an investigation.

As part of Speak Up procedures, individuals making an identifiable report, will receive an acknowledgement within three days and an update within three months, unless an update would seriously impair the achievement of the investigation and a delay is appropriate.

If you have been named as a witness, are asked to contribute to an investigation or are implicated in a report of wrongful behaviour, we will use your personal data and other information to assist in investigating the report.

If you are not the reporter, we will inform you about the processing of your personal data contained in a Speak Up report within a reasonable period, and within one month at the latest, unless disclosure would seriously impair the achievement of the investigation and a delay is appropriate.

Legal basis of our processing

Our use of your personal data must comply with relevant data protection laws and establish a lawful basis for the processing.

Value Retail will process personal data of reporters (where they have volunteered to be identifiable), witnesses, implicated persons and investigators:
- Europe – in compliance with our Legal Obligation to provide a whistle-blower system.
- UK – as part of our legitimate business interest to provide a safe and secure place of work, investigate non-compliance with our Code of Conduct and Ethics and other policies, and to prevent and detect crime. We have conducted an assessment to ensure that the rights and freedoms of data subjects do not outweigh our legitimate interests.
In exceptional cases, personal data and associated information may also be processed for the purposes of crime detection and personal safety.

Sharing your personal data, including international transfers

All personal data and other information recorded in Speak Up will be treated in the strictest confidence in accordance with the Speak Up policy and procedures. All data contained in and communications to and from Speak Up is protected using cryptographic technology and only disclosed outside of Speak Up when absolutely necessary.

You should note that if you choose to provide your identity when making a report, we are obliged to inform the implicated person that their personal data and other information is being processed about them. This includes information about your identity.
Where disciplinary action is under consideration, personal data and information about reporters, witnesses, contributors and implicated individuals will be disclosed to the relevant Value Retail People team.
We could share personal data contained in reports with the emergency services when absolutely necessary and in the vital interests of an individual.
We could also use consultants and professional advisors to assist us from time to time. Please contact us if you’d like to know more about this.

Value Retail partners with NAVEX Global, Inc. as its data processor, to provide online or telephone reporting and support services, to help us manage Speak Up. Navex securely stores Speak Up data in their EU data centre; however, telephone line staff are located globally (to assist with translation support) and Navex system and services support are based in the US.

Value Retail has conducted transfer risk assessments and put in place safeguards such as standard contract clauses issued by European and UK data protection authorities. This is not applicable to the US.

How long we keep your personal data for

If your report does not comply with Speak Up guidelines, we will tell you this via Speak Up and the report will be anonymised to remove all personal data within two months. When an investigation is concluded and no further action is required, the report will be anonymised to remove all personal data within two months.

When an investigation is concluded and further action is required, the data will be transferred to the relevant Value Retail People team or local law enforcement bodies to take appropriate action and the data kept in Speak Up until all further action is concluded all personal data will then be anonymised.

Personal data and other information transferred to the People team will be retained in line with personnel-retention schedules.

Confidentiality and security of your personal data

We are committed to keeping your personal data secure and we will take appropriate precautions to protect it from loss, misuse or alteration.

All of our employees and the third-party partners with whom we share your personal data are obliged to respect the confidentiality of the personal data of all individuals. We check all third parties that we use, to ensure that they can provide sufficient guarantees regarding the confidentiality and security of your personal data, with particular regard to technical and organisational measures.

Detailed and robust policies and processes have been designed and implemented to ensure the integrity of Speak Up data processing.

Your rights

You have the following rights in relation to the personal data we are processing about you:

1 Right to withdraw your consent to processing of your personal data

If you identified yourself when making a report you will have consented to Speak Up processing personal data about your identity. You have the right to withdraw that consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point, is unlawful).

If you withdraw your consent we may not be able to continue an investigation. We will inform you when this is the case. Where you identify yourself in your report we are obliged to inform the implicated person at the latest one month after the report is made (which may include disclosing your identity) and so the withdrawal of your consent may have limited effect after one month.

