SOCIAL RESPONSIBILITY PRIVACY POLICY
Internal Information System Data Protection Policy (Ethical Channel)
In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, the Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) and Law 2/2023, of February 20, Regulating the Protection of Persons Reporting Regulatory Violations and the Fight against Corruption (Whistleblower Protection Act), as well as the provisions of the rest of the applicable regulations on data protection, we process personal data that is provided through the Ethical Channel as follows.
The Ethical Channel has implemented the necessary measures to guarantee and ensure the confidentiality of the identity and protection of the informant and any third party mentioned in the communication, preventing unauthorized persons from accessing the information.
Back1. Data Controller
Your personal data will be processed by:
| Data of the Data Controller |
|
|---|---|
| Identity | Volotea S.L. (hereinafter, the “Data Controller”, the “Controller” or the “Company”) |
| NIF | B64841927 |
| Postal address | Aeropuerto de Asturias, Santiago del Monte (Castrillón), 33459, Spain |
| Data Protection Officer contact (DPO) | dataprotection.officer@volotea.com |
2. Types of Personal Data That May Be Processed
Whether you provide us with your personal data directly or it is provided by a third party involved in the communication, the following are the main categories of personal data that may be processed.
| Type of data subjects | Categories of data |
| Consultant | Identifying data, contact data, data related to reported facts and data related to evidence, as well as image and voice. |
| Named informant | Identifying data, contact data, data related to reported facts and data related to evidence, as well as image and voice. |
| Anonymous informant (The informant may provide the following data or none of them) | Pseudonym, contact data, data related to reported facts and data related to evidence, as well as image and voice. |
| Complainant | Identifying data, contact data, data related to reported facts and data related to evidence, as well as image and voice. |
| Witness | |
| Third party |
3. Purpose, Legal Basis and Retention
Depending on the processing carried out, personal data may be processed for the following purposes and on the following legal basis. In addition, the periods of retention of personal data are disclosed:
| Processing |
Purpose |
Legal basis and retention |
|---|---|---|
| Managing queries | Although this channel is not designated for the reception of queries, if you send a query through this channel which is related to the Ethics Channel, your data will be processed in accordance with this basis for the processing and conservation, for the purpose of: responding to queries made in relation to the operation and management of the Internal Information System and/or the Compliance Model. In such case, you will be provided with an acknowledgment of the receipt of the queries submitted. The same processing will apply to queries received through the channel enabled for consultations: Compliance.officer@volotea.com | Legal basis: Legitimate interest. We inform you that the legitimate interest of the Controller is to respond to the queries submitted. Likewise, the benefit for the Controller is to detect deficiencies and improve internal processes in relation to the Internal Information System and/or the compliance model. The benefit for you is to obtain answers to the queries that you raise. You may request more information regarding the balancing test of the legitimate interest by contacting dataprotection.officer@volotea.com Retention: Regarding consultations, personal data will be retained for as long as necessary to resolve the query or issue raised and provide an answer to the person concerned. For more information about the conservation period, please go to section “6. Duration of the processing”. |
| Management of complaints | We will process data for the purpose of receiving complaints, providing you with an acknowledgement of receipt of the complaints raised, and we will decide whether to initiate an investigation of the complaints, including whether to keep it recorded in the information logbook. If the complaint is deemed justified, the data will be processed for the following purposes: to carry out an investigation of the reported facts, to record the investigation in the information logbook, to inform the Public Prosecutor's Office if there are indications of a crime, to protect the informant from retaliation, to take, if necessary, appropriate corrective measures and to initiate, if necessary, legal action against the defendants and/or third parties. |
Legal basis: 1- Legal obligation, where the company has the obligation to have an Ethical Channel in accordance with Law 2/2023, of February 20, regulating the protection of persons who report regulatory violations and the fight against corruption (Whistleblower Protection Act) and the complaint concerns any of the actions or omissions provided for in article 2 of said law. 2.- Legitimate interest, where the complaint informs about actions or omissions outside the scope of art. 2 of the Whistleblower Protection Act and there is no legal obligation to process such data. We inform you that the legitimate interest of the Company lies in demonstrating the adequacy and effectiveness of the regulations and internal controls as well as preventing violations. The benefit for the interested parties, as well as for the company, is the improvement and efficiency of internal processes and preventing violations from occurring. You can request more information about the balancing test carried for the legitimate interest by contacting dataprotection.officer@volotea.com Retention: Personal data will be stored in the Ethical Channel only for the time that is necessary to decide on whether it is appropriate to initiate an investigation into the reported facts. In any case, a maximum period of three (3) months from the date of acknowledgment of receipt of the complaint is established. If no acknowledgment of receipt is issued, a period of seven (7) days following the sending of the complaint will be established. After three (3) months from the receipt of the complaint, if no investigative actions have been initiated, the data stored in the Ethical Channel will be deleted. However, data may be kept as evidence of the proper functioning of the Channel, in which case they will be anonymized and the obligation of blocking provided for in the LOPDGDD will not apply. Personal data contained in the complaints admitted for processing and the personal data collected during the investigation process will be retained within the Ethics Channel for the duration of the investigation. In the event that the investigation leads to the adoption of certain corrective measures or legal actions, the personal data will be kept for as long as the appropriate corrective measures or legal actions persist. For more information on the retention periods, please refer to section “6. Duration of the processing”. |
