Data Protection and Privacy at Work Policy
DUAL BORGSTENA TEXTILE PORTUGAL UNIPESSOAL,LDA, legal person with tax number PT502355409, with registered office at EN KM 234 KM 87.70, 3520-095 Nelas, Portugal, hereinafter referred to as Dual Borgstena Textile Portugal, “Employer” or “Data Controller”, hereby publishes this Data Protection and Privacy Policy, to ensure transparency and the dissemination of information to each of its employees on the rules applicable to Data Protection in the Employment Context, following the entry into force of the General Data Protection Regulation (hereinafter GDPR) and the Law Implementing the General Data Protection Regulation (hereinafter LERGPD).
1.Contact details of the Data Controller
Dual Borgstena Textile Portugal establishes the following contacts for the purpose of applying the rules of the GDPR as Data Controller:
General email address: info@borgstena.com;
General telephone: + 351 232427660;
Website: www.borgstena.com;
Email address of the Data Protection Officer: dataprotection@borgstena.com.
2.Personal data processed
The Employer, within the strict limits of the purposes and legal grounds specified below, processes, by itself or on its behalf, Employees’ personal data, namely name, marital status, civil, tax, social security and health user identification numbers, age, date of birth, place of birth, academic, technical and professional qualifications, telephone numbers, composition and identification of members of the respective household, training data and professional performance data.
The Employer, on the grounds of the exception provided for in Article 9 of the General Data Protection Regulation and in strict compliance with the provisions of the aforementioned article, in particular with regard to the obligation of professional secrecy, also processes the following special categories of personal data: trade union membership, biometric data and health data.
3.Purpose of processing
Employees’ personal data is processed for the purposes inherent in the performance of the employment contract, including compliance with related legal obligations, namely planning and organization of work, equality and diversity in the workplace, health and safety at work, protection of the Employer’s assets and for the purposes of the exercise and enjoyment, individually or collectively, of employment-related rights and benefits, as well as for the purposes of termination of the employment relationship.
Without prejudice to the above purposes, special categories of personal data are processed for the following specific purposes:
a) trade union membership – for compliance with legal obligations and/or at the request of Workers;
b) biometric data – for access control to facilities and/or attendance control and for the protection of persons and property;
c) health data – for the purposes of preventive and occupational medicine and for assessing the working capacity of Workers, by subcontractors legally qualified for the purpose, and under strict obligation of professional secrecy.
4.Legal basis for treatment
4.1. The processing of the aforementioned personal data is necessary for:
i) the performance of the employment contract,
ii) the fulfillment of legal obligations to which the Employer is subject by virtue of applicable national or Community legislation,
iii) the effect of the legitimate interests pursued by the Employer, namely the exercise of its management powers and the corresponding optimization of its operational organizational processes.
4.2. Outside of these cases, the Employer may process data collected from Employees for other specific, explicit and legitimate purposes, expressly obtaining the corresponding and legitimate consent of the Employees at the time of collection.
5.Recipients
5.1. Within the scope and context of the employment relationship and for the purposes and on the grounds specified above, the Employer may communicate the Employees’ personal data to other entities, namely subcontractors for the provision of occupational medicine, management consultancy, human resources, accounting, tax, legal or other services, banking entities, insurance entities, the Tax Authority, Social Security Services, the Working Conditions Authority, the Employment and Professional Training Institute, judicial entities, enforcement agents, the National Data Protection Commission and other entities as determined by law or in compliance with judicial orders.
5.2. The Employer, in accordance with the provisions of the General Data Protection Regulation, will formalize the corresponding contracts with its subcontractors, ensuring that they adopt the technical and organizational protection measures required to protect the personal data they process.
6.Retention period
6.1 Without prejudice to personal data being kept for the period strictly necessary to achieve the specific purposes in question, and compliance with other applicable legal time limits depending on the special categories of personal data processed, Employees’ personal data will be kept, by default, for a period of two years from the termination of the employment contract binding the Parties, under the terms of Article 337(1) of the Labor Code.
6.2 Employees are informed that this period may be extended when this becomes necessary for the declaration, exercise or defense of the Employer’s rights in legal proceedings.
7.Rights of the Personal Data Subject
7.1. Employees, as holders of personal data, have the right of access, rectification, erasure, limitation, opposition and data portability, under the conditions and with the exceptions provided for by law.
7.2 In the event of a breach of their personal data, the Data Subject may also lodge a complaint with a supervisory authority, namely the National Data Protection Commission.
7.3 In cases where the legal basis for the processing of their personal data is consent, Employees also have the right to withdraw their consent at any time, without this affecting the lawfulness of the processing carried out until then on that basis.
8.Exercising the rights of the Data Subject
8.1. To exercise any type of data protection and privacy rights or for any matter relating to data protection, privacy and information security, Employees may contact the Data Protection Officer at dataprotection@borgstena.com, describing the subject of the request and indicating an e-mail address, a telephone contact address or a correspondence address for reply.
8.2 A Form for Exercising the Rights of Personal Data Subjects is available to Employees at https://borgstenabtp.dataprotectionofficer.help/forms or at any of the Employer’s work service points, and can also be requested by emailing the Data Protection Officer.
9.Obligations of Employees with regard to the protection of personal data
Employees are obliged to act in accordance with the legal rules applicable to the protection of personal data and with the internal rules in force in this area, namely the procedures, internal regulations and work instructions in the area of data protection and information security, and are expressly aware of the terms of the Data Protection Policies and Information Security Policies approved by the Data Controller, accessible on the Data Protection Officer’s Documentation Platform at https://borgstenabtp.dataprotectionofficer.help/.
10.Duty of secrecy and confidentiality
Employees are bound by duties of secrecy and confidentiality whenever they process personal data, in accordance with the terms of the Data Protection and Privacy Policy accessible at www.borgstena.com, and must guarantee the confidentiality of all personal data within the scope of their employment responsibility, undertaking to comply with all procedural, technical and organizational measures necessary for the secrecy of personal data or information, and to process this data in a manner that guarantees its security, including protection against unauthorized or unlawful processing and against accidental access, editing, disclosure, use, destruction or damage, adopting the measures deemed appropriate for this purpose.
11.Duty to report a personal data breach
11.1 Employees must be aware of and comply with the rules of the personal data and information security incident management system in force at the Employer.
11.2 In the event of a personal data breach, Employees must notify the Employer without undue delay and, where possible, within 12 hours of becoming aware of it, unless the personal data breach is not likely to result in a risk to the rights and freedoms of natural persons. If the notification is not transmitted within 12 hours, it must be accompanied by the reasons for the delay.
11.3 A Personal Data Breach Incident Reporting Form is available to Employees at https://borgstenabtp.dataprotectionofficer.help/forms or at any of the Employer’s work service points, and can also be sent by email by requesting it from the Data Protection Officer.
12.Permanent Security Contact Point
12.1 Employees are informed that the Employer has set up a Permanent Contact Point for the management of information security and cyberspace security incidents, in accordance with the legal regulations in force, and that they are obliged to report the occurrence of any information security incident or cyberspace security incident as soon as they become aware of it, by contacting the Permanent Contact Point without undue delay via the communication channels indicated at https://borgstenabtp.dataprotectionofficer.help/security.
12.2 Employees must use the Information Security or Cyberspace Security Incident Reporting Form, which can be accessed at https://borgstenabtp.dataprotectionofficer.help/forms or at any workplace service point, and can also be sent by email by contacting the Permanent Contact Point.
13.Whistleblower protection
13.1 Employees are informed that the Employer has implemented a Whistleblowing Channel, accessible via the link available at https://www.whistleblowingofficer.com/borgstena/, in accordance with the legal regulations in force, guaranteeing the protection of data subjects’ personal data.
13.2 A Whistleblowing Form is available to Employees at https://borgstenabtp.dataprotectionofficer.help/whistleblowing or at any workplace service point, and the Whistleblowing Officer at the Employer may also be asked to send it by email, using the contact details available at that link.
14.Data Processing Information Sheets
Employees can consult all of the Employer’s Data Processing Information Sheets on the Data Protection Officer Platform, accessible at https://borgstenabtp.dataprotectionofficer.help/information, or in person at any employment service point.
15.Changes to Internal Data Protection Procedures, Policies or Standards
15.1. To ensure their updating, development and continuous improvement, Employees are informed that the Employer may, at any time, make any changes that are deemed appropriate or necessary to the Procedures, Policies or Internal Data Protection Standards, and that they are published in the various internal channels to ensure transparency and information for Employees.
15.2 Employees are informed that they can consult the applicable updated versions of the Procedures, Policies or Internal Data Protection Standards on the Data Protection Officer’s Documentation Platform, accessible at https://borgstenabtp.dataprotectionofficer.help/ or in person at any workplace service point and can also consult the document history by emailing a request to dataprotection@borgstena.com.
16.Support from the Data Protection Officer
To request intervention or request technical and regulatory assistance or support in the field of data protection or privacy, Employees should contact the Employer’s Data Protection Officer by email at dataprotection@borgstena.com. The functional description, procedures and contact details are available on the Data Protection Officer’s Support Platform, accessible to Employees at https://borgstenabtp.dataprotectionofficer.help/support.
17.Versions of the Employment Data Protection and Privacy Policy
Version of this Policy: 202306.
Date: 20230620.
To consult previous versions of the Data Protection and Privacy in the Workplace Policy, Employees can send a request by email to dataprotection@borgstena.com.
