1. Introduction
The purpose of operating the Whistleblower System (hereinafter referred to as the "System") is to ensure the possibility of reporting abuses or violations while protecting the whistleblower.
This information note outlines the procedure for submitting a report in the System, the investigation process, the circumstances under which an investigation may be omitted, the scope of whistleblowers and affected persons, and the scope of actual or suspected contraventions and concerns that can be reported in the System. Additionally, this note provides information on the scope of personal data processed in connection with a report and the protection of such data.
The operator of the System is Duna Aszfalt Út és Mélyépítő Zártkörűen Működő Részvénytársaság (seatregistered office: 6060 Tiszakécske, Béke utca 150; company registration number: 03-10-100618; tax number: 28733232-4-03; hereinafter referred to as the "Company"). The Company operates the System jointly with the company within its corporate group, allowing reports to be submitted regarding the Company or other companies within its corporate group by indicating the relevant company.
In operating the System, the Company complies with the rules applicable to the operation of the System, in particular, but not exclusively, the provisions of Act XXV of 2023 on complaints, public interest disclosures, and whistleblowing (hereinafter referred to as the "Complaints Act"). In its data processing activities, the Company ensures appropriate safeguards and guarantees for the protection of personal data and the free movement of such data, and taking into consideration those specified in the Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter referred to as the "GDPR") on the repeal of the Regulation 95/46/ECK and of Act CXII of 2011 on the right to informational self-determination and freedom of information (hereinafter referred to as the "Info Act").
The terms used in this information note (hereinafter referred to as the "Note") correspond to those defined in the Complaints Act, GDPR, and Info Act. In case of deviations, explicit references are provided in the Note.
2. Complaints
The whistleblower is entitled to report an unlawful or suspected unlawful act or omission, or other abuse-related information (hereinafter referred to as the "Report") through the System.
Reports containing manifestly false or maliciously made statements or declarations cannot be submitted to the System.
A Report is lawful if:
(i) the whistleblower submits the Report in one of the ways specified in this Note,
(ii) the whistleblower acquires the information pertaining to the circumstances affected by the Report and reported in connection with their lawful activities, and
(iii) the whistleblower has reasonable grounds to believe that the information pertaining to the circumstances reported was accurate at the time of submission.
3. Persons Entitled to Submit Reports
Reports can be submitted in compliance with the operational rules of the System by the following individuals, regardless of whether they are natural persons, legal entities, or entities without legal personality (hereinafter referred to as the "Whistleblower"):
a) employees, including those employees whose employment with the Company has been terminated, and those persons that wish to establish an employment relationship with the Company in the case of which the process related to the establishment of this legal relationship has been initiated,
b) private entrepreneur or individual firms in a contractual relationship with the Company,
c) individuals with ownership interests in the Company or members of its executive, managerial, or supervisory bodies, including non-executive members,
d) contractors, subcontractors, suppliers, or individuals under their supervision and direction, who have established or are or were in the process of establishing a contractual relationship with the Company,
e) interns and volunteers working at the Company,
f) individuals seeking to establish a relationship described in points b), c), or e) with the Company, and
g) individuals whose relationship described in points b), c), or e) with the Company has been terminated.
4. Methods for Submitting a Whistleblower Report
Reports may only be submitted using the methods specified in this Note. Reports submitted in any other way will not be investigated and will not be considered lawfully submitted reports against the Company.
Reports may be submitted orally or in writing by authorized persons. Oral reports can be made at the address of the seat of the Company address, preferably by prior appointment. After submission, or at one time with it the content of the Report will be recorded in a protocol.
The protocol of an orally presented Report (hereinafter referred to as the "Protocol") must include at least the following:
The Protocol will be sent to the whistleblower for verification of the rightness and accuracy of its contents if contact details were provided . The Report is considered submitted to the Company when the whistleblower confirms the written Protocol within the specified deadline or implicitly consents to it. For anonymous reports, the Report is considered submitted on the day the Protocol is recorded in writing. For those Protocols that have been made on the oral Reports the Reports specified in them are considered submitted in writing after those have been recorded in protocols and in written form.
Whistleblowers can make their Reports in writing as well:
(i) via postal mail addressed to the Company's seat,
(ii) by email to panasz@dunaaszfalt.hu, or
(iii) through the form available under the "Complaint Submission" tab on the Company's website at www.dunagroup.hu.
The letter sent by post, as well as the report sent via email, will only be investigated if it is received at the designated contact points of the Company, namely at the registered address or the specified email address, and if it includes the designation “Complaint Report,” especially along with, but not limited to, the following:
5. Handling and Investigation of Reports
The Company sends an acknowledgment of receipt of the Report, or of the initiation of its investigation, to the Whistleblower's provided contact details within 7 (seven) days from the date of the oral Report or the receipt of the written Report.
The Company investigates the contents of the Report within the shortest possible time allowed by the circumstances but no later than 30 (thirty) days from the date of receipt of the Report at the address specified in the Report Guide. This deadline may be extended in particularly justified cases, with simultaneous report of the Whistleblower, but the investigation period, even with the extension, may not exceed 3 (three) months.
During the investigation of the Report, the Company maintains contact with the Whistleblower. This process may include supplementing or clarifying the content of the Report, clarifying the facts, and providing additional information.
Employees, representatives, or other interested parties of the Company who were involved in the implementation, execution, or decision-making related to the action complained of may not participate in the decision-making process regarding the Report, regardless of whose responsibility or task it was to make the decision.
