Information about the terms and conditions for internal reporting

This information is provided pursuant to Art. 12, para. 4 of the Act on Protection of Persons, Reporting Information, or Publicly Disclosing Information about Breaches (“APPRIPDIB”).

1. Who has the right to report?

  • current or former employees;
  • persons working under a civil contract;
  • persons exercising free professions or craft activities;
  • volunteers and interns;
  • persons working for our clients, contractors, subcontractors or suppliers;
  • job applicants or participants in competitions for occupying a certain position.
  • all persons who have become aware of information about violations in a work context

NB! Anonymous reports are NOT considered.

2. What violations can you report?

For violations of Bulgarian and European legislation in various areas, including:

  • public procurement;
  • public health;
  • transport safety;
  • consumer protection;
  • the protection of privacy and personal data;
  • the security of networks and information systems;
  • violations related to cross-border tax schemes;
  • committed crime of a general nature;
  • labor legislation;
  • the rules for payment of due public state and municipal receivables, and other areas specified in APPRIPDIB.

NB! Reports of violations that do not fall within the scope of the APPRIPDIB, as well as reports of violations committed more than two years ago, are not considered.

3. How can you report to “TORO GROUPS” OOD?

You can submit a written report by completing a sample form in one of the following ways: 

  • in person – to our employee, responsible for reporting of breaches;
  • electronically by sending it to the following e-mail: signals@torogroups.com
  • by post or by courier service – to the address of “TORO GROUPS” OOD (Sofia, Izgrev district, 26 Dragan Tsankov Blvd.) with the explicit designation as the addressee of the postal/courier shipment of the responsible person under APPRIPDIB or writing on the postal envelope/courier shipment of a text indicating that they contain a signal under APPRIPDIB.

NB! The reports must be signed by the persons submitting them. When submitted electronically, the form is signed with a qualified electronic signature.

NB! The form is NOT mandatory, but is for your convenience and contains the mandatory data that you must fill out. If your report does not meet any of the legal requirements, our employee responsible for reports will send you a notice to remedy the irregularities within 7 days of receiving the report. If the irregularities are not corrected within this period, the signal together with its attachments will be returned to you.

It is a good idea to attach any written evidence you have. Also, you can designate persons who could confirm the reported data or provide additional information.

You can make an oral report in any of the following ways: 

  • on the phone number of our signal officer – 0887500752;
  • in a personal meeting with our signal officer, which you have arranged in advance on the phone number indicated.

In these cases, our signal officer will fill in the data in the template form and give you the opportunity to check, correct and agree to the text of the conversation in writing, as well as the content of the form by signing them.

4. What happens after the report is submitted?

  • We will confirm receipt within 7 days and register it with a unique identification number. If the signal does not meet the requirements of the law, we will notify you to remove the irregularity within 7 days.
  • A review of the report will be conducted by a person who does not have a conflict of interest.
  • Within three months of confirming the receipt of the signal, we will provide you with feedback with the results of the inspection and the actions taken.

5. What protections do whistleblowers have?

  • Whistleblowers, as well as persons related to them (eg colleagues and relatives), are protected against unjustified disclosure of their identity, except in cases permitted by law.
  • It is prohibited to take retaliatory measures against the protected persons, namely: temporary suspension from work, dismissal, demotion, negative assessment of work, application of property and disciplinary responsibility, physical and verbal coercion, threat, hostility and violation of their dignity, discrimination etc.

6. What are the conditions for granting protection?

  • The whistleblower must have reasonable cause to believe that the information submitted about the violation in the report was correct at the time of submission and that this information falls within the scope of the APPRIPDIB
    ; and
  • The report of violation was submitted under the conditions and according to the order of APPRIPDIB.

NB! The persons named in the report as violators are entitled to compensation for all pecuniary and non-pecuniary damages when it is determined that the whistleblower knowingly filed a report with false information.

7. How you can file a report with the COMMISSION FOR THE PROTECTION OF PERSONAL DATA?

The Commission for the Protection of Personal Data is the Central Authority for external whistleblowing. You can also submit your report directly to her in one of the following ways:

  • in writing:
    • via email: whistleblowing@cpdp.bg
    • by mail to the address: Sofia 1592, “Prof. Tsvetan Lazarov” No. 2
    • via the Secure Electronic Delivery System
    • via the website of the Commission for the Protection of Personal Data
  • orally – on site at the CPDP at the address: Sofia 1592, “Prof. Tsvetan Lazarov” No. 2

You could use the sample Form for registering a whistleblower report, which can be downloaded from the CPDP website. The form is optional. However, if you decide to use it, you must complete only Parts I – V inclusive and sign it: when sending the form by post – with a handwritten signature; when sending by e-mail – with a qualified electronic signature.

If you use the System for secure electronic delivery, the employee of the CPDP in charge of considering the report will establish contact with you in order to fill in a Form for registering a report for submitting information about violations under the APPRIPDIB.

Privacy notice regarding internal whistleblowing

“Toro Groups” Ltd. pays serious attention to the privacy of all natural persons reporting or publicly disclosing information about violations.

Please read this Notice to understand how and why personal data is processed in connection with the operation of our internal whistleblowing channel.

A data subject in relation to the submitted signal can be:

  • the author of the report (also referred to as the whistleblower);
  • the person against whom the report is filed or persons related to him (affected persons);
  • the witness(es) and other persons whose personal data could become known in the course of the inspection.

WHAT ARE THE PURPOSES OF PERSONAL DATA PROCESSING?

Personal data is processed for the purposes of receiving, registering, verifying and taking action on reports of alleged violations committed by our staff.

When you provide your personal data in a reported report, we will collect and store your personal data in order to investigate and investigate your report. The information you provide to us will be kept strictly confidential and secure.

