Complaints handling policy
Information on the internal abuse reporting system
prepared in order to fulfil the information obligation of Hévíz Palace Hotel Kft. (registered office: 8380 Hévíz, Rákóczi u. 1-3.) as an employer under Article 25 of Act XXV of 2023 on Complaints, Public Interest Disclosures and Rules for Reporting Misconduct (hereinafter referred to as the Complaints Act).
1. Subject of the notifications
Information concerning unlawful or suspected unlawful acts or omissions, or other forms of abuse, may be reported to the internal abuse reporting system established by the employer.
Examples of the types of abuse that may be reported include, but are not limited to:
- workplace abuse: fraud, money laundering, bribery, kickbacks,
- retaliation at work, termination of employment, withholding of pay, undeclared work, forced labour,
- unsafe working conditions or environmental damage,
- harassment, discrimination, racism, sexual harassment, threats, intimidation,
- unfair competition,
- unfair contract terms,
- breach of a trade or professional secret.
2. Persons entitled to make a complaint
The persons entitled to lodge a complaint are defined in Article 20 (2-3) of the Complaints Act. According to these provisions, persons entitled to lodge a complaint include, for example, employees, former employees, members of the employer’s staff, contractors, subcontractors, suppliers or persons under the control of a contractor, subcontractors, suppliers or agents, trainees and volunteers working for the employer.
3. Making the declaration
The notifier may make the notification in writing or orally. An oral notification may be made by telephone or in person using the contact details in point 9.
4. Investigation or non-investigation of the notification
The employer shall investigate the allegations made in the notification as soon as possible, but not later than 30 days after receipt of the notification. The 30-day time limit may be extended in particularly justified cases, provided that the notifier is informed at the same time.
The employer may refrain from investigating the notification if
- (a) the notification was made by an unidentified notifier,
- (b) the notification was not made by an authorised person,
- (c) the notification is a repeat notification from the same notifier with the same content as the previous notification; or
- (d) the harm to the public interest or to an overriding private interest would not be proportionate to the restriction of the rights of the natural or legal person concerned by the notification resulting from the examination of the notification.
5. Measures to remedy abuses
In the course of investigating the notification, the employer must examine and assess the relevance of the facts set out in the notification and take measures to remedy the reported abuses.
6. Information to the notifier following notification
The whistleblower protection officer shall inform the whistleblower in writing of the investigation of the notification or the decision not to investigate the notification and the reasons for the decision not to investigate, the outcome of the investigation of the notification, and the action taken or planned. The written information may be waived if the whistleblower has been informed orally by the operator of the internal whistleblowing system and has taken note of the information.
7. Data management rules
The identity of the whistleblower, if they provide the information necessary to establish it, shall be kept confidential at all stages of the investigation. A separate privacy notice has been prepared by the employer on the handling of personal data processed in an internal abuse report.
8. Protection of whistleblowers
The protection of whistleblowers is governed by Articles 41-49 of the Complaints Act. According to these, any measure which is detrimental to the whistleblower and which is taken as a result of the lawful making of a report and which is taken in connection with the whistleblower’s legal relationship or connection with the whistleblower is unlawful, even if it would otherwise be lawful.
The rights for the protection of whistleblowers only apply to a notification that is made lawfully and in good faith. A whistleblower acting in bad faith is not entitled to the whistleblower protection rights under the Complaints Act. A whistleblower report cannot constitute a crime or an offence. When making a whistleblowing report, the whistleblower must observe the rules on defamation and libel.
The whistleblower protection officer
The Employer’s internal whistleblowing system is operated by László Szabó.
Receiving whistleblowers
Via the whistleblowing system: https://platform.crespo.hu/form?fktu7sgt=3e70a575-09a5-433b-a814-8f307e001b8e
In person: 8380 Hévíz, Rákóczi u. 1-3., by prior arrangement on 06 83 542 140
By post: 8380 Hévíz, Rákóczi u. 1-3.
By e-mail: panaszbejelentes@palacehotelheviz.hu
Hévíz, 10 December 2023.
Hévíz Palace Hotel Ltd.
DATA MANAGEMENT INFORMATION
on the operation of the whistleblowing system
1. Name, location of the data controller / Representative of the data controller
Hévízi Palace Hotel Ltd.
Registered office.
