Privacy Policy for Whistleblowers
Version: March 27, 2023
With this Privacy Policy, we inform you how Leica Camera AG (hereinafter also referred to as “we” or“us”) and our subsidiaries listed in Annex 1 (hereinafter referred to as “Subsidiaries” and, together withus, “Leica Camera Group”) process your personal data in the event that Leica Camera AG or a Subsidiary has obtained this personal data from you or from a third party within the scope of reports submitted
in connection with the whistleblowing system (“Whistleblowing System”).
1

Controller and contact details

Leica Camera AG is the controller for data processing initially:
Am Leitz-Park 5
D-35578 Wetzlar
Personal/confidential
Compliance Officer
Email address: compliance@leica-camera.com
The Leica Camera Group uses the Whistleblowing System for the purpose of preventing and clarifying
behaviour of employees of the Leica Camera Group or other persons where this behaviour relates tothe company and is unlawful and/or damaging to the company. Therefore, Leica Camera AG works
closely with the affected Subsidiaries to clarify and investigate the matters and determine the necessary
measures.
If you submit reports on matters concerning a Subsidiary, Leica Camera AG and the affected Subsidiaries shall be joint controllers and jointly responsible for certain processing steps (as set out in Annex
1) (in accordance with Art. 26 para. 1 sentence 1 of the General Data Protection Regulation (“GDPR”))
and in accordance with their agreement regarding joint responsibility; the Leica Camera Group will behappy to provide you with main excerpts of this upon request. You can submit your request via thecontact details for the Leica Camera Group provided in this section 1 or for the relevant Subsidiary inAnnex 1.
Leica Camera AG is the controller responsible for providing the information set out in this Privacy Policy(in accordance with Art. 13, 14 GDPR).
If you have any questions or suggestions relating to data protection, or if you wish to assert any of yourrights under data protection law (as per Art. 15 et seq. GDPR), please feel free to contact the companiesof the Leica Camera Group named in this Privacy Policy using the contact details specified here and in
Annex 1.
Should you have any questions regarding the Whistleblowing System and how the Whistleblowing System works, you can also contact the support staff of the operator of the Whistleblowing System, LegalTegrity, Platz der Einheit 2, 60323 Frankfurt am Main (“LegalTegrity”) via email at support@legaltegrity.com or via the telephone number +49 69 9999 88 38. If you contact LegalTegrity to clarify questions
regarding the Whistleblowing System and how it works, LegalTegrity is an independent data controller1.

of your personal data that you provide to LegalTegrity for the purpose of responding to your enquiry.
Please contact LegalTegrity for further information regarding LegalTegrity’s privacy policy.
In contrast to this, LegalTegrity is a data processor appointed by Leica Camera AG to process personal
data contained in reports submitted to the Whistleblowing System on behalf of Leica Camera AG (seesection 6).
Please note: If you have submitted a report anonymously via the Whistleblowing System andsubsequently contact us with questions regarding the Whistleblowing System, data protection
or to assert your rights, you may lose your anonymity with regards to your report if your subsequent enquiry can be associated with it by Leica Camera AG and/or any Subsidiary.
2

Data protection officer

The data protection officer of Leica Camera AG can be contacted at DPO@leica-camera.com. If a dataprotection officer has been designated for the respective Subsidiaries, their contact details can be foundin Annex 1.
3

Subject of data protection

Personal data is all information that relates to an identified or identifiable natural person (in accordancewith Art. 4 no. 1 GDPR). In particular, this can be your name, but can also cover information such as a
documented behaviour that is associated with you. In this Privacy Policy, personal data may simply bereferred to as data.
4

When is your personal data processed?

Within the scope of the Whistleblowing System, your personal data is processed:•

when you access the Whistleblowing System.

•

when you submit a report yourself or contact the Leica Camera Group via the contact details
specified in section 1 and provide your name, email address or other information that enable alink to your person to be established.

•when a reference to you is established from or in connection with a report from a third party,
such as where you are accused of misconduct or if you are mentioned in connection with theclaimed misconduct of another person, e.g., because you are named as a witness to the misconduct.

5

Automated data collection

When you access the Whistleblowing System, your end device automatically transfers the following
technical data:•

Browser type and version•

Operating system used•

Referrer URL

2•

Host name of the accessing computer•

Time of server request•

IP addressThis data is only processed in order to deliver the content of the Whistleblowing System and to provide
its functions. This data is not saved or merged with other personal data that you transfer as part of areport sent via our Whistleblowing System.
6

Operation of the Whistleblowing System

The Whistleblowing System is provided by the service provider LegalTegrity GmbH, Platz der Einheit 2,60323 Frankfurt am Main (“LegalTegrity”). LegalTegrity processes personal data on behalf of Leica
Camera AG, i.e., exclusively according to the instructions of Leica Camera AG (see Art. 4 no. 8, Art. 28
GDPR).
7

Reports submitted via the Whistleblowing System

7.1

Type of report

As the whistleblower, you can choose freely between the following two options for submitting your report
via the Whistleblowing System:a)Anonymous report

You can submit your report anonymously. In this case, Leica Camera AG, any Subsidiaries
affected by the report and the Forensic Team at Deloitte GmbH do not know your identity.
Please note:
If you specify your email address at the end of the reporting process or provide information that
identifies you during another part of the reporting process, your report will not be anonymous.
Remember that you may be identifiable not only from your email address and name, but also
in other ways. For example, if only you are a possible witness to a process, e.g., due to yourposition in the respective company of the Leica Camera Group, your physical presence or a
special access authorisation.
b)

Confidential report (not anonymous)

In the other type of report, your personal data is disclosed to both the Forensic Team of DeloitteGmbH and the internal employees of Leica Camera AG who are responsible for processing
the report and, if the report concerns a Subsidiary, to the responsible employees there in eachcase for the purpose of investigating the report.
7.2

Data for recording the incident

If you as a whistleblower wish to submit a report via the Whistleblowing System, you must provide thefollowing details:

3•Category of incident to be reported•

Country and, if applicable, Leica Group company to which the report refers•

Description of the incident to be reported•

Location of the incident•

Date and time of the incident•

Name and position of the people involved•

Name and position of possible witnesses•

Details on the availability/non-availability of physical documentation or proof of the incident•Your relationship to the Leica Camera Group•

When reporting theft, you must also provide details as to where the stolen object was storedprior to the theft.

