Frequently Asked Questions

The Data Protection Platform is the institutional space, available at borgstena.dataprotectionofficer.help, through which the Borgstena Group fulfils its duties of transparency and accountability in matters of personal data processing. It brings together the policies, information sheets, forms and the contacts of the Data Protection Officer, in Portuguese and in English versions.

The Platform is intended for all data subjects whose personal data are processed by the Borgstena Group — namely customers, users, job applicants, workers, representatives and employees of suppliers — as well as for the supervisory authorities and for any interested party wishing to know the rules and procedures of the Group in matters of data protection.

The Platform serves on a cross-cutting basis the companies of the Borgstena Group, namely Dual Borgstena Textile Portugal, Unipessoal, Lda., and the other companies established in Brazil, China, the Czech Republic, Romania and Sweden. The full list, with the country and the capacity as controller, is set out on the Group Companies page.

The reference regulation is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), complemented in Portugal by Law No. 58/2019 of 8 August. Both instruments are available from official sources, namely the Diário da República and the website of the National Data Protection Commission (www.cnpd.pt).

The applicable regulation is Law No. 93/2021 of 20 December, which establishes the General Regime for the Protection of Whistleblowers of Infringements, transposing Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019. The instrument is accessible through the Diário da República.

At European Union level, the main reference is Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 (NIS 2 Directive). The corresponding national transposition is set out in [national act to be confirmed and referenced here after verification in the Diário da República]. In the processing of personal data, security is also governed by Article 32 of the GDPR.

The Borgstena Group will provide a consolidated glossary on the Platform. The essential definitions — namely personal data, processing, controller and processor — are already included in section 2 (Definitions) of the general Personal Data Protection and Privacy Policy and correspond to the definitions in Article 4 of the GDPR.

The policies in force — the general Policy and the special policies on Applications, Employment Context, Procurement and Cookies — are available at borgstena.dataprotectionofficer.help/borgstena/policies.

The Information Sheets — the General Sheet and the Special Sheets for Applicants, Suppliers, Workers, Cookies and Website — are available at borgstena.dataprotectionofficer.help/borgstena/information.

The Policy is normative in nature: it sets out general principles and rules governing the processing of personal data. The Information Sheet is informative in nature: it describes, in detail, the processing activities, categories of data, lawful bases, recipients and retention periods, fulfilling the duty to inform set out in Articles 12 to 14 of the GDPR.

The GDPR recognises the data subject's rights of access, rectification, erasure, restriction of processing, portability and objection, as well as the right to withdraw consent where the processing is based on that ground, and the right not to be subject to automated individual decisions, including profiling, under Article 22.

Rights are exercised through the Rights Exercise Form available at borgstena.dataprotectionofficer.help/borgstena/forms, or by email to the Data Protection Officer at dataprotection@borgstena.com, describing the subject of the request and indicating a valid contact for reply.

The response is provided within one month from receipt of the request, under Article 12(3) of the GDPR. In cases of particular complexity or of a high number of requests, the deadline may be extended by two further months, with notice to the data subject of the reasons for the extension.

The exercise of rights is free of charge. Only in cases of manifestly unfounded or excessive requests, in particular because of their repetitive character, may a reasonable fee be charged or the response refused, under Article 12(5) of the GDPR.

Yes. Where the processing is based on consent, this may be withdrawn at any time, without affecting the lawfulness of the processing carried out up to that point. The withdrawal of consent may be communicated through the Rights Exercise Form or directly to the Data Protection Officer.

Borgstena processes the data strictly necessary to assess the application: name, role sought, contacts and the elements contained in the curriculum vitae or in the application form. Special categories of data are not requested, save in cases legally admissible and duly justified.

The default retention period for the curricula and personal data of applicants processed by the human resources management services is two years. The applicant may, at any time, request their erasure or exercise any other right.

Yes. The deletion of the application may be requested at any time, through the Rights Exercise Form or by email to the Data Protection Officer, without prejudice to the retention of data strictly necessary to comply with legal obligations.

