Privacy Statement for Whistleblower Reporting

WHISTLEBLOWER REPORTING
PRIVACY STATEMENT

What is the purpose of this Privacy Statement?

This Privacy Statement gives you information about the personal data we collect about you in relation to your whistleblowing report (hereinafter “Report”), and how and for what purposes we process your personal data. We understand and respect the importance of privacy. This Statement describes how Huawei Sweden uses and protects your personal data and how we fulfil our obligations under GDPR. It also contains a summary of your rights in relation to your personal data. Some of the terminology in this Statement may be unfamiliar to you – there is a glossary at the end of the Statement which you may find useful. Terms which are included in the glossary are in capital letters.

The identity and contact details of the Controller

Your personal data will be processed by: Huawei Technologies Sweden AB (hereinafter "Huawei Sweden", "we", "our" and "us") with registered address at Gustav III:s Boulevard 50A, 169 03 Solna, Sweden. Our Data Protection Officer can be contacted at: Huawei DPO Office; Hansaallee 205 teg; 40549 Düsseldorf or via electronic contact form: https://www.huawei.com/en/personal-data-request

What Personal Data do we process, for what purposes and how?
Personal Data collected and processed
The source of personal data	The personal data and information that will be collected are directly provided by you.
Will we process special categories of data?	We may process special categories of data containing in your report only if such data are clearly relevant for the processing of the specific report.
Below you will find detailed information on what personal data we process, for what purpose and on what legal basis arising from generally applicable data protection regulations.
For what purpose does Huawei Sweden process your personal information?	What categories of personal data do we process for this processing purpose	Legal basis of processing
Comply with our legal obligations.	1. You can choose to remain anonymous when reporting. In this case, we will not process your personal data; 2. If you choose to identify yourself, only the data delivered by you (e.g. name, contact details) will be processed by Huawei Sweden for the purpose of case handling. We will contact you through the information delivered by you to: o provide you with a confirmation that the report has been received by us (within 7 days); o provide you with feedback and result in response to your report (within 3 months after confirmation of receipt).	Article 6(1)(c) GDPR; Legal obligation of Swedish Act (2021: 890) on the protection of persons who report malpractice;
Evaluate suspected serious violations of laws or regulations, as well as suspected breach of Huawei Sweden’s policies or Code of Conduct.	Data related to a litigation	Article 6(1)(f) GDPR; Legitimate interest
Please be informed that if the processing for aforementioned purposes involve any special categories of personal data, the processing will be based on Article 9(2)(e)(g) GDPR. Please also be informed if your report contains personal data which are manifestly not relevant for the handling of a specific report, we will delete it without undue delay.
Recipients of the personal data	Please be informed that for the purpose of processing your report and conducting investigations, the personal data and other information in your report will be accessed by the authorized investigation team at Huawei Sweden, law enforcement authorities or, if required by law, by other local authorities. Please also be informed that Huawei Sweden uses suppliers and service providers to ensure carrying out its business and to ensure adequate protection of the Personal Data. The processing of Personal Data in relation to our suppliers is always commissioned by us and the parties will act only on our behalf as data processors or based on another contractual set-up. Such processing is always protected with contractual arrangements to ensure that your Personal Data is processed in accordance with the laws and good data processing practices. Huawei Sweden and its suppliers and service providers shall establish technological, physical, administrative and procedural safeguards all in line with the industry accepted standards in order to ensure the confidentiality, integrity and accessibility of the Personal Data processed; prevent the unauthorized use of or unauthorized access to the Personal Data or prevent a Personal Data breach (security incident).
How long will the Personal Data be retained before it is deleted?	Your personal data may be retained only for a period of time that is necessary to fulfil the purposes for which the personal data was collected and used. We may retain your personal data for no more than 2 years after the investigation is closed.
Transfer of Personal Data out of the EEA
Huawei is a global group of companies that does not always operate within the territorial boundaries of the legal entities and countries in which it is based. Like most global organizations, Huawei has centralized data management systems that include access to personal information by Huawei group companies outside the European Economic Area. Huawei ensures adequate protection of your data by conducting Transfer Impact Assessment, implementing appropriate safeguards, which include technical and organizational measures as well as contractual mechanisms, to ensure that the personal data you provide is protected as required by applicable data protection laws.
Your rights as a data subject
As the Data Subject, you have certain legal rights in relation to your personal data, which you can find described below. Depending on the case and the legal basis for processing your personal data, these rights may be subject to certain restrictions under the applicable data protection rules. To exercise these rights or contact us on privacy or data protection issues, please send your request via a written notice to Huawei Sweden (please find address in section ‘The identity and contact details of the Controller’) or to the dedicated contact channel: https://www.huawei.com/en/personal-data-request
Right of Access	You have the right to obtain a confirmation from Huawei Sweden as to whether or not Personal Data concerning you is being processed and, where that is the case, access to a copy of the Personal Data and specific information about how Huawei Sweden or any of its affiliates processes your Personal Data.
Right of Rectification (Correction)	You have the right to obtain from Huawei Sweden the correction of inaccurate Personal Data concerning you and also the right to have incomplete Personal Data completed.
Right of Erasure (Deletion)	You have the right to obtain from Huawei Sweden the erasure (deletion) of your Personal Data in particular circumstances.
Right of Restriction	You have the right to obtain from Huawei Sweden restriction of processing in particular circumstances.
Right of Objection	You have the right to object to the processing of your Personal Data in particular circumstances.
Right of Portability	In certain circumstances, you have the right to receive your Personal Data in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller. Please bear in mind that the right of portability does not apply in the case of processing personal data on legal obligation or legitimate interests’ basis.
Right to Withdraw Consent	Where the legal basis of processing Personal Data is based on consent, you have the right to withdraw your consent at any time by providing a withdrawal notice to Huawei Sweden. Please note, however, that the withdrawal of your consent will not affect any use of the Personal Data made before you withdrew your consent.
Right to lodge a Complaint	If you consider your Personal Data is not being processed in compliance with the applicable laws, you have the right to lodge a complaint with any relevant supervisory authority. List of Supervisory Authorities: https://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/index_en.html

Glossary
Controller	An organisation who (alone or jointly with others) determines the purposes and means of the processing of Personal Data.
Data Transfer Agreement	An agreement containing standard data protection clauses adopted by the European Union Commission as referred to in Article 46(2)(c)of the GDPR.
Data Subject	The identified or identifiable natural person to whom the Personal Data relates.
GDPR	Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
Legal Basis	Processing of Personal Data is only lawful if and to the extent that at least one legal basis specified in the GDPR applies. The available legal bases which are applicable for this data processing activity are specified above.
Personal Data	Any information relating to an identified or identifiable natural person (Data Subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Anonymized data is not considered personal data.
Process / Processing	Any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Special Categories of Personal Data	Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.