What companies keep

The lines below come from the companies' own official privacy policies, read on the dates shown. Among them are TikTok, which records the rhythm of your typing, and WhatsApp, which uploads your full contact list. Pick a company and write it a request.

Telecoms

  1. MEO / Altice Portugal

    On its official data-protection page, MEO writes that it processes the origin and destination numbers of your communications, with date, time and duration, along with an interests profile and the location of your device.

    Privacy policy, read on 21 August 2026.

    Write to MEO Full entry

  2. NOS

    According to the official policy, NOS processes the numbers and length of your calls, the films you watched and the cinema rooms you visited. Among the data there is also an interests profile, which can include your football club.

    Privacy policy, read on 21 August 2026.

    Write to NOS Full entry

  3. Vodafone Portugal

    The official declaration says Vodafone processes the numbers you call, the time and length of your calls, the data volume you use and your location, obtained from the network masts your phone connects to.

    Privacy statement, read on 21 August 2026.

    Write to Vodafone Portugal Full entry

  4. DIGI

    DIGI logs your TV viewing and the sites and apps you use. The operator also keeps your device's location, obtained through the mobile network or GPS, and recordings of calls to customer support.

    Privacy policy, read on 21 August 2026.

    Write to DIGI Full entry

Shops and marketplaces

  1. Continente / Cartão Continente (Sonae MC)

    Continente keeps the item, store and time of each purchase and analyses your consumption preferences to personalise offers, its official policy writes. If there is a medical incident in a store, the policy provides for processing health data.

    Privacy policy, read on 21 August 2026.

    Write to Continente Full entry

  2. Worten

    Worten builds a profile with your tastes, interests and preferences, alongside the history of what you searched for and bought, according to its official policy.

    Privacy policy, read on 21 August 2026.

    Write to Worten Full entry

  3. Pingo Doce

    If you allow it, Pingo Doce shares your phone's unique identifier with Google and Facebook, which can use it to build consumption profiles and show ads matched to your interests.

    Privacy policy, read on 21 August 2026.

    Write to Pingo Doce Full entry

  4. Lidl

    With your consent, Lidl records your behaviour on the site and app, including the coupons you used and how often you shop in store with Lidl Plus, and can add your age and gender to your user profile.

    Privacy policy, read on 21 August 2026.

    Write to Lidl Full entry

  5. Fnac

    To provide the services you contracted, FNAC may pass your data to insurance companies and to payment-processing entities.

    Privacy policy, read on 21 August 2026.

    Write to Fnac Full entry

  6. Amazon

    Whenever you speak to Alexa, Amazon retains the voice recording, says its official notice, along with your profile photo and the images and videos tied to its services. Your browsing history on the site remains too.

    Privacy notice, read on 21 August 2026.

    Write to Amazon Full entry

  7. Glovo

    Glovo processes your location data and the number of orders you made and, from what it collects, places you in segments to personalise the app. So says the official policy.

    Privacy policy, read on 21 August 2026.

    Write to Glovo Full entry

  8. OLX

    To verify identity, its official policy says, OLX can process your ID document number, tax number and date of birth. Address, phone and approximate location are retained as well.

    Privacy policy, read on 21 August 2026.

    Write to OLX Full entry

  9. Decathlon Portugal

    Decathlon transmits your identification data such as your email and phone number, in encoded form, to third-party advertising platforms to show you personalised ads and to find profiles similar to yours, according to the policy.

    Privacy policy, read on 21 August 2026.

    Write to Decathlon Portugal Full entry

  10. Zara

    If you use the Try On feature, the images you send are used to create an avatar of you, which stays in your account for up to one year.

    Privacy policy, read on 21 August 2026.

    Write to Zara Full entry

  11. Temu

    When an order requires customs clearance in certain EU countries, Temu may collect and share your passport number or your tax identification number.

    Privacy policy, read on 21 August 2026.

    Write to Temu Full entry

  12. IKEA Portugal

    If you give your consent, IKEA analyses your habits and your sales profile as a consumer to build a profile of you and offer you the things it knows you will like most.

    Privacy policy, read on 21 August 2026.

    Write to IKEA Portugal Full entry

  13. AliExpress

    Your messages exchanged with sellers and anything you disclose in discussion forums are among the personal data AliExpress collects. The company may also infer individual preferences from your shopping patterns, such as the style and colours you favour.

