Supplier Management and Supply Chain
Normative and operational documentation on data protection and information security applicable to the suppliers and the supply chain of the Borgstena Group.
Demonstrating Borgstena's commitment to compliance and accountability in the management of suppliers and the supply chain, and reinforcing transparency and information in the contractual relationship, this page brings together the main policies, operational procedures, procurement instructions and security measures in force in the organisation.
1. Framework
The management of suppliers and the supply chain takes place at the intersection of two essential regulatory frameworks: Regulation (EU) 2016/679 (GDPR), as regards the protection of personal data processed by suppliers and their employees, and Directive (EU) 2022/2555 (NIS 2), as regards the security of information and cybersecurity throughout the supply chain. This interplay is reflected in the documentation below, in which the references to the GDPR, NIS 2 or GDPR+NIS 2 are expressly indicated.
This page complements, at the operational level, the Data Processing Policy in Relations with Suppliers, the Special Data Processing Information Sheet — Suppliers' Representatives or Employees, and the other reference documentation of the Data Protection Platform.
2. Applicable documentation
3. Relationship with the Data Protection Platform
The documentation on this page is directly connected to the following elements of the Platform:
- the Data Processing Policy in Relations with Suppliers, which sets out the applicable principles and general rules;
- the Special Data Processing Information Sheet — Suppliers' Representatives or Employees, which details the processing activities;
- the Incident Reporting Form, within the Unified Notification Procedure;
- the Information Security Page, as regards the cybersecurity dimensions of the supply chain.
4. Contacts and channels
For any matter relating to data protection and to the processing of personal data of suppliers' representatives or employees, the Data Protection Officer may be contacted at dataprotection@borgstena.com. For matters relating to information security and cybersecurity in the context of the relationship with suppliers, the Permanent Security Contact Point is accessible through the channels indicated on the Information Security Page.
5. Term and review
This page, as well as the documentation to which it provides access, is subject to periodic review, under the responsibility of the Data Protection Officer and the Security Officer, whenever developments in the regulatory framework, the entry into force of the national transposition of Directive (EU) 2022/2555 or developments in the Group's practices so warrant.