Privacy Policy
Scope
The purpose of this privacy policy is to inform you of how Sociedade de Transportes Colectivos do Porto, EIM, SA (hereinafter referred to as STCP, EIM, SA), with registered office at Avenida Fernão de Magalhães, 1862nd, 13th floor, 4350-158 Porto, with unique corporate number and registration number 500 246 467, with share capital of €90,000,000 (ninety million euros), processes your personal data.
Your privacy and the protection of your personal data are a priority for STCP, EIM, SA, and therefore, we recommend reading this document. Providing your personal data implies knowledge of and acceptance of the terms and conditions of this Privacy and Data Protection Policy.
Commitment
STCP, EIM, SA ensures appropriate personal data management in accordance with applicable legislation.
Personal data are processed lawfully, fairly and transparently, and are collected for specific, explicit and legitimate purposes, with STCP, EIM, SA guaranteeing that such personal data are adequate, relevant and not excessive in relation to the purposes for which they are collected.
The data collected is processed electronically and stored in specific databases created and managed for this purpose.
The person responsible for processing personal data, as well as persons who, in the exercise of their functions, have knowledge of the personal data subject to processing, are subject to professional secrecy and a duty of confidentiality, even after the end of their functions.
Data controller
STCP, EIM, SA is responsible for the processing of your personal data, as it determines the purposes and means of processing.
It is the responsibility of the data controller to apply appropriate technical and organizational measures to ensure that the processing of personal data is carried out in compliance with the rules resulting from the General Data Protection Regulation and its implementing law.
Data Protection Officer
STCP, EIM, SA has appointed a Data Protection Officer who can be contacted via the email address epd@stcp.pt or by letter sent to Avenida Fernão de Magalhães, 1862, 13th Floor, 4350-158 Porto.
Personal data collected
STCP, EIM, SA collects and processes personal data in order to carry out its duties, in particular for the purposes of identification, contact, invoicing, recruitment, management of administrative offence reports and
complaints, as well as those that may prove to be strictly necessary for the fulfillment of its legal and contractual obligations.
Categories of personal data processed
The data collected may be the following:
Cookies or connection testimonials
STCP, EIM, SA uses cookies or connection testimonials – small text files stored by the website on the user's device when they visit it – to improve the website's performance and user experience.
To learn more about cookies and how STCP, EIM, SA uses them, see the Cookie Policy.
Data security
STCP, EIM, SA uses a set of technologies, tools and security procedures to protect your personal data from unauthorized access, use or disclosure.
Privacy Policy Update
This privacy policy will be updated continuously, and the update date will be changed accordingly.
Updated on: 05/29/2025
The purpose of this privacy policy is to inform you of how Sociedade de Transportes Colectivos do Porto, EIM, SA (hereinafter referred to as STCP, EIM, SA), with registered office at Avenida Fernão de Magalhães, 1862nd, 13th floor, 4350-158 Porto, with unique corporate number and registration number 500 246 467, with share capital of €90,000,000 (ninety million euros), processes your personal data.
Your privacy and the protection of your personal data are a priority for STCP, EIM, SA, and therefore, we recommend reading this document. Providing your personal data implies knowledge of and acceptance of the terms and conditions of this Privacy and Data Protection Policy.
Commitment
STCP, EIM, SA ensures appropriate personal data management in accordance with applicable legislation.
Personal data are processed lawfully, fairly and transparently, and are collected for specific, explicit and legitimate purposes, with STCP, EIM, SA guaranteeing that such personal data are adequate, relevant and not excessive in relation to the purposes for which they are collected.
The data collected is processed electronically and stored in specific databases created and managed for this purpose.
The person responsible for processing personal data, as well as persons who, in the exercise of their functions, have knowledge of the personal data subject to processing, are subject to professional secrecy and a duty of confidentiality, even after the end of their functions.
Data controller
STCP, EIM, SA is responsible for the processing of your personal data, as it determines the purposes and means of processing.
