Special Data Processing Information Sheet
Suppliers' Representatives or Employees
Information provided to the legal representatives and employees of the Borgstena Group's suppliers, in compliance with Articles 12, 13 and 14 of the GDPR.
This Special Sheet describes the processing of personal data of legal representatives and employees of the Borgstena Group's suppliers, within the contractual relationship and the management of procurement, and complements the Data Processing Policy in Relations with Suppliers and the General Data Processing Information Sheet.
1.Commitment to information and transparency
The Borgstena Group complies with the duty to inform set out in Articles 12 to 14 of the GDPR towards the legal representatives and employees of its suppliers, providing in this Sheet the information relating to the processing of their personal data.
2.Identification of the controller
| Company name | Dual Borgstena Textile Portugal, Unipessoal, Lda. |
|---|---|
| Identification number | 502355409 |
| Registered office | EN 234 — km 87.7 (Chão do Pisco), Apartado 35, 3521-909 Nelas |
| General telephone | (+351) 232 427 660 |
| General email | info@borgstena.com |
3.Data Protection Officer
For any matter relating to the processing of their personal data, the supplier's representative or employee may contact the Borgstena Group's Data Protection Officer at dataprotection@borgstena.com.
4.Data subjects covered
This Sheet applies to the legal representatives of Borgstena's suppliers, whether natural or legal persons, as well as to the employees of such suppliers who, within the contractual relationship, interact with Borgstena or access its premises.
5.Processing activities
| Purpose | Categories of data | Lawful basis | Recipients | Retention |
|---|---|---|---|---|
| Verification of the legitimacy of legal representatives | Identification, capacity in which they act, contact data. | Performance of a contract (Article 6(1)(b) of the GDPR); compliance with legal obligations (Article 6(1)(c) of the GDPR). | Contracting and procurement services. | For the duration of the contractual relationship and the applicable legal periods thereafter. |
| Management of the contractual relationship and procurement | Identification, contacts, professional data and certifications. | Performance of a contract (Article 6(1)(b) of the GDPR); legitimate interest in the pursuit of the economic activity (Article 6(1)(f) of the GDPR). | Contracting and procurement services; financial services. | For the duration of the contractual relationship and the applicable legal periods thereafter. |
| Premises access control | Identification, traffic and access data, image (video surveillance). | Legitimate interest in the protection of persons and property (Article 6(1)(f) of the GDPR); compliance with legal obligations. | Security and facilities services; competent authorities in the legally provided cases. | One year by default, without prejudice to the applicable legal periods for video surveillance images. |
| Occupational safety, hygiene and health | Identification, occupational safety and health training and certifications, presence data on the premises. | Compliance with legal obligations (Article 6(1)(c) of the GDPR); legitimate interest in the protection of persons and property (Article 6(1)(f) of the GDPR). | Occupational safety and health services. | For the legal periods applicable to occupational safety and health matters. |
6.Categories of personal data processed
Borgstena processes the following categories of personal data: identification data; contact data; professional data and certifications; traffic and premises access control data. The processing is limited to the data strictly necessary for each purpose, in accordance with the principle of data minimisation.
7.Source of the data
Personal data are collected directly from the data subjects themselves or, indirectly, from their employer, namely through the completion of information registration forms. Where the data are obtained indirectly, the information set out in Article 14 of the GDPR is provided.
8.Recipients and processors
Personal data are processed exclusively by Borgstena's contracting and procurement, human resources management and occupational safety and health services. They are not communicated to third parties, save in the legally provided situations. Where it is necessary to engage processors, namely for the operation of information systems or access control, the contracts provided for in Article 28 of the GDPR are concluded.
9.International transfers
Whenever transfers take place to Borgstena Group companies established outside the European Economic Area, the requirements of Chapter V of the GDPR are observed.
10.Automated decisions and profiling
The processing operations described in this Sheet do not involve automated individual decisions likely to produce legal effects on the data subject, within the meaning of Article 22 of the GDPR.
11.Data retention
Personal data are retained for the period necessary to pursue the purposes of the processing, in compliance with the applicable legal deadlines. The default retention period for the personal data of suppliers' representatives or employees is one year, without prejudice to longer periods required by legal obligations, namely in contractual, tax and occupational safety and health matters.
12.Rights of data subjects
The data subject may, at any time and free of charge, exercise the rights to withdraw consent, to information, of access, rectification, erasure, restriction of processing, portability and objection, through the Rights Exercise Form or by contacting the Data Protection Officer. A response is provided within one month, extendable by two months in justified cases, under Article 12(3) of the GDPR.
13.Relationship with the Policy and the General Sheet
This Sheet complements the Data Processing Policy in Relations with Suppliers and the General Data Processing Information Sheet, accessible on the Data Protection Platform.
14.Complaints to the supervisory authority
The data subject has the right to lodge a complaint with the National Data Protection Commission (CNPD), through the contacts available at www.cnpd.pt.
15.Versions of the Sheet
Version of this Sheet: 202605. Date: 26 May 2026. To consult previous versions, the data subject may send a request by email to dataprotection@borgstena.com.