PRIVACY POLICY

1. In accordance with current data protection legislation, PORTVIAS informs the User that the personal data exchanged in the context of the contractual relationship will be processed by PORTVIAS as the data controller for that processing, the purpose of the processing being proper performance and furtherance of the existing contractual relationship. The contractual relationship is the lawful basis for the processing. The data in question will not be transferred to third parties.

2. To handle the payments on the toll roads, the entity which manages the toll road will communicate PORTVIAS the data related with the payment. In addition, once made the payment by the User through the App, PORTVIAS will communicate to the entity which manages the toll road all the data needed to issue the corresponding invoice.

3. PORTVIAS will process the personal data while the relationship with the User lasts, and after it has ended, PORTVIAS will store them, duly protected, for the period in which liabilities could arise for either as a consequence of processing of the data and for the compliance with legal obligations to which PORTVIAS may be subject.

4. PORTVIAS further agrees to ensure compliance with current data protection legislation. In addition, the User may exercise its rights to access, rectification, erasure, restriction, or portability of its data on giving formal notice to the email: pedidos_rgpd@A23bi.pt. Also, the User will be entitled to submit a complaint to the Portuguese Data Protection Commission (Comissão Nacional de Proteção de Dados).

5. PORTVIAS agrees to observe the duty of secrecy and the duty to keep the data disclosed confidential and to pass those same duties onto all those persons (employees, subcontracted personnel, interns, etc.) or entities that have access to the data in the performance of their functions and obligations in respect of the services received.

6. To the extent that it is necessary to provide the services, the User expressly authorise PORTVIAS to provide to the relevant authorities with certain User information and/or personal information. This information may consist of: (i) name; (ii) vehicle number plate; (iii) the amount of the toll payment that is being paid through the User’s account; and (iv) the location of the toll that is being paid by the User.

7. he relevant authorities shall have the right to maintain User information to the extent that is permitted by law. Such User information may or may not include personal data. User Information that is maintained by the relevant authorities will not be provided to PORTVIAS.

8. Within the scope of the interconnection of toll collection portals, with the purpose of enabling users, on a single platform, to be able to consult, on a transversal and voluntary basis, all outstanding tolls and make the respective payment, in relation to the various portals, the following entities are jointly responsible for the processing, specifically, under the terms of the provisions of article 26(1) of the GDPR, Ascendi O&M S.A., Portvias – Portagem de Vias, S.A., ViaLivre, S.A. and Via Verde Portugal – Gestão de Sistemas Eletrónicos de cobrança, S.A. .

9. Personal Data is processed in accordance with the principles enshrined in Article 5 of the GDPR, in particular the principle of data minimisation and purpose limitation. The legal basis for the processing is the consent of the data subject. The categories of data processed are: identification data, contact data, vehicle data, billing data and outstanding amounts. The categories of data subjects are the users of the Parties’ portals, mentioned above.

10. Under the terms and within the limits of the applicable legislation, data subjects may exercise their rights (access, rectification, erasure, limitation, limitation, portability and opposition) in relation to any of the controllers, using the means available in the respective privacy policies. By the same means and at any time, the consent given may be withdrawn, without this compromising the lawfulness of the processing until that moment.

11. The data will be kept for a period of 90 (ninety) days after the request for consultation for the purpose of tracking operations and responding to any requests from the data subjects.

12. For these purposes, the Controllers have signed a joint responsibility agreement pursuant to the provisions of art. 26(1) of the GDPR, in which their respective responsibilities have been established and the essence of which, pursuant to no. 2 of the aforementioned article, may be consulted HERE.

13. To the remaining characteristics inherent to this processing operation, the remaining provisions set forth in the privacy policies of each controller shall apply.