You can also provide more information and documentation on the incident if you wish. You also havethe option of removing details that could personally identify you from the documents prior to
uploading them, or of rendering these unrecognizable.
At the end of the process, you have the option of providing your email address if you would like Leica
Camera AG to keep you informed about the processing status of your report.
7.3

Access data for whistleblowers and additional information

Once the report is submitted, a reference number will be displayed. You must also enter a four-digit PIN.
You can use the reference number and your chosen PIN to obtain information regarding the processing
status of your report in the Whistleblowing System at any time, as well as to add further information to
your report and to answer any questions, e.g., using the chat function of the Whistleblowing System.
Please note that it is not possible to reset your access code or PIN. If you have forgotten these, youhave to create a new report.
7.4

Purposes of data processinga)Receipt of the report
Leica Camera AG processes your personal data in order to receive and conduct initialchecks on the report, as well as to assign the report to the respective Subsidiary insofar
as it relates to a Subsidiary.

b)

Follow-up measures for reports relating to Leica Camera AG
For reports relating to Leica Camera AG, Leica Camera also processes your personal
data for the purpose of checking and further investigating the reported incidents and to
decide on the required countermeasures and how to initiate them.

4c)Processing reports relating to Subsidiaries
For reports relating to a Subsidiary, Leica Camera AG processes your personal data forthe purpose of checking and sharing the report (including a recommendation for further
action) to the Subsidiary in question. Your data is also processed for the purpose of
jointly further investigating the reported incidents and coordinating the required countermeasures and their initiation.
Leica Camera AG, jointly with the Subsidiary in question, is the controller for this processing.

d)

Processing your email address in order to keep you informed regarding your report
Where you as a whistleblower have specified that you wish to be informed of the processing status of your report by email or that you wish to be contacted by email if questions arise, Leica Camera AG processes your email address in order to provide you withthe corresponding information or to contact you in the event of questions.

e)

Processing your email address in connection with reports relating to Subsidiaries
Where you as a whistleblower have specified that you wish to be informed of the processing status of your report by email or that you wish to be contacted by email if questions arise, Leica Camera AG processes your email address in order to provide you withthe corresponding information, contact you in the event of questions, or shares youremail with the Forensic Team of Deloitte so that the Forensic Team of Deloitte cancontact you in the event of questions.
Leica Camera AG, jointly with the Subsidiary in question, is the controller for this processing.

Leica Camera AG processes your personal data for the purpose of preventing and clarifying behaviourof employees of the Leica Camera Group or other persons where this behaviour relates to the company
and is unlawful and/or damaging to the company.
7.5

Sharing your personal dataa)

Sharing your personal data with Deloitte

Leica Camera AG transfers incoming reports, the data they contain and additional informationthat may be provided to us by whistleblowers or other data provided by the whistleblower upon
our request to Deloitte GmbH, Schwannstraße 6, 40476 Düsseldorf, Germany (“Deloitte”) for
the initial viewing and classification of the incoming reports and for the purpose of a moredetailed investigation and the identification of solutions by the Forensic Team (e.g., drawing up
follow-up measures).
For reports relating to a Subsidiary, Leica Camera AG also transfers your email address to
Deloitte in order to enable the Forensic Team to contact you should any questions arise.
Deloitte processes your personal data as an independent data controller. Leica Camera Groupis not responsible for Deloitte's data protection law compliance. Please contact Deloitte forfurther information regarding Deloitte's privacy policy.

5b)

Sharing your personal data with the Subsidiary in question

For reports relating to a Subsidiary, Leica Camera AG also transfers the incoming reports, thedata they contain and additional information that may be provided to us by whistleblowers to
the Subsidiary in question, for the purpose of further checking and investigating the reported
incidents and to decide on the required countermeasures and how to initiate them.
Leica Camera AG, jointly with the Subsidiary in question, is the controller for this processing.
7.6

Legal basisa)Receiving and checking the reports
When the reports are received and checked, our legitimate interests (see Art. 6 para. 1
lit. f) GDPR) form the legal basis for the processing, including transfer to Deloitte and to
the Subsidiary in question, of the following:Personal data of the whistleblowers and other persons (in particular accused
persons or witnesses)

Additional information that the whistleblowers may have provided on request

Leica Camera AG has a legitimate interest in the receipt and checking of reports for the
purpose of enabling preventive or repressive measures against conduct in relation to
the Leica Camera Group that is unlawful and/or damaging to the company. In the caseof reports relating to a Subsidiary, Leica Camera AG also pursues the same interestsof the respective Subsidiary.
b)

Follow-up measures in the event of criminal acts by employees of Leica Camera AG
The legal basis for processing the personal data of accused employees of Leica Camera
AG, including its transfer to Deloitte, for identifying criminal acts or serious breaches ofduty in connection with the employment relationship is Section 26 para. 1 sentence 2 of
the German Federal Data Protection Act (“BDSG”).

c)

Follow-up measures for other violations by employees of Leica Camera AG, violations
by employees of Subsidiaries or violations by other persons
The legal basis for processing the personal data of•

the accused employees of Leica Camera AG or the Subsidiaries•

other accused persons(in each case including transferring this data to Deloitte and, in the event of violations
concerning a Subsidiary, to the Subsidiary in question) for the purpose of clarifying otherconduct in relation to the Leica Camera Group that is unlawful and/or damaging to thecompany is our legitimate interest (see Art. 6 para. 1 lit. f) GDPR).
Leica Camera AG has a legitimate interest in processing personal data relating to reports that are suitable for enabling preventive or repressive measures against conduct6

in relation to the Leica Camera Group that is unlawful and/or damaging to the company.
In the case of violations by employees of Subsidiaries, Leica Camera AG also pursues
the same interests of the respective Subsidiary.
d)Legal basis for processing the personal data of the whistleblowers and witnesses within
the scope of follow-up measures
The legal basis for processing the personal data of whistleblowers and witnesses within
the scope of follow-up measures is our legitimate interest (see Art. 6 para. 1 lit. f)GDPR).
Leica Camera AG has a legitimate interest in processing personal data relating to reports that are suitable for enabling preventive or repressive measures against conduct
in relation to the Leica Camera Group that is unlawful and/or damaging to the company.
In the case of violations by employees of Subsidiaries, Leica Camera AG also pursues
the same interests of the respective Subsidiary.

