Submit a Complaint

  • A Confidential Channel for Reporting Potential Legal or Ethical Violations



    This channel is intended exclusively for reporting conduct that may constitute a breach of applicable laws, regulations, or the ethical principles of the Company.
    Reports may be submitted confidentially and, if preferred, anonymously. Kia Iberia S.L.U. ("KES"), acting as Data Controller, will carry out the data processing activities necessary for the management of internal reports submitted through the local whistleblowing channel implemented by KES.
    The Privacy Notice applicable to this internal reporting channel is set out below.

  • 1. Data Controller



    KIA IBERIA, S.L.U., located at Alcobendas (Madrid), C/ Anabel Segura, 16, 2nd Floor (Vega Norte II Building), email: contacto@kia.es, is the Data Controller of the Personal Data processed in connection with the receipt, investigation, and handling of reports submitted through the KES Reporting Channel. If you have any questions regarding how KES processes your personal data, you may contact the KES Data Protection Officer at: lopd@kia.es

  • 2. Data Subjects, Limitation of Processing and Data Minimisation



    KIA IBERIA, S.L.U., located at Alcobendas (Madrid), C/ Anabel Segura, 16, 2nd Floor (Vega Norte II Building), email: contacto@kia.es, is the Data Controller of the Personal Data processed in connection with the receipt, investigation, and handling of reports submitted through the KES Reporting Channel.
    If you have any questions regarding how KES processes your personal data, you may contact the KES Data Protection Officer at: lopd@kia.es

  • 3. Purpose and Legal Basis for Processing



    Personal data provided through the KES Reporting Channel will be processed for the primary purpose of receiving, managing, and investigating reports concerning irregularities, unlawful conduct, serious or very serious breaches of the ethical values, principles, and standards of conduct set out in Kia's Integrity and Compliance Code, applicable legislation, internal regulations, or commitments undertaken by the Company, as well as any other potential misconduct or non-compliance.
    The information provided may also be used to support disciplinary proceedings or the initiation of actions before competent authorities.
    The processing of personal data in connection with internal reporting systems is considered lawful pursuant to Article 6(1)(c) of Regulation (EU) 2016/679 (GDPR), Article 8 of Organic Law 3/2018 of 5 December, and Article 11 of Organic Law 7/2021 of 26 May, where the establishment of an internal reporting system is mandatory under applicable law. Where such obligation does not exist, processing shall be deemed lawful pursuant to Article 6(1)(e) of the GDPR.
    Processing carried out through external reporting channels shall also be considered lawful under the aforementioned legal provisions.

  • 4. Disclosure of Personal Data to Third Parties



    Personal data will be processed in accordance with Law 2/2023 of 20 February on the protection of persons who report regulatory breaches and on combating corruption, Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 of 5 December on Personal Data Protection and the Guarantee of Digital Rights, and Organic Law 7/2021 of 26 May on the processing of personal data for purposes related to the prevention, detection, investigation and prosecution of criminal offences and the execution of criminal penalties.
    Access to personal data contained within the internal reporting system shall be restricted to:
    a) The System Manager and any persons directly responsible for managing the system.
    b) The Human Resources Officer or the duly designated competent body, solely where disciplinary action against an employee may be required.
    c) The legal department or legal counsel of the entity, where legal action relating to the reported facts may be appropriate.
    d) Any duly appointed data processors. In this context, People Intouch B.V. will process relevant personal data solely in accordance with the instructions provided by the Data Controller.
    e) The Data Protection Officer.
    Personal data may also be disclosed to the Legal Department, external legal advisers, judicial authorities, and law enforcement authorities where the facts reported may constitute a criminal offence or another form of legal infringement.

  • 5. International Data Transfers



    Personal data submitted through the KES Reporting Channel will not be transferred outside the European Economic Area (EEA), unless the destination country benefits from an adequacy decision issued by the European Commission confirming an adequate level of data protection.
    Should any relevant personal data be transferred in the future to a recipient located in a country outside these categories, such transfer will only take place subject to appropriate safeguards in accordance with the GDPR.

  • 6. Data Retention Period



    In accordance with applicable data protection legislation, personal data relating to individuals submitting reports, as well as personal data relating to third parties identified in such reports, will be retained within the KES Reporting Channel only for as long as necessary to determine whether an investigation should be initiated and, in any event, for a maximum period of three (3) months from the date of submission, unless retention is necessary to demonstrate the proper functioning of the reporting system.
    Reports that are not pursued may only be retained in anonymised form, and the blocking obligations established under Article 32 of Organic Law 3/2018 shall not apply.
    Notwithstanding the above, data may be retained for a longer period outside the KES Reporting Channel where access is restricted to personnel responsible for internal control and compliance functions. If the investigation results in the need to initiate legal proceedings or judicial action, the relevant data may be retained for the additional period necessary until a final judicial decision is issued, in accordance with applicable law.

  • 7. Exercise of Data Subject Rights



    KES guarantees the exercise of data protection rights at all times. You have the right to request access to, rectification, erasure, restriction of processing, objection to processing, and data portability with respect to your personal data.
    You may exercise your rights by submitting a request through the contact methods specified in this Privacy Notice.
    If you believe that the processing of your personal data does not comply with applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority, the Spanish Data Protection Agency (AEPD): Spanish Data Protection Agency

  • 8. Additional Retention Requirements Applicable in Spain



    For reports originating in Spain, and as required by law, where no investigative actions have been initiated within three (3) months from receipt of the report, the information must be deleted, unless retention is necessary to provide evidence of the proper functioning of the reporting system. Reports that are not pursued may only be retained in anonymised form.