Whistleblowing — raise a concern safely
If you have noticed a possible breach of the law, internal policies or ethical standards in any ECHO company, you can report it here safely, anonymously if you prefer. Your voice matters and you are protected by law.
Who can raise a concern
- Current or former employees of ECHO companies
- Applicants in a recruitment process
- Collaborators and contractors
- Suppliers
- Business partners
- Residents and their families
- Anyone else with relevant information about the conduct of the organization, its staff or those acting on its behalf
What you can report
- Fraud
- Corruption or bribery
- Conflicts of interest
- Theft or misuse of assets
- Financial or accounting irregularities
- Breaches of the law, regulations or internal policies
- Retaliation against people who raise concerns
- Risks to health, safety or the environment
- Harassment, including sexual harassment
- Discrimination
- Abuse, violence, exploitation or serious risk to a person
- Other serious unethical conduct
You do not need to prove anything before raising a concern; it is enough to describe in good faith what you have observed.
You do not need to investigate yourself, access information unlawfully or put yourself or others at risk to obtain evidence.
How it works
- Submit your report, with or without your name. Only the description is required.
- You receive a code and a password. Keep them safe: they are the only way to follow up on your report.
- Receipt of your report is confirmed automatically, in the report mailbox.
- You receive information on the progress of your report within 3 months at most.
Anonymity and confidentiality
On these pages we use no analytics or advertising tools and we do not store your IP address. If you choose to remain anonymous, no one at ECHO can find out your identity from the system. If you give your name, your identity remains confidential: only the people handling the report know it, and it may be disclosed only with your express consent or where the law requires it; in that case you are informed in writing beforehand of the disclosure and the reasons for it, unless informing you would jeopardise the related investigations or judicial proceedings (Article 8(3) of Law no. 361/2022).
- Use a personal device, not your work computer or phone.
- Connect from your own network (for example, mobile data), not from your workplace Wi-Fi.
- Open the page in a private browser window and close the window when you are done.
- If you want to remain anonymous, do not write your name in the text and check that your attachments do not identify you (for example, through a name, a signature, comments or the file name).
- Keep the code and password away from your work device, for example written down on paper, and do not save them in your browser.
To be transparent: like any website, this one is hosted by cloud service providers, who see IP addresses in their technical logs; our application does not store them. The content of your report is encrypted, and the technical team cannot read it through the application. Additional protection, with encryption directly in the browser (end-to-end), is planned.
Protection against retaliation
Law no. 361/2022 and the ECHO procedure prohibit any retaliation — dismissal, demotion, intimidation, discrimination — against anyone who reports in good faith (Article 22). If it happens anyway, report that too: it is handled as a priority. If a measure taken against you is challenged, it is for the employer or, as the case may be, the entity that took the measure to prove that it was not retaliation (Article 23(2)).
Who receives your report
Reports are received by the person designated by the group: Roxana Bordeanu, Legal and Compliance Director. If the report concerns this person, or they could have a conflict of interest, tick the option in the form and the report will go directly to the Chair of the Board of Directors or to an independent person appointed by the Board.
Alternative: e-mail
You can also send your report by e-mail, directly to the Legal and Compliance Director, at: ...
E-mail is not anonymous: your sender address is visible, and the message does not have the protections of the online channel (encryption, code and password). To remain anonymous, use the form.
If the report concerns the Legal and Compliance Director, or they could have a conflict of interest, do not use e-mail: use the form and tick the conflict of interest option.
External channels
You can also report directly to the competent authorities, including the National Integrity Agency (Agenția Națională de Integritate), which operates the external reporting channel provided for by Law no. 361/2022. You can use the external channel instead of the internal one or after it (Article 5(2) of the law).
Processing of personal data
The data controller is ECHO Elderly Care S.A. (registration code CUI 52225235), with its registered office at Str. Argentina nr. 33, ap. 3, etaj 1, Sector 1, București, Romania. The channel is operated at group level, for all ECHO companies.
Purpose: receiving, reviewing and resolving reports, protecting the people who report, and keeping the register provided for by Article 7 of Law no. 361/2022.
Legal basis: the controller's legal obligation — Article 6(1)(c) of Regulation (EU) 2016/679 (GDPR), in conjunction with Articles 9–10 of Law no. 361/2022 on the protection of public interest whistleblowers.
Data about people mentioned in a report (for example, the person concerned or witnesses) is processed on the basis of the same legal obligation or, where applicable, the controller's legitimate interest in verifying and remedying wrongdoing (Article 6(1)(f) GDPR), with due regard for the rights provided by Article 25 of Law no. 361/2022.
Reports are received and handled by the Legal and Compliance Director or, where applicable, by the Chair of the Board of Directors or the independent person appointed by the Board. For the review, a report may be referred to an internal function or an external adviser, keeping it confidential and only as far as necessary. Other people at ECHO, including executive management and the technical team, have no access to the content through the application. The providers hosting the application act as processors, and authorities receive data only where the law requires it.
Transfers outside the European Economic Area: the providers that host the application and send the e-mail notifications may also process data on servers outside the EEA. In such cases, the transfer takes place only with appropriate safeguards, such as the standard contractual clauses approved by the European Commission or an adequacy decision (Articles 44–46 GDPR). A copy of the safeguards can be obtained from the data protection officer at the address below.
Retention: reports and their documents are kept for 5 years after closure and then destroyed, regardless of the medium (Article 7(2) of Law no. 361/2022).
On the channel's pages we use no analytics or advertising cookies, and the application stores neither your IP address nor information about your browser.
To limit abuse, we keep a pseudonymous technical key for 24 hours, derived from your IP address (for the mailbox, from the code or the identifier of the report). The key is deleted automatically and kept separately from the report; the IP address itself is not stored.
The mailbox uses no cookies: the session opened with the code and password exists only in the open page, is not saved on your device and ends after 30 minutes, when you log out or when you reload the page.
Your rights: access, rectification, erasure, restriction of processing and objection, under the conditions of the GDPR, as well as the right to lodge a complaint with the Romanian data protection authority, ANSPDCP (www.dataprotection.ro). Some rights may be restricted as far as necessary to protect the identity of the whistleblower and the proper conduct of the review; the right of access of people mentioned in a report does not extend to the identity of the whistleblower.
For questions about how your data is processed, you can contact the data protection officer (DPO), Adrian Magda, at: ...
Procedure on public interest whistleblowers (Procedura privind avertizorii în interes public) — October 2026