e)Processing your email address in connection with reports relating to Leica Camera AG
and the Subsidiaries
If you as a whistleblower have specified that you wish to be informed of the processing
status of your report by email or that you wish to be contacted by email if questions
arise, Leica Camera AG has a legitimate interest in processing for the aforementioned
purposes as per our legitimate interest (see Art. 6 para. 1 lit. f) GDPR). For reports relating to Subsidiaries, Leica Camera AG also transfers your email address to Deloitte inorder to enable the Forensic Team to contact you should any questions arise. This constitutes the legitimate interest of Leica Camera AG and the legitimate interest of theaffected Subsidiary being pursued by Leica Camera AG.

8

Data processing by Subsidiaries

8.1

Processing reports / purposes of data processing

For reports relating to a Subsidiary, the Subsidiary in question processes your personal data for the
purpose of jointly further investigating the reported incidents and to coordinate and initiate the required
countermeasures against the accused employees of the affected Subsidiary and other accused persons.
Leica Camera AG, jointly with the Subsidiary in question, is the controller for this processing.
Your personal data is processed for the purpose of preventing and clarifying behaviour of employees of
the Subsidiary or other persons where this behaviour relates to the company and is unlawful and/or
damaging to the company.
8.2

Sharing your personal data

The Subsidiary in question transfers additional information and findings obtained during the further investigation of the incidents to both Deloitte and Leica Camera AG for the purposes specified in section 8.1.
Leica Camera AG, jointly with the Subsidiary in question, is the controller for this processing.

7

8.3

Legal basis

The legal basis•

for processing the personal data of the whistleblowers and other persons (in particular accused
persons or witnesses), as well as additional information that the whistleblowers may have provided on request•

for transferring this data to Deloitte and Leica Camera AG

for the purposes specified in section 8.1 and 8.2 can be found in Annex 1 for the Subsidiaries outside Germany.
The following legal bases apply for the German Subsidiaries:a)

Follow-up measures in the event of criminal acts by employees of the Subsidiary
The legal basis for processing the personal data of accused employees of the Subsidiary, including the transfer of this data to Deloitte and Leica Camera AG, for identifying
criminal acts or serious breaches of duty in connection with the employment relationshipis Section 26 para. 1 sentence 2 BDSG.

b)

Follow-up measures for other violations by employees of the Subsidiary or other persons
The legal basis for processing the personal data of•

the accused employees of the Subsidiaries•

other accused persons(in each case including transferring this data to Deloitte and Leica Camera AG) for the
purpose of clarifying other conduct in relation to the Leica Camera Group that is unlawful and/or damaging to the company is our legitimate interest (see Art. 6 para. 1 lit. f)GDPR).
c)

Processing the personal data of the whistleblowers and witnesses within the scope offollow-up measures
The legal basis for processing the personal data of whistleblowers and witnesses is ourlegitimate interest (see Art. 6 para. 1 lit. f) GDPR).

Where our legitimate interest (see Art. 6 para. 1 lit. f) GDPR) constitutes the legal basis for the processing, the processing is necessary for observing the legitimate interests of the affected Subsidiary in
the prevention or resolution of behaviour that relates to the company and is unlawful and/or damaging
to the company. Furthermore, the affected Subsidiaries pursue the identical interest of Leica Camera
AG in the prevention or resolution of the aforementioned behaviour in relation to the Leica Camera
Group.

8

9

Duration of storage

Reports and additional information are deleted from the Whistleblowing System two months after theend of the associated investigations. Leica Camera AG and the affected Subsidiary store personal data
related to a report for a period of up to 10 years, starting at the end of the year in which the investigation
was completed and the report was thus fully processed. If the report is followed by official or (pre-)trial
proceedings, the storage period begins upon completion of the corresponding proceedings.
In the case of unfounded or unsubstantiated reports, we delete the personal data immediately after
completion of the investigation.
The legal basis for storage is our legitimate interest (see Art. 6 para. 1 lit. f) GDPR). Storage is necessary for maintaining internal documentation as well as for asserting, exercising or defending legal claims.
This also constitutes the legitimate interest of Leica Camera AG or the affected Subsidiary.
10

Malicious reports

10.1

Malicious reports relating to Leica Camera AG

If you as a whistleblower submit a malicious report (i.e., clearly false or untrue reports) relating to Leica
Camera AG, Leica Camera processes your personal data in order to take repressive measures against
you, including the initiation of measures pertaining to labour law.
The legal basis for the processing of your personal data is Section 26 para. 1 sentence 2 BDSG, where
you are an employee of Leica Camera AG and the malicious report is deemed a serious breach of duty
or a criminal act in connection with the employment relationship. In other cases, the legal basis is ourlegitimate interest (see Art. 6 para. 1 lit. f) GDPR). Leica Camera AG has a legitimate interest in resolving malicious reports and initiating appropriate measures.
10.2

Malicious reports relating to a Subsidiary

If you as a whistleblower submit a malicious report relating to a Subsidiary, Leica Camera AG and theaffected Subsidiary process your personal data in order to take repressive measures against you, including the initiation of measures pertaining to labour law.
The legal basis for the processing of your personal data can be found in Annex 1 for the Subsidiaries
outside Germany.
The legal basis for the processing of your personal data is Section 26 para. 1 sentence 2 BDSG, insofar
as you are an employee of Leica Camera AG and the malicious report is deemed a serious breach of
duty or a criminal act in connection with the employment relationship. In other cases, the legal basis is
our legitimate interest (see Art. 6 para. 1 lit. f) GDPR). Leica Camera AG has a legitimate interest inpunishing malicious reports relating to a Subsidiary and initiating appropriate measures.
The following legal bases apply for the German Subsidiaries:
The legal basis for the processing of your personal data is Section 26 para. 1 sentence 2 BDSG, where
you are an employee of the Subsidiary and the malicious report is deemed a serious breach of duty ora criminal act in connection with the employment relationship. In other cases, the legal basis is ourlegitimate interest (see Art. 6 para. 1 lit. f) GDPR).

