Data Handling Policy in Supplier Relations
1.Data Protection Commitment
Coindu – Componentes para a Industria Automovel SA, hereinafter referred to as COINDU, a legal person with the portuguese legal person number 501998055, complies with the applicable Community and national legal rules regarding the protection of personal data, privacy and information security of data subjects, within the scope of data processing operations carried out in the relationship with suppliers – whether the data subjects are the suppliers themselves as natural persons, or the data subjects are the suppliers’ employees – in accordance with
the general terms of the Data Protection and Privacy Policy, which can be accessed at www.coindu.com or at any of the service points, and
the special terms of this Policy for the Processing of Personal Data in Relations with Suppliers.
2.Personal Data
COINDU collects and processes the following categories of personal data from suppliers or suppliers’ employees:
– identification data;
– contact details;
– professional data and certifications;
– traffic data and access control on the premises.
3.Data Sources
COINDU collects personal data from suppliers or suppliers’ employees by collecting it directly from them or indirectly from their employer, by filling in information registration forms.
4.Purpose of processing
COINDU processes the personal data of suppliers or suppliers’ employees exclusively for the purposes of verifying the legitimacy of legal representatives, access control, safety, hygiene and occupational health and the provision of contracted services in the exercise of economic activity.
5.Legitimacy of Processing
COINDU bases the legitimacy of the processing of the personal data of suppliers or suppliers’ employees on the specific processing activity carried out, whether based on the management of the contractual relationship, the fulfillment of legal obligations or the legitimate interests of pursuing economic activity.
6.Data retention period
COINDU will keep the data for the period necessary to pursue the purposes of the processing, complying with the applicable legal deadlines, with the candidate being able to request, at any time, its deletion or exercise any other right, with the conditions and limitations provided for by law, and with a default period of one year for the retention of personal data of suppliers or suppliers’ employees.
7 Communication of Personal Data
The personal data of suppliers or suppliers’ employees is processed exclusively by COINDU’s contracting and procurement, human resources management and occupational health and safety services, and no data is communicated to third parties, except for the legally stipulated situations in which personal data must be communicated to third parties.
- Data Processing Information Sheets
Under the terms of the principle of loyalty and transparency and to guarantee compliance with the duty to provide information, COINDU delivers directly or makes publicly available to all data subjects, depending on how their personal data is collected, information sheets on the data processing operations carried out, which are accessible for consultation at any service point or on request from the Data Protection Officer.
The Information Sheet on Data Processing in Relations with Suppliers is available at 7 Communication of Personal Data
The personal data of suppliers or suppliers’ employees is processed exclusively by COINDU’s contracting and procurement, human resources management and occupational health and safety services, and no data is communicated to third parties, with the exception of the legally stipulated situations in which personal data must be communicated to third parties.
- Data Processing Information Sheets
Under the terms of the principle of loyalty and transparency and to guarantee compliance with the duty to provide information, COINDU delivers directly or makes publicly available to all data subjects, depending on how their personal data is collected, information sheets on the data processing operations carried out, which are accessible for consultation at any service point or on request from the Data Protection Officer.
The Information Sheet on Data Processing in Relations with Suppliers is available at 7 Communication of Personal Data
The personal data of suppliers or suppliers’ employees is processed exclusively by COINDU’s contracting and procurement, human resources management and occupational health and safety services, and no data is communicated to third parties, except for the legally stipulated situations in which personal data must be communicated to third parties.
- Data Processing Information Sheets
Under the terms of the principle of loyalty and transparency and to guarantee compliance with the duty to provide information, COINDU delivers directly or makes publicly available to all data subjects, depending on how their personal data is collected, information sheets on the data processing operations carried out, which are accessible for consultation at any service point or on request from the Data Protection Officer.
The Information Sheet on Data Processing in Relations with Suppliers is available at www.dataprotectionofficer.help/coindu/information.
9.Rights of suppliers or their employees
COINDU facilitates the exercise of the rights of suppliers or their employees regarding the protection of personal data.
