Data Protection Platform — Presentation

The Borgstena Group Data Protection Platform is the single point of access to the information, the normative documentation and the contact channels relating to the processing of personal data carried out by the companies of the Group.

This presentation page describes the purpose of the Platform, its regulatory framework, its structure and the way in which data subjects, employees, suppliers and other interested parties may use it. The Platform is available at borgstena.dataprotectionofficer.help, in a Portuguese version and an English version.

1. What the Data Protection Platform is

The Data Protection Platform is an instrument of transparency and accountability through which the Borgstena Group publishes, in an organised and permanently accessible manner, the set of policies, information sheets, procedures and forms that govern the processing of personal data within the companies of the Group.

More than a documentary repository, the Platform gives effect to the Borgstena Group's commitment to complying with the General Data Protection Regulation and to effectively demonstrating that compliance. It brings together, in a single environment, the information that data subjects need in order to understand the processing operations that concern them and to exercise their rights, as well as the channels that allow them to contact the Data Protection Officer directly.

2. Purpose: compliance and accountability

The Platform serves a twofold purpose. On the one hand, it ensures compliance, by making available to data subjects the prior, clear and complete information to which they are entitled regarding processing operations and their respective purposes, lawful bases and retention periods. On the other hand, it ensures accountability, enabling the Borgstena Group to demonstrate, at any time and to any interested party or supervisory authority, that it adopts and maintains technical and organisational measures appropriate to the protection of personal data.

The principle of accountability is enshrined in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, hereinafter the GDPR), under which the controller must not only comply with the principles relating to the processing of personal data but must also be able to demonstrate such compliance. In this sense, the Platform is a living and continuously updated record of the Group's diligence.

3. Regulatory framework

The activity documented on this Platform is governed, in the first place, by the GDPR, which is directly applicable in all Member States of the European Union. In Portugal, the GDPR is complemented by Law No. 58/2019 of 8 August, which ensures its implementation within the national legal order, as well as by the other applicable sectoral legislation.

The Borgstena Group operates in several legal jurisdictions. In the companies established within the European Union — namely in Portugal, the Czech Republic, Romania and Sweden — the GDPR and the national implementing legislation of each Member State apply. In the companies established outside the Union, the processing of personal data additionally observes the applicable local legislation, namely [the Brazilian General Data Protection Law — Law No. 13.709/2018 — and the Chinese personal information protection legislation, the detailed reference to which is under review].

4. How the Platform is organised

The Platform is structured to allow intuitive access to information through three complementary navigation areas.

4.1. Side menu

The side menu brings together institutional and contact links: the link to the Group's institutional website, the page listing the companies of the Group, the compliance platforms page and the Permanent Support and Contact page.

4.2. Main top menu

The top menu provides access to the normative and operational content of data protection:

• the Privacy and Data Protection Policies, which set out the general principles and rules adopted by the Group;
• the Data Processing Information Sheets, which describe each category of processing in detail;
• the Rights and Incident Forms, which facilitate the exercise of rights and the reporting of incidents;
• the Data Protection Officer page, with the corresponding contacts and procedures;
• the pages dedicated to the Whistleblowing channel, to Information Security, to Human Resources and Careers and to Supplier Management and the Supply Chain;
• the Frequently Asked Questions (FAQ) section.

4.3. Bottom menu

The bottom menu brings together the documentation relating to the Platform itself: the Platform Data Protection Policy, the Platform Cookie Policy and the Platform Technical Sheet.

5. Who the Platform is for

The Platform is addressed to all data subjects whose personal data are processed by the Borgstena Group, namely employees and job applicants, representatives and employees of suppliers and partners, customers and users and, in general, any natural person whose data are processed by the Group. It is also addressed to the competent supervisory authorities, which find on it the documentary evidence of compliance with legal obligations.

6. The Data Protection Officer

The Borgstena Group has designated a Data Protection Officer, in compliance with Articles 37 to 39 of the GDPR. The Data Protection Officer informs and advises the Group regarding its obligations, monitors compliance of processing operations, cooperates with the supervisory authority and acts as the contact point for data subjects. The dedicated Data Protection Officer page, accessible from the top menu, brings together the corresponding contacts and the procedures for handling enquiries.

7. Updating and continuous improvement

This revision of the Platform reflects the Borgstena Group's commitment to continuous improvement, aligning its structure and content with the evolution of the regulatory framework and with best practice in the documentary management of compliance and accountability. The Platform is subject to periodic review under the responsibility of the Data Protection Officer, and any material changes are recorded in the corresponding Technical Sheet.