9

Where our legitimate interest (see Art. 6 para. 1 lit. f) GDPR) constitutes the legal basis for the processing, the processing is necessary for observing the legitimate interests of the affected Subsidiary inpunishing malicious reports and initiating appropriate measures.
10.3

Duration of storage

Leica Camera AG and the affected Subsidiary store personal data of the whistleblower in connection
with a malicious report for a period of 10 years, starting at the end of the year in which the investigation
was completed and the report was thus fully processed. If the report is followed by official or (pre-)trial
proceedings, the storage period begins upon the completion of the corresponding proceedings.
The legal basis for storage is our legitimate interest (see Art. 6 para. 1 lit. f) GDPR). Storage is necessary for internal documentation as well as for asserting, exercising or defending legal claims. This also
constitutes the legitimate interest of Leica Camera AG or the affected Subsidiary.
11

Making contact using our contact details

If you use the contact details specified in section 1 to send a query (e.g., regarding how the Whistleblowing System works or data protection) to the Leica Camera Group (via email or post), the following
data will be processed:•

Your name, provided that you specify this in your query•

The time and date of your query, as well as the further information you provide in your query

and, depending on the form of contact chosen by you or the available contact details:•Your email address and/or•Your address

The data is processed on the basis of Leica Camera AG or its Subsidiaries legitimate interest in theeffective processing of your query (see Art. 6 para. 1 lit. f) GDPR). The company of the Leica Camera
Group contacted by you is responsible for this processing.
Your queries will be deleted as soon as they are no longer required for the purpose for which they were
made. This is the case if your query has been fully processed by the respective company of the Leica
Camera Group.
Please note: If you submitted your report anonymously via the Whistleblowing System and subsequently contact us with questions regarding the Whistleblowing System, or data protection
you may lose your anonymity with regards to your report if your subsequent enquiry can beassociated with it.
12

Cookies and similar technologies

On the website of the Whistleblowing System, Leica Camera AG uses ‘cookies’ in order to offer certain
functions of the Whistleblowing System. Cookies are small files that are saved on your end device using
your internet browser. We use local storage as a similar technology. In this case, data is stored locallyin the cache of your browser. This data is also retained and can be read after closing the browser window10

or exiting the program – provided you do not delete the cache (this data is hereinafter collectively referred to as “Cookies and Similar Technologies”).
Leica Camera AG only uses Cookies and Similar Technologies that are absolutely necessary for theoperation and functionality of the Whistleblowing System website. These help make the website technically accessible and usable and offer essential and basic functionalities, e.g., the Cookies and Similar
Technologies guarantee that the Whistleblowing System is protected against attacks, enable navigationof the website, and allow access to secure areas of the site.
Leica Camera AG uses essential cookies without your consent on the basis of Section 25 para. 2 no. 2of the German Telecommunications-Telemedia Data Protection Act (TTDSG). Where personal datafrom these cookies is processed, the processing is performed in order to ensure that the website of the
Whistleblowing System and the associated functions are usable, as well as to ensure the security of thewebsite. This also constitutes the legitimate interest of Leica Camera AG (see Art. 6 para. 1 lit. f) GDPR).
Personal data is deleted at the end of each day. It is not possible to identify the whistleblower using thisdata. Furthermore, the data is not merged in order to identify the whistleblower.
In the event that cookies or similar technologies beyond this are used, you have full control over them
via the cookie consent manager on the Whistleblowing System website.
13

Providing your data

As a whistleblower, you are neither legally nor contractually obliged to provide your personal data. Instead, you can submit your report anonymously.
Please note:
If you specify your email address at the end of the reporting process or provide information that allows
conclusions to be drawn about your person during another part of the reporting process, your report is
no longer anonymous. Also remember that conclusions about your person can not only be enabledthrough your email address and name, but also in other ways. For example, this can be the case if you
are a possible witness to a process, e.g., due to your position in the respective company of the Leica
Camera Group, your physical presence or a special access authorization.
In individual cases, the removal of all information that enables conclusions to be drawn about your person can therefore make it impossible, or only possible to a limited extent, to follow up an incident reported by you. In this case, you will be asked to provide further information via the Whistleblowing System. However, you are not obliged to comply with this request.
In other respects, too, whistleblowers or other users are neither legally nor contractually obliged to provide personal data, nor is the provision of this data necessary for concluding a contract.
However, the provision of personal data is necessary to a certain degree so that the functions andcontents of the Whistleblowing System can be provided for you and in order to receive and process
queries. Where your personal data is not disclosed, this is only possible to a limited extent or not at all.
14

Origin of the data

If you are named in a report as an accused person, a witness or a third party or if conclusions can be
drawn about your person as a result of a report, Leica Camera AG receives your personal data from the11whistleblowers. The categories of personal data about you that are processed are specified in section 7.2.
In the case of reports concerning a Subsidiary, the Forensic Team of Deloitte and Leica Camera AG
provide the affected Subsidiary with the following:•

The aforementioned personal data of the whistleblowers, accused persons, witnesses and third
parties•

Additional information and findings in this regard that are obtained during the course of theinvestigation

In these circumstances, Leica Camera AG also receives personal data from additional information andfindings that are obtained during the course of the investigation and are provided by the affected Subsidiary and the Forensic Team of Deloitte.
15

Sharing your data

Beyond the sharing of your data described in this Privacy Policy, your data is only shared to the following
extent:a)

