This policy contains the rules applicable to the collection and processing of personal data by Upcoop Portugal. On its website, in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
General Provisions
- This policy applies to all personal data processed by Upcoop Portugal;
- This policy applies to all professionals and partners and any third parties who have or may have access to personal data processed by Upcoop Portugal;
- This policy does not replace any clauses that are the subject of a specific agreement with any third party, whether a client, partner, supplier or collaborator. In this case, this policy may supplement such documents, but does not replace them. Data subject or user are terms used interchangeably in this Policy to designate the holder of personal data;
- The Data Protection Manager will take responsibility for Upcoop Portugal's ongoing compliance with this policy.
What are the principles regarding the processing of personal data?
Upcoop Portugal is committed to processing personal data in accordance with the requirements of the GDPR.
Article 5º Article 6 of the GDPR requires that personal data be:
- Object of lawful, fair and transparent processing in relation to the data subject;
- Collected for specified, explicit and legitimate purposes and may not be further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, or for scientific or historical research purposes or for statistical purposes is not considered incompatible with the original purposes;
- Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
- Accurate and up-to-date whenever necessary; all appropriate measures must be taken so that inaccurate data, taking into account the purposes for which it is processed, is erased or rectified without delay;
- kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which they are processed; personal data may be kept for longer periods provided that they are processed solely for archiving purposes in the public interest, or for scientific or historical research purposes, or for statistical purposes, subject to the application of appropriate technical and organizational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject; and
- processed in a manner that ensures their security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, by taking the measures appropriate technical or organizational.
How do we guarantee Lawfulness, Fairness and Transparency in the processing of personal data?
- To ensure that data processing is carried out lawfully, fairly and transparently, Upcoop Portugal maintains a GDPR Management System;
- When necessary, considering the legal basis on which the data is processed, measures will be taken to ensure that the data is kept up to date;
- Data subjects have the right to access, rectify, portability and erasure of their personal data. They also have the right to restrict processing and to lodge a complaint with the supervisory authority, the National Data Protection Commission (CNPD);
- Any requests made to Upcoop Portugal must be dealt with in good time.
What is the legal basis for processing personal data?
- Data processing must be carried out in accordance with one of the following legal grounds: consent, performance of a contract, compliance with a legal obligation, defense of vital interests, exercise of functions in the public interest or legitimate interests;
- Upcoop Portugal will register the legal basis applicable to each data processing;
- When consent is invoked as a legal ground for data processing, evidence of consent must be kept with the personal data;
- When communications are sent to data subjects based on their consent, the option to revoke consent must be clearly available and the GDPR management system must ensure that such revocation is accurately reflected in Upcoop Portugal's records.
How do we guarantee data minimization?
Upcoop Portugal guarantees that the personal data processed is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.
Who is responsible for processing your personal data?
- Contact details of the Data Controller:
Le Chèque Déjeuner Portugal S.A, with the trading name Upcoop Portugal, with registered office at Avenida Infante D. Henrique, nª333-H, Edifício Lisboa Oriente Office, escritório 16, 1800-282 Lisboa, with the registration and legal person number 508907608. - Contact details of the Data Protection Officer:
Upcoop Portugal has appointed a Data Protection Officer. For any questions related to data protection contact: dpo@Upcoop-portugal.pt.
For what purpose do we process your personal data?
- Upcoop Portugal, as an employer, processes, collects and stores the personal data of employees, contractors and consultants.
- As part of its activity, Upcoop Portugal issues service tickets and manages tax and social benefits. To this end, Upcoop Portugal needs to collect personal data for the following purposes:
- Managing relationships with clients, partners and suppliers;
- Management of titles and benefits;
- Commercial communications, provided that the user has given their consent and has not refused the use of their contacts for this purpose.
What personal data do we process?
Personal data is any information that makes it possible to directly or indirectly identify a natural person, the data subject.
Upcoop Portugal processes the following categories of personal data:
- Identification data (e.g. name, identification document number, tax identification number, photograph);
- Contact details (e.g. address, telephone number or email address);
- Biographical data: (e.g. date of birth, gender, nationality, place of birth, marital status);
- Invoice data (e.g. TIN, amount, date, IBAN);
- Products and services (e.g. meal card number);
- Family life (e.g. household, number of children);
- Professional life (e.g. profession, working hours, remuneration);
- Access accounts (e.g. user account, user authentication credentials);
- Content: Information (for example: contained in written communications between users and Upcoop Portugal, recorded calls (video and/or audio));
- Transactions (e.g. entries and exits);
- Use of websites and applications (for example: pages visited, or information about the equipment used (e.g. IP address, geographical location, browser used)).
Upcoop Portugal has access to personal data as follows:
- By the data subject by filling in the form available on the website or by email;
- Directly from the companies that hire us. For example: When a client is registered, they provide us with their employees' details so that we can manage their titles and benefits;
- Indirectly from other external sources. For example, from partners who tell us about the use of titles or the use of benefits;
- In the process of acquiring products and services For example: when acquiring a meal card;
- In letters or e-mails sent to Upcoop Portugal;
- Participation in Upcoop Portugal promotional activities;
- In response to satisfaction surveys.
Obligation to provide personal data:
Within the scope of pre-commercial, commercial and contractual relations, it is mandatory to submit and process some personal data of Employees, Suppliers, Partners, Customers, potential Customers and others, necessary for the fulfillment of pre-contractual and contractual obligations and diligences, or those arising from the regulations in force. As a general rule, without this data Upcoop Portugal will have to refuse to enter into the contract or terminate the contract.
