Data protection information of the Compliance Reporting Office

Toll Collect GmbH collects and processes your personal data in connection with the operation of a reporting centre under the following conditions.

The controller for the processing of personal data for the registration office within the meaning of the GDPR is

Toll Collect GmbH
Linkstr. 4
10785 Berlin
Telefon: +49 30 74077-0
Fax: +49 30 74077-2222

The data protection officer of Toll Collect can be contacted at:

A whistleblower system has been set up to receive and process information from both Toll Collect employees and external parties regarding grievances, legal violations or impending claims against Toll Collect GmbH.

The processing of the associated personal data through the submission and further processing of information from Toll Collect employees is based on Art. 6 para. 1 lit. c GDPR in conjunction with Sections 10 para. 1, 13 para. 1 Whistleblower Protection Act (HinSchG). If there are indications of possible criminal offences by a Toll Collect employee, the processing of personal data in connection with further processing is based on Section 26 (1) para. 2 German Federal Data Protection Act (BDSG).

If external parties decide to disclose their identity when submitting information, the processing of the identification data of the person submitting the information is based on their consent in accordance with Art. 6 para. 1 lit. a GDPR. The further processing of information from external parties is based on Art. 6 para. 1 lit. f GDPR. The legitimate interest pursued is the possibility of preventing and prosecuting criminal behaviour.

When a report is submitted, Toll Collect GmbH generally collects the following information, unless the report was submitted anonymously:

• Identification and communication data of the whistleblower
• Employment status in the Toll Collect Group
• Names and other personal data mentioned in the notification

Access to the report is restricted to a very narrow circle of expressly authorised Toll Collect GmbH employees and the data is treated confidentially. There is no protection of confidentiality if whistleblowers intentionally or through gross negligence report incorrect information about an offence or wish to discredit persons.

In certain cases, there is an obligation under data protection law to inform the accused person of the allegations made against them. Their identity as the person providing the information or conclusions about their identity will not be disclosed as far as legally possible.

Personal data may be passed on to external bodies if there is a legal obligation to do so or if it is necessary to clarify the report. These include law enforcement and administrative authorities, courts, law firms and auditing companies.

Personal data is not transferred to third countries or international organisations.

Toll Collect only your personal data stores for as long as is permissible under data protection law. The documentation of a report is deleted three years after the conclusion of the procedure in accordance with Section 11 (5) of the Whistleblower Protection Act (HinSchG). The documentation may be kept for longer to fulfil the requirements of the HinSchG or other legislation as long as this is necessary and proportionate.

You have the following rights vis-à-vis us with regard to your personal data:

1. Right to information,

2. Right to rectification,

3. Right to erasure ("right to be forgotten"),

4. Right to restriction of processing,

5. Right to object to the processing,

6. Right to data portability.

You can revoke your consent at any time. The withdrawal of consent when submitting the report may only be possible within one month, as Toll Collect is obliged in certain cases to inform the accused person about the allegations and the investigation carried out within one month in accordance with Art. 14 para. 3 lit. a GDPR. It is then no longer possible to delete or stop data processing. The revocation period may be shortened if the nature of the notification requires the immediate involvement of an authority or a court. The identification data can then be found in the files of the authority or court in addition to the case file at Toll Collect GmbH.

You have the right to file a complaint with a data protection supervisory authority regarding the processing of your personal data by Toll Collect.

You are not obliged to provide us with any information. However, without the processing of certain personal data, it may not be possible to process some information.

Automated decision-making within the meaning of Art. 22 GDPR is not used.

Please direct any further questions about the processing of your personal data to: