Privacy Policy

This Privacy Policy describes how Upcoop Portugal collects, uses, retains, shares, protects, and, in general, processes the personal data of data subjects in the course of its activities, including those carried out through its website, in accordance with Regulation (EU) 2016/679 of April 27, 2016 (General Data Protection Regulation or GDPR), and other applicable legislation regarding the protection of personal data.

General Provisions

• This policy applies to all personal data processed ​​by Upcoop Portugal;
• This policy applies to all employees, service providers, partners, suppliers, and any third parties who have or may have access to personal data processed by Upcoop Portugal; 
• This policy does not supersede any provisions that are the subject of a specific agreement with any third party, whether a customer, partner, supplier, or employee. In such cases, this policy may supplement those documents, but does not replace them. 
• For the purposes of this Policy, the terms “user” and “data subject” may be used interchangeably to refer to the individual who accesses the website or whose personal data is processed by Upcoop Portugal.

What are the principles regarding the processing of personal data?

Upcoop Portugal is committed to processing personal data in accordance with the requirements of the GDPR.

Article 5 of the GDPR requires that personal data be:

• Object of lawful, fair and transparent processing in relation to the data subject;
• Collected for specified, explicit and legitimate purposes and may not be further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, or for scientific or historical research purposes or for statistical purposes is not considered incompatible with the original purposes;
• Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; 
• Accurate and up-to-date whenever necessary; all appropriate measures must be taken so that inaccurate data, taking into account the purposes for which it is processed, is erased or rectified without delay;
• kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which they are processed; personal data may be kept for longer periods provided that they are processed solely for archiving purposes in the public interest, or for scientific or historical research purposes, or for statistical purposes, subject to the application of appropriate technical and organizational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject; and
• processed in a manner that ensures their security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, by taking the measures appropriate technical or organizational.
•  

How do we guarantee Lawfulness, Fairness and Transparency in the processing of personal data?

• To ensure that data processing is carried out lawfully, fairly and transparently, Upcoop Portugal maintains a GDPR Management System;
• When necessary, considering the legal basis on which the data is processed, measures will be taken to ensure that the data is kept up to date;
• Data subjects have the right to access, rectify, portability and erasure of their personal data. They also have the right to restrict processing and to lodge a complaint with the supervisory authority, the National Data Protection Commission (CNPD);
• Any requests made to Upcoop Portugal must be dealt with in good time.

What is the legal basis for processing personal data? 

• Data processing must be carried out in accordance with one of the following legal grounds: consent, performance of a contract, compliance with a legal obligation, defense of vital interests, exercise of functions in the public interest or legitimate interests; 
• Upcoop Portugal will register the legal basis applicable to each data processing;
• When consent is invoked as a legal ground for data processing, evidence of consent must be kept with the personal data;
• When communications are sent to data subjects based on their consent, the option to revoke consent must be clearly available and the GDPR management system must ensure that such revocation is accurately reflected in Upcoop Portugal's records.

How do we guarantee data minimization?

Upcoop Portugal guarantees that the personal data processed is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.

Who is responsible for processing your personal data?

• Contact details of the Data Controller:
  Le Chèque Déjeuner Portugal S.A, with the trading name Upcoop Portugal, with registered office at Avenida Infante D. Henrique, nª333-H, Edifício Lisboa Oriente Office, escritório 16, 1800-282 Lisboa, with the registration and legal person number 508907608.
• Contact details of the Data Protection Officer:
  Upcoop Portugal has appointed a Data Protection Officer. For any questions regarding data protection, please contact: dpo@up-portugal.pt.

For what purpose do we process your personal data?

• Managing relationships with customers, users, partners, suppliers, and other entities with which the company interacts;
• Issuance, provision, administration, and management of tax and social benefit certificates;
• Provision of the requested services and management of the corresponding contractual relationship;
• Handling inquiries, clarifications, suggestions, complaints, and other requests submitted through the website or other communication channels;
• Administrative, financial, accounting, and operational management of Upcoop Portugal’s activities;
• Compliance with the legal, regulatory, tax, and administrative obligations to which Upcoop Portugal is subject;
• Sending institutional, informational, and commercial communications related to Upcoop Portugal’s products, services, campaigns, and initiatives, when there is a legal basis for doing so;
• Ensuring the security of information systems, the network, and the services provided, including the prevention and detection of fraud, misuse, or unauthorized access;
• Management of recruitment and selection processes, unsolicited applications, and evaluation of professional profiles, when applicable;
• Analyzing website usage, monitoring its performance, and improving the user browsing experience, including through the use of cookies and similar technologies, in accordance with the Cookie Policy;
• Continuous development, improvement, and optimization of the products, services, content, and features provided by Upcoop Portugal.