It is the responsibility of the data controller to apply appropriate technical and organizational measures to ensure that the processing of personal data is carried out in compliance with the rules resulting from the General Data Protection Regulation and its implementing law.
Data Protection Officer
STCP, EIM, SA has appointed a Data Protection Officer who can be contacted via the email address epd@stcp.pt or by letter sent to Avenida Fernão de Magalhães, 1862, 13th Floor, 4350-158 Porto.
Personal data collected
STCP, EIM, SA collects and processes personal data in order to carry out its duties, in particular for the purposes of identification, contact, invoicing, recruitment, management of administrative offence reports and
complaints, as well as those that may prove to be strictly necessary for the fulfillment of its legal and contractual obligations.
Categories of personal data processed
The data collected may be the following:
a) Identification data, such as name, civil identification number, NIF, date of birth;
b) Contact details, such as address, email address, telephone or mobile number;
c) Professional data, academic qualifications, certifications, curriculum;
d) Payment data, in the event of requesting a service or within the scope of executing a contract, data will be collected to carry out the respective processing;
e) Reasons for contact, such as complaints, suggestions and requests for information;
f) Validation data;
g) Data contained in news reports;
h) Invoice history and payment method for on-board transport tickets;
i) Data on comments, suggestions and complaints (content);
j) Individualized responses to surveys;
k) Geolocation data from the use of the WiFi service;
l) Browsing data and use of STCP digital tools with login;
m) Video, in the case of visiting STCP, EIM, SA facilities or traveling on one of its buses.
b) Contact details, such as address, email address, telephone or mobile number;
c) Professional data, academic qualifications, certifications, curriculum;
d) Payment data, in the event of requesting a service or within the scope of executing a contract, data will be collected to carry out the respective processing;
e) Reasons for contact, such as complaints, suggestions and requests for information;
f) Validation data;
g) Data contained in news reports;
h) Invoice history and payment method for on-board transport tickets;
i) Data on comments, suggestions and complaints (content);
j) Individualized responses to surveys;
k) Geolocation data from the use of the WiFi service;
l) Browsing data and use of STCP digital tools with login;
m) Video, in the case of visiting STCP, EIM, SA facilities or traveling on one of its buses.
Basis and purpose of processing
STCP, EIM, SA collects and processes personal data for the purpose of fulfilling its legal obligations, based on its legitimate interests and the consent of the data subject.
Sharing and disclosure of data to third parties
As part of its business activities, STCP, EIM, SA may use subcontractors to process personal data on its behalf, which will imply access by these entities to such data. If this occurs, STCP, EIM, SA will take appropriate measures, as stipulated in the contract, to ensure that these third parties provide sufficient and appropriate guarantees that they will implement technical and organizational measures and that they will act only in accordance with STCP, EIM, SA's instructions.
Data retention period
Personal data will be kept for the periods established by law or for the period strictly necessary for the pursuit of the purposes for which they were collected and processed, after which they will be deleted or anonymized.
Rights of data subjects in relation to data
Under the terms of the General Data Protection Regulation, the data subject's rights include, in particular:
STCP, EIM, SA collects and processes personal data for the purpose of fulfilling its legal obligations, based on its legitimate interests and the consent of the data subject.
Sharing and disclosure of data to third parties
As part of its business activities, STCP, EIM, SA may use subcontractors to process personal data on its behalf, which will imply access by these entities to such data. If this occurs, STCP, EIM, SA will take appropriate measures, as stipulated in the contract, to ensure that these third parties provide sufficient and appropriate guarantees that they will implement technical and organizational measures and that they will act only in accordance with STCP, EIM, SA's instructions.
Data retention period
Personal data will be kept for the periods established by law or for the period strictly necessary for the pursuit of the purposes for which they were collected and processed, after which they will be deleted or anonymized.