| Proving the proper functioning of the Ethical Channel and/or the Compliance Model. | We may retain your information to prove the proper functioning of the Ethics Channel and/or our Compliance Model. | Legal basis: Legitimate interest. We inform you that the legitimate interest of the Controller is to be able to prove the suitability and effectiveness of the operation of the Ethical Channel and/or the Compliance Model. The benefit for the interested parties, as well as for the company, is the improvement and efficiency of the processes and management of the Ethical Channel. You can request more information about the balancing test carried out for the legitimate interest by contacting dataprotection.officer@volotea.com. Retention: The data will be retained for the same periods stipulated in the previous section “management of complaints”. For more information on the retention periods, please refer to section “6. Duration of the processing”. |
4. Disclosure of Personal Data
As a general rule, your personal data will be kept confidential and will not be communicated to third parties, including the persons to whom the facts reported refer.
However, your personal data may be communicated to those service providers contracted by the Controller for purposes related to the receipt of information from the Ethics Channel and, where appropriate, for the management and conducting of investigations that may be necessary, as well as for imposing corrective actions and/or legal actions. In this case, service providers will process the data as Data Processors and, in no case, will process the data for their own purposes, such as, for example, the processing of your personal data for the purposes of the Ethics Channel. For example, Ulises GRC is a provider specialized in the management of internal Ethical Channel management systems of companies, with whom the Controller maintains a contractual relationship for the purpose of receiving, retaining and technical and legal management of communications made through the Ethical Channel.
Additionally, personal data may be disclosed to the Security Forces and Corps, Judges or Courts, as well as to any other competent body if required in accordance with applicable law.
In cases where there are indications that the reported facts may constitute a crime, if required in accordance with applicable law, your data may be communicated to the Public Prosecutor's Office or, if the reported facts may affect the financial interests of the European Union, they may be communicated to the European Public Prosecutor's Office.
Back5. International Data Transfers
Data is processed within the territory of the European Union or within the European Economic Area.
If your data is processed outside the European Union or the European Economic Area, the Controller will ensure that such data processing is always carried out with appropriate safeguards in place, which may include (I) EU-approved Standard Clauses or (II) Third Party Certifications.
Back6. Duration of the Processing
All data provided will be processed for the period established in section 3. “Purpose, legal basis and retention” of this Privacy Policy.
Once the corresponding retention period has expired, the data will be blocked for the purpose of demonstrating compliance, as well as suitability and/or the effectiveness of the Ethical Channel and/or the Compliance Model of the Controller and, where applicable, to comply with the applicable legal obligations, up to a maximum period of ten (10) years.
However, we may keep the personal data blocked for a longer period when the statutory limitation period for the potential infractions or offenses reported is greater than ten (10) years, in accordance with applicable law, in which case the blocking period will be equivalent to said statutory limitation period.
Upon expiration of the relevant blocking period, the personal data will be permanently deleted.
However, we inform you that we will immediately remove the data from the Ethical Channel, without the need for blocking, if:
- It is proven that the information provided, or part of it, is untrue, unless the lack of truthfulness constitutes a criminal offense, in which case the data will be stored for the time necessary to pursue legal proceedings.
- Personal data that is not relevant for the knowledge and investigation of actions or omissions within the scope of this Ethics Channel, and particularly, data falling under special categories of data, have been communicated. In the latter case, the data will be immediately deleted and will not be registered or subject to any further processing.
7. Exercise of Rights and Further Information
You may request more information about the processing of your personal data at any time and may exercise your rights of access, rectification, deletion, opposition, limitation or portability free of charge through the following link: https://www.volotea.com/en/passenger-rights-form/
However, if the person under investigation exercises the right to oppose the processing of his/her personal data, it will be presumed, unless proven otherwise, that there are compelling legitimate reasons that justify the continuation of such processing.
If we deem it necessary, we may request a copy of your ID card or equivalent document proving your identity to properly execute your request to exercise your rights.
If you have any doubts, questions or complaints about the way in which we process your personal data, you can contact our DPO through the following email address dataprotection.officer@volotea.com. Additionally, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe that we have not properly addressed your rights.
Back