What is the legal basis for the processing of your personal data?

Upcoop Portugal processes personal data only when there is a valid legal basis, in accordance with Article 6.º of the General Data Protection Regulation (GDPR).

The processing of personal data by Upcoop Portugal is based, in particular, on the following grounds:

What personal data do we process?

Personal data is any information that makes it possible to directly or indirectly identify a natural person, the data subject.

Upcoop Portugal processes the following categories of personal data:

• Identification data (e.g. name, identification document number, tax identification number, photograph);
• Contact details (e.g. address, telephone number or email address);
• Biographical Information: (for example: date of birth, gender, nationality, place of birth, marital status);
• Invoice data (e.g. TIN, amount, date, IBAN);
• Products and Services (for example: meal card number);
• Family life (e.g. household, number of children);
• Professional life (e.g. profession, working hours, remuneration);
• Access Accounts (for example: user account, user authentication credentials);
• Content: Information (for example: contained in written communications between users and Upcoop Portugal, recorded calls (video and/or audio));
• Transactions (e.g. entries and exits);
• Use of websites and applications (for example: pages visited, or information about the devices used (for example: IP address, geographic location, browser used)).

Upcoop Portugal has access to personal data as follows:

• By the data subject by filling in the form available on the website or by email; 
• Directly from the companies that hire us. For example: When a client is registered, they provide us with their employees' details so that we can manage their titles and benefits;
• Indirectly from other external sources. For example, from partners who tell us about the use of titles or the use of benefits;
• In the process of acquiring products and services For example: when acquiring a meal card;
• In letters or e-mails sent to Upcoop Portugal; 
• Participation in Upcoop Portugal promotional activities;
• In response to satisfaction surveys.

Obligation to provide personal data:

In the context of pre-commercial, commercial, and contractual relationships, it is mandatory to collect and process certain personal data from Employees, Suppliers, Partners, Customers, potential Customers, and others—which is necessary to fulfill pre-contractual and contractual obligations and procedures, or those arising from applicable regulations. As a general rule, without this data, Upcoop Portugal may be unable to establish or maintain the intended contractual relationship.

Who do we pass on your personal data to?

• Personal data may be disclosed to third parties when we have a legitimate basis for doing so or when the third party is processing data on our behalf, the contractual relationship being regulated by a contract in which the security measures and organization of the processing are defined and in which it is specified that it only acts on instructions from Upcoop Portugal; 
• Personal data may also be disclosed if necessary to comply with a legal obligation, statute, or court order; for the purpose of obtaining legal assistance; in connection with or for the purpose of exercising or defending a right in legal proceedings, or when necessary to defend a legal right; or to safeguard national security;
• Personal data is processed by Upcoop Portugal and may be transferred to other entities within the Upcoop Group that provide complementary services or support necessary to achieve the purposes described in this Policy. These entities will process personal data exclusively for the authorized purposes and in accordance with the applicable contractual instruments and data protection safeguards, acting, as the case may be, as data processors, independent data controllers, or joint data controllers;
• Personal data may be transmitted to commercial establishments belonging to the network of partners in relation to commercial transactions that take place there at the indication of the data subject;
• All professionals and partners must avoid any inappropriate disclosure of personal data and comply with the general duties of confidentiality.

Do we transfer personal data internationally outside the European Union?

Upcoop Portugal does not transfer personal data to third countries located outside the European Union or the European Economic Area.

Should it become necessary in the future to transfer personal data internationally, Upcoop Portugal will ensure that the appropriate safeguards set forth in the General Data Protection Regulation (GDPR) are implemented, in order to guarantee a level of protection equivalent to that required in the European Union.

How long do we keep your personal data?

Upcoop Portugal retains personal data only for as long as is strictly necessary to fulfill the purposes for which it was collected and processed, in accordance with the principle of data retention limitation set forth in the General Data Protection Regulation (GDPR).

To that end, Upcoop Portugal adopts a Data Retention and Disposal Policy, which defines, for each data category and processing activity:

• The personal data to be retained;
• The purposes of the processing;
• The respective retention periods;
• The reasons for its conservation.

Data collected through the website—including through contact forms, requests for information, or other online interactions—will be retained for a period of 12 months, starting from the date of the data subject’s last interaction, unless there is a legitimate basis or legal obligation that requires a different retention period, as provided for in the Data Retention and Disposal Policy.

Once the respective retention periods have expired, personal data will be securely deleted or irreversibly anonymized; in the latter case, it may be retained for statistical, historical, archival, or service improvement purposes.