In exceptional cases, Leica Camera AG and/or the affected Subsidiaries may be obliged
to collaborate with public authorities, in particular law enforcement agencies, tax authorities or regulatory supervisory authorities. The legal basis for data processing in thiscontext is our compliance with our legal obligations (see Art. 6 para. 1 lit. c) GDPR).

b)

In addition, Leica Camera AG and the affected Subsidiaries share your data with publicauthorities (in particular law enforcement agencies, tax authorities or regulatory supervisory authorities), courts (within the scope of (pre-)trial proceedings) and external consultants (e.g., lawyers) for the following purposes:•

For law enforcement, hazard prevention or prosecution if there is specific evidenceof crimes•

To provide proof and assert, exercise or defend against claims

The data is processed on the basis of the legitimate interests specified above (see Art. 6
para. 1 lit. f) GDPR).
In the event of criminal acts or serious breaches of duty by employees in relation to theemployment relationship, the legal basis for the sharing of personal data of employeesc)•of Leica Camera AG by Leica Camera AG or of the German Subsidiaries by theaffected Subsidiary is Section 26 para. 1 sentence 2 BDSG.

•

of the affected Subsidiary outside Germany by this Subsidiary is specified in Annex 1.

Your personal data can also be shared if Leica Camera AG and/or the affected Subsidiaries are subject to other claims from third parties that include access to your data. In
particular, these can be claims of data subjects within the scope of the granting of theirrights in accordance with Chapter III GDPR. Provision of data that enables conclusions

12

to be drawn as to the identity of whistleblowers only takes place following a carefulbalancing of interests and only where the interests of the whistleblowers do not override
the interests of the requesting person.
d)Personal data is also exchanged if you assert your rights as a data subject vis-à-vis
Leica Camera AG and/or the Subsidiaries and these are jointly responsible for the processing of your personal data. This exchange is necessary in order for Leica Camera
AG and the Subsidiaries to implement your rights to their full extent. The legal basis forthis is our compliance with our legal obligations (see Art. 6 para. 1 lit. c) GDPR in conjunction with Art. 15 to 21 GDPR).

e)

Leica Camera AG and the affected Subsidiaries rely on contractually bound third-party
companies and external service providers, known as “processors” (see Art. 4 no. 8 andArt. 28 GDPR), for the processing of the reports and the associated processes and investigations. In such cases, personal data is shared to these processors in order that
Leica Camera AG and its Subsidiaries can receive their services. These processors
only process personal data in accordance with our instructions.
In addition to the processors already named in this Privacy Policy, Leica Camera AG
and the affected Subsidiaries deploy the following categories of processor:

16•

IT service providers•

Cloud service providers•

Software service providers

Your rights

In certain circumstances, you have the rights described below in relation to the processing of your personal data. You can assert your rights by sending a request by post or email to the addresses specified
in section 1.
Please note: If you submitted your report anonymously via the Whistleblowing System and subsequently contact us to assert your rights, you may lose your anonymity with regards to yourreport if your subsequent enquiry can be associated with it.
16.1

Right of access

You have the right to access the personal data concerning you that is being processed by Leica Camera
AG and/or the Subsidiaries at any time upon request within the scope of Art. 15 GDPR.
16.2

Right to rectification of inaccurate data

You have the right to request that we immediately rectify personal data about you, should this data beinaccurate.
16.3

Right to erasure

In accordance with Art. 17 GDPR, you have the right to request the erasure of the personal data concerning you.

13

16.4

Right to restriction of processing

You have the right to request the restriction of processing as per Art. 18 GDPR.
16.5

Right to object

You have the right to object to the processing of personal data concerning you (see Art. 21
GDPR, if the processing based on Art. 6 para. 1 lit. e) or f) GDPR), at any time on grounds relating
to your particular situation. The processing of your personal data will then cease, unless wehave compelling legitimate grounds to continue the processing that override your interests,
rights and freedoms, or the processing is for the assertion, exercise or defense of legal claims.
16.6

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority of your choice.
16.7

Data processing when exercising your rights

The personal data provided by you when exercising your rights (as per Art. 15 to 21 GDPR) will beprocessed for the purpose of implementing these rights, providing verification hereof and, if applicable,
defending legal positions. In this context, your data will be stored for three years as of the complete
fulfilment of your rights as a data subject.
Leica Camera AG, jointly with the Subsidiaries, is responsible for processing for the fulfilment of yourrights.
The legal basis for this processing is our compliance with our legal obligations (see Art. 6 para. 1 lit. c)
GDPR in conjunction with Art. 15 to 21 GDPR). If the personal data is processed for purposes relating
to legal defense, this also constitutes a legitimate interest (as per Art. 6 para. 1 lit. f) GDPR).
You are neither contractually nor legally obliged to provide your personal data; however, the fulfilmentof your request to exercise your rights as a data subject can be rejected (as per Art. 12 para. 2 sentence 2 GDPR) if you do not provide the data required to identify you (after being requested to do so, if
applicable).

14

Annex 1
Name / contact details of the Subsidiary / data protection officer if
applicable

Processing step

Legal basis

Leica - Aparelhos Ópticos de Precisão S.A.

Processing of personal data of the whistleblowers andother persons (in particular other accused persons or
witnesses) – see section 8.1 and 8.3

Art. 6 para. 1 lit. f) GDPR

Processing of personal data of accused employees of
the Subsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship, see section 8.1 and 8.3

Art. 6 para. 1 lit. f) GDPR

Processing of personal data of accused employees of
the Subsidiary in the event of other violations, see section 8.1 and 8.3

Art. 6 para. 1 lit. f) GDPR

Transfer of personal data of accused employees of theSubsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship to:Art. 6 para. 1 lit. f) GDPR

Rua da Leica 55, 4760-810 Lousado, Vila Nova de Famalicão
Portugal
Personal/confidential
Local Compliance Representative
Email address: vitor.freitas@leica-camera.com•

Deloitte•

Leica Camera AG– see section 8.2 and 8.3

15.

