Your Personal Data (or Data) is any information that is about you, or is related to you and used to learn, evaluate, or decide something about you. This Privacy Notice explains what Data Opella collects through Opella’s Speak Up Program, including, but not limited to, the Speak Up Helpline and Case Management System, why Data is collected, how it is used, and your rights related to it.

Who is responsible for using your Data.

Each Opella legal entity concerned by the reported issue is responsible, jointly with Opella Healthcare Group SAS, for the use of your Data for the handling of such report, as described in this Privacy Notice and according to applicable data protection laws.

A list of Opella legal entities, including Opella Healthcare Group SAS, is available here: https://www.opella.com/en/privacy-center/documents/ListOfOpellaAffiliates-en-GL.

Details concerning the allocation of responsibility between Opella Healthcare Group SAS and the other Opella legal entities please refer to the “Allocation of Responsibilities” paragraph in this Privacy Notice.

What Data Opella collects about you.

Due to the unique nature of the Speak Up Program, the types of Data that Opella may collect and process for handling and investigating reports can vary significantly. While not all the categories listed below will necessarily be processed in every case, they are included to reflect the potential scope of Data that may be involved:

  • Personal identification and contact details such as name, surname, date of birth, age, or age range, email address, telephone number, etc.;
  • Images such as pictures, CCTV, and other video recordings;
  • Family information such as general reputation, social status, interactions, friends, connections, acquaintances, group memberships, and other relationships;
  • Social information such as information on social life and relationships, both in the physical and virtual environment;
  • Communication information data or metadata, such as email subject line, timestamp and contents, video or phone call recordings, voicemail, instant messages; 
  • Financial information such as credit card numbers, bank account numbers, financial transaction data (purchases, sales, income, taxes, and other transactions);
  • Educational and Professional data such as academic degrees or diplomas, professional certifications or licenses, training or workshop completions, scholarships or academic awards, membership in professional bodies, published works or research, relevant coursework or specialized training, examinations or tests passed, languages spoken;
  • Employment history and records such as previous employers, dates of employment, positions held, promotions or demotions, transfer records, recognition or awards received, disciplinary actions or records, resignation or termination details;
  • Organizational affiliation data such as company or organization, job title, role, function, department or division, manager or supervisor's name, direct reports, or subordinates, reporting hierarchy level, office or location assignment, project or task group associations, functional responsibilities or domain areas;
  • Compensation and benefits data such as salary or wage amount, bonus structures, stock options or shares awarded, health or medical benefits, retirement or pension plans, travel, car or housing allowances, performance-based incentives, other non-monetary perks or benefits, tax deduction details;
  • HR administrative records such as onboarding or induction documents, attendance logs or timesheets, leave requests and approvals, training schedules;
  • Evaluation and assessment data such as feedback/notes/observations from managers, peers or other stakeholders, results from aptitude or skills tests, assessment and self-assessment outcomes (behavioral, psychological, personality, progression), performance appraisal scores;
  • Device and equipment information such as device identifiers (Serial number, IMEI, VIN, etc.), device network information (IP address, Mac address, browser fingerprint);
  • Interaction and activity logs such as computer login times, application login/logout time, file downloads, internet navigation history and other operational behaviors;
  • Preferences and behavioral information such as interests, favorite foods, colors, likes, dislikes, browsing history and behavior, links clicked;
  • Judicial information such as convictions, charges, pardons;
  • Political, religious, labor or philosophical beliefs, opinion and affiliations such as political beliefs or opinions, religion, trade union membership, political or religious affiliations, philosophical beliefs and opinions;
  • Ethnicity information such as age race, national or ethnic origin; 
  • Sexual life information such as gender identity;
  • Medical, health and impairment information such as physical and mental health, drug test results, disabilities, family or individual health history, health records.

How Opella collects your Data.

Opella may collect data:

  • directly from you, when you are acting as a reporter and are reporting an alert through the Speak Up Program, including the Speak Up Helpline and Case Management System;
  • Indirectly, when someone else is reporting an issue, internal and external investigators, publicly available sources, partners, service providers, or from Data previously collected by Opella for other purposes or obtained from other affiliates in the group.

Why Opella uses your Data.

Opella collects, uses, and processes your Data to receive, assess and investigate reports, to take appropriate follow‑up actions, and to protect its legal and compliance interests.
Depending on the circumstances of the report and the applicable jurisdiction, such processing relies on one of the following grounds:

  • to comply with applicable legal and regulatory obligations, including laws requiring the establishment and management of whistleblowing or reporting channels;
  • to meet recognized compliance and business purposes, including the prevention, detection and investigation of misconduct and the enforcement of our internal policies;
  • to establish, exercise or defend legal rights and claims;
  • where permitted by applicable law, to pursue our legitimate interests in maintaining high standards of ethics, integrity and corporate responsibility;
  • where required by law, with your consent.

Who can access your Data.

