Privacy Policy for the Blueprint AG Whistleblower Portal
1. Controller
The controller for the personal data processed through this portal is Blueprint AG, Lindberghstraße 17, 80939 Munich, Germany.
2. Operation of the reporting office
The internal reporting office is operated by intelligent piXel GmbH, Enzianstraße 4a, 82319 Starnberg, as an independent external reporting office under Section 14 (1) of the German Whistleblower Protection Act (HinSchG) and as a processor under Article 28 GDPR. Reports are handled independently and free from instructions as to their substance.
3. Hosting
The portal is hosted on servers of Hetzner Online GmbH in a data centre in Germany.
4. Purpose and legal basis
We process your data in order to receive and handle reports under the German Whistleblower Protection Act. The legal basis is Article 6 (1) (c) GDPR together with the obligations arising from that Act.
5. What data we process
We process the content of your report, any details you provide voluntarily, your case access credentials, and processing and deadline data. You may submit a report without providing personal data. We store a name only if you choose to provide one. We do not store IP addresses. Your self-chosen password is stored solely as a non-reversible hash.
6. Reporting by phone with a voice assistant
For reporting by phone we use an AI voice assistant that guides you through the call and responds in several languages, so that language barriers do not stand in the way. The assistant converts speech into text. This voice processing is carried out by X.AI LLC as a processor. Your caller number is not stored. The technical telephone connection is provided by Twilio Ireland Limited. The transcript of the call is transferred into the portal and handled confidentially in the same way as a written report.
7. Recipients and processors
To provide the service we use the following processors: X.AI LLC for the voice assistant and transcription, and Twilio Ireland Limited for the telephone connection. Both are bound by contract under Article 28 GDPR and pass the same data protection obligations on to their own sub-processors. The telecommunications carriers themselves are not processors, because the mere transmission of a call does not constitute processing within the meaning of data protection law.
8. Processing in third countries
X.AI LLC is a company based in the United States. Even where data is held in the EU, processing in the United States cannot be ruled out. This transfer is safeguarded by the Standard Contractual Clauses of the European Commission. For Twilio Ireland Limited, safeguards are provided through Binding Corporate Rules, additional Standard Contractual Clauses and the Data Privacy Framework. Processing takes place primarily on servers within the European Union.
9. Confidentiality
Your identity is treated confidentially under Section 8 HinSchG, including towards Blueprint AG. Blueprint AG does not learn your identity. Disclosure takes place only in the statutory exceptions set out in Section 9 HinSchG.
10. Retention period
Your report and the related documentation are deleted three years after the procedure has been concluded (Section 11 (5) HinSchG). For the X.AI LLC voice assistant, zero data retention is enabled, no content is stored after processing is complete, and your data is not used to train AI models. The authoritative record is kept solely within the portal.
11. Your rights and contact
Within the limits provided by law, you have the right of access, rectification, erasure, restriction of processing and objection, insofar as this is compatible with confidentiality under Section 8 HinSchG. In particular, you may request the erasure of your data.
As long as and to the extent that we are legally required to document and retain the report (Section 11 HinSchG, Article 17 (3) (b) GDPR), we will delete it only once that obligation no longer applies, at the latest three years after the procedure has been concluded.
To exercise your rights or for data protection questions, you can contact the reporting office at: intelligent piXel GmbH, Enzianstraße 4a, 82319 Starnberg, Germany, my@intelligent-pixel.com (encrypted via Proton Mail). You may also lodge a complaint with the competent supervisory authority, the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.
12. Protection against reprisals
As a whistleblower you are protected against reprisals under Section 36 HinSchG, including a reversal of the burden of proof in your favour. Further details are set out in the reprisal protection notice on this portal.
13. No tracking
We do not use any analytics or tracking services and we do not use cookies, apart from a technically necessary session.
14. Fonts and icons
The fonts (Google Fonts) and icons (Lucide) used on this portal are served locally from our own server. Loading the site does not establish any connection to Google or other third-party servers, and no data, in particular no IP addresses, is transmitted to third parties.
This page is also available in German. In case of doubt or discrepancies, only the German version is authoritative.