Transfer of personal data of accused employees of theSubsidiary in the event of other violations to:•

Deloitte•

Leica Camera AG

Art. 6 para. 1 lit. f) GDPR

– see section 8.2 and 8.3

Leica Camera Comercial, Unipessoal, LDA
Rua de Sá Bandeira 48/52, 4000-427 Porto
Portugal
Personal/confidential
Local Compliance Representative
Email address: Paulo.Silveira@leica-camera.com

Legal basis for processing the personal data of whistleblowers and witnesses (including its transfer to Deloitteand Leica Camera AG) within the scope of follow-up
measures – see section 8.1 and 8.2

Art. 6 para. 1 lit. f) GDPR

Processing within the scope of malicious reports – seesection 10.2

Art. 6 para. 1 lit. f) GDPR

Processing of personal data of the whistleblowers andother persons (in particular other accused persons or
witnesses) – see section 8.1 and 8.3

Art. 6 para. 1 lit. f) GDPR

Processing of personal data of accused employees of
the Subsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship, see section 8.1 and 8.3

Art. 6 para. 1 lit. f) GDPR

Processing of personal data of accused employees of
the Subsidiary in the event of other violations, see section 8.1 and 8.3

Art. 6 para. 1 lit. f) GDPR

16

Transfer of personal data of accused employees of theSubsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship to:•

Deloitte•

Leica Camera AG

Art. 6 para. 1 lit. f) GDPR

– see section 8.2 and 8.3
Transfer of personal data of accused employees of theSubsidiary in the event of other violations to:•

Deloitte•

Leica Camera AG

Art. 6 para. 1 lit. f) GDPR

– see section 8.2 and 8.3

Leica Camera SARL
134 Rue du Faubourg Saint-Honoré, 75008 Paris
FranceLegal basis for processing the personal data of whistleblowers and witnesses (including its transfer to Deloitteand Leica Camera AG) within the scope of follow-up
measures – see section 8.1 and 8.2

Art. 6 para. 1 lit. f) GDPR

Processing within the scope of malicious reports – seesection 10.2

Art. 6 para. 1 lit. f) GDPR

Processing of personal data of the whistleblowers andother persons (in particular other accused persons or
witnesses) – see section 8.1 and 8.3

Art. 6 para. 1 lit. f) GDPR

Processing of personal data of accused employees of
the Subsidiary in the event of criminal acts or severe

Art. 6 para. 1 lit. f) GDPR

17

Personal/confidential
Local Compliance Representative
Email address: Cyril.Thomas@leica-camera.com

breaches of duty in relation to the employment relationship, see section 8.1 and 8.3
Processing of personal data of accused employees of
the Subsidiary in the event of other violations, see section 8.1 and 8.3

Art. 6 para. 1 lit. f) GDPR

Transfer of personal data of accused employees of theSubsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship to:Art. 6 para. 1 lit. f) GDPR•

Deloitte•

Leica Camera AG– see section 8.2 and 8.3
Transfer of personal data of accused employees of theSubsidiary in the event of other violations to:•

Deloitte•

Leica Camera AG

Art. 6 para. 1 lit. f) GDPR

– see section 8.2 and 8.3
Legal basis for processing the personal data of whistleblowers and witnesses (including its transfer to Deloitteand Leica Camera AG) within the scope of follow-up
measures – see section 8.1 and 8.2

Art. 6 para. 1 lit. f) GDPR

Processing within the scope of malicious reports – seesection 10.2

Art. 6 para. 1 lit. f) GDPR

18

Leica Camera Italia S.r.l.
Via Mengoni 4, 20121 Milano
Italy
Personal/confidential
Local Compliance Representative
Email address: Vanessa.Bernocchi@leica-camera.com

Processing of personal data of the whistleblowers andother persons (in particular other accused persons or
witnesses) – see section 8.1 and 8.3

Art. 6 para. 1 lit. f) GDPR

Processing of personal data of accused employees of
the Subsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship, see section 8.1 and 8.3

Art. 6 para. 1 lit. f) GDPR

Processing of personal data of accused employees of
the Subsidiary in the event of other violations, see section 8.1 and 8.3

Art. 6 para. 1 lit. f) GDPR

Transfer of personal data of accused employees of theSubsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship to:Art. 6 para. 1 lit. f) GDPR•

Deloitte•

Leica Camera AG– see section 8.2 and 8.3
Transfer of personal data of accused employees of theSubsidiary in the event of other violations to:•

Deloitte•

Leica Camera AG– see section 8.2 and 8.3

19Art. 6 para. 1 lit. f) GDPR

Leica Smart Projection GmbHAm Leitz-Park 5, 35578 Wetzlar
Germany
Personal/confidential
Local Compliance Representative
Email address: stephan.albrecht@leica-camera.com

Legal basis for processing the personal data of whistleblowers and witnesses (including its transfer to Deloitteand Leica Camera AG) within the scope of follow-up
measures – see section 8.1 and 8.2

Art. 6 para. 1 lit. f) GDPR

Processing within the scope of malicious reports – seesection 10.2

Art. 6 para. 1 lit. f) GDPR

Processing of personal data of the whistleblowers andother persons (in particular other accused persons or
witnesses) – see section 8.1 and 8.3

see privacy policy

Processing of personal data of accused employees of
the Subsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship, see section 8.1 and 8.3

see privacy policy

Processing of personal data of accused employees of
the Subsidiary in the event of other violations, see section 8.1 and 8.3

see privacy policy

Transfer of personal data of accused employees of theSubsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship to:see privacy policy•

Deloitte•

Leica Camera AG– see section 8.2 and 8.3

20

Transfer of personal data of accused employees of theSubsidiary in the event of other violations to:•

