What is this about? (Definition)

At Columbia Road we want to make sure everyone feels safe in reporting misconduct or wrongdoing. We have created this document to clarify Columbia Road’s actions and approach to any suspicions, as well as to share information about our Whistleblowing tool Your Voice.

What is Your Voice? (Anonymity)

Your Voice enables anonymously reporting misconduct or wrongdoing, or any suspicion of zero-tolerance behaviors, such as harassment, bullying or discrimination. Your messages and identity will be kept anonymous within Your Voice.

How can I access Your Voice? (Access)

You can access the tool through this link: 

https://yourvoice.hibob.com/consult/m-8HAlhhL7

How is a person protected? (Protection)

Any person who makes a report regarding alleged misconduct or wrongdoing will have protection from retaliation, as long as the person reports in good faith and has reasonable grounds for believing that the content of the disclosure is true.

Who will see these reports? (Company Representatives)

Any submitted reports will be handled by specified individuals within HR and the CEO. On a need basis, anonymised, aggregated and/or reduced data might be processed by other relevant parties within Columbia Road, as well as its Board of Directors.

When will we respond? (Response Time)

We commit to acknowledge a report within seven (7) days and provide a response within three (3) months. The acknowledgement will be sent within Your Voice to ensure that we retain sufficient records of all of the communication.

What are the actions we will take? (Investigation and Actions)

We take all submitted reports seriously and want to ensure that they are handled in a professional manner, as well as ensure objectivity in the investigation. To investigate submitted reports we may engage an external investigator. If the suspicions are confirmed, the information provided in the report may be used in the implementation of required disciplinary actions and corrective measures.

Do I need to submit any personal data? (Purposes and Legal Basis)

The person filing the report will need to use their personal email address when submitting the report, so they are able to access all details of the case within Your Voice. We collect and process your personal data to be able to fulfill our legal obligations. Your Voice will enable protecting the anonymity of the person filling a report and the company representatives will not receive any personal data. Personal data may be disclosed to third parties, such as public authorities or external auditors, where this is necessary, for example, by law.

What information do we collect and where? (Categories and Sources of Personal Data)

The following data is collected in relation to the report:

• Date of report (Source: Your Voice and/or the person who reported)
• Place of incident (Source: Person who reported)
• Overview of the incident (Source: Person who reported)
• Handler (Source: Handler)
• Correspondence (Source: Handler)
• Start date of processing (Source: Handler)
• How report was/will be handled (Source: Handler)
• Conclusion (Source: Handler)

Who processes your data? (Recipients)

The data is controlled by Columbia Road Oy. Anonymised statistical data may be shared to other Columbia Road companies. Your Voice is maintained by an external service provider, Hi Bob, Inc. No personal data will be transferred outside the EU or the EEA. 

How long do we keep your data? (Storage Period)

The need to retain identifying information, such as names, will be assessed regularly at least once a year, and data that is not needed will be deleted to anonymise data. Thereafter certain incident-related data may be stored in accordance with the local statutory requirements, such as occupational safety, corruption, ethics and accounting laws.

What are your rights? (Rights of Data Subject)

You can at any time ask us:

• to confirm if we process any personal data related to you and to deliver an electronic copy of such data,
• to correct any inaccurate personal data related to you,
• to erase any personal data related to you,
• to restrict us processing any personal data related to you, and
• to stop processing any personal data related to you due to personal reasons.

Please note, however, that due to the nature of the incident report we may not be able to disclose, erase or stop processing your personal data on the register if that would jeopardize the rights of the other persons related to the matter or if we have other legal obligation not to fulfill your request.

What if I want to file a complaint? (Right to Complain)

If you disagree with our decision in relation to your request or you think your rights have not been respected, you can always contact us. You can also file a complaint with your local data protection authority: 

• Finland: Tietosuojavaltuutettu (Finnish Data Protection Ombudsman)
• Sweden: Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection)