This notice explains how personal data is handled when you use the Swiss Automotive Group SpeakUp channel or when information about you is included in a report. It applies to reports submitted through website, phone, or other available channels. This notice does not describe the reporting procedure itself: information on how to submit a report, who handles reports at the relevant Group company and the external reporting channels available under national law are provided separately by each Group company.
1. Who is responsible for your data?
The data controller for a report is Swiss Automotive Group AG / SAG Management International AG, Erlenstrasse 4, CH-6343 Rotkreuz. Swiss Automotive Group AG and its affiliated companies are referred to in this notice as the "Group Companies".
Reports are received centrally by Swiss Automotive Group AG for initial assessment and triage by the authorized Group SpeakUp Team. Depending on the subject of the report and the persons involved, Swiss Automotive Group AG and the relevant Group companies may act as joint controllers for the subsequent handling of the report. Where a report falls within the scope of a national whistleblowing law, the Group company that is the obliged entity under that law (typically your employer) is the controller for the handling of that report. The investigation may then be conducted locally by the appointed case managers acting on behalf of the relevant Group company or at the Group level by the appointed members of the relevant committee acting on behalf of Swiss Automotive Group AG. Access to report information is restricted to individuals authorized to handle the case.
For privacy questions, contact Group DPO at Datenschutz (at) sag-ag.ch
2. Whose data may be processed?
A report may contain personal data about:
- The person submitting the report, if they choose to identify themselves;
- The person or people whose conduct is reported
- Witnesses or other people who may have relevant information; and
- Other people mentioned in the report or supporting material
You may submit the report anonymously where the option is available. Please avoid including details that could identify you if you wish to remain anonymous. Information in the report may still make someone identifiable.
3. What data may be processed and why?
Depending on the report, we may process:
- Contact and identification details, if provided;
- The report and any follow-up messages;
- Information about the alleged conduct, events, dates and people involved
- Statements, documents, or other evidence provided or collected during the follow-up.
- Information needed to assess, investigate or close the case; and
- Technical information required to operate and secure the reporting service, as described in the service configuration.
We use this information to receive and assess reports, decide whether they fall within SpeakUp process, arrange the appropriate follow-up, investigate where necessary, communicate with the reporting person, protect the confidentiality of the process, document and close the case. We also use it to comply with our legal obligations, to protect reporting persons and other persons involved against retaliation, and to establish, exercise or defend legal claims.
Reports are reviewed by authorized case managers.
4. What is the legal basis for processing
For reports within the scope of applicable whistleblowing laws, Swiss Automotive Group and Group Companies process personal data to comply with their legal obligations (Art. 6(1)(c) GDPR), where those obligations apply.
For reports outside that legal scope but handled through the SpeakUp channel Swiss Automotive Group and Group Companies may rely on their legitimate interests (Art. 6(1)(f) GDPR) in receiving and assessing reports of suspected misconduct and protecting people, assets and the integrity of the business, where that basis is appropriate and the rights and interests of individuals do not override those interests.
A report may include special-category data, such as information about health, ethnicity or trade union membership, or information about alleged offences. We process such data only where this is permitted by applicable law, in particular where it is necessary to comply with our obligations under whistleblowing or employment law, to establish, exercise or defend legal claims or for reasons of substantial public interest (Art. 9(2)(b), (f) and (g) and Art. 10 GDPR).
Submitting a report is voluntary. You do not have to provide information that is not necessary. If you choose not to provide relevant details, this may limit our ability to assess or investigate the report. Where the applicable whistleblowing law requires reporting persons to identify themselves for the report to be handled under that law, providing your identification details is a legal requirement for that purpose.
5. Who may receive or access report information?
Access is restricted to people who need the information for their role in handling the case.
This may include:
- Members of the authorized Group SpeakUp team;
- Designated local or group investigators, depending on the case and any conflict of interest;
- Members of authorized committee or external professional advisers, where their involvement is necessary;
- Relevant Swiss Automotive Group and Group Companies authorized personnel; and
- Public authorities, regulators or courts, where disclosure is required or permitted by the law.
To protect the confidentiality of each report, access is limited to people who need the information to assess, investigate or otherwise handle the case. Access is granted according to the person's role and the case-access rules. A person’s position as a manager or executive does not, in itself, give them access to a report.
The SpeakUp service is provided by People Intouch B.V. acting as a processor of personal data on data subjects. It processes personal data on behalf of Swiss Automotive Group and Group Companies under a Data Processing Agreement signed in June 2025. Other service providers (for example IT and hosting providers or external forensic experts) may process personal data on our behalf as processors under data-processing agreements.
6. Confidentiality and disclosure
We take steps to protect the identity of the reporting person and the information in a report. Access is limited to authorized people who need the information to handle the case.
A reporter’s identity or information that could reveal it may be disclosed only where permitted or required by the applicable law, for example where disclosure is necessary and proportionate in an investigation or judicial proceeding. Where the law requires it, the reporting person will be informed before such disclosure, unless doing so is prohibited. The identity of the person reported and of other persons mentioned in a report is protected in the same way as long as the follow-up is ongoing.
7. International transfers
Because Swiss Automotive Group operates across several countries, case information may be accessed or transferred to another country when needed to handle a report.
Further information about safeguards can be requested from Datenschutz (at) sag-ag.ch
8. How long will we keep the information
We keep report information only for as long as necessary to assess and handle the report, complete any investigation or related proceedings, meet applicable legal obligations, and establish, exercise or defend legal claims. As a rule, the case file is retained for 5 years from receipt of the report, or for the longer period prescribed by the whistleblowing law applicable to the relevant Group company. Reports that are found to fall outside the scope of SpeakUp and are not followed up are deleted without undue delay. Personal data that is manifestly not relevant to the handling of the report is deleted without undue delay.
9. Your privacy rights
Depending on the circumstances and applicable law, you may have the right to request access to, correction or deletion of your personal data, restriction of processing or object to processing. You may also have the right to complain to a data-protection supervisory authority. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. To exercise your rights, contact the Group DPO (see section 11).
These rights may be subject to legal restrictions. In particular, information may be withheld or delayed where the applicable law allows this and it is necessary to protect the confidentiality of a report, prevent interference with an investigation, or protect the rights of others.
10. Information for people named in a report
If your personal data was provided by someone else (for example by the reporting person or a witness, or obtained from our own records), we will provide information about the processing as required by applicable data-protection laws. The timing or extent of that information may be restricted where the law allows and informing you would risk the confidentiality of the reporting process or seriously impair an investigation. In particular, the identity of the reporting person and any information that could reveal it will not be disclosed to you, and your right of access does not extend to that information.
11. Questions
For questions about this notice or the handling of personal data in the SpeakUp process, contact Datenschutz (at) sag-ag.ch
Last updated: October 2026