Data protection

Privacy Policy Vispato-Whistleblowing-portal


Dear Sir or Madam,
As the controller responsible for processing the personal data of the users of the whistleblower portal, we use the whistleblower system of the service provider Vispato GmbH, Hansaallee 299, 40549 Düsseldorf, Germany, with whom we have concluded an order processing agreement, to provide the portal. Information on data protection at Vispato is available at https://www.vispato.com/de/fragen-und-antworten and at https://www.vispato.com/de/datenschutz

1. Name and contact details of the controller
The person responsible for processing your personal data within the framework of the whistleblower system is the

BAF Petfood GmbH
Steindl 16a 
91177 Thalmässing
Tel.: 09173 794 42 202
E-Mail: daniel.weinert@frostfutter.de
Website: www.baf-petfood.com

2. Contact details of the data protection officer
The designated data protection officer is

DataCo GmbH 
Dachauer Str. 65 
80335 München 
Tel.: +49 (0) 89 7400 458 40
E-Mail: datenschutz@dataguard.de

3. Processing of your personal data

a. Your personal data processed by us
In the event of suspected violations of the law, other breaches of regulations or criminal acts, you can provide information about the suspected cases anonymously via the whistleblower portal. You can voluntarily provide personal data such as your name. The information is processed solely for the purpose of receiving and clarifying the suspicious case and will be deleted once the purpose no longer applies.
The information will then be forwarded to the expressly named contact persons for further handling.
The report can be made completely anonymously, so that no conclusions can be drawn about the person. Furthermore, the report is stylometrically adapted, i.e. all punctuation marks are removed and all words are written in lower case, so that identification is additionally excluded. All information is encrypted end-to-end. No personal data, such as IP address or location data, is stored on the servers hosted by DATEV.
When using the portal, further server-related data may be generated. In this regard, we refer to our general data protection declaration at (https://www.frostfutter.de/datenschutz) with the proviso that the function of the portal is limited solely to the reporting of suspicious cases and no tracking services are used on the tip portal or cookies are set in any other way.

b. Purposes of data processing
The processing serves to clarify suspicious cases of violations of the law, other breaches of rules or criminal acts may.

c. Legal basis of data processing

Processing on the basis of consent - Art. 6 para. 1 p. 1 lit. a GDPR
If you provide personal data, such as your name, on a voluntary basis, the processing of the personal data is based on your consent pursuant to Art. 6 para. 1 lit. a) GDPR. In this case, the processing is carried out solely for the purpose of receiving and clarifying the suspicious case and the information is deleted after the purpose no longer applies.

Legal obligations - Art. 6 para. 1 p. 1 lit. c GDPR 
To the extent necessary, we are legally obligated to provide a whistleblower system. The legal basis for data processing in this case is Art. 6 para. 1 p. 1 lit. c GDPR. Our legal obligations arise in particular from the following regulations: 


4. Recipients or categories of recipients of the personal data
In the course of processing your personal data, we may disclose the personal data concerning you to the following recipients. We only transfer your personal data to external recipients if you have consented or if this is permitted by law. External recipients of your personal data are in particular:

  • affiliated companies
  • attorneys
  • processors such as agencies and software providers for video streaming or video conferencing (incl. Vispato and DATEV)

5. Transfer of personal data to a third country
Your personal data will not be transferred to third countries outside the European Union or the European Economic Area and this is not planned.

6. Duration of storage of personal data
The personal data you have provided will be stored for as long as is necessary to clarify the suspected case and its final processing, including the elimination of any deficiencies that may have been identified and the handling of any associated legal proceedings. Your personal data will also be retained thereafter if required by legal, regulatory or contractual retention obligations or permitted by law. Your personal data will be deleted as soon as this is legally required.
Your data will be stored on a limited basis if the storage is solely for the purpose of fulfilling a retention obligation.

7. Data subject rights

With regard to the processing of your personal data, you have the following rights:
  • If your personal data is processed, you have the right to receive information from the controller about the data stored about you (Art. 15 GDPR).
  • If incorrect personal data is processed, you have the right to rectification (Art. 16 GDPR).
  • If the legal requirements are met, you may request the erasure or restriction of processing (Art. 17 and 18 GDPR).
  • If you have consented to the data processing or if there is a contract for data processing and the data processing is carried out with the help of automated procedures, you may have a right to data portability (Art. 20 GDPR).
  • If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes. 
  • Furthermore, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is The Bavarian State Office for Data Protection Supervision (BayLDA) This can be reached at:

The Bavarian State Office for Data Protection Supervision
Postal address: P.O. Box 1349, 91504 Ansbach, Germany
Telephone: 0981/ 180093-0
Fax: 0981/ 180093-800
E-mail: poststelle@lda.bayern.de
Web: www.lda.bayern.de


You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6 (1) (e) of the GDPR (data processing in the public interest) and Art. 6 (1) (f) of the GDPR (data processing on the basis of a balance of interests), Art. 21 (1) of the GDPR. This also applies to profiling based on this provision within the meaning of Art. 4 (4) GDPR.  

If you object, we will no longer process your personal data unless we can demonstrate compelling interests worthy of protection for the processing that override your interests, rights and freedoms, or the processing serves the assertion, exercise or defense of legal claims. 

The objection can be made form-free. 

8. Right of revocation in case of consent
If you have consented to processing by the controller by means of a corresponding declaration, you can revoke your consent at any time for the future. The legality of the data processing carried out on the basis of the consent until the revocation is not affected by this.