Deloitte•

Leica Camera AG

see privacy policy– see section 8.2 and 8.3

LFI - Photographie GmbH
Burchardstraße 14, 20095 Hamburg
Germany
Personal/confidential
Local Compliance Representative
Email address: compliance@lfi-online.deLegal basis for processing the personal data of whistleblowers and witnesses (including its transfer to Deloitteand Leica Camera AG) within the scope of follow-up
measures – see section 8.1 and 8.2

see privacy policy

Processing within the scope of malicious reports – seesection 10.2

see privacy policy

Processing of personal data of the whistleblowers andother persons (in particular other accused persons or
witnesses) – see section 8.1 and 8.3

see privacy policy

Processing of personal data of accused employees of
the Subsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship, see section 8.1 and 8.3

see privacy policy

Processing of personal data of accused employees of
the Subsidiary in the event of other violations, see section 8.1 and 8.3

see privacy policy

Transfer of personal data of accused employees of theSubsidiary in the event of criminal acts or severe

see privacy policy

21

breaches of duty in relation to the employment relationship to:•

Deloitte•

Leica Camera AG– see section 8.2 and 8.3
Transfer of personal data of accused employees of theSubsidiary in the event of other violations to:•

Deloitte•

Leica Camera AG

see privacy policy– see section 8.2 and 8.3

Leica Camera Austria GmbHAnnagasse 5, 1010 Vienna
Austria
Personal/confidential
Local Compliance Representative

Legal basis for processing the personal data of whistleblowers and witnesses (including its transfer to Deloitteand Leica Camera AG) within the scope of follow-up
measures – see section 8.1 and 8.2

see privacy policy

Processing within the scope of malicious reports – seesection 10.2

see privacy policy

Processing of personal data of the whistleblowers andother persons (in particular other accused persons or
witnesses) – see section 8.1 and 8.3

Art. 6 para. 1 lit. f) GDPR

Processing of personal data of accused employees of
the Subsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship, see section 8.1 and 8.3

Art. 6 para. 1 lit. f) GDPR

22

Email address: Alexander.Sedlak@leica-camera.com

Processing of personal data of accused employees of
the Subsidiary in the event of other violations, see section 8.1 and 8.3

Art. 6 para. 1 lit. f) GDPR

Transfer of personal data of accused employees of theSubsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship to:Art. 6 para. 1 lit. f) GDPR•

Deloitte•

Leica Camera AG– see section 8.2 and 8.3
Transfer of personal data of accused employees of theSubsidiary in the event of other violations to:•

Deloitte•

Leica Camera AG

Art. 6 para. 1 lit. f) GDPR

– see section 8.2 and 8.3
Legal basis for processing the personal data of whistleblowers and witnesses (including its transfer to Deloitteand Leica Camera AG) within the scope of follow-up
measures – see section 8.1 and 8.2

Art. 6 para. 1 lit. f) GDPR

Processing within the scope of malicious reports – seesection 10.2

Art. 6 para. 1 lit. f) GDPR

23

Leica Camera Deutschland GmbHAm Leitz-Park 5, 35578 Wetzlar
Germany
Personal/confidential
Local Compliance Representative
Email address: tim.habermehl@leica-camera.com

Processing of personal data of the whistleblowers andother persons (in particular other accused persons or
witnesses) – see section 8.1 and 8.3

see privacy policy

Processing of personal data of accused employees of
the Subsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship, see section 8.1 and 8.3

see privacy policy

Processing of personal data of accused employees of
the Subsidiary in the event of other violations, see section 8.1 and 8.3

see privacy policy

Transfer of personal data of accused employees of theSubsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship to:see privacy policy•

Deloitte•

Leica Camera AG– see section 8.2 and 8.3
Transfer of personal data of accused employees of theSubsidiary in the event of other violations to:•

Deloitte•

Leica Camera AG– see section 8.2 and 8.3

24

see privacy policy

Leica Camera Iberia S.L.
Calle de José Ortega y Gasset nº34, 28006, Madrid,
Spain
Personal/confidential
Local Compliance Representative
Email address: compliance.es@leica-camera.com

Legal basis for processing the personal data of whistleblowers and witnesses (including its transfer to Deloitteand Leica Camera AG) within the scope of follow-up
measures – see section 8.1 and 8.2

see privacy policy

Processing within the scope of malicious reports – seesection 10.2

see privacy policy

Processing of personal data of the whistleblowers andother persons (in particular other accused persons or
witnesses) – see section 8.1 and 8.3

Art. 6 para. 1 lit. f) GDPR

Processing of personal data of accused employees of
the Subsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship, see section 8.1 and 8.3

Art. 6 para. 1 lit. f) GDPR

Processing of personal data of accused employees of
the Subsidiary in the event of other violations, see section 8.1 and 8.3

Art. 6 para. 1 lit. f) GDPR

Transfer of personal data of accused employees of theSubsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship to:Art. 6 para. 1 lit. f) GDPR•

Deloitte•

Leica Camera AG– see section 8.2 and 8.3

25

Transfer of personal data of accused employees of theSubsidiary in the event of other violations to:•

Deloitte•

Leica Camera AG

Art. 6 para. 1 lit. f) GDPR

– see section 8.2 and 8.3

Leitz-Park Marketing GmbHAm Leitz-Park 6, 35578 Wetzlar
Germany
Personal/confidential
Local Compliance Representative
Email address: Tim.Pullmann@leica-camera.com

Legal basis for processing the personal data of whistleblowers and witnesses (including its transfer to Deloitteand Leica Camera AG) within the scope of follow-up
measures – see section 8.1 and 8.2

Art. 6 para. 1 lit. f) GDPR

Processing within the scope of malicious reports – seesection 10.2

Art. 6 para. 1 lit. f) GDPR

Processing of personal data of the whistleblowers andother persons (in particular other accused persons or
witnesses) – see section 8.1 and 8.3

see privacy policy

Processing of personal data of accused employees of
the Subsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship, see section 8.1 and 8.3

see privacy policy

Processing of personal data of accused employees of
the Subsidiary in the event of other violations, see section 8.1 and 8.3

see privacy policy

Transfer of personal data of accused employees of theSubsidiary in the event of criminal acts or severe

see privacy policy

26breaches of duty in relation to the employment relationship to:•

Deloitte•

Leica Camera AG– see section 8.2 and 8.3
Transfer of personal data of accused employees of theSubsidiary in the event of other violations to:•

