BBM Group Whistleblowing Channel

The BBM Group values integrity, transparency and responsibility in its relationships with all its stakeholder. Therefore, true and honest information and care with the ethical conduct of its leaders, employees and suppliers are always valued.

Any act that does not comply with the Code of Ethics must be reported. In addition, any information or situation that may harm the BBM Group, the companies belonging to the Group or any of its stakeholders is important, deserves attention and should be reported on the BBM Group Whistleblowing Channel.

BBM Group Whistleblowing Channel is supported by an independent company, which will ensure the confidentiality of your information.

Get to know the BBM Group’s Code of ethics by clicking here.

You can also record your report by sending an email to: bbm@relatoconfidencial.com.br, or by contacting us at 0800 721 1402.

By registering a report on this Confidential Complaints Channel (via website or toll free phone), you may provide us personal data (information that identifies or may lead to the identification of a natural person) and sensitive personal data (racial or ethnic origin, religious belief, political opinion, union membership, or religious, philosophical or political organization, health or sexual life data, genetic or biometric data) about you; Protester, denounced or third party mentioned in the report.

This Privacy Notice it is intended to clarify how DELOITTE treats your personal data and sensitive personal data (collectively referred to herein only as personal data) when you contact us to use the services of the Confidential Complaints Channel or when you are targeted or mentioned in a report.

All personal data collected in this Confidential Complaints Channel will be treated by DELOITTE in accordance with the provisions of the General Law on Protection of Personal Data (Law No. 13,709/2018 – "LGPD") and relevant regulations.

For more details on the measures we apply in the treatment of personal data, please visit DELOITTE's Privacy Policy via the link.

1. What types of personal data are collected?

Will be collected only the personal data provided voluntarily by the Protester through the registration of the report in this Confidential Complaints Channel - via website or toll-free phone.

Any personal data informed in the report that is considered excessive, unnecessary or that has no relevance to the investigation of what happened will be disregarded and will only be stored for the purpose of maintaining the entirety of the original text contained in the report, for the period necessary to achieve the processing purposes.

Protester

The personal data of the Protester will be collected according to the identification profile chosen, and may include name, gender (statistical purposes), position, area, e-mail, telephone, mobile phone, type of audience and voice recording (reports via toll free phone).

In addition, any other personal data contained in the report and files attached by the Protester may be collected, which may include images, voice recordings and other types of personal data.

Denounced and third parties

The following personal data may be collected of the accused and third parties from a report voluntarily registered by the Protester:

i) first name, surname, position and workplace;
ii) description of suspected violation of the Company's Code of Ethics, policies, and/or applicable law and regulations, including all relevant facts and details;
iii) any other personal data that may be mentioned by the Protester during the description of the event, which may include images, voice recordings and other types of personal data.

This Confidential Complaints Channel is not designed or intentionally targeted to collect personal data from children and adolescents. However, in any situations where the collection of these types of personal data is necessary in the context of receipt and investigation of a report, the treatment will take place in the best interests of the child and / or adolescent and all provisions of the LGPD and pertinent regulations will be respected.

2. What is the purpose of collecting personal data?

Protester:

The processing of personal data aims to allow the identification and contact between DELOITTE and /or the COMPANY and the Protester to clarify doubts, collect additional information and progress of the investigations, respecting, in any case, the identification profile chosen by the Protester (identified, confidential or anonymous). In addition, this data may be processed for the purposes of compliance with legal or regulatory obligations, regular exercise of rights and statistical analysis (in an anonymized manner).

Denounced and third parties

The collection of this personal data is intended to verify the facts reported and take appropriate action, in accordance with applicable legislation. Such investigation will be carried out by the COMPANY, and DELOITTE is merely an intermediary, responsible only for the sharing of personal data and reports registered in this Confidential Complaints Channel. In addition, this data may be processed for the purposes of compliance with legal or regulatory obligations, regular exercise of rights and statistical analysis (in an anonymized manner).

3. What is the legal basis that justifies the processing of personal data?

All personal data collected will be processed based on the COMPANY's legitimate interests and sensitive personal data based on regular exercise of rights, since both treatments, in the context and scope of the services provided by DELOITTE, aim to assist the COMPANY in the investigation, prevention and mitigation of behaviors and misconduct that violate the COMPANY's Code of Ethics, internal policies, laws and regulations.

It is also possible that the processing of personal data and sensitive personal data occurs to comply with legal or regulatory obligations, depending on the alleged misconduct practiced.

4. With whom do we share the personal data collected?

The personal data of the Protester, denounced and third parties may be shared with:

i) The COMPANY, for the purposes of knowledge and investigation of the content of the report, always respecting the identification profile of the Protester;
ii) Authorities, Agencies and Government Entities, to comply with legal or regulatory obligations and regular exercise of rights;
iii) Technology companies that manage the integrated systems or responsible for the storage and guarantee of security in the processing of the personal data collected; and
iv) Third-party companies that will replace DELOITTE in the provision of Confidential Complaints Channel services to the COMPANY.

For more details on the shares described above, please contact the DELOITTE Clerk /DPO (Data Protection Officer) via the link Contact us.

5. How long is personal data stored?

Personal data will be kept only for as long as necessary to fulfill the purposes described in this document or as necessary to comply with legal or regulatory obligations and regular exercise of rights. When personal data is no longer necessary or relevant to the intended purposes, its erasure will be provided.

For statistical purposes, personal data will remain stored in an anonymized manner.

6. What are the rights relating to personal data?

According to the LGPD, the owners have several rights over their personal data, among them: confirmation of processing, access to personal data, updating and correction of incorrect, incomplete or inaccurate personal data; anonymisation, blocking and deletion of personal data that are unnecessary, excessive or non compliance with LGPD; opposition to the processing of personal data, when we no longer have a legitimate or legal need to process it; information on the sharing of personal data with public and private entities.

These rights are not absolute and should be interpreted in the light of legislation and other regulations. Thus, DELOITTE will evaluate legal claims individually in order to maintain the confidential nature of the Confidential Complaints Channel and not compromise the progress of investigations that may be ongoing with the COMPANY.

It is noteworthy that when the Protester chooses not to identify himself when recording the report, DELOITTE will not be able to guarantee access to the rights provided for in the LGPD since it will not have access to the identification data of the owner.

If you would like to access any of your rights provided for in the LGPD for free, please contact deloitte's DPO through the link Contact us.

7. Security

DELOITTE adopt technical and organisational measures to protect personal data from unauthorized access and accidental or unlawful situations of destruction, loss, alteration, communication or any form of improper or unlawful treatment.

In addition, access to personal data is restricted only to DELOITTE professionals who need to access it to develop activities related to the treatment of the report.

Whenever possible and applicable, anonymization and encryption techniques will be adopted for the security of personal data.

8. Alterations

This document may be changed without the need of prior notice, such as in cases of change in legislation or any decision or guidance of the National Personal Data Protection Authority ("ANPD"). The Protester may periodically review the altered content to have access to such modifications.