2 Right to be informed of the personal data we are processing about you

You have the right to be provided with clear, transparent and easily understandable information about how we collect and use your personal data. This is why we’re providing you with the information in this Notice.

3 Right of access to the personal data we are processing about you

If you ask us, we’ll confirm whether we’re processing your personal data and, if so, provide you with a copy of that personal data (along with certain other details). If you require additional copies, we may need to charge a reasonable fee.

4 Right to correct the personal data we are processing about you

If the personal data we hold about you is inaccurate or incomplete, you’re entitled to have it corrected. If we’ve shared your personal data with others, we’ll let them know about the changes where possible. If you ask us, where possible and lawful to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly.

5 Right to delete information the personal data we are processing about you

This is also known as ‘the right to be forgotten’. You can ask us to delete or remove your personal data in some circumstances, such as where we no longer need it or if you withdraw your consent (where applicable). If we’ve shared your personal data with others, we’ll let them know about the deletion request where possible. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly.

6 Right to restrict the processing of personal data

You can ask us to ‘block’ or suppress the processing of your personal data in certain circumstances, such as where you contest the accuracy of that personal data or you object to us processing it. We will still be able to store your personal data. We’ll tell you before we lift any restriction. If we’ve shared your personal data with others, we’ll let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly.

7 Right to portability of your personal data

You have the right, in certain circumstances, to obtain the personal data you’ve provided us with (in a structured, commonly used and machine-readable format) and to reuse it elsewhere or to ask us to transfer it to a third party of your choice.

8 Right to object to the personal data we are processing

You can ask us to stop processing your personal data, and we will do so, if we are relying on our own legitimate interests to process your personal data, except if we can demonstrate compelling legal grounds for the processing; our interests must override your interests, rights and freedoms or be for the establishment, exercise or defence of legal claims.

9 Rights in relation to automated decision-making and profiling using your personal data

You have the right not to be subject to a decision when it’s based on automatic processing, including profiling, if it produces a legal effect or similarly significantly affects you.

10 Right to complain to a data protection supervisory authority

If you are unhappy about any aspect of the way we collect, share or use your personal data, we would like you to tell us. You can contact us using the details above. You also have a right to complain to your local Data Protection Authority:

UNITED KINGDOM
The Information Commissioners’ Office (ICO)
https://ico.org.uk

IRELAND
The Data Protection Commissioner (DPC)
https://www.dataprotection.ie/docs/Home/4.htm

FRANCE
Commission Nationale de l’Informatique et des Libertés (CNIL)
https://www.cnil.fr/fr

ITALY
Garante per la protezione dei dati personali (Garante)
https://www.garanteprivacy.it/web/guest/home

SPAIN
Agencia Española de Protección de Datos (AEPD)
https://www.agpd.es

BELGIUM
Gegevensbeschermingsautoriteit (GBA)
https://www.gegevensbeschermingsautoriteit.be

GERMANY
Data protection for private sector organisations is overseen by regional data protection authorities. Value Retail operates in two regions within Germany and, therefore, falls under the jurisdiction of two supervisory authorities.

Bavaria
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
https://www.lda.bayern.de/de/index.html

Baden-Württemberg
Der Landesbeauftragte für den Datenschutz Baden-Württemberg
https://www.baden-wuerttemberg.datenschutz.de

To exercise your rights, please email SpeakUpContact@ValueRetail.com

We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information for:

baseless or excessive/repeated requests; or
further copies of the same information.

Generally, we'll respond to you within one month from when we receive your request but, if the request is going to take longer to deal with, we’ll come back to you and let you know.

Changes to this Privacy Notice
This Notice is reviewed on a regular basis by the Data Protection team to ensure it is achieving its stated objectives and to reflect any required changes. If we make any significant changes we will take additional steps to inform you of them.

This Notice does not form part of any contract of employment or engagement.