Rights of data subjects in relation to data
Under the terms of the General Data Protection Regulation, the data subject's rights include, in particular:
a) Right of access: the right to obtain confirmation from the controller as to whether or not personal data concerning you are being processed and, where that is the case, the right to access your personal data and the way in which they are processed;
b) Right to rectification: the right to obtain, without undue delay, from the controller, the rectification of incorrect and/or incomplete personal data concerning you;
c) Right to erasure of data ('right to be forgotten'): the right to obtain from the controller the erasure of your personal data, without undue delay, when:
b) Right to rectification: the right to obtain, without undue delay, from the controller, the rectification of incorrect and/or incomplete personal data concerning you;
c) Right to erasure of data ('right to be forgotten'): the right to obtain from the controller the erasure of your personal data, without undue delay, when:
• The data are no longer necessary for the purpose for which they were collected or processed;
• The holder has withdrawn his/her consent, unless there is another legal basis for the respective processing;
• The holder objects to the processing, except when there are prevailing legitimate interests that justify it;
• The personal data were processed unlawfully;
• By legal obligation, arising from Union law or that of a Member State to which the controller is subject.
• The holder has withdrawn his/her consent, unless there is another legal basis for the respective processing;
• The holder objects to the processing, except when there are prevailing legitimate interests that justify it;
• The personal data were processed unlawfully;
• By legal obligation, arising from Union law or that of a Member State to which the controller is subject.
d) Right to restriction of processing: the right to obtain from the controller restriction of processing, if one of the following situations occurs:
• Contest the accuracy of personal data, for a period that allows the data controller to verify its accuracy;
• The processing is unlawful and the data subject opposes the erasure of personal data and requests, instead, the limitation of its use;
• The controller no longer needs the personal data for processing purposes, but such data are required by the data subject for the purposes of declaring, exercising or defending a right in legal proceedings;
• The processing is unlawful and the data subject opposes the erasure of personal data and requests, instead, the limitation of its use;
• The controller no longer needs the personal data for processing purposes, but such data are required by the data subject for the purposes of declaring, exercising or defending a right in legal proceedings;
• If you have objected to the processing of data, until it is verified that the legitimate reasons of the controller prevail over those of the data subject.
e) Right to data portability: the right to receive personal data concerning you that you have provided to the data controller, in a structured, commonly used and machine-readable format, and the right to transmit such data to another data controller without the controller to whom the personal data were provided being able to prevent it, when:
• The processing is based on consent or the performance of a contract; and
• The processing is carried out by automated means.
• The processing is carried out by automated means.
f) Right to object: the right to object, at any time, to the processing of personal data concerning you, including profiling, except where compelling legitimate grounds for such processing prevail over the interests, rights and freedoms of the data subject.
g) Automated individual decisions, including profiling: the right not to be subject to any decision taken solely on the basis of automated processing, including profiling, unless the decision:
g) Automated individual decisions, including profiling: the right not to be subject to any decision taken solely on the basis of automated processing, including profiling, unless the decision:
• It is necessary for the conclusion or performance of a contract between the data subject and a data controller;
• It is based on the consent of the data subject;
• It is authorized by Union or Member State law to which the controller is subject, and which also lays down suitable measures to safeguard the rights and freedoms and legitimate interests of the data subject;
• It is based on the consent of the data subject;
• It is authorized by Union or Member State law to which the controller is subject, and which also lays down suitable measures to safeguard the rights and freedoms and legitimate interests of the data subject;
h) Withdrawal of consent: the right to withdraw your consent at any time. Withdrawal of consent does not compromise the lawfulness of processing carried out based on previously given consent or another lawful basis.
Cookies or connection testimonials
STCP, EIM, SA uses cookies or connection testimonials – small text files stored by the website on the user's device when they visit it – to improve the website's performance and user experience.
To learn more about cookies and how STCP, EIM, SA uses them, see the Cookie Policy.
Data security
STCP, EIM, SA uses a set of technologies, tools and security procedures to protect your personal data from unauthorized access, use or disclosure.
Privacy Policy Update
This privacy policy will be updated continuously, and the update date will be changed accordingly.
Updated on: 05/29/2025