What are the rights of the data subject?

Upcoop Portugal guarantees the exercise of the rights of data subjects in relation to their processing.

The data subject has the following rights in terms of personal data protection:

• Access: Without prejudice to the protection of the rights of third parties, Data Subjects have the right to have access to personal data concerning them, as well as to obtain information on the respective processing conditions;
• Rectification: Data Subjects have the right to request the rectification of inaccurate or incomplete personal data (e.g. address, email address, telephone contacts);
• Objection Data Subjects have the right to object to data processing based on Upcoop Portugal's legitimate interest;
• Withdrawal of consent: Data subjects have the right to withdraw the consent they have given for data processing based on it;
• Right to be Forgotten: Data Subjects have the right to have their personal data held by Upcoop Portugal erased, provided there are no valid grounds for retaining it (e.g., compliance with a legal obligation, or the defense of Upcoop Portugal or third parties in legal proceedings).
• Limitation: Data Subjects have the right to request the limitation of data processing when: 
  • have contested the accuracy of the personal data and for a period that allows Upcoop Portugal to verify its accuracy; 
  • the processing is unlawful and they oppose the erasure of their personal data; 
  • Upcoop Portugal no longer needs the personal data, but such data is required by the Data Subjects for the purposes of declaring, exercising or defending a right in legal proceedings; 
  • have objected to the processing and during the period of evaluation of the request by Upcoop Portugal.
• Portability: Data Subjects have the right to receive the personal data they have provided to Upcoop Portugal in a structured, commonly used, and machine-readable format, and the right to transmit that data to another data controller;
• Upcoop Portugal does not use fully automated decision-making processes—including profiling—that are likely to produce legal effects on data subjects.

How do I exercise my rights?

To exercise your rights, please contact Upcoop Portugal at dpo@up-portugal.pt or by letter to Le Chèque Déjeuner Portugal S.A., trading as Upcoop Portugal, Avenida Infante D. Henrique, nª333-H, Edifício Lisboa Oriente Office, escritório 16, 1800-282 Lisboa - Portugal.

Upcoop Portugal will respond to requests within a maximum of 30 days, except for particularly complex requests. In these cases, Upcoop Portugal will inform the owners about:

1. the need to extend the deadline for response by a further maximum of 60 days,
2. of the respective justification.

Whenever Upcoop Portugal considers that it is not possible to respond to requests, data subjects will be informed of Upcoop Portugal's reasons within the time limits established above.

The exercise of rights is free of charge, except in situations considered excessive, anomalous and/or in bad faith. In these situations, Upcoop Portugal will inform the data subjects in advance of the fees to be charged and their justification.

Upcoop Portugal has appropriate mechanisms for verifying and confirming the identity of data subjects who wish to exercise their rights. Only those whose identity can be confirmed will be attended to, and through a channel that allows evidence of the request and the respective response to be kept.

If you so wish, you can also lodge a complaint with the National Data Protection Commission (CNPD). www.cnpd.pt.

What do we do in the event of a data breach?

Upcoop Portugal has internal procedures in place to identify, record, assess, and manage security incidents that could result in a personal data breach.

In the event of a personal data breach—defined as a security breach that results, accidentally or unlawfully, in the destruction, loss, alteration, unauthorized disclosure, or unauthorized access to personal data that has been transmitted, stored, or otherwise processed— Upcoop Portugal will assess the incident and its impact on the rights and freedoms of the data subjects.

Whenever a data breach is likely to pose a risk to the rights and freedoms of individuals, Upcoop Portugal will notify the National Data Protection Commission (CNPD) in accordance with legal requirements.

When a breach is likely to pose a high risk to the rights and freedoms of data subjects, they shall also be informed of the breach and the measures taken to mitigate its effects, unless applicable law exempts such notification.

How do we protect your data?

• Upcoop Portugal implements appropriate technical and organizational measures to ensure a level of security commensurate with the risk, safeguarding the confidentiality, integrity, availability, and resilience of its personal data processing systems and services;
• To protect personal data against destruction, loss, alteration, unauthorized disclosure, or improper access, Upcoop Portugal implements physical, logical, technical, and organizational security measures appropriate to the nature of the processing of personal data and the risks associated with such processing;
• Access to personal data is limited to employees, service providers, and other professionals who need to know such information in order to perform their duties; they are subject to confidentiality obligations and the rules set forth in Upcoop Portugal’s Information Security Policy.

Changes to the Policy

Upcoop Portugal may periodically update this policy to reflect changes in the law or changes to the website itself and its content.

The latest version will always be available on the Upcoop Portugal website.

New version approved by Upcoop on August 20, 2026.