Access to Data collected in the context of the Speak Up program is granted on a strict “need to know” basis, at single case level.

Only authorized recipients have access to your Data to conduct one of the activities described above. Such recipients include:

  • Opella Speak Up operators in charge for managing alerts, reports, investigations. This personnel is bound by confidentiality and trained to assess information in an independent, impartial and objective manner.
  • Other Opella employees and staff involved in the implementation of appropriate follow-up actions;
  • Opella’s partners, such as service providers or contractors acting upon our instructions as external investigators. These include Whispli SAS (10 rue de la Paix, 75002 Paris, France; https://www.whispli.com), which provides and operates the Opella Speak Up platform;
  • business partners which need to be informed about a violation, as it concerns one of their employees;
  • professional advisors and auditors;
  • regulatory bodies, public authorities, courts, and law enforcement bodies.
     

When required by law, Opella enters into contractual agreements with external recipients so that they agree to provide adequate protection measures, not to use the Data for purposes other than those described in this Privacy Notice and cooperate with Opella to ensure that your rights are exercised.

Where is your Data processed.

Opella is a multinational group with employees, affiliates, partners and subcontractors located around the world. Consequently, your Data may be processed and accessed in countries where different data protection laws apply.

When Personal Data is transferred to or accessed from other countries, Opella ensures that the laws in force in the recipient's country provide adequate protection. If this condition is not met, Opella commits to adopting one of the mechanisms provided by law to ensure the appropriate protection of the Personal Data in the destination country.

The Opella digital platforms used to collect and track reports and cases is hosted in the European Economic Area.

How long is your Data kept.

Your Data will be kept, in accordance with applicable laws and regulations, for a period not exceeding the time necessary to achieve the purposes for which it was collected.

The retention of Data depends primarily on applicable laws and on whether a report is substantiated. A report is considered substantiated when the investigation finds sufficient evidence that the reported concern is well-founded.

Unless otherwise Unless otherwise provided by applicable laws in specific countries or cases, reports containing your Data will be retained for 10 years after the closure date.

How Opella protects your Data.

While Opella strives to protect your Personal Data, no action on your Data, including storage, can be guaranteed to be 100% secure. To protect your Data Opella implemented a variety of technical and organizational measures aimed at mitigating the risk that such Data is leaked, lost, or used for unauthorized purposes.

These measures consider the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons.

If a security incident occurs and affects your Personal Data, Opella will take reasonable actions to further mitigate possible impacts on you. When the incident is likely to result in serious harm, this may include a notification to you or to competent authorities when necessary.

Your rights.

You are entitled to:

  • have access to, and receive a copy of your Data;
  • obtain the rectification of your Data, should it be inaccurate, incomplete, or obsolete;
  • obtain the deletion of your Data in situations set forth by applicable data protection laws (“right to be forgotten”);
  • withdraw your consent to data processing at any time, without affecting the lawfulness of processing, where your Data has been collected and processed on the basis of your consent;
  • object to the processing of your Data, where it has been collected and processed on the basis of our legitimate interests;
  • request a limitation of data processing activities, in the situations set forth by applicable laws;
  • request that some of the Data you provided to us is delivered to you, or to another Controller, in a commonly used, machine-readable format.
     

If you want to exercise any of these rights, contact us.

You are also entitled to lodge a complaint with your local Data Protection Authority.

Contact us.

If you have a question, want to exercise your rights or simply want to know more, you can:

Allocation of responsibilities.

As indicated in previous sections of this Privacy Notice, each Opella legal entity concerned by a report is responsible, jointly with Opella Healthcare Group SAS, for the use of your Data for the handling of such report. In certain jurisdictions, this shared responsibility goes under the legal definition of joint controllership, and each party is referenced as a joint controller.

With regards to the use of Data described by this Privacy Notice, the joint controllers have agreed to allocate their responsibilities as follows:

  • each controller is primarily responsible to guarantee the transparency of the processing by providing appropriate privacy notices through the reporting channels they manage;
  • each controller is responsible for properly and timely handling the requests received from the data subjects, concerning the exercising of their rights and supporting the other controller with the fulfillment of such requests;
  • each controller is responsible for properly and timely handling possible personal data breaches they are notified of or they otherwise become aware, and supporting the other controller for the handling of possible personal data breaches handled by the other controller.
     

The following responsibilities are assigned to Opella Healthcare Group SAS only:  

  • defining and maintaining up‑to‑date group‑level procedures for the handling of reports; 
  • selecting digital tools and external service providers used at group level;  
  • ensuring the adequacy of such tools and providers, as well as of the related contractual arrangements (where applicable), and;  
  • implementing appropriate and effective measures to ensure proper data retention within group‑level systems.
     

The practical modalities and further details of this allocation are set out in the Global Whistleblowing Standard and any applicable local procedures.

Changes to this Privacy Notice.

Opella may update this Privacy Notice periodically to reflect changes in the law or practices. Opella encourages you to check this page periodically.