ICONNEXA CONSULTING VALENCIA, S.L.
ICONNEXA CONSULTING VALENCIA, S.L. Internal Reporting System

Your rights

Information for reporting persons

This is what Spanish Law 2/2023 and the General Data Protection Regulation require us to tell you before you decide whether to use this channel. It is written to be easily understood. The Spanish version is the authoritative text.

Who processes your data

  • Controller: ICONNEXA CONSULTING VALENCIA, S.L. (Tax ID B-98144363), owner of the internal reporting system.
  • Processor: ICONNEXA CONSULTING VALENCIA, S.L., which manages the channel on behalf of the organisation under a contract pursuant to Article 28 GDPR.
  • System Officer: Vicente Rodrigo Iranzo.

Purpose and legal basis

We process what you tell us in order to receive, register and handle reports of breaches, which is a legal obligation of the organisation. The legal basis is Article 6(1)(c) GDPR in conjunction with Law 2/2023: we do not ask for your consent because the processing does not depend on it, and for the same reason you cannot withdraw it to stop us handling what has been reported.

How long it is kept

Only for as long as strictly necessary. If no investigation has been started three months after your report is received, the personal data are deleted; anything kept as evidence that the system works is kept in anonymised form. In no case are data kept for more than ten years (Article 32 of Law 2/2023).

Your identity

  • You can report anonymously: the written form does not ask for your name or email.
  • If you identify yourself, your identity is confidential and is not disclosed to the person concerned. It may only be revealed to the judicial authority, the Public Prosecutor’s Office or the competent administrative authority, and in the context of an investigation.
  • We do not store your IP address or your browser. The only thing stored is a code calculated from them using a secret key that expires after 30 days and is destroyed when it expires. While it exists, that code only makes it possible to know that two reports came from the same place, never which place that is. Once the key is destroyed, the code can no longer be recalculated even with your address in hand, and becomes a string of characters that leads nowhere. It is used to detect floods of false reports and to link a follow-up to its original report.
  • The content of your report is stored encrypted.
  • If the person concerned exercises their right of access, that right does not extend to your identity.

Prohibition of retaliation

  • Acts of retaliation for having made a report are prohibited, as are threats and attempts of retaliation (Articles 36 et seq. of Law 2/2023).
  • Retaliation includes, among other things: suspension or dismissal, demotion, an imposed change of position or working hours, refusal of training, negative appraisals, sanctions, coercion, harassment, blacklisting and early termination of contracts.
  • Protection also extends to anyone who assists you, to your colleagues or relatives in the same environment and to the legal entities you work for.

What is asked of you

Just one thing: that you have reasonable grounds to believe that what you report is true at the time of reporting it. You are not asked to be right, to prove it or to be able to classify it legally. Investigating is the channel’s job, and an honest mistake is covered by the protection of the law.

What the law does not protect is the opposite: making up facts knowing them to be false. Article 63 of Law 2/2023 classifies this as a very serious infringement and, depending on the case, it could also have criminal consequences. This is stated here because you have the right to know it, not to discourage you: if you are unsure whether what you know is accurate, report it including your doubts, which is exactly what is expected of you.

Who manages this channel, and why that protects you

This channel is not run in-house by the organisation. Its management is entrusted to ICONNEXA CONSULTING VALENCIA, S.L., an external and independent law firm, under Article 6 of Law 2/2023, which expressly allows the system to be entrusted to a third party.

In practice this means three things. That the first person to read what you report does not work for your organisation and does not answer to anyone there. That this firm is bound by professional secrecy, in addition to the duty of confidentiality imposed by the law itself. And that your identity is not handed over to the organisation: the System Officer receives the facts and what is needed to investigate, not a name to pass on to management.

This does not mean the final decision is not the organisation’s: the case is decided by its System Officer, as required by Article 8. What changes is who stands in between.

Your rights and how to exercise them

You can request access, rectification, erasure, restriction and objection by contacting the controller organisation. If you reported anonymously, we will not be able to identify you in order to deal with your request, which is the other side of anonymity. You can also lodge a complaint with the Spanish Data Protection Agency (AEPD).

You are not obliged to use this channel

This is the internal channel, and it is best placed to deal with what you tell us: those who know the organisation, the people and the facts are here, and can act within days. That is why the law itself prefers that the internal route be tried first.

That said, you are not obliged to. You can go directly to the Independent Whistleblower Protection Authority (A.A.I.), or to the relevant regional authority, without going through this channel and without losing any protection: you will find their contact details on their official website. You can also make a public disclosure in the circumstances provided for in Article 28 of the Law. Whichever route you use, your rights and the prohibition of retaliation remain exactly the same.

The deadlines we commit to

Acknowledgement of receipt within seven calendar days at most. A response within three months of the report at most, extendable by a further three in particularly complex cases, in which case you will be informed.