Deloitte•

Leica Camera AG

see privacy policy– see section 8.2 and 8.3

Leica Eyecare GmbHAm Leitz-Park 5, 35578 Wetzlar

Legal basis for processing the personal data of whistleblowers and witnesses (including its transfer to Deloitteand Leica Camera AG) within the scope of follow-up
measures – see section 8.1 and 8.2

see privacy policy

Processing within the scope of malicious reports – seesection 10.2

see privacy policy

Processing of personal data of the whistleblowers andother persons (in particular other accused persons or
witnesses) – see section 8.1 and 8.3

see privacy policy

27Germany
Personal/confidential
Local Compliance Representative
Email address: compliance@leica-eyecare.com

Processing of personal data of accused employees of
the Subsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship, see section 8.1 and 8.3

see privacy policy

Processing of personal data of accused employees of
the Subsidiary in the event of other violations, see section 8.1 and 8.3

see privacy policy

Transfer of personal data of accused employees of theSubsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship to:see privacy policy•

Deloitte•

Leica Camera AG– see section 8.2 and 8.3
Transfer of personal data of accused employees of theSubsidiary in the event of other violations to:•

Deloitte•

Leica Camera AG

see privacy policy– see section 8.2 and 8.3
Legal basis for processing the personal data of whistleblowers and witnesses (including its transfer to Deloitteand Leica Camera AG) within the scope of follow-up
measures – see section 8.1 and 8.2

28

see privacy policy

Leica Camera Classics GmbH
Westbahnstraße 40
1070 Vienna
Austria
Personal/confidential
Local Compliance Representative
Email address: Alexander.Sedlak@leica-camera.com

Processing within the scope of malicious reports – seesection 10.2

see privacy policy

Processing of personal data of the whistleblowers andother persons (in particular other accused persons or
witnesses) – see section 8.1 and 8.3

Art. 6 para. 1 lit. f) GDPR

Processing of personal data of accused employees of
the Subsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship, see section 8.1 and 8.3

Art. 6 para. 1 lit. f) GDPR

Processing of personal data of accused employees of
the Subsidiary in the event of other violations, see section 8.1 and 8.3

Art. 6 para. 1 lit. f) GDPR

Transfer of personal data of accused employees of theSubsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship to:Art. 6 para. 1 lit. f) GDPR•

Deloitte•

Leica Camera AG– see section 8.2 and 8.3
Transfer of personal data of accused employees of theSubsidiary in the event of other violations to:29•

Deloitte•

Leica Camera AG

Art. 6 para. 1 lit. f) GDPR

– see section 8.2 and 8.3

Leica Camera Ltd.
6-8 James Street Marylebone
London, W1U 1ED
United Kingdom
Personal/confidential
Local Compliance Representative
Email address: tatiana.devyaterikova@leica-camera.com

Legal basis for processing the personal data of whistleblowers and witnesses (including its transfer to Deloitteand Leica Camera AG) within the scope of follow-up
measures – see section 8.1 and 8.2

Art. 6 para. 1 lit. f) GDPR

Processing within the scope of malicious reports – seesection 10.2

Art. 6 para. 1 lit. f) GDPR

Processing of personal data of the whistleblowers andother persons (in particular other accused persons or
witnesses) – see section 8.1 and 8.3

Art. 6 para. 1 lit. f) UK GDPR

Processing of personal data of accused employees of
the Subsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship, see section 8.1 and 8.3

Art. 6 para. 1 lit. f) UK GDPR; andSection 10 of Part 2 to Schedule
1 of the Data Protection Act 2018

Processing of personal data of accused employees of
the Subsidiary in the event of other violations, see section 8.1 and 8.3

Art. 6 para. 1 lit. f) UK GDPR

Transfer of personal data of accused employees of theSubsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship to:Art. 6 para. 1 lit. f) UK GDPR; andSection 10 of Part 2 to Schedule
1 of the Data Protection Act 2018•

Deloitte•

Leica Camera AG– see section 8.2 and 8.3

30

Transfer of personal data of accused employees of theSubsidiary in the event of other violations to:•

Deloitte•

Leica Camera AG

Art. 6 para. 1 lit. f) UK GDPR

– see section 8.2 and 8.3

Ernst Leitz Werkstätten GmbHAm Leitz-Park 4, 35578 Wetzlar
Germany
Personal/confidential
Local Compliance Representative
Email address: d.blunschi@ernst-leitz-werkstaetten.com

Legal basis for processing the personal data of whistleblowers and witnesses (including its transfer to Deloitteand Leica Camera AG) within the scope of follow-up
measures – see section 8.1 and 8.2

Art. 6 para. 1 lit. f) UK GDPR

Processing within the scope of malicious reports – seesection 10.2

Art. 6 para. 1 lit. f) UK GDPR

Processing of personal data of the whistleblowers andother persons (in particular other accused persons or
witnesses) – see section 8.1 and 8.3

see privacy policy

Processing of personal data of accused employees of
the Subsidiary in the event of criminal acts or severe
breaches of duty in relation to the employment relationship, see section 8.1 and 8.3

see privacy policy

Processing of personal data of accused employees of
the Subsidiary in the event of other violations, see section 8.1 and 8.3

see privacy policy

Transfer of personal data of accused employees of theSubsidiary in the event of criminal acts or severe

see privacy policy

31breaches of duty in relation to the employment relationship to:•

Deloitte•

Leica Camera AG– see section 8.2 and 8.3
Transfer of personal data of accused employees of theSubsidiary in the event of other violations to:•

Deloitte•

Leica Camera AG

see privacy policy– see section 8.2 and 8.3
Legal basis for processing the personal data of whistleblowers and witnesses (including its transfer to Deloitteand Leica Camera AG) within the scope of follow-up
measures – see section 8.1 and 8.2

see privacy policy

Processing within the scope of malicious reports – seesection 10.2

see privacy policy

32