PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA
pursuant to art. 13 of Law no. 124/2024 On Personal Data Protection
("Data Protection Law")
Dompé Albania SH.P.K., in its capacity as "Data Controller", (hereinafter "Dompé Albania", "Company" or "Data Controller"), wishes to inform the data subjects on how the personal information contained in the whistleblowing report is collected through a platform (hereinafter the "Platform"), both via telephone line and online, at the disposal of Dompé Albania employees and third parties (e.g. contractors, consultants, suppliers, etc.) in order to report any suspected unlawful conduct, irregularities and/or violations related to business activities specified in Dompé Albania's Code of Conduct, policies, procedures, laws and regulations and on how the personal information collected is processed by Dompé Albania.
Data Controller: Dompé Albania SH.P.K., with registered office in Arena Center, Entrance D, Floor 6, Unit D1/L6, Italia Square, Tirana (Albania), email: privacy@dompe.com.
Data Controller’s point of contact is Mrs. Aida Iljazi, who can be contacted by email at aida.iljazi@dompe.com
Categories of personal data
Personal data are contained in the report and in any documents attached thereto, and may relate to the whistleblower himself, to the natural persons to whom the alleged unlawful conduct is ascribed and / or other natural persons in any case mentioned in the report or whose identity can be inferred, as well as possibly to other subjects such as the Manager assisting the whistleblower.
Personal data are as follows:
Common data: identifiers (name, surname), contact details (e-mail, telephone number), job role, other elements of personal identification.
Special categories of personal data: data that may reveal racial or ethnic origin, religious or philosophical beliefs, political opinions, membership of parties or trade unions, data relating to health and sex life.
Judicial data: judicial data, such as hypotheses of crime, pending charges, criminal record, integrity requirements, status of suspect/defendant, pending charges of administrative offenses dependent on crime, pursuant to Article 10 Data Protection Law.
Sources of personal data
The data are collected from the whistleblower through the Platform, both the reporting web platform and the telephone channel, by virtue of which the report will be received and transcribed.
Purpose, legal basis of processing and retention period of personal data
1) Reporting management
The processing of personal data will take place to manage the report carried out pursuant to Albanian Law no. 96/2025, and in particular in order to:
- acquiring, receiving and managing reports, including those concerning offences falling within the scope of Albanian Law no. 96/2025, also through the Dompé Internal Committee specifically set up to manage reports and carry out investigations and/or the Supervisory Body;
- carry out the investigation, verification, supervision and in-depth activities necessary to ascertain the validity of the reports, also through collaboration with the competent public authorities where required by law;
- adopt, where necessary, appropriate disciplinary measures and appropriate administrative, civil, criminal and/or judicial action against those responsible for the unlawful conduct;
- carry out the communications and obligations required by the applicable legislation, including those provided for by Albanian Law no. 96/2025;
- guarantee the protection of the whistleblower and other protected persons pursuant to Albanian Law no. 96/2025, in compliance with the confidentiality measures provided for by law.
Legal basis: the processing is necessary to comply with a legal obligation to which the controller is subject (Art. 7.1 (c) Data Protection Law).
The processing of special data is necessary for the purposes of carrying out an obligation or specific right of the controller or of the data subject in the field of employment and social security and social protection, including the rights and obligations deriving from a collective agreement pursuant to applicable law in such areas, provided that fundamental rights and interests of the data subject are guaranteed (Art. 9.2(b) Data Protection Law).
Retention period: Personal Data will be processed for the time strictly necessary to pursue the purposes indicated or required by law. In any case, the storage of such data will not exceed a period of 5 years from the date of communication of the final outcome of the reporting procedure (pursuant to Article 12, Albanian Law no. 96/2025), unless the law or judicial protection requirements impose a longer term.
2) Compliance with legal and regulatory obligations
The data will be processed to meet legal and regulatory obligations.
Legal basis: the processing is necessary to comply with a legal obligation to which the controller is subject (Art. 7.1 (c) Data Protection Law).
Retention period: the data will be retained for the duration specified by the applicable legislation.
3) Establishing and safeguarding the legal interests of the Data Controller both judicially and extrajudicially
Your personal data may be processed when necessary to establish or protect the Data Controller’s rights—both in and out of court.
Legal basis: the processing of personal data is necessary for the purposes of the legitimate interest pursued by the Controller, such as in the possible legal defense of the rights and interests of the Company (art. 7.1 (dh) Data Protection Law).
Retention period: the data will be kept for as long as necessary for the preparation and conduct of legal action, including appeals, until a final ruling is made or the limitation period of the rights and/or actions expires, including any terms provided for in the insurance contracts.
Nature of the provision of data
The provision of this information is optional, as the Platform allows you to send reports anonymously.
If the whistleblower communicates personal data, the Data Controller will process them for the pursuit of the purposes indicated above.
Persons authorised to process
Personal data will be processed, in accordance with Data Protection Law, by authorized personnel of the Company who have been given adequate operating instructions in order to avoid loss, destruction, unauthorized access or unauthorized processing.
Personal data may also be processed by external parties, specifically appointed as data processors, pursuant to Article 26 of Data Protection Law, such as the company that provides and manages the web and telephone platform as well as the database in which the data are stored, consulting firms, suppliers of information systems, companies of the Dompé Group.
Recipients of the data
Your personal data may be communicated to the following categories of third parties, independent data controllers, by virtue of legal obligations or specific contractual agreements in place, such as, by way of example, law firms and public authorities competent in the exercise of their powers.
The updated list of recipients is available upon request to privacy@dompe.com.
Data transfers to foreign Countries
The Data Controller acknowledges that your personal data may be processed by companies of the Dompé Group or by third parties, located in foreign Countries, such as Italy. In such circumstances, the transfer will take place on the basis of the rules established in Chapter IV “International Data Transfer” of Data Protection Law, including through the use of standard contractual clauses.
The updated list of recipients of the data and appropriate safeguards is available upon request to privacy@dompe.com
Rights of Data Subjects
At any time, the interested party may obtain confirmation of the existence or otherwise of the processing of your personal data and to know its content and origin, request its integration or correction or, in the cases provided for by law, portability, limitation of processing, cancellation of processed data, anonymization, as well as to object, for legitimate reasons, to their treatment. To exercise your rights, you can contact privacy@dompe.com
Complaint to the Data Protection Authority
The data subject also has the right to lodge a complaint with the Commissioner for the Right to Information and Personal Data Protection if he/she believes that his/her rights have not been respected or that he/she has not received a response to his/her requests.
