General Data Processing Information Sheet
Users, Service Users and Service Recipients
Information provided under Articles 12, 13 and 14 of the GDPR, in compliance with the Borgstena Group's duty of transparency as controller.
This Information Sheet fulfils the controller's duty to provide, in a transparent and accessible manner, the information set out in Articles 12, 13 and 14 of the GDPR to the Users, Service Users and Service Recipients of the Borgstena Group.
1.Commitment to information and transparency
The Borgstena Group, demonstrating its commitment to transparency in the processing of personal data, provides in this Sheet the information set out in Articles 12 to 14 of Regulation (EU) 2016/679 (GDPR) and in Law No. 58/2019 of 8 August. This Sheet is general in nature and applies to Users, Service Users and Service Recipients, without prejudice to the Special Sheets applicable to specific contexts.
2.Identification of the controller
| Company name | Dual Borgstena Textile Portugal, Unipessoal, Lda. |
|---|---|
| Identification number | 502355409 |
| Registered office | EN 234 — km 87.7 (Chão do Pisco), Apartado 35, 3521-909 Nelas |
| General telephone | (+351) 232 427 660 |
| General email | info@borgstena.com |
| Website | www.borgstena.com |
This Sheet applies, with the necessary adaptations, to the other companies of the Borgstena Group as controllers of the personal data they process in the exercise of their activity.
3.Data Protection Officer
The Borgstena Group has designated a Data Protection Officer, in compliance with Articles 37 to 39 of the GDPR, who may be contacted for any matter relating to the processing of personal data at dataprotection@borgstena.com. The contacts and procedures of the Data Protection Officer are set out at borgstena.dataprotectionofficer.help/borgstena/data-protection-officer.
4.Categories of data subjects covered
This Sheet applies to the following categories of data subjects:
- Users of Borgstena's channels, systems and applications;
- Service Users of the services provided by Borgstena;
- Service Recipients, whether natural persons or representatives or employees of legal persons;
- visitors to the controller's premises, as regards data collected through access control and video surveillance systems.
5.Processing activities
Detailed information on each processing activity, namely as regards purpose, categories of data, lawful basis, recipients and retention period, is set out in the table below:
| Purpose | Categories of data | Lawful basis | Recipients | Retention |
|---|---|---|---|---|
| Management of requests and contacts | Identification, contact, content of the request. | Pre-contractual steps (Article 6(1)(b) of the GDPR); legitimate interest in responding to contacts (Article 6(1)(f) of the GDPR). | Competent Borgstena services; communication platform processors. | For the period necessary to respond to the request and any possible development into a contractual relationship. |
| Provision of institutional information | Identification, contact, communication preferences. | Consent (Article 6(1)(a) of the GDPR); legitimate interest (Article 6(1)(f) of the GDPR). | Institutional communication services. | Until consent is withdrawn or the data subject objects. |
| Management of pre-contractual, contractual and post-contractual relationship | Identification, contact, professional data, billing data, interaction records. | Performance of a contract (Article 6(1)(b) of the GDPR); compliance with legal obligations (Article 6(1)(c) of the GDPR). | Commercial, financial and legal services of Borgstena; public entities in compliance with legal obligations. | During the contractual relationship and for the applicable legal periods thereafter, namely in tax and commercial matters. |
| Direct marketing communications | Identification, contact, preferences and interaction history. | Prior and express consent (Article 6(1)(a) of the GDPR), under the electronic communications regime (Law No. 41/2004 of 18 August). | Institutional communication services; communication delivery processors. | Until consent is withdrawn or the data subject objects. |
| Access control and video surveillance of premises | Identification, image, access traffic data. | Legitimate interest in the protection of persons and property (Article 6(1)(f) of the GDPR); compliance with legal obligations. | Security and facilities services; competent authorities in the legally provided cases. | In accordance with the applicable legal periods, namely [up to thirty days for video surveillance images, save for retention on legally justified grounds]. |
6.Source of the data
Personal data are, as a rule, collected directly from the data subject through the channels, forms, systems and applications made available by Borgstena. Where processing concerns data not collected from the data subject, Borgstena provides the information set out in Article 14 of the GDPR, namely as regards the source and the categories of data concerned.
7.Recipients and processors
Personal data are processed by the internal services of Borgstena strictly competent in view of the purpose. Borgstena may engage processors for the performance of specific operations, namely hosting, electronic communication, accounting or legal services, concluding with each of them the contracts provided for in Article 28 of the GDPR. Outside these cases, personal data are communicated to third parties only where there is a legal obligation or express authorisation of the data subject.
8.International transfers
Whenever transfers of personal data take place outside the European Economic Area, namely to Borgstena Group companies established in third countries, the requirements of Chapter V of the GDPR are observed, by means of adequacy decisions or, in their absence, appropriate safeguards such as standard contractual clauses approved by the European Commission.
9.Automated decisions and profiling
The processing operations described in this Sheet do not involve automated individual decisions likely to produce legal effects on the data subject, within the meaning of Article 22 of the GDPR. Should such processing arise in practice, specific information is provided in accordance with the law.
10.Rights of data subjects
The data subject may, at any time and free of charge, exercise the rights provided for in the GDPR, namely the right to withdraw consent, the right of access, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability and the right to object. These rights are exercised through the Rights Exercise Form or by contacting the Data Protection Officer, with a response provided within one month, extendable by two months in justified cases, under Article 12(3) of the GDPR.
11.Relationship with the Data Protection Policy
This Sheet complements the Personal Data Protection and Privacy Policy of the Borgstena Group, to which it refers for the applicable definitions, principles and general rules. The Policy and the other Special Sheets are available on the Data Protection Platform at borgstena.dataprotectionofficer.help/borgstena/policies and at borgstena.dataprotectionofficer.help/borgstena/information.
12.Complaints to the supervisory authority
Without prejudice to direct contact with the Data Protection Officer, the data subject has the right to lodge a complaint with the competent supervisory authority. In Portugal, the supervisory authority is the National Data Protection Commission (CNPD), whose contacts are available at www.cnpd.pt.
13.Versions of the Sheet
Version of this Sheet: 202605. Date: 26 May 2026. To consult previous versions, the data subject may send a request by email to dataprotection@borgstena.com.