Legal representative: Edina Pémer, Managing Director
2. Data Protection Officer
László Szabó – szabolaszlo411@gmail.com
3. Definition of the data processed
- The data provided by the whistleblower, information about an unlawful or suspected unlawful act or omission or other misuse, may be reported to the abuse reporting system. The internal abuse reporting system shall process the personal data of the whistleblower and the personal data of the person whose conduct or omission gave rise to the report and who has relevant information in relation to the report. All other personal data not covered by the foregoing shall be deleted from the notification system without delay.
4. Purpose and length of time for data processing
The purpose of the processing is: solely to investigate the notification and to remedy or stop the conduct which is the subject of the notification.
Duration of processing: the data will be retained until the purpose specified above has been met.
5.
To fulfil a legal obligation. [Article 6(1)(c) GDPR] The controller is obliged to investigate and process the notification pursuant to Act XXV of 2023 on complaints, notifications of public interest and rules relating to the notification of abuse.
6.
- No processing will take place.
7. Data transmission, recipients
Recipients: the personal data of the notifier may only be transferred to the public body or authority competent to conduct the procedure initiated on the basis of the notification, if such public body or authority is entitled to process the data by law or if the notifier has consented to the transfer of the data. The personal data of the notifier shall not be disclosed without his/her consent. If it has become apparent that the notifier has communicated false data or information in bad faith, his or her personal data shall be disclosed in accordance with the procedure to the body or person entitled to initiate or conduct the relevant proceedings.
No transfer shall be made to a third country or international organisation.
8. Legal basis for the transfer
- consent of the data subject
9. Length of time for which personal data will be stored
- The data will be processed until the data subject’s authorisation is withdrawn. The newsletter can be unsubscribed from at the bottom of each newsletter, which also means that the data subject requests the deletion of their e-mail address.
10. Information concerning the rights of the notifier
The data subject has the right to,
- to be informed by the controller as to whether or not their personal data are being processed and, where that is the case, to have the right to access the personal data.
- to obtain, at his or her request and without undue delay, the rectification by the controller of inaccurate personal data relating to him or her.
- on his or her request, the controller to erase without undue delay personal data relating to him or her and the controller to erase without undue delay personal data relating to him or her where other conditions are met
- at the controller’s request, the controller shall restrict processing where o the data subject contests the accuracy of the personal data,/the restriction shall last until the controller verifies the accuracy of the personal data,/
- the processing is unlawful and the data subject opposes the erasure of the data and requests instead the restriction of their use;
- the controller no longer requires the personal data, but the data subject requests it for the establishment, exercise or defence of legal claims.
- the data subject has objected to the processing; in this case, the restriction shall apply for a period of time until it is established whether the legitimate grounds of the controller override the legitimate grounds of the data subject.
- to receive personal data relating to him or her which he or she has provided to the controller in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance from the controller to which he or she has provided the personal data, where the processing is based on voluntary consent or on a contract and is carried out by automated means.
- Where the processing of personal data is carried out for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning him or her for such purposes, including profiling, where it is related to direct marketing.
- shall not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
11. Information on profiling and automated decision-making
- no profiling or automated decision-making takes place
12. Data storage, data security
The data controller and the organisation acting as a data processor shall store the data on its own computer equipment located at its headquarters or, in the case of a data processor, in a rented server park. The data controller and the data processor shall select and operate the IT tools they use in such a way that the data processed are accessible to those authorised to access them, their authenticity and authentication are guaranteed, their integrity is verifiable and they are protected against unauthorised access. The data shall be protected against unauthorised access, alteration, disclosure, transmission, erasure or destruction and against accidental destruction or accidental damage or loss, and against inaccessibility resulting from changes in the technology used, by ensuring that the controller ensures the security of processing by technical, organisational and organisational measures which, having regard to the state of the art, provide a level of protection appropriate to the risks associated with the processing.
13. Right of recourse to public authorities:
The data subject may bring proceedings against the controller before a court of a Member State in the event of an infringement of his or her rights. At the data subject’s option, such proceedings may be brought before a court of the place of residence or domicile of the data subject. The court shall hear such a case at an expedited procedure.
Legal remedies and complaints may be lodged with the National Authority for Data Protection and Freedom of Information: Name: National Authority for Data Protection and Freedom of Information Headquarters: 1125 Budapest, Szilágyi Erzsébet fasor 22/C. Postal address: 1530 Budapest, Pf.: 5.