The language of the investigation of the Report is Hungarian during the operating of the System, but the Company strives to ensure case handling in a language understood and spoken by the Whistleblower, wherever possible.
The Company maintains a record of received Reports in a structured and transparent manner according to unified principles established by them, containing the data necessary for the identification of each Report.
The Company is entitled to refrain from investigating lawfully submitted Reports in the following cases:
The Company informs the Whistleblower in writing about the investigation of the Report or the reasons for refraining from the investigation, the results of the investigation, and the measures taken or planned.
If, following the investigation of the Report, initiating criminal proceedings is justified, the Company takes steps to file charges. If the conduct described in the Report does not constitute a crime but violates the Company's internal regulations or employment-related rules, the Company, as the employer, may take employer-related or other actions against the affected employee.
If the investigation concludes that the Report is unfounded or that no further action is required, the Company closes the procedure.
6. Protection of Whistleblowers
During the investigation of reports, the Company is obliged to ensure that the Whistleblower does not suffer any adverse consequences due to or in connection with the report.
Any adverse action taken against the Whistleblower due to the lawful submission of the report, which is connected to a legal relationship or association with the Company, shall be deemed unlawful, even if it would otherwise be lawful. Furthermore, any adverse action taken against an entity owned by the Whistleblower or against an entity in an employment or other contractual relationship with the Whistleblower due to the lawful submission of the report shall also be deemed unlawful, even if it would otherwise be lawful.
Adverse actions may include, in particular, termination of employment, discrimination, or any labour-related sanctions. Further details are provided in Section 41 of the Complaints Act. In administrative or judicial proceedings related to adverse actions—if the Whistleblower proves the lawful nature of the report—it must be presumed that the adverse action was taken due to the lawful submission of the report. The burden of proof rests on the person taking the adverse action to demonstrate that it was justified by valid reasons and not due to the lawful submission of the report.
In the case of the lawful submission of a report, the Whistleblower shall not be held liable for obtaining or accessing the information contained in the report unless the Whistleblower committed a criminal offense to obtain or access the information. The Whistleblower cannot be held liable for the lawful submission of a report if they had reasonable grounds to believe that the report was necessary to uncover the circumstances described in it.
7. Data Processing Information
The Company, as a data controller, informs data subjects that its data processing activities comply with the provisions of the GDPR and the Data Protection Act and that it provides appropriate organizational safeguards for data processing and investigation of reports.
The Company provides the following table to detail its data processing activities, including the scope of data processed, the purpose of data processing, the legal basis for data processing, and the duration of data processing:
| Scope of Data Processed | Purpose of Data Processing | Legal Basis for Data Processing | Duration of Data Processing |
|---|---|---|---|
| Personal data provided by the data subject during oral or written reporting. | Investigation of the report, maintaining contact. | Consent of the data subject (GDPR Article 6(1)(a)). | Shortly after the investigation of the report, within 8 (eight) working days. |
The Company does not use automated decision-making or profiling for the personal data provided during reporting, thus they do not check the personal data specified during the report. The authenticity of the provided data is the sole responsibility of the individual providing it.
The personal data provided by the data subject may be transferred by the Company to another entity within its corporate group designated by the Whistleblower for the purpose of investigating the report.
The Company informs data subjects, pursuant to Article 13(f) of the GDPR, that it does not transfer the personal data it processes to data controllers located in third countries or international organizations.
Data subjects may request access to, rectification, deletion, or restriction of processing of their personal data, exercise their right to data portability, or object to data processing. These rights can be exercised as follows:
(i) Right to Access/Information: The data subject is entitled to request information from the data controller regarding the scope and method of processing personal data.
(ii) Right to Data Portability: The data subject may request to receive their personal data in a structured, commonly used, and machine-readable format and may request the transfer of these data to another data controller without obstruction by the original controller.
(iii) Right to Rectification: The data subject may indicate inaccuracies in the processed data and request corrections to be specified instead of them.
(iv) Right to Erasure/Right to Be Forgotten: The data subject may request the deletion of their data and also the removal of any trace of processing. If the data controller has granted third parties’ access to the data, they must inform those parties for those they disclosed the relevant data to delete any references and stored data.
(v) Right to Restriction of Processing: In certain cases, such as unclear legal disputes or when data processing is no longer necessary but the data subject still wishes it to be retained, the data subject may request restricted processing. In such cases, personal data may only be stored. In the case of data restriction the data controller must inform as well all recipients with whom the personal data has been shared.
(vi) Right to Object: The data subjects may object any time to the processing of their personal data based on the data controller's legitimate interests due to reasons related with their own states of affairs. In such cases, the data controller is not entitled to continue processing except when the data controller can prove that data procession is justified due to such compelling legitimate grounds that override the data subject's interests, rights and freedom or that are related to the submission, assertion or defence of legal claims.
Since data processing is based on the consent of the data subject, the data subject may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to withdrawal.
Data subjects may exercise these rights through the contact details of the Company provided in the Company’s Note. Electronically or in writing, the request will be reviewed without undue delay, but no later than one month from receipt, and the Company will inform the requester of the actions taken. If the request is complex or requires further action, this period may be extended by up to at most two months.
If the data subject disagrees with any data processing activity carried out by the data controller, they may file a complaint with the National Authority for Data Protection and Freedom of Information at the following contact details:
Address: 1055 Budapest, Falk Miksa utca 9-11
Mailing Address: 1363 Budapest, Pf.: 9
Email: ugyfelszolgalat@naih.hu
Phone: +36 (1) 391-1400
Additionally, they may also bring legal action before the competent court to enforce their rights.
