Hotline Privacy Notice

This privacy notice (“Notice”) describes how Wella Company, which includes Wella Company International Operations Switzerland S.à.r.l. (our headquarters) and its affiliates and subsidiaries1 (“Wella Company”, “we”, “us”, “our”, or similar) collect and use your personal data when you use the Wella Ethics & Compliance Hotline (the “Hotline”). In this Notice, personal data means information that (either in isolation or in combination with other information) enables you to be directly or indirectly identified (“personal data”). For the purposes of the Hotline, Wella Company is the data controller. If you want further information about the way Wella Company processes personal data and your privacy rights, please see the Wella Privacy Notice found at wellacompany.com/privacy-policy. If you are a Wella Company employee, please also refer to the Employee Privacy Notice.  

The Hotline is run by an independent third party, EQS, on our behalf. 

EQS provides whistleblowing platform software and runs the telephone hotline. Any reports made on the platform or by telephone are received by EQS, which then sends the report to Wella Company. Reports submitted by other means (e.g., email) are received directly by Wella Company personnel. All investigations are handled by Wella Company personnel, although they may be supported by external experts. Because Wella Company is a global organization, the reports may be investigated by Wella Company personnel in any of the countries in which there is a Wella Company presence.  

We will typically collect the name and contact details of the person making the report as well as details of other individuals named in a report together with a description of the conduct at issue and any questions or concerns raised by the reporter. Depending on the nature of the matter being reported, we may collect sensitive personal data including information relating to racial or ethnic origin, physical or mental health, sexual orientation, criminal convictions, and offences. 

You are in control of what personal data you provide when you submit your report. Concerns can be raised anonymously where it is allowed by local law. If you wish to remain anonymous, please be aware that sometimes you may be identifiable from the information that you provide and other contextual information, so you should take care not to include any information that could be used to identify you in free text fields. 

In any event, you can be assured that your confidentiality will be protected to the greatest extent possible, consistent with the need for us to conduct an adequate investigation and comply with any legal obligations to which we are subject. 

Any personal data you submit in connection with a hotline report will be processed for the purpose of, and to the extent necessary, to enable us to comply with our legal obligations and pursue our legitimate interests to investigate your report and take any necessary further action. Where a report contains sensitive personal data or information about criminal convictions or offences, we will only use this information where it is permissible to do so in accordance with applicable laws or where the processing is necessary to comply with employment law obligations and /or establish or defend legal claims. We will obtain your consent where we need to do so in order to comply with applicable laws. 

Wella Company is a global organization. To the extent permitted by applicable law, your personal data may be transferred to, stored, or accessed by Wella Company personnel located around the globe. 

When your personal data is transferred to (or accessed from) a country which has not been deemed ‘adequate’ by the ‘transferee’ country, we ensure that appropriate safeguards are implemented in accordance with applicable laws. 

We make every effort to keep your information secure and have technical and organizational measures in place to protect your personal data, including limiting who has access to the reports and any investigation. 

In general, personal data in reports will be retained for two (2) years from the closure of the case. After 2 years, we will review the case to determine whether the data needs to be further retained, for example if it is required for ongoing litigation/internal proceedings, or to comply with local laws. 

Please note that the retention period mentioned in the paragraph above does not apply to reports made in Portugal, involving Wella Company entities based in Portugal, and/or involving employees who were based in Portugal at the time the report was made. In such cases, the data will be retained for at least 5 years to comply with Portuguese law.  

Subject to applicable local laws, you have the right to request access to and to receive details about the personal data we process about you; request that certain personal data about you be transmitted to another entity, rectified, erased, or restricted; or to object to the processing of your personal data in the context of a report to the Hotline.  

You have a right to lodge a complaint. When making a complaint to Wella Company, we request that you put your complaint in writing to assist with our investigation. We will investigate your complaint and will use reasonable endeavours to respond to you within a reasonable time of receiving the written complaint and in accordance with any local legal requirements. If we fail to respond to your complaint within the timeframes set by applicable laws or if you are dissatisfied with the response that you receive from us, you may also have the right to lodge a complaint with the competent data protection supervisory authority, depending on your jurisdiction. 

If you have any questions or complaints relating to the processing of your personal data, please raise them with us directly. If you are not satisfied with our response, you may consult your local data protection authority.  

If you have any questions or complaints about the Hotline, or if you would like to exercise your rights, please contact wella.data.privacy@wella.com.