Borgstena processes the data necessary for the performance of the employment contract and for compliance with related legal obligations, namely civil, tax, social security and health user identification, contacts, professional data, training data and performance assessment data. In certain contexts, and on the basis of Article 9 of the GDPR, it also processes special categories of data — trade union membership, biometric data and health data.

Data are retained, by default, for two years from the termination of the contract, under Article 337(1) of the Labour Code, without prejudice to longer legal periods, namely in tax, contributory and occupational safety and health matters.

Yes. Borgstena processes biometric data for the purposes of access control to facilities and attendance control and for the protection of persons and property. The processing observes the conditions set out in Article 9 of the GDPR and the applicable provisions of the Labour Code, with the adoption of enhanced security measures.

Borgstena processes identification data, contacts, professional data and certifications, as well as traffic and premises access control data, exclusively for the purposes of verifying the legitimacy of representatives, access control, occupational safety and health and the provision of the contracted services.

The Borgstena Group has an integrated set of documents for the supply chain, including General Conditions and Instructions for Processing, Supply Chain Security Policy, Risk Assessment and Incident Management Procedures, Standard Contractual Clauses, Audits and Continuity and Digital Security Requirements. The full index is available at borgstena.dataprotectionofficer.help/borgstena/suppliers.

Yes. Currently, the site uses the necessary cookie _GRECAPTCHA, set by Google's reCAPTCHA service, with the purpose of identifying bots and protecting the site against spam attacks. The detailed and updated list is set out in the Special Data Processing Information Sheet — Cookies.

The user may manage consent through the privacy settings panel made available on the site, changing or withdrawing the consent previously given. The browser settings additionally allow cookies to be blocked or deleted, with the caveat that disabling strictly necessary cookies may affect the operation of the site.

The report may be made through the Personal Data Breach Incident Reporting Form, available at borgstena.dataprotectionofficer.help/borgstena/forms, or by email to the Data Protection Officer at dataprotection@borgstena.com.

The report is made to the Permanent Security Contact Point, through the email address cyber.security@borgstena.com, the telephone (+351) 213 243 750 or the Form available at borgstena.dataprotectionofficer.help/borgstena/forms.

The Permanent Security Contact Point is described on the Information Security page, with the email address, telephone and dedicated Form. The Point operates in conjunction with the Data Protection Officer.

The Data Protection Officer may be contacted by email at dataprotection@borgstena.com. Full contacts and the handling procedures are set out on the Data Protection Officer page.

Yes. The data subject has the right to lodge a complaint with the competent supervisory authority, which, in Portugal, is the National Data Protection Commission (CNPD), through the contacts available at www.cnpd.pt. In the other European Union Member States in which the Borgstena Group operates, the respective national authority is competent.

The report may be made through the Borgstena Group Whistleblowing Platform, accessible at whistleblowingofficer.com/borgstena, under the regime of Law No. 93/2021 of 20 December, with guarantees of confidentiality and protection of the whistleblower against acts of retaliation.

The Whistleblowing Platform allows reports to be submitted with the anonymity option selected, by using the dedicated form at whistleblowingofficer.com/borgstena.

In addition to the Whistleblowing Platform, the email address compliance@borgstena.com and the telephone (+351) 911 879 229 are available. The full description of the channels is set out on the Whistleblowing page.

The Platform dedicated to the prevention of corruption, within the framework of Decree-Law No. 109-E/2021 of 9 December, is accessible at anticorrupcao.pt/borgstena.

The Permanent Support and Contact service of the Platform is accessible through the email servicedesk@dataprotectionofficer.pt and the telephone (+351) 213 243 750, as indicated at borgstena.dataprotectionofficer.help/support.

For matters of personal data protection and exercise of rights, the Rights Exercise Form or the contact of the Data Protection Officer should be used. For security incidents, the Permanent Security Contact Point. For whistleblowing reports, the Whistleblowing Platform. For technical, procedural or orientation support in the use of the Platform, the Support service.

The Support service and the Data Protection Officer are available to answer any question on the Platform and on the processing of personal data by the Borgstena Group. This list of Frequently Asked Questions is subject to periodic review and your suggestion is welcome.