Declaration of Principle
TUBEMBAL - Transformação de Papel e Comércio de Embalagens, S.A. is firmly committed to strict compliance with respect to the privacy of the personal data of its clients, workers and suppliers, as well as the legal obligations inherent to it, with due regard for the requirements arising from applicable national and community legislation, in terms of the protection of personal data, namely Regulation (EU) 2016/679 of the European PARLIAMENT and of the Council, of 27 April (GDPR - General Data Protection Regulation) and of the national implementation Law No. 58/2019 of 8 August.
This Policy for the Treatment and Protection of Personal Data thus defines the set of rules implemented by Tubembal regarding data collection and processing, without prejudice to the prevalence of mandatory rules provided for in applicable national and community legislation.
I. ENTITY RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA:
Your personal data will be processed by TUBEMBAL - Transformação de Papel e Comércio de Embalagens, S.A., corporate taxpayer no. 504434780, with registered offices at Rua da Milheirada, no. 115 - Lantemil - Santiago de Bougado - 4785-635 Trofa, hereinafter simply referred to as “the Company” or “Tubembal”, which acts as Controller of the processing
of personal data, within the meaning of the General Data Protection Regulation.
In compliance with the regulations in force, the data Controller designates as its representative: Fátima Filipe who can be contacted directly via the following email address: email@example.com
II. CATEGORIES OF PERSONAL DATA COLLECTED
The Company, guided by the principles of necessity and minimization of data, among others, and according to the purposes of the respective data processing, may collect and process your personal data, namely: full name, date of birth, address, tax identification number, citizen card, driver's license, social security number, marital status and household situation, email and telephone contact, image/photo, certification and qualifications, curriculum vitae, work suitability sheet, banking data, job application, mandatory personnel records and other data that are necessary for the execution of contracts (including commercial, provision of services or work), as well as the fulfillment of the legal obligations inherent in them, or the pursuit of legitimate interests pursued by Tubembal or its Subcontractors.
III. RECIPIENTS AND PURPOSES OF THE PROCESSING OF PERSONAL DATA
When applicable and necessary, TUBEMBAL will carry out the processing of your personal data for the following purposes:
- Management of clients and potential clients
The processing of your data is necessary for:
- the execution of the contract to be agreed between you and the Company, in order to provide the service you have contracted, whenever it draws on the data, as well as the inherent commercial management.
- compliance with legal obligations associated with the provision of the service contracted and inherent commercial relationships (e.g. tax, administrative, or ther obligations)
- Marketing and publicity The Company may process your data to send you information about its products and services and to promote promotional campaigns associated with them, to clients. The legal basis for this purpose is the existence of a legitimate interest for the Company. The data processing for this specific purpose, will only be carried out with your written consent, provided at the time by the client, either in physical (paper) or digital format (application or computer platform). If you consent, you will receive marketing communications via email or phone. The unavailability of your personal data (email and telephone) makes it impossible for the Company to send you commercial, or promotional messages, discounts or offers.
Important note: If the client does not provide their data, for the purposes set out in points 1) and 2) and when it becomes necessary for this purpose, Tubembal reserves the right not to provide the requested service.
- Handling of complaints and calls received by the Company
Any contacts or complaints regarding the services provided by the Company, will be the subject of due
processing. For this purpose, your personal data contained in it, which may be provided by you at your initiative, will be processed based on the legitimate interests of the Company and your consent. The Company will collect your data to analyse and resolve the situation that prompted your contact or complaint and may share it with third parties with legally determined competency for its processing, namely, and without prejudice to others:
> CNPD.- Comissão Nacional para a Protecção de Dados [National Commission for Data Protection]:
> ASAE- Autoridade de Segurança Alimentar e Económica [Authority for Economic and Food Safety]
> AT- Autoridade Tributária e Aduaneira [Tax and Customs Authority]
Your data will be kept for this purpose for the time necessary to resolve your issue.
- Management of suppliers and/or Subcontractors
The processing of the data of these third parties, suppliers or subcontractors, is necessary for the execution: either of actual contracts with partners who are subcontracted by the company (e.g.: suppliers, transport service providers, etc.), or of contract(s) to be agreed between the Company and its clients, in order to prepare, produce and deliver requests/orders. If you do not provide your data, we will not be able to provide you with the contracted service.
The personal data of suppliers may be processed by the Company for the purpose of managing legal disputes. Its legal basis is there being a legitimate interest on behalf of the Company, and the data will be kept for the period necessary to exercise the respective rights.
The data of the Company's subcontractors, in particular their representatives and/or employees, may be communicated to the Company's clients in order to comply with contractual or legal obligations, specifically if required to perform the service itself.
- Management of employment relations
Tubembal will undertake the collection and processing of workers' personal data within the scope of their respective employment relationship, with the aim, not only of faithfully executing pre-contractual, contractual and legal obligations, but also to safeguard the legitimate interest of the company as an employer, with regard to the management of human resources, specifically:
administrative management and organisation of human resources; ii)
selection and recruitment of workers; iii)
processing of remunerations, instalments, allowances or bonuses, or others, including garnishments and operations related to mandatory or optional discounts on remuneration, resulting from legal provisions; iv)
safety and health at work; v)
management of disciplinary sanctions; vi)
professional training; vii)
video surveillance; viii)
monitoring of working times and attendance/punctuality; ix)
provision of a meal card; x)
without prejudice to other specific purposes that may be communicated in due course and/or that result from other due contractual or legal obligations.
Within the scope of the purposes listed above, Tubembal will communicate and/or transfer your personal data to the following entities, without prejudice to the others arising from legal and/or contractual obligation:
IGFSS - Instituto de Gestão Financeira da Segurança Social [Institute of Financial Management of Social Security];
AT - Autoridade Tributária e Aduaneira [Tax and Customs Authority];
Occupational Medicine Service
ACT - Autoridade para as Condições do Trabalho [Authority for Work Conditions];
CITE- Comissão para a Igualdade no Trabalho e no Emprego [Commission for Equality in Labour and Employment]
Any other entity to which wage processing and/or other functions related to personnel management have been or will be assigned.
Other entities not mentioned, but which have legal legitimacy to proceed with the processing of the data in question, cannot be excluded.
As the Controller for processing the personal data collected, Tubembal may use third parties (hereinafter referred to as “Subcontractors”) to carry out, on its behalf, the processing of the personal data of the recipients/subjects listed above.
If you are our client or supplier, your personal data may be processed by companies subcontracted by the Company, specifically for the purposes of processing sales and/or transporting and delivering orders, or as part of technical and computer support. These companies will only be provided with the personal data necessary for the provision of the service in question.
Personal data may also be accessed by internal and external auditors of the Company, with the guarantee that it will be kept confidential and will not be used for purposes unrelated to the audits, without prejudice to the possibility of its use for statistical purposes, but only after such data has been rendered anonymous.
For your protection, the aforementioned entities, with which we operate, are contractually bound by duty of confidentiality to safeguard and process your data securely, by duty of privacy by default, to process this data strictly within the need for its use for the purposes described above, and in relation to which these entities, by their activity, have guidelines.
They are also bound by the duty of minimisation, anonymisation and confidentiality of data, without prejudice to other duties arising from applicable legislation, including the duty to delete it after the legal period for keeping it has elapsed.
V. WHAT ARE YOUR RIGHTS AS THE PERSONAL DATA SUBJECT?
At any time, you can ask us for:
to the information we hold about you;
of information if it is inaccurate or incomplete;
- The deletion or limiting of the processing
of your personal data;
- If the processing depends on your consent
or compliance with the contract and the processing is carried out by automated means, you have the right to the sending/portability
of the personal data previously provided, in a structured, commonly used and computer-readable format.
Personal data subjects also retain the right to submit a complaint to the Data Controller and/or the Controlling Authority.
Your requests will be treated with special care so that we can ensure the effectiveness of your rights.
In the event that any of these rights are exercised by their respective subject, they may be asked to prove their identity, to ensure that personal data is only shared with its effective subject.
You will be informed of any measures taken to this effect within one month of the request being made. You should be aware that in certain cases (e.g. due to legal requirements) your request may not be met immediately.