In addition to always being able to lodge a complaint with the respective supervisory authority, in order to exercise any type of data protection rights, namely the rights to withdraw consent, information, access, rectification, opposition, limitation of processing or erasure, suppliers or their employees can contact the COINDU Data Protection Officer via email at dpo@coindu.com, describing the subject of the request and indicating an email address, telephone contact address or correspondence address for a reply.
A Form for Exercising the Rights of Data Subjects is available at www.dataprotectionofficer.help/coindu/forms/ or at any COINDU service point.
10.Reporting Data Breach Incidents
COINDU has implemented a data protection and information security incident management system.
If any Supplier or Collaborator of a COINDU Supplier wishes to report the occurrence of any personal data breach, which accidentally or unlawfully causes the unauthorized destruction, loss, alteration, disclosure or access to personal data transmitted, stored or subject to any other type of processing, they may contact the COINDU Data Protection Officer or use the general COINDU contacts.
A Personal Data Breach Incident Reporting Form can be found at www.dataprotectionofficer.help/coindu/forms or at any COINDU service point, and can also be sent by email by contacting the Data Protection Officer.
11.Permanent Security Contact Point
COINDU has implemented a Permanent Contact Point for the management of information security and cyberspace security incidents.
If any Supplier or Supplier Employee wishes to report an information security incident or a cyberspace security incident, they can contact the COINDU Permanent Contact Point through the communication channels available at www.dataprotectionofficer.help/coindu/security/.
An Information Security or Cyberspace Security Incident Reporting Form can be found at www.dataprotectionofficer.help/coindu/forms or at any COINDU service point, and can also be sent by email on request to the Permanent Contact Point.
12.Proteção de Denunciantes
A COINDU tem implementado um Canal de Denúncias, em conformidade com as normas jurídicas em vigor, garantindo a proteção dos dados pessoais dos titulares de dados, nos termos da Política de Proteção de Denunciantes acessível em https://www.whistleblowingofficer.com/coindu/.
O Responsável pelas Denúncias na COINDU pode ser contactado através dos contactos disponíveis em www.dataprotectionofficer.help/coindu/whistleblowing/.
A Plataforma de Denúncias da COINDU está acessível através da hiperligação disponível em https://www.whistleblowingofficer.com/coindu/.
Um Formulário de Comunicação de Denúncias está acessível em www.dataprotectionofficer.help/coindu/forms/ ou em qualquer ponto de atendimento da COINDU, podendo ser também solicitado o seu envio por correio eletrónico, através do pedido ao Responsável pelas Denúncias.
13.Prevention of Corruption
COINDU has implemented a Regulatory Compliance Program within the scope of Corruption Prevention, in accordance with the legal regulations in force, guaranteeing the protection of the personal data of the data subjects, under the terms of the Corruption Prevention Policy accessible at www.coindu.com.
For the purposes of submitting complaints within the scope of the corruption prevention regime, any interested party can use,
the COINDU Complaints Platform, accessible via the link available at https://www.whistleblowingofficer.com/coindu/ or
the Whistleblowing Form, accessible at www.dataprotectionofficer.help/coindu/forms/ or at any COINDU service point.
14.Data Protection Policies
The Policy for the Processing of Personal Data of Suppliers or Employees of a COINDU Supplier is complemented by COINDU’s General Data Protection Policy, which can be accessed at www.coindu.com. It is also possible to consult the other specific Data Protection and Privacy Policies,
either by contacting the Data Protection Officer at dpo@coindu.com;
or by contacting any service point in person.
15.Versions of the Policy
This version of the Data Processing Policy for Supplier Management has been published under reference Version 202312.
To ensure its updating, development and continuous improvement, COINDU may, at any time, make any changes deemed appropriate or necessary to the Data Protection Policies, and its publication in the different channels is ensured to guarantee transparency and information to Users, Service Recipients, Clients, Employees, Candidates or Suppliers.
To consult previous versions of the Data Protection and Privacy Policy, please send a request by email to dpo@coindu.com.
