Data protection information letter in accordance with EU Regulation
679/2016 (General Data Protection Regulation) - Whistleblower

Dear whistleblower,
We are pleased to inform you about how we process your personal data. This information letter will
also tell you what rights you can exercise as a data subject.
Who processes my personal data?
Data processor
ARA Pustertal SPA
Floronzo /Tobel, 54 - I - 39030 San Lorenzo di Sebato (BZ)
Tel. +39 0474 479601 - E-Mail: info@arapustertal.it
MwSt. IT 02524850217
Contact details of the data protection officer
Privacy@steger-consulting.it
If you make an anonymous report, your personal data will not be processed. This information letter is
not legally relevant for you, as in this case none of your personal data, as defined in Art. 4(1) of the
GDPR, will be processed.
What personal data is processed and for what purpose?
Pursuant to the EU Regulation 2016/679 (General Data Protection Regulation) as well as nationally
applicable legislation in the area of data protection, the following data, among others, may be subject
to processing:
 Message subject
 Description of the case (possible accused persons)
 Department concerned
 Category
 Optional: Uploaded file (Attention, please remove all information that could make persons
identifiable, e.g., in documents, file names or in metadata of the uploaded file, especially if
you want to remain anonymous).
If provided voluntarily, the following personal data may be processed by you:
 Name
 Phone
 E-mail
If you wish to register voluntarily and then make a notification, you must attach an identity document
as part of the registration process.
The purpose of the data processing is the sending of your notification and the subsequent necessary
data processing in order to be able to receive and process it properly and in accordance with the law.
Due to the possibility of anonymous reporting, a possible failure to provide personal data does not
prevent the report from being carried out. The provision of personal data is therefore voluntary and
its communication is neither legally nor contractually required.
To whom will my personal data be forwarded?
When submitting a report, your personal data, where specified, will be received and processed
confidentially by one or more persons appointed internally for this purpose.
Information Letter Data Protection
Whistleblower
Version 2.1 Page 2 of 2
It is possible that the company has engaged external persons (such as an external lawyer) for this
purpose.
In addition, data may be disclosed in the course of public authorities such as ANAC, judicial authorities
and legal representatives, e.g., for criminal prosecution.
What are the legal bases for data processing?
Legal basis used:
 Compliance with legal obligations (Art. 6.1 c GDPR) e.g., disclosure to public authorities,
compliance with EU Whistleblowing Directive (Decree No. 24/2023 - adaptation of EU
Directive 2019/1937).
 If voluntarily provided by the whistleblower: Voluntary provision of personal data (Art. 6.1
a DSGVO)
How long will my personal data be stored?
The data is deleted after the legal archiving period has expired. In Italy this period is 5 years.
Should the data provided be relevant in the context of disciplinary or judicial measures, the retention
period may be extended accordingly, as provided by law.
Does data transfer outside the EU or profiling take place?
Your personal data will not be transferred to other EU countries. Automated decision making, including
profiling, is not used.
What are my data subject rights?
You can exercise your rights free of charge at any time: right to information (Art. 15 GDPR), right to
rectification (Art. 16 GDPR), right to erasure (Art. 17 GDPR), right to restriction of processing (Art. 18
GDPR), right to data portability (Art. 20 GDPR), right to object (Art. 21 GDPR).
To exercise your rights, please contact the responsible person named above.
Please note that some of these rights cannot be exercised in some cases, e.g. if this would jeopardise
the confidentiality of the whistleblower or if the exercise of rights conflicts with legal provisions (e.g.
documentation/archiving deadlines).
You also have the right to lodge a complaint with the Italian supervisory authority for data protection
"Garante per la protezione dei dati personali".