Right to access
The subject of the personal data has the right to obtain confirmation from the Company that the data concerning him or her is being processed and, if applicable, to access their personal data and access the information provided by law.
If you want more than one copy of your personal data being processed, the Company may require the payment of a fee for administrative costs.
Right to rectification
The subject of the personal data has the right to demand from the Company, without undue delay, the rectification of inaccurate or incomplete data concerning him/her.
Right to delete data ("right to be forgotten")
The subject of the personal data has the right to demand from the Company the deletion of his/her data without undue delay and the latter has the obligation to delete the personal data without undue delay, when one of the following reasons is specifically applicable:
a) Personal data is no longer necessary for the purpose for which it was collected or processed;
b) The subject has withdrawn his/her consent for the processing of data (in cases where the processing is based on consent) and there is no other basis for such processing;
c) The subject objects to the processing and there are no overriding legitimate interests justifying the processing;
Right to limitation of the processing
The subject of the data has the right to demand from the Company the limitation of the processing if one of the following specifically applies:
a) To contest the accuracy of personal data, for a period that allows the Company to verify its accuracy;
b) The processing of data is unlawful and the subject of the data objects to the deleting of personal data and requests, in return, the limitation of its use;
c) The Company no longer needs personal data for processing purposes, but this data is required by the subject for the purposes of declaration, exercise or defence of a right in a judicial process;
d) If there is an objection to the processing, until it is found that the legitimate grounds of the processing controller prevail over those of the data subject.
Right of portability of the data
If the processing depends on the consent of the data subject and such consent has been provided by automated means, the data subject has the right to receive the personal data that concerns him/her and which he/she has provided to the Company in a currently-used, structured format that is automatically readable.
Right to objection
In cases where the processing of data was carried out: 1) in pursuit of the Company's legitimate interests; 2) for the purposes of direct marketing or 3) for the definition of profiles, you can also, at any time, object to the processing of your personal data.
Right to complaint
You also have the right to complain to: the processing Controller, via the email firstname.lastname@example.org and/or the National Data Protection Commission, on the website found at the following
Can I revoke my consent later?
If consent is legally required for the processing of personal data, the data subject has the right to withdraw consent at any time, although that right does not compromise the lawfulness of the processing made on the basis of the consent previously given, nor its subsequent processing based on other legal grounds, such as compliance with the contract or legal obligations to which the Company is subject, or its legitimate interest.
If you wish to withdraw your consent, you may contact us preferably to email@example.com
VI. TERRITORIAL SCOPE OF PROCESSING AND TRANS-BORDER TRANSFERS
Your data will be processed within the European Union and may be subject to transfers and cross-border processing, in which case the requirements and obligations legally provided for this purpose will be fulfilled.
VII. AUTOMATED DECISIONS?
Personal data that is the subject of this collection and processing will not be processed in an automated way, nor will it be subject to automated decisions, including the definition of profiles.
VIII. TIME FOR WHICH DATA IS KEPT:
Personal data is kept for different periods of time, depending on the purpose for which it is intended and taking into account criteria and/or compliance with legal obligations, necessity and minimizing the time it is kept. Its conservation in a data base will only be continued:
- With respect to clients, suppliers or subcontractors: for as long as the commercial relationship with the personal data subject lasts and up to at least 5 years after the termination of that commercial relationship;
- In relation to workers: the data provided will be kept for the entire term of the individual contract of the data subject and until the end of a period of 5 years from the date of its termination;
- Without prejudice to the possibility of extending that period, as long as the keeping of such data is necessary for the exercise of legitimate rights or interests or for the fulfilment of legal, judicial or other relevant obligations or interests.
- After such periods have elapsed and there is no justification for this data to be kept for any other reason, it will be deleted/eliminated.
- In the event that deletion of personal data is requested by its data subject, notwithstanding situations in which the processing controller may legitimately refuse immediate deletion for the purposes of complying with legal, judicial and/or public interest obligations, but only as long as such obligations remain.
IX. DATA CONFIDENTIALITY
Do you have any questions?
If you have any questions regarding the processing of your personal data, or if you wish to exercise any of your rights, please contact us: