The Professional Association of Hygienists of Galicia (hereinafter, HIDEGAL) has an ethical channel (hereinafter, the “Ethical Channel” or “Internal Information System”) which is governed by Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019, on the protection of persons who report breaches of Union law, the Law, and other applicable legislation.
The processing of the personal data of the informant, of the person under investigation, and of the rest of the affected persons, obtained and/or generated in the context of the management of the Ethical Channel, will be adjusted to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, “GDPR”), Law 2/2023, of February 20, regulating the protection of persons who report regulatory infringements and the fight against corruption (hereinafter “Law 2/2003”), and other applicable legislation.
In accordance with Article 13 of the GDPR, we inform you that the HIDEGAL entity to which the communication refers is the Data Controller. The entities are as follows:
Likewise, we inform you that the entity responsible within the Association will access and process your data for the management of communications of the Ethical Channel and of public disclosures. You may contact the Data Protection Officer at the email address info@hidegal.com.
HIDEGAL guarantees the confidentiality of both the information provided and your personal data supplied through the aforementioned Ethical Channel. Making responsible use of the Ethical Channel is your obligation; therefore, under no circumstances should you make unfounded or bad faith communications, in which case the applicable legal and/or disciplinary actions may be taken. Furthermore, any statement you make to report on another person must be respectful and maintain decorum and good manners. HIDEGAL is not responsible for derogatory comments you may make about any third party. Likewise, you must guarantee that the personal data provided are true, accurate, complete, and up to date.
Management of communications of the Ethical Channel.
The data processed and included in the communication sent to the Ethical Channel may be kept in the Internal Information System for the time strictly necessary to decide whether to initiate an investigation into the reported facts. In any case, after three (3) months from receipt of the communication without investigative actions having been initiated, the data must be deleted, unless the purpose of retention is to leave evidence of the functioning of the system. Communications that have not been acted upon may only be recorded in anonymized form. If it is proven that the information provided, or part of it, is not truthful, it will be deleted as soon as this circumstance becomes known, unless such lack of veracity may constitute a criminal offense, in which case the information will be kept for the necessary time while the judicial procedure is processed. Information received containing special categories of data pursuant to Article 9 of the GDPR will be immediately deleted without being processed, unless processing is carried out for reasons of essential public interest, pursuant to Article 9.2.g) of the GDPR. Under no circumstances will personal data that are not necessary for the knowledge and investigation of actions or omissions be processed; if applicable, they will be deleted immediately. Once investigative actions and/or communication and cooperation with competent authorities have been initiated, the personal data subject to such actions will be retained for the time necessary to achieve the intended purpose and, where applicable, for the maximum period established by the applicable regulations. Once the stated purposes have been achieved, the data will be blocked for the limitation periods of the liability that may arise in each case from the activity carried out.
In accordance with the applicable data protection regulations, access to the data is limited exclusively to the Sole Responsible Party of the Internal Information System and those who carry out internal control and compliance functions. However, access by other persons, or even communication to third parties, will be lawful when necessary for the adoption of disciplinary measures or for the processing of judicial proceedings that, where appropriate, apply:
As provided for by the GDPR, we inform you that:
To exercise the recognized rights, to the extent that they are applicable, you must send a written communication to the following email address info@hidegal.com providing a copy of your ID card or equivalent document, and identifying yourself as a user of the HIDEGAL Ethical Channel form. You may revoke the consents given, if applicable, by contacting the address or email indicated above. Likewise, we inform you that you have the right to lodge a complaint with the competent Data Protection Agency, especially when you have not obtained satisfaction in the exercise of your rights.
As a general rule, the data provided through the HIDEGAL Ethical Channel will not be subject to International Data Transfer. However, your data may be transferred to Group companies in the European Economic Area in order to manage your communication, if, for administrative reasons and/or arising from the investigation procedure, so required.
In order to safeguard the security of your personal data, we inform you that we have adopted all necessary technical and organizational measures to guarantee the security of the personal data provided against alteration, loss, misuse, disclosure, and unauthorized processing or access, as required by personal data protection regulations. In this regard, HIDEGAL guarantees the custody of the processed data, for which it will adopt the pertinent measures for such purposes, always in accordance with the state of technology at any given time. Our security measures are permanently updated in line with technological development and the obligations of data protection regulations. Although in data transmissions over the internet it is not possible to guarantee absolute protection against intrusions, both we and our subcontractors and business partners make the utmost efforts to maintain physical, electronic, and procedural protection measures to guarantee the protection of your data in accordance with the legal requirements applicable in this area. Among the measures we use are the following:
The case tracking number or password provided (the credentials) that you must use when starting each session is personal and non-transferable. You are responsible for preserving the security and confidentiality of the credentials and preventing any access to information on the progress of the investigation by third parties other than yourself.
Copyright 2025. All rights reserved.
At the Professional Association of Dental Hygienists of Galicia, we work for our members, but we are also our members. That's why we invite you to actively participate in the activities we carry out.