Privacy Policy

1. Preamble

Published in May 2016, the General Data Protection Regulation (GDPR) regulates the protection of natural persons with regard to the processing of personal data and the free movement of such data, replacing Directive 95/46/EC, which was transposed into the Portuguese legal system by the Personal Data Protection Law, Law no. 67/98 of 26 October. This latter law was subsequently repealed by Law no. 58/2019 of 8 August, which ensures the implementation of the GDPR in national territory.

The approval of this regulatory framework aims to increase citizens’ trust in public and private entities by creating a more stable, clear, and predictable legal regime, putting an end to the differences that previously existed among the national legislations of the various Member States.

The GDPR introduces significant changes in the relationship between data controllers and data subjects, including in the employment relationship.

Concern for the privacy of its employees is not a new topic for TSMARTS, S.A., which has always conducted its activities in compliance with the most fundamental rights of its employees. Proof of this concern can be found in the existing internal regulations, which provide all relevant information to employees.

This Regulation aims to materialize concern with Personal Data Protection in a transversal manner, applying it to the entire internal structure of the company, as well as to clarify the conditions under which personal data processing is carried out, in accordance with the principles described in Article 5 of the GDPR.

Chapter I – General Provisions

Clause 1 – Scope

1. This Regulation applies to all collaborators, internal and external, regardless of the nature of their relationship with TSMARTS, S.A., hereinafter referred to as TSMARTS, as well as to its directors and board members.
2. This Regulation lists the personal data processing operations carried out by TNORD-TECH, the conditions for their lawfulness, and the data retention periods, considering the fundamental principles of personal data protection and full respect for data subjects’ rights.
3. This Regulation sets out the rights and obligations of TSMARTS’ collaborators regarding the processing of personal data, in addition to guiding the company’s duties as the controller of such processing.

Clause 2 – Definitions

For the purposes of this Regulation and the General Data Protection Regulation (GDPR), the following definitions apply:

a) “Personal data”: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, electronic identifiers, or one or more elements specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person;

b) “Processing”: any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction;

c) “Controller”: the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data – in this case, the controller is TSMARTS;

d) “Processor”: a natural or legal person who processes personal data on behalf of the controller;

e) “Health data”: personal data related to the physical or mental health of a natural person, including the provision of healthcare services, which reveal information about that person’s health status;

f) “Supervisory authority”: the National Data Protection Commission (CNPD);

g) “Consent” of the data subject: any freely given, specific, informed, and explicit indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

Chapter II – Personal Data Processing

Clause 3 – Lawfulness of Personal Data Processing

1. Personal data processing carried out by TSMARTS in the employment context is based on the following lawful grounds:

a) Necessity for the performance of a contract to which the data subject is a party, namely the employment contract, pursuant to Article 6(1)(b) of the GDPR;
b) Compliance with legal obligations, pursuant to Article 6(1)(c) of the GDPR, in accordance with the Portuguese Labour Code and, in the case of occupational health, Law no. 102/2009;
c) Legitimate interest of the controller, in cases involving the use of video surveillance systems, internal communications to employees, and the collection of employee images at internal TSMARTS events, pursuant to Article 6(1)(f) of the GDPR;
d) Consent of the data subject, in the case of promotional communications and the use of employee images for promotional videos or external communications;
e) Processing of special categories of data, whether in the context of occupational and preventive medical examinations, alcohol and psychoactive substance testing, or data processing resulting from the contracting of mandatory insurance, based on Article 9(2)(b) and (h) of the GDPR.

2. Personal data of clients, suppliers, or third parties processed by TSMARTS are processed on the following lawful grounds:

a) Necessity for the performance of a contract, for the purpose of managing client contracts, pursuant to Article 6(1)(b) of the GDPR;
b) Legitimate interest of the controller, for sending campaign communications and promotional actions related to products and services transacted with the client, institutional communications, or communications falling within “social usage” with third parties with whom TSMARTS has an institutional relationship, as well as the use of video surveillance systems;
c) Compliance with a legal obligation, namely invoicing, pursuant to Decree-Law no. 28/2019 of 15 February;
d) Processing based on the consent provided by the client for other situations.

Clause 4 – Data Collection

1. Data collection for subsequent processing must be carried out in accordance with applicable legislation and best known practices.
2. Data collection shall consider data subjects’ rights, the lawful basis authorizing the processing, the purpose of collection, and compliance with contractual or legal obligations.
3. Whenever available, a specific form designed for data collection must be used.
4. Where no specific form exists, data collection must follow criteria of necessity and indispensability of the information requested.
5. The use of collected data for subsequent purposes, when not based on consent, must comply with the conditions set out in Article 6(4) of the GDPR.

Clause 5 – Sharing of Personal Data with Third Parties

1. TSMARTS may engage processors to provide services involving personal data processing, ensuring compliance with data protection principles and data subjects’ rights through contracts in accordance with Article 28 of the GDPR.
2. In compliance with legal obligations, TSMARTS is required to transmit employees’ personal data to competent public authorities, limiting such transmission to strictly necessary data.
3. Any other disclosure of personal data to third parties shall comply with the legal limits established by the GDPR and related legislation.

Clause 6 – Technical and Organizational Measures

1. Personal data processing carried out by TSMARTS is governed by a set of technical and organizational measures, namely:
   a) Appointment of a Data Protection Officer and disclosure of their contact details;
   b) Creation of mechanisms to respond to data subjects’ rights requests;
   c) Definition of access profiles to systems and media containing personal data;
   d) Establishment of dedicated channels to respond to personal data incidents, namely the email rgpd@tnord.pt;
   e) Creation of procedures for conducting Data Protection Impact Assessments whenever legally required or decided by management;
   f) Compliance with data protection by design and by default principles, pursuant to Article 25 of the GDPR.

Clause 7 – Security of Processing

1. All personal data processing under TSMARTS’ responsibility complies with technological and procedural measures aimed at ensuring security, whether implemented internally or externally.
2. Personal data in physical (paper) format is afforded the same level of security as data stored in digital format.

Clause 8 – Security Measures

1. Depending on the nature and characteristics of the processing, TSMARTS applies measures to:
   a) Prevent unauthorized access to documents containing personal data;
   b) Prevent unauthorized reading, copying, alteration, or destruction of data media;
   c) Ensure traceability of access to media containing personal data.
2. Any collaborator, director, or administrator of TSMARTS undertakes to comply with this Regulation, particularly by:
   a) Not disclosing system passwords;
   b) Not storing passwords automatically;
   c) Adopting “clean desk” policies;
   d) Using electronic devices responsibly, including logging out when absent, avoiding public networks, and not installing unauthorized software.

Clause 9 – Confidentiality Commitment

1. All personal data processed by TSMARTS is subject to confidentiality obligations.
2. In accordance with the principle of least privilege, access to data is limited to what is strictly necessary for job functions.
3. All members of TSMARTS undertake to comply with the confidentiality and security obligations listed in points a) to l).

Clause 10 – Personal Data Breaches

1. All personal data breaches are handled in accordance with established procedures.
2. Suspected or confirmed breaches must be reported to rgpd@tnord.pt.
3. Any breach must be reported to the Data Protection Officer within 24 hours of detection.

Chapter III – Data Subject Rights

Clause 11 – Compliance with Data Subject Rights

1. Data subjects shall be informed in accordance with Article 13 of the GDPR at the time of data collection.
2. Data subjects have the right of access, rectification, erasure, restriction, objection, and data portability, subject to legal limitations.
3. Requests must be forwarded to the Data Protection Officer within 24 hours of receipt.

Chapter IV – Personal Data Processing in the Employment Context

Clause 12 – Time and Access Management

1. Attendance control is carried out using an employee card containing only the employee’s name and identification number.
2. Access to sensitive areas is restricted to authorized personnel.
3. Authorized personnel lists are reviewed whenever necessary.

Clause 13 – Human Resources Management

1. Employee data may be shared with public authorities and training entities in compliance with legal obligations.
2. Data is retained for one year after termination, unless legal or judicial requirements apply.

Clause 14 – Access to Email Accounts

1. TSMARTS may access former employees’ email accounts solely to retrieve relevant business information.
2. Access shall be supervised by the Data Protection Officer.
3. Email accounts are permanently deleted after retrieval of essential information.

Clause 15 – Occupational Health

1. Occupational health activities are carried out in compliance with Law no. 102/2009.
2. Processing is based on Article 9(2)(h) of the GDPR.
3. Data is retained for five years by the responsible physician.

Clause 16 – Processing of Employee Images

1. Video surveillance is used for security purposes based on legitimate interest.
2. Promotional use of images requires prior consent.
3. Images from internal social events are processed based on legitimate interest, with the right to object.

Clause 17 – Identification of External Contractors

Any external personnel working on TSMARTS premises must identify themselves at reception using legally admissible means.

Final Provisions

Clause 20 – Liability

Any violation of this Regulation may result in disciplinary, civil, or criminal liability.

Clause 21 – Gaps

Any omissions shall be resolved in accordance with the GDPR, CJEU case law, EDPB guidelines, and national supervisory authority guidance.