    Privacy policy, read on 21 August 2026.

    Write to AliExpress Full entry

  14. Auchan Portugal

    Your fingerprint is one of the biometric data types Auchan may collect, and premises with video surveillance capture your image.

    Privacy policy, read on 21 August 2026.

    Write to Auchan Portugal Full entry

  15. Fitness Hut Portugal

    Your personal data is kept only for as long as necessary for the purposes of processing, without a fixed duration stated in the policy, and you may request erasure by emailing dados.pessoais@vivagymgroup.com.

    Privacy policy, read on 21 August 2026.

    Write to Fitness Hut Portugal Full entry

  16. Holmes Place Portugal

    The policy does not state that data is deleted afterward. It only says data remains in place while the processing purpose lasts, until consent is withdrawn unless another legal basis exists, or for the legally required period when a legal obligation applies.

    Privacy policy, read on 21 August 2026.

    Write to Holmes Place Portugal Full entry

  17. Well's

    Wells keeps billing data for ten years, while other personal data is only processed for as long as the customer's account stays active, or for up to two years for purchases made without an account, according to the company's privacy policy.

    Privacy policy, read on 21 August 2026.

    Write to Well's Full entry

  18. Douglas Portugal

    In the App, the one-year-after-contract period applies to contact data used to show you products similar to ones you already bought. All other data, on the site and in the App, remains in place only for as long as the purpose behind its collection stays active, a period that can extend for legal obligations.

    Privacy policy, read on 21 August 2026.

    Write to Douglas Portugal Full entry

  19. Primor

    Personal data is kept only for as long as strictly necessary to handle the user's request, and for a registered account, until deletion is requested, after which the data may sit blocked for the legal limitation period before being erased.

    Privacy policy, read on 21 August 2026.

    Write to Primor Full entry

  20. Zalando

    Even after the account is closed, Zalando still keeps order and payment data for up to ten years, as required by German tax and commercial law, before final deletion becomes possible.

    Privacy policy, read on 21 August 2026.

    Write to Zalando Full entry

  21. Darty Portugal

    Darty Portugal, the brand that replaced MediaMarkt in the country (mediamarkt.pt now redirects to darty.pt), keeps personal data only for as long as needed for the purpose it was collected for, without setting a concrete period in the policy itself.

    Privacy policy, read on 22 August 2026.

    Write to Darty Portugal Full entry

Platforms and social networks

  1. Netflix

    The official statement reads that Netflix keeps your viewing history, your searches and your voice entries, including recordings, and that it draws inferences about you and your household from what it collects.

    Privacy statement, read on 21 August 2026.

    Write to Netflix Full entry

  2. Spotify

    Spotify can process your phone's sensor data about how you move or hold the device, when a feature requires it, says the official policy. With voice features on, audio recordings of your voice are processed.

    Privacy policy, read on 21 August 2026.

    Write to Spotify Full entry

  3. Google

    Google processes your searches, the videos you watched, voice and audio information, your purchase activity, the people you communicate with and your location, per its official policy. This entry links to Google's form for getting your name out of search results.

    Privacy policy, read on 21 August 2026.

    Write to Google Full entry

  4. TikTok

    Even the rhythm and patterns of your typing are collected, according to TikTok's official policy, as is your clipboard content, if you copy and paste, and that of the messages you send and receive on the platform.

    Privacy policy, read on 21 August 2026.

    Write to TikTok Full entry

  5. Instagram (Meta)

    According to Meta's official policy, the content you create and what passes through your camera or camera roll is collected, along with what you view, how you interact, and the GPS location shared by your device settings.

    Privacy policy, read on 21 August 2026.

    Write to Instagram (Meta) Full entry

  6. Facebook (Meta)

    Meta's policy, the same one Instagram runs on, says it collects the content you create and what passes through your camera or camera roll, what you view and how you interact, and the GPS location shared by your device settings.

    Privacy policy, read on 21 August 2026.

    Write to Facebook (Meta) Full entry

  7. LinkedIn

    Using automated systems and AI, LinkedIn builds inferences about you, according to its official policy, which also warns that other people may post or write about you on the platform.

