Privacy Policy

For LUSOPONTE – Concessionária para a Travessia do Tejo, S.A. (hereinafter "LUSOPONTE") the protection of your personal data and privacy is essential. For this reason, LUSOPONTE adopts a set of measures to protect the personal data of users (i) of its website, (ii) its Application(s) (the "Portals") and (iii) the services provided and other actors (such as suppliers or candidates in recruitment), creating for this purpose this Privacy Policy.

This Privacy Policy, available in http://www.lusoponte.pt/, regulates the collection and processing of personal data by LUSOPONTE, as well as the exercise of the rights of data subjects, in accordance with applicable legislation.

1. Concepts

What is Personal Data?

Personal data is any information, of any nature or on any other form, relating to an identified or identifiable natural person. Any person who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, identification number, location data, electronic identifiers or one or more specific elements of the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person, shall be considered identifiable.

Who are the personal data subjects?

The holders of personal data are natural persons, identified or identifiable, to whom the personal data relates.

What is the Controller?

The controller is the person (natural or legal), the public authority, agency or other organization that, individually or in conjunction with others, determines the purposes and means of processing personal data.

1.1. Who is the Controller of your personal data?

LUSOPONTE will be the entity responsible for the processing the user’s personal data of the Portals and the services provided.

The personal data collected will be processed by LUSOPONTE and, where applicable, by the entities subcontracted by it.

1.2. What are the personal data processed by LUSOPONTE?

LUSOPONTE processes or may process various categories of personal data relating to customers, jobseekers, suppliers and other third parties. These categories include:
• Identification data (name, address, nationality, age, date of birth, telephone contact, email address, image, identification number, taxpayer number, driver's license number, VIA CARD card number, trade union number, social security number, professional card number, marital status, marriage regime, affiliation);
• Invoicing data (NIB/IBAN, bank, swift, account holder name, reference of the card used for payment, transaction data - date, time, toll route used, amount, card balance VIA CARD);
• Vehicle data (identifier number, registration, make, model, vehicle class);
• Location data (time and place of toll passage);
• Data relating to infringements (history);
• Health data;
• Incident data (policy number, accident description);
• Professional data (position performed, educational qualifications, professional experience, desired remuneration, professional category, normal working period, remuneration, allowances and discounts, professional training and professional aptitude, registration, evaluations);
• Computer data (IP access to the site and the pages consulted);
• Financial data;
• Data relating to associations;
• Evaluation (quality, safety, time and flexibility);
• Data relating to MISI system (entity number);
• Other (e.g., amount of compensation awarded in the context of expropriation, fuel consumption, place and time of supply in the context of benefits granted to family members of employees, affiliation and data relating to relatives of employees – name, degree of kinship, date of birth).

1.3. What are the purposes of the processing of personal data by Lusoponte?

LUSOPONTE will only process your data for the following purposes:
• Customer relationship management, which includes:
- VIA CARD Contract adhering and management;
- Toll collection.
• Processing of infringements related to the misuse of toll roads;
• Marketing (Marketing campaigns for VIA CARD Customers);
• Business communication, which includes:
- Capture of photos and videos of physical elements of LUSOPONTE (in the context of events);
- Management of sporting events (e.g., the Half Marathon).
• Litigation management;
• Complaint management;
• Information Systems Management, which includes:
- Site management; and
- VIA CARD website and app management.
• Economic and accounting management;
• Human resources management;
• Employees and recruitment selection;
• Supply management;
• Routine maintenance management;
• Operation management, which includes:
- Record of incidents;
- Accident report;
- Road surveillance video.
• Structural maintenance management;
• Conducting audits;
• Security management;
• Execution of expropriations.

1.4. On what lawful basis do we treat your personal data?

The processing of your personal data is only carried out when it has one of the following lawful basis:
• When we obtain your prior consent and only if such consent is free, informed, specific and unequivocal;
• When carried out in the context of the performance of a contract and/or pre-contractual steps;
• For compliance with legal obligations;
• Based on a legitimate interest of LUSOPONTE (where the processing of personal data corresponds to a legitimate interest of LUSOPONTE or third parties and the reasons for the processing must prevail over its rights);
• when it is necessary to protect your vital interests; or
• When it is necessary to perform public interest functions.

2. Rights

What are your rights?

Right of access

Where you request it, you have the right to obtain confirmation of whether your personal data is processed by LUSOPONTE, as well as information relating to such processing (e.g. what purposes of the processing, which categories of personal data are processed, who are the recipients of your data and the retention periods of your data).

Right of rectification

If you believe that your personal data is incomplete or incorrect, you may require it to be completed or rectified.

Right to deletion

You have the right to request the deletion of your personal data in the following situations:
- When personal data are no longer necessary for the purpose that motivated its collection or processing;
- When you withdraw the consent on which the processing of data is based and there is no other legal basis for it;
- When it opposes the processing of the data and there are no prevailing legitimate interests, to be assessed on a case-by-case basis that justify the processing;
- When personal data must be erased under a legal obligation to which LUSOPONTE is subject; or
- Where personal data has been collected in the context of the provision of information society services to children.

This right does not apply where treatment is necessary for the following purposes:
- Exercise of freedom of expression and information;
- Compliance with a legal obligation that requires treatment and applies to LUSOPONTE;
- When public health reasons are concerned;
- for the purpose of public-interest archive, scientific or historical research purposes or statistical purposes, to the extent that the exercise of the right to erasure seriously impairs the achievement of the objectives of such treatment; or
- For the declaration, exercise, or defense of a right in a judicial proceeding.

Right to limitation of treatment

You have the right to request from LUSOPONTE to limit the processing of your personal data in the following cases:
- If you dispute the accuracy of your personal data, for a period of time that allows LUSOPONTE to verify its accuracy;
- If LUSOPONTE no longer needs personal data for processing purposes, but if such data are necessary for the data subject for the purpose of declaration, exercise or defense of a right in a judicial process; or
- If you have opposed the processing, until it is found that LUSOPONTE 's legitimate interests prevail over yours.

Right of portability

You have the right to request Lusoponte to deliver, in a structured format, in common use and automatic reading, of the personal data provided by you. You also have the right to ask LUSOPONTE to transmit these data to another controller if this is technically possible.

The portability right only applies when:
- the processing is based on express consent or the performance of a contract; and
- The treatment in question is carried out by automated means.

Right of opposition

You also have the right to objects to the processing of your personal data at any time for reasons relating to your situation in the following situations:
- When the treatment is based on the legitimate interest of LUSOPONTE; or
- When the processing is carried out for purposes other than those for which the data were collected, but which are compatible with them.

In these cases, LUSOPONTE will no longer process your personal data unless you have legitimate reasons for performing such processing and that these prevail over your interests.

You may also object to the processing of your data for direct marketing purposes, including profiling.

Right to withdraw your consent

Where the processing of the data is done based on your consent, you may withdraw consent at any time.
If you withdraw your consent, your personal data will no longer be processed unless there is another basis, such as the contract, legal and regulatory obligations or the legitimate interest justifying such processing.

Right to lodge complaints with the supervisory authority

If you wish, you may file a complaint regarding matters related to the processing of your personal data with the National Data Protection Commission. For more information, go to www.cnpd.pt.

How can you exercise your rights?

You can exercise your rights free of charge by:
• E-mail: for the address epd@lusoponte.pt or sclientes@lusoponte.pt;
• Online: at the https://www.lusoponte.pt ;
• Mail: by letter, addressed to LUSOPONTE, to the address:

Edifício da Portagem
Praça da Portagem
Penas
2870 - 392 Montijo
Phone: +351 212 328 200.

3. Collection of your personal data

LUSOPONTE assumes that the data collected were communicated by the respective holder and that its insertion was authorized or performed by the same, being true and accurate.

4. Recipients of personal data

LUSOPONTE may have to transmit or give access to your personal data to other entities, to comply with legal obligations to which it is subject, to protect the vital interests of the holders of personal data, to provide contracted services or to improve the service provided.

LUSOPONTE will only transmit or give access to your personal data to the following entities:
• Service providers contracted by LUSOPONTE (e.g. for payment processing, maintenance of toll management systems, external auditors, telecommunications services);
• Banking institutions;
• Insurers;
• Public authorities, such as the Tax Authority, Social Security, Judicial Courts or public security forces).

5. Time limits for the retention of personal data

The processing and retention of the data by LUSOPONTE will remain as long as it proves necessary or mandatory for the fulfillment of the above purposes.

6. Security measures

LUSOPONTE makes its best efforts to protect users' personal data from unauthorized access via the Internet.

To this end, it uses security systems, rules, and other procedures to ensure the protection of users' personal data, as well as to prevent unauthorized access to the data, its improper use, disclosure, loss, or destruction.

It is the user's responsibility to guarantee and ensure that your computer or device (smartphone, tablet, among others) is adequately protected against harmful software, computer viruses and worms. In addition, you should be aware that without the adoption of appropriate security measures (e.g., the secure configuration of the navigation program, up-to-date antivirus software, security barrier software and the non-use of software of dubious origin), it aggravates the risk of personal data and passwords being accessed by third parties without your permission.

It should be noted that whenever data collection is carried out on open networks, such as the Internet, they may circulate without adequate security conditions, and there is a risk of being seen and used by unauthorized third parties.

7. Automated decisions

Currently, automatic profile analyzes that result in automatic decisions are not performed.

However, customers receive automatic SMS or email messages when their ViaCard balance reaches a limit set by the customer itself. The client can disable this service using the site.

8. Changes to privacy policy

LUSOPONTE may, at any time, without notice and with immediate effect, change, add or revoke, in part or in whole, this Privacy Policy, without prejudice to its legal obligations.

Any changes will be immediately disclosed in the Portals, so we advise you to consult this page regularly.

9. Other information

LUSOPONTE has appointed a Data Protection Officer, who may address any questions about how LUSOPONTE process personal data by sending an email to epd@lusoponte.pt .

You will also request any clarification on this matter through the contact page available in http://www.lusoponte.pt/ , by phone on +351 212328200, or by written message addressed to the email address sclientes@lusoponte.pt .