In certain cases, we may also need to process your data in connection with legal disputes, as set out in the How long we keep your personal data section, and for purposes set out elsewhere in this Notice.

We will notify you in the event that we would like or need to use your personal data for purposes and in a manner significantly different from what we have informed you about and, if necessary, we will seek your consent.

ON WHAT BASIS WE PROCESS PERSONAL DATA?

In the context of the operation of our internal whistleblower channel, we process personal data in compliance with our obligations under the Whistleblower Protection Act (WFP). The legal basis we refer to is Article 6, paragraph 1, letter “c” of the GDPR.

If the information we receive in connection with the report of violations contains a special category of data revealing the racial or ethnic origin, political views, religious or philosophical beliefs, data about the state of health, sex life, sexual orientation of the natural person, etc., the legal basis on which we will process these personal data is Article 9, paragraph 2, letter “g” of the GDPR, because the processing is necessary for reasons of important public interest based on the law of the Union and Bulgarian law.

WHAT PERSONAL DATA WE PROCESS AND WHERE WE COLLECT IT FROM?

We process only such personal data as is strictly necessary for the above purposes.

We receive the data from the signals sent through our internal channel. In particular, we may receive such data because you give it to us (by submitting a report) or because other whistleblowers from our staff or our suppliers and contractors or other third parties give it to us (e.g. if you appear in a report as a potential offender or witness).

If necessary, we may request additional information so that we can investigate all the grounds for your report, along with any supporting documents or evidence.

In the process of receiving, registering, checking and taking action on the report, we may process the following types of personal data:

  • names, job title/position, telephone number, email address and other contact details for you (eg address) of a whistleblower;
  • signature, electronic signature or other identification of the sender of the signal;
  • names, title/position and contact details of persons named in a reported report;
  • names, job titles/positions and contact details of persons verifying the report;
  • personal data related to circumstances that are the subject of the report and those collected during its verification;
  • personal data in connection with measures taken on the report.

The processing of the above-mentioned personal data is necessary for the regularity of the signal and the verification of the information indicated in it. Failure to provide this data would not allow the processing of the report and the conduct of the related investigation.

Pursuant to the Act on the Protection of Persons Submitting Signals or Publicly Disclosing Information on Breaches, no anonymous whistleblower proceedings are initiated.

WHO WILL HAVE ACCESS TO YOUR PERSONAL DATA?

Personal data collected in connection with a whistleblower report (and in particular the identity of the whistleblower) is treated with complete confidentiality as required by the Whistleblower Protection Act. This personal data will be available only to the persons designated by the company, who will accept and carry out a check on the report. These individuals are specially trained and aware of their duty of confidentiality regarding all aspects of the inspection.

The whistleblower’s identity is not disclosed to the accused persons.

The whistleblower’s identity is disclosed only if the whistleblower consents to it, or if disclosure of the whistleblower’s identity is required in a criminal proceeding, or if the whistleblower has filed a false report with malicious intent.

Personal data may be disclosed to third parties, such as public authorities or external inspectors, when this is a necessary and proportionate obligation imposed by Bulgarian law or European Union law in the context of investigations by national authorities or legal proceedings, including with with a view to guaranteeing the right of defense of the affected person. In these cases, before disclosing the identity or information related to the whistleblowers, we will notify the whistleblower of the need for disclosure.
The notification shall be in writing and shall be motivated. The whistleblower is not notified when the investigation or legal proceedings are jeopardized.

TRANSFER OF PERSONAL DATA OUTSIDE BULGARIA

We will not transfer your personal data to persons outside the EU or EEA.

HOW LONG DO WE STORE YOUR PERSONAL DATA?

Personal data that is the subject of a report that is anonymous is deleted immediately.

If the report contains personal data that is not necessary for its verification, such personal data is also deleted immediately.

We store your personal data for a period of 5 years after the conclusion of the examination of the report, except in the presence of criminal, civil, labor law and/or administrative proceedings in connection with the submitted report pursuant to Art. 8 of Ordinance No. 1 of July 27, 2023 on keeping the register of signals under Art. 18 of ZZLPSPOIN and for forwarding internal signals to the CPLD.

The report does not apply to this procedure
The report did not lead to any consequences When disciplinary or legal proceedings have been initiated
The data is destroyed immediatelyThe data is destroyed within 5 years after the investigation of the report is completedThe data is destroyed at the end of the procedure or the limitation period for appealing the decision.

HOW WE PROTECT YOUR PERSONAL DATA?

We value your privacy and take the security measures of the personal data we collect and store very seriously.

We use multiple physical, electronic and organizational measures, appropriate in view of the sensitivity of the information we maintain, to protect your personal data from unauthorized access, use or disclosure. For example, we use passwords, we have firewalls and anti-virus programs and more. We have adopted data protection policies and procedures.

Only persons specifically designated to verify a received report will have access to the personal data contained in the report.

WHAT RIGHTS DO YOU HAVE?

You have the following rights:

  • Right of access to personal data relating to you;
  • Right to object to the processing of your personal data where we invoke our legitimate interest;
  • The right to request rectification of inaccurate personal data relating to you;
  • The right to request erasure of personal data relating to you (“the right to be forgotten”);
  • Right to request restriction of processing of personal data relating to you;
  • The right to submit a complaint to the Commission for the Protection of Personal Data, with the address Sofia, 1592, “Tsvetan Lazarov” Blvd. No. 2. You can also seek protection of your rights through court proceedings.

HOW TO CONTACT US?

  • The administrator of the personal data is “TORO GROUPS” OOD, EIK 131102883, with headquarters and management address: Sofia, Izgrev district, Dragan Tsankov Blvd., No. 26.
  • If you have any questions about this notice or about how we process your personal data, please contact our data protection officer at e-mail: myprivacy@torogroups.com