    Privacy policy, read on 21 August 2026.

    Write to LinkedIn Full entry

  8. WhatsApp (Meta)

    Your phone's address book is uploaded regularly, including people who do not yet use the service, according to the official policy, which also covers your precise location and device signals such as battery level. The messages themselves are end-to-end encrypted.

    Privacy policy, read on 21 August 2026.

    Write to WhatsApp (Meta) Full entry

  9. Microsoft

    Windows collects data about you, your device and the way you use it, including voice recognition and location services, says Microsoft's official statement. And if the device is managed by an organisation, such as your employer or school, that organisation can access your data.

    Privacy statement, read on 21 August 2026.

    Write to Microsoft Full entry

  10. Telegram

    If Telegram receives a valid court order confirming you are a suspect in a criminal case that violates its Terms of Service, it may disclose your IP address and phone number to the authorities.

    Privacy policy, read on 21 August 2026.

    Write to Telegram Full entry

  11. X (Twitter)

    X may keep the email address and phone number of suspended accounts indefinitely to stop repeat offenders, and collects the content and recipients of your Direct Messages.

    Privacy policy, read on 21 August 2026.

    Write to X (Twitter) Full entry

  12. Reddit

    The IP address used to create your account is the only one Reddit does not delete after 100 days. Even after you delete your account, old posts and comments stay visible unless you delete each one first.

    Privacy policy, read on 21 August 2026.

    Write to Reddit Full entry

  13. Discord

    Message drafts you never sent count among the content Discord collects about you. After you delete your account, some content may still be retained under its data retention policy.

    Privacy policy, read on 21 August 2026.

    Write to Discord Full entry

  14. Steam

    Valve keeps transaction data for up to ten years. When you delete your account, games that affected other players' scores are not deleted, only your link to them is permanently anonymised.

    Privacy policy, read on 21 August 2026.

    Write to Steam Full entry

  15. Indeed

    Indeed Ireland Operations Limited retains your personal data until it is no longer needed for the purpose it was collected for, unless the law requires otherwise, with periods that vary by data type, such as ten years for messages exchanged on the platform.

    Privacy policy, read on 21 August 2026.

    Write to Indeed Full entry

Transport and travel

  1. Via Verde

    For as long as the service lasts, Via Verde processes vehicle data and your geographic location, according to the official policy. The same document says calls are recorded and app usage is analysed to personalise offers.

    Privacy policy, read on 21 August 2026.

    Write to Via Verde Full entry

  2. TAP Air Portugal

    TAP holds your passport number, credit card and frequent-flyer history, per its official policy. For a flight, you can also be asked for your address at origin or destination and an emergency contact.

    Privacy policy, read on 21 August 2026.

    Write to TAP Air Portugal Full entry

  3. Bolt

    When you open the app, Bolt collects your phone's precise geolocation, by GPS and IP address, according to its official declaration. The company also holds onto your transaction history and official ID documents.

    Privacy statement, read on 21 August 2026.

    Write to Bolt Full entry

  4. Uber

    During a trip, Uber's official notice says your location is tracked and the route gets linked to your account. Uber also determines your approximate location and, if you give permission on your phone, your exact one.

    Privacy notice, read on 21 August 2026.

    Write to Uber Full entry

  5. Booking.com

    Booking.com processes your address, payment details and current location, and records whether you travel for work, its official statement provides. It also keeps the names and birth dates of those travelling with you and, for flights, your passport.

    Privacy statement, read on 21 August 2026.

    Write to Booking.com Full entry

  6. Ryanair

    Ryanair runs a photo of your face and your identity document through automated processing to verify bookings and accounts, and keeps most booking data for seven years after the flight date.

    Privacy policy, read on 21 August 2026.

    Write to Ryanair Full entry

  7. Airbnb

    Your facial recognition data, extracted from the photos and the government ID you submit for verification, is collected by Airbnb where this feature is available, with your consent where required by law.

    Privacy policy, read on 21 August 2026.

    Write to Airbnb Full entry

  8. FreeNow

    Your face photo is automatically compared against your identification document through the external provider Onfido, a process FREE NOW classifies as biometric data subject to consent, according to the privacy policy of Intelligent Apps GmbH.

    Privacy policy, read on 21 August 2026.

