Privacy Policy
1. Preamble
Published in May 2016, the General Data Protection Regulation (GDPR) governs the protection of natural persons with regard to the processing of personal data and the free movement of such data, replacing Directive 95/46/EC, which was transposed into the Portuguese legal system by the Personal Data Protection Law, Law No. 67/98 of 26 October. This law was subsequently repealed by Law No. 58/2019 of 8 August, which ensures the application of the GDPR within national territory.
The approval of this regulatory framework aims to increase citizens’ trust in public and private entities by creating a more stable, clear, and predictable legal regime, putting an end to the differences that previously existed between the national legislations of the various Member States.
The GDPR introduces significant changes in the relationship between data controllers and data subjects, including in the employment relationship.
Concern for the privacy of its employees is not a new issue for TSMARTS, S.A., which has always carried out its activities in compliance with the most fundamental rights of its employees. Evidence of this concern can be found in existing internal regulations, which provide all relevant information to employees.
This Regulation aims to give concrete form to the concern with Personal Data Protection in a transversal manner, applying it to the entire internal structure of the company, as well as to clarify the conditions under which personal data are processed, in accordance with the principles described in Article 5 of the GDPR.
Chapter I – General Provisions
Clause 1 – Scope
This Regulation applies to all employees, internal and external, regardless of the nature of their relationship with TSMARTS, S.A., hereinafter referred to as TSMARTS, as well as to its directors and members of the board of directors.
This Regulation lists the personal data processing operations carried out by TNORD-TECH, the conditions for their lawfulness, and the data retention periods, taking into account the fundamental principles of personal data protection and full respect for the rights of data subjects.
This Regulation establishes the rights and obligations of TSMARTS employees regarding the processing of personal data, in addition to guiding the duties of the company as the data controller.
Clause 2 – Definitions
For the purposes of this Regulation and the General Data Protection Regulation (GDPR), the following definitions apply:
a) “Personal data”: information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, online identifiers, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person;
b) “Processing”: an operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction;
c) “Controller”: the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data – in this case, the controller is TSMARTS;
d) “Processor”: a natural or legal person which processes personal data on behalf of the controller;
e) “Health data”: personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about that person’s health status;
f) “Supervisory authority”: the National Data Protection Commission (CNPD);
g) “Consent” of the data subject: any freely given, specific, informed, and explicit indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Chapter II – Processing of Personal Data
Clause 3 – Lawfulness of Personal Data Processing
The processing of personal data carried out by TSMARTS in the employment context is based on the following lawful grounds:
a) Necessity for the performance of a contract to which the data subject is a party, namely the employment contract, under Article 6(1)(b) of the GDPR;
b) Compliance with legal obligations, under Article 6(1)(c) of the GDPR, in accordance with the Portuguese Labour Code and, in the case of occupational health, with Law No. 102/2009;
c) Legitimate interest of the controller, in cases involving the use of video surveillance systems, internal communications to employees, and the collection of images of employees at internal TSMARTS events, under Article 6(1)(f) of the GDPR;
d) Consent of the data subject, in the case of promotional communications and the use of employee images for promotional videos or external communications;
e) Processing of special categories of data, whether in the context of occupational and preventive medical examinations, alcohol and psychoactive substance testing, or data processing resulting from the contracting of mandatory insurance, based on Article 9(2)(b) and (h) of the GDPR.
The personal data of clients, suppliers, or third parties processed by TSMARTS are processed on the following lawful grounds:
a) Necessity for the performance of a contract, for the purposes of managing contracts with clients, under Article 6(1)(b) of the GDPR;
b) Legitimate interest of the controller, for sending communications regarding campaigns and promotional actions related to products and services transacted with the client, institutional communications, or communications that fall within “social use” with third parties with whom TSMARTS maintains an institutional relationship, as well as the use of video surveillance systems;
c) Compliance with a legal obligation, namely invoicing, under Decree-Law No. 28/2019 of 15 February;
d) Processing based on the consent provided by the client for other situations.
Clause 4 – Data Collection
The collection of data for subsequent processing must be carried out in accordance with applicable legislation and known best practices.
Data collection must take into account the rights of data subjects, the legal basis authorising the processing, the purpose of the collection, and compliance with contractual or legal obligations.
Whenever available, a specific form designed for data collection should be used.
In the absence of a specific form, data collection must follow criteria of necessity and indispensability of the requested information.
The use of collected data for subsequent purposes, when not based on consent, must comply with the conditions established in Article 6(4) of the GDPR.
Clause 5 – Sharing of Personal Data with Third Parties
TSMARTS may engage processors to provide services involving the processing of personal data, ensuring compliance with data protection principles and the rights of data subjects through contracts in accordance with Article 28 of the GDPR.
In compliance with legal obligations, TSMARTS is required to transmit employees’ personal data to competent public authorities, limiting such transmission to strictly necessary data.
Any other disclosure of personal data to third parties must comply with the legal limits established by the GDPR and related legislation.
Clause 6 – Technical and Organisational Measures
The processing of personal data carried out by TSMARTS is governed by a set of technical and organisational measures, namely:
a) Appointment of a Data Protection Officer and disclosure of their contact details;
b) Creation of mechanisms to respond to requests for the exercise of data subject rights;
c) Definition of access profiles to systems and media containing personal data;
d) Establishment of dedicated channels to respond to personal data incidents, namely the email address rgpd@tnord.pt;
e) Creation of procedures for carrying out Data Protection Impact Assessments whenever legally required or decided by management;
f) Compliance with the principles of data protection by design and by default, under Article 25 of the GDPR.
Clause 7 – Security of Processing
All personal data processing under the responsibility of TSMARTS complies with technological and procedural measures designed to ensure security, whether implemented internally or externally.
Personal data in physical (paper) format benefit from the same level of security as data stored in digital format.
Clause 8 – Security Measures
Depending on the nature and characteristics of the processing, TSMARTS applies measures to:
a) Prevent unauthorised access to documents containing personal data;
b) Prevent unauthorised reading, copying, alteration, or destruction of data media;
c) Ensure the traceability of access to media containing personal data.
Any employee, director, or manager of TSMARTS undertakes to comply with this Regulation, namely:
a) Not to disclose system passwords;
b) Not to store passwords automatically;
c) To adopt “clean desk” policies;
d) To use electronic devices responsibly, including logging out when absent, avoiding public networks, and not installing unauthorised software.
Clause 9 – Confidentiality Commitment
All personal data processed by TSMARTS are subject to confidentiality obligations.
In accordance with the principle of least privilege, access to data is limited to what is strictly necessary for job functions.
All members of TSMARTS undertake to comply with the confidentiality and security obligations listed in points a) to l).
Clause 10 – Personal Data Breaches
All personal data breaches are handled in accordance with established procedures.
Suspected or confirmed breaches must be reported to rgpd@tnord.pt.
Any breach must be reported to the Data Protection Officer within 24 hours of detection.
Chapter III – Rights of Data Subjects
Clause 11 – Compliance with Data Subject Rights
Data subjects must be informed in accordance with Article 13 of the GDPR at the time of data collection.
Data subjects have the right of access, rectification, erasure, restriction, objection, and data portability, subject to legal limitations.
Requests must be forwarded to the Data Protection Officer within 24 hours of receipt.
Chapter IV – Processing of Personal Data in the Employment Context
Clause 12 – Time Management and Access
Attendance control is carried out through an employee card containing only the employee’s name and identification number.
Access to sensitive areas is restricted to authorised personnel.
Lists of authorised personnel are reviewed whenever necessary.
Clause 13 – Human Resources Management
Employee data may be shared with public authorities and training entities in compliance with legal obligations.
Data are retained for one year after termination of the contract, unless legal or judicial requirements apply.
Clause 14 – Access to Email Accounts
TSMARTS may access the email accounts of former employees solely to retrieve relevant commercial information.
Access must be supervised by the Data Protection Officer.
Email accounts are permanently deleted after the recovery of essential information.
Clause 15 – Occupational Health
Occupational health activities are carried out in accordance with Law No. 102/2009.
Processing is based on Article 9(2)(h) of the GDPR.
Data are retained for five years by the responsible physician.
Clause 16 – Processing of Employee Images
Video surveillance is used for security purposes based on legitimate interest.
Promotional use of images requires prior consent.
Images from internal social events are processed based on legitimate interest, with the right to object.
Clause 17 – Identification of External Service Providers
Any external personnel working on TSMARTS premises must identify themselves at reception using legally admissible means.
Final Provisions
Clause 20 – Liability
Any breach of this Regulation may result in disciplinary, civil, or criminal liability.
Clause 21 – Gaps
Any omissions shall be resolved in accordance with the GDPR, the case law of the Court of Justice of the European Union (CJEU), the guidelines of the European Data Protection Board (EDPB), and the guidelines of the national supervisory authority.