Who do we pass on your personal data to?
- Personal data may be disclosed to third parties when we have a legitimate basis for doing so or when the third party is processing data on our behalf, the contractual relationship being regulated by a contract in which the security measures and organization of the processing are defined and in which it is specified that it only acts on instructions from Upcoop Portugal;
- Personal data may also be disclosed if necessary to comply with a legal obligation, statute or court order; for the purpose of obtaining legal advice; in connection with or for the purpose of exercising or defending a right in legal proceedings or when necessary for the defense of a legal claim; or to safeguard national security;
- Personal data is processed by Upcoop Portugal services and may be transmitted to other Upcoop Group companies that provide complementary services essential to the pursuit of the stated purposes;
- Personal data may be transmitted to commercial establishments belonging to the network of partners in relation to commercial transactions that take place there at the indication of the data subject;
- All professionals and partners must avoid any inappropriate disclosure of personal data and comply with the general duties of confidentiality.
Do we transfer personal data internationally outside the European Union?
Upcoop Portugal does not transfer personal data outside the European Union.
How long do we keep your personal data?
To ensure that personal data is kept for as long as is strictly necessary for the purpose for which it is processed, Upcoop Portugal has adopted a Data Retention and Disposal Policy for each process for which personal data is processed.
The Retention and Disposal Policy considers which data should be kept, for how long and why. Beyond this period, some data may be kept for archival or statistical purposes, for which they will first be anonymized.
Personal data processed by Upcoop Portugal is stored for the period necessary to fulfill the purposes set out in this regulation
The personal data processed will be kept secure in order to safeguard their confidentiality, integrity and availability. To this end, Upcoop Portugal has adopted technical and organizational measures to prevent unauthorized use or access, modification, unlawful or accidental destruction and accidental loss.
What are the rights of the data subject?
Upcoop Portugal guarantees the exercise of the rights of data subjects in relation to their processing.
The data subject has the following rights in terms of personal data protection:
- Access: Without prejudice to the protection of the rights of third parties, Data Subjects have the right to have access to personal data concerning them, as well as to obtain information on the respective processing conditions;
- Rectification: Data Subjects have the right to request the rectification of inaccurate or incomplete personal data (e.g. address, email address, telephone contacts);
- Objection Data Subjects have the right to object to data processing based on Upcoop Portugal's legitimate interest;
- Withdrawal of consent: Data subjects have the right to withdraw the consent they have given for data processing based on it;
- Oblivion: Data Subjects have the right to obtain the erasure of their personal data held by Upcoop Portugal, provided that there are no valid grounds for its retention (e.g. compliance with a legal obligation, defense of Upcoop Portugal or third parties in legal proceedings);
- Limitation: Data Subjects have the right to request the limitation of data processing when:
- have contested the accuracy of the personal data and for a period that allows Upcoop Portugal to verify its accuracy;
- the processing is unlawful and they oppose the erasure of their personal data;
- Upcoop Portugal no longer needs the personal data, but such data is required by the Data Subjects for the purposes of declaring, exercising or defending a right in legal proceedings;
- have objected to the processing and during the period of evaluation of the request by Upcoop Portugal.
- Portability: Data Subjects have the right to receive the personal data they have provided to Upcoop Portugal in a structured, commonly used and machine-readable format, and the right to transmit this data to another controller.
How do I exercise my rights?
To exercise your rights, please contact Upcoop Portugal at dpo@up-portugal.pt or by letter to Le Chèque Déjeuner Portugal S.A., trading as Upcoop Portugal, Avenida Infante D. Henrique, nª333-H, Edifício Lisboa Oriente Office, escritório 16, 1800-282 Lisboa - Portugal.
Upcoop Portugal will respond to requests within a maximum of 30 days, except for particularly complex requests. In these cases, Upcoop Portugal will inform the owners about:
- the need to extend the deadline for response by a further maximum of 60 days,
- of the respective justification.
Whenever Upcoop Portugal considers that it is not possible to respond to requests, data subjects will be informed of Upcoop Portugal's reasons within the time limits established above.
The exercise of rights is free of charge, except in situations considered excessive, anomalous and/or in bad faith. In these situations, Upcoop Portugal will inform the data subjects in advance of the fees to be charged and their justification.
Upcoop Portugal has appropriate mechanisms for verifying and confirming the identity of data subjects who wish to exercise their rights. Only those whose identity can be confirmed will be attended to, and through a channel that allows evidence of the request and the respective response to be kept.
If you so wish, you can also lodge a complaint with the National Data Protection Commission (CNPD). www.cnpd.pt.
What do we do in the event of a data breach?
In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to personal data, Upcoop Portugal will assess the risk to the rights and freedoms of data subjects and, if appropriate, report this breach to the CNPD (National Data Protection Commission).
How do we protect your data?
- Upcoop Portugal will maintain data security by protecting the confidentiality, integrity and availability of personal data;
- To ensure data security, it has adopted technical and organizational measures to prevent unauthorized use or access, modification, unlawful or accidental destruction and accidental loss;
- Access to personal data is controlled and restricted to professionals who need to access it, in accordance with the Information Security Policy, and appropriate security measures have been adopted to prevent unauthorized sharing of information;
- The deletion of the data is done securely, so that the data is unrecoverable.
Changes to the Policy
Upcoop Portugal may amend this notice from time to time to reflect changes in legislation or changes to the site itself and its contents.
The latest version will always be available on the Upcoop Portugal website.
New version approved by Upcoop on April 29, 2026.
