Special Data Processing Information Sheet
Workers
Information provided to the workers of the Borgstena Group, within the employment relationship, in compliance with Articles 12, 13 and 14 of the GDPR and with the Labour Code.
This Special Sheet describes the processing of workers' personal data carried out by the Borgstena Group as employer, and complements the Data Protection and Privacy at Work Policy and the General Data Processing Information Sheet.
1.Commitment to information and transparency
The Borgstena Group, as employer, complies with the duty to inform workers set out in Articles 12 to 14 of the GDPR, providing in this Sheet the information relating to the processing of their personal data, in conjunction with the Labour Code, approved by Law No. 7/2009 of 12 February.
2.Identification of the controller
| Company name | Dual Borgstena Textile Portugal, Unipessoal, Lda. |
|---|---|
| Identification number | 502355409 |
| Registered office | EN 234 — km 87.7 (Chão do Pisco), Apartado 35, 3521-909 Nelas |
| General telephone | (+351) 232 427 660 |
| General email | info@borgstena.com |
3.Data Protection Officer
For any matter relating to the processing of their personal data, the worker may contact the Borgstena Group's Data Protection Officer at dataprotection@borgstena.com.
4.Data subjects covered
This Sheet applies to the workers of the Borgstena Group bound by an employment contract, in any of its forms, including, with the necessary adaptations, workers under temporary assignment and trainees.
5.Processing activities
| Purpose | Categories of data | Lawful basis | Recipients | Retention |
|---|---|---|---|---|
| Performance of the employment contract and administrative management | Identification, contacts, civil, tax, social security and health user identification, household. | Performance of the contract (Article 6(1)(b) of the GDPR); compliance with legal obligations (Article 6(1)(c) of the GDPR). | Human resources services; Tax Authority; Social Security. | During the contract and for two years after termination, under Article 337(1) of the Labour Code, without prejudice to longer legal periods. |
| Work planning and organisation | Identification, role, qualifications, schedules, attendance records. | Performance of the contract (Article 6(1)(b) of the GDPR); legitimate interest of the employer in the exercise of management powers (Article 6(1)(f) of the GDPR). | Human resources services; line managers. | During the contract. |
| Occupational safety and health Special cat. | Identification, health data, occupational medicine examinations. | Compliance with occupational safety and health obligations (Article 9(2)(b) of the GDPR); Article 6(1)(c) of the GDPR. | Subcontracted occupational medicine services, under strict professional secrecy; Working Conditions Authority. | For the legal periods applicable to occupational safety and health matters. |
| Access and attendance control Special cat. | Identification, biometric data. | Performance of the contract (Article 6(1)(b) of the GDPR); legitimate interest (Article 6(1)(f) of the GDPR); Article 9(2) of the GDPR, and the provisions of the Labour Code on biometric data. | Human resources services; security and facilities services. | During the contract and for the applicable legal periods. |
| Trade union membership Special cat. | Identification, trade union membership data. | Compliance with legal obligations in employment, social security and social protection law (Article 9(2)(b) of the GDPR); at the worker's request. | Human resources services; trade unions, under legal terms. | During the contract and for the applicable legal periods. |
| Training and professional development | Identification, qualifications, training data. | Performance of the contract (Article 6(1)(b) of the GDPR); compliance with legal obligations (Article 6(1)(c) of the GDPR). | Human resources services; subcontracted training entities. | During the contract and for the applicable legal periods. |
| Assessment of professional performance | Identification, performance and assessment data. | Performance of the contract (Article 6(1)(b) of the GDPR); legitimate interest of the employer (Article 6(1)(f) of the GDPR). | Human resources services; line managers. | During the contract and for the applicable legal periods. |
| Compliance with tax, social security and employment obligations | Identification, tax and contributory data, remuneration data. | Compliance with legal obligations (Article 6(1)(c) of the GDPR). | Tax Authority; Social Security; Working Conditions Authority; Employment and Vocational Training Institute; banking and insurance entities. | For the legal periods applicable to tax, contributory and employment matters. |
| Management of the termination of the employment relationship | Identification, contractual data, financial data, relevant documentation. | Performance of the contract (Article 6(1)(b) of the GDPR); compliance with legal obligations (Article 6(1)(c) of the GDPR). | Human resources services; competent public entities. | Two years after termination of the contract, under Article 337(1) of the Labour Code, without prejudice to longer legal periods. |
6.Categories of personal data processed
The Employer processes, within the strict limits of the purposes and lawful bases indicated, the following personal data of workers: name, marital status, civil, tax, social security and health user identification numbers, age, date and place of birth, academic, technical and professional qualifications, telephone numbers, composition and identification of household members, training data and professional performance assessment data.
7.Special categories of data
On the basis of the exception provided for in Article 9 of the GDPR, and in strict compliance with professional secrecy obligations, the Employer processes the following special categories of data: trade union membership data, biometric data and health data. The processing of these categories is subject to enhanced security and confidentiality measures and is limited to what is strictly necessary.
8.Source of the data
Workers' personal data are collected directly from them, at the time of hiring and throughout the employment relationship, or from third parties in the cases legally provided for. Where the data are obtained indirectly, the information set out in Article 14 of the GDPR is provided.
9.Recipients and processors
Workers' personal data are communicated to third parties only where this is necessary for compliance with legal obligations — namely before the Tax Authority, the Social Security services, the Working Conditions Authority, the Employment and Vocational Training Institute, banking and insurance entities — or for the performance of the contract. Where processors are engaged, namely for occupational medicine, management consultancy, human resources, accounting or legal services, the contracts provided for in Article 28 of the GDPR are concluded.
10.International transfers
Whenever transfers take place to Borgstena Group companies established outside the European Economic Area, namely within shared functions, the requirements of Chapter V of the GDPR are observed.
11.Automated decisions and profiling
The processing operations described in this Sheet do not involve automated individual decisions likely to produce legal effects on the worker, within the meaning of Article 22 of the GDPR.
12.Data retention
Workers' personal data are retained throughout the employment relationship and, after its termination, for the two-year period provided for in Article 337(1) of the Labour Code, without prejudice to longer legal periods applicable in tax, contributory and occupational safety and health matters. The period may be extended where this is necessary for the declaration, exercise or defence of the Employer's rights in legal proceedings.
13.Workers' rights
The worker may, at any time and free of charge, exercise the rights to withdraw consent (where applicable), to information, of access, rectification, erasure, restriction of processing, portability and objection, under the terms and with the limitations provided for by law and arising from the employment relationship. These rights are exercised through the Rights Exercise Form or by contacting the Data Protection Officer.
14.Relationship with the Policy and the General Sheet
This Sheet complements the Data Protection and Privacy at Work Policy and the General Data Processing Information Sheet, accessible on the Data Protection Platform.
15.Complaints to the supervisory authority
The worker has the right to lodge a complaint with the National Data Protection Commission (CNPD), through the contacts available at www.cnpd.pt.
16.Versions of the Sheet
Version of this Sheet: 202605. Date: 26 May 2026. To consult previous versions, the worker may send a request by email to dataprotection@borgstena.com.