    Write to FreeNow Full entry

  9. eDreams

    Data belonging to travellers is, as a rule, retained for up to ten years from the last trip or platform interaction, according to eDreams' privacy policy.

    Privacy policy, read on 21 August 2026.

    Write to eDreams Full entry

Banks and payments

  1. MB WAY (SIBS)

    Your geolocation and the value and volume of the operations you make appear in the app's official policy. The type of operations on the Multibanco network and your phone's make and model are recorded too.

    Privacy policy, read on 21 August 2026.

    Write to MB WAY (SIBS) Full entry

  2. PayPal

    PayPal records your official ID document, bank account number, card details, including the CVV, and IBAN, its official statement says, to which it adds the amount you send or request and your income.

    Privacy statement, read on 21 August 2026.

    Write to PayPal Full entry

  3. Santander Portugal

    Santander keeps your voice and your image as biometric data to identify you. It also records geographic information about the bank branches and ATMs you use.

    Privacy policy, read on 21 August 2026.

    Write to Santander Portugal Full entry

  4. Revolut

    When you use the app or the website, Revolut collects behavioural biometric data such as how you navigate or type. After the relationship ends, it may keep your personal data for up to ten years.

    Privacy policy, read on 21 August 2026.

    Write to Revolut Full entry

  5. Caixa Geral de Depósitos

    With your consent, CGD can profile you using statistical techniques to tailor product and service offers. Your data can remain on file for up to ten years after the relationship ends.

    Privacy policy, read on 21 August 2026.

    Write to Caixa Geral de Depósitos Full entry

  6. Millennium bcp

    Whenever you give stock exchange orders by phone, Millennium bcp records the call as proof and may keep that recording for up to ten years after your contract ends.

    Privacy policy, read on 21 August 2026.

    Write to Millennium bcp Full entry

  7. Banco BPI

    Banco BPI keeps the images captured by its video surveillance cameras on its premises for a period of 30 days.

    Privacy policy, read on 21 August 2026.

    Write to Banco BPI Full entry

  8. Novo Banco

    For as long as necessary to fulfil the purposes of processing or legal and regulatory obligations, Novo Banco keeps and processes its clients' personal data, applying retention criteria specific to each case.

    Privacy policy, read on 21 August 2026.

    Write to Novo Banco Full entry

  9. Cofidis

    With your consent and to confirm the information you provided, Cofidis checks external databases from the Tax Authority and Social Security, helping prevent fraud and money laundering, according to the Cofidis Portugal privacy policy (cofidis.pt).

    Privacy policy, read on 21 August 2026.

    Write to Cofidis Full entry

  10. Fidelidade

    Fidelidade processes policyholders' health data for health and personal-accident insurance, based on consent, to assess risk and manage claims, and may decline cover if that data is not provided.

    Privacy policy, read on 21 August 2026.

    Write to Fidelidade Full entry

  11. Ageas Seguros

    When providing its services, Ageas Seguros may collect policyholders' health data, treated as a special category under GDPR. Data linked to the insurance contract, including health data, remains on file for the life of the contract, with a longer period for judicial defence or legal and regulatory obligations.

    Privacy policy, read on 21 August 2026.

    Write to Ageas Seguros Full entry

Energy and services

  1. EDP Comercial

    The official policy says EDP receives the meter readings from your home and analyses your consumption data. If you join the energy advice feature, the same policy provides for building an energy profile of you.

    Privacy policy, read on 21 August 2026.

    Write to EDP Comercial Full entry

  2. Galp

    Loyalty card, payment methods and transactions all figure in Galp's official policy. Video surveillance images remain on file for up to thirty days, it adds, and geolocation is processed with your consent.

    Privacy policy, read on 21 August 2026.

    Write to Galp Full entry

  3. CTT - Correios de Portugal

    Depending on the service, the CTT group's official policy provides for processing images of your ID documents, your address, your household composition and even your degree of disability.

    Privacy policy, read on 21 August 2026.

    Write to CTT Full entry

  4. Idealista Portugal

    The retention period depends on the purpose, but in every case the data is deleted only when the data subject requests it, after which it stays blocked for the legal limitation period of that purpose.

    Privacy policy, read on 21 August 2026.

    Write to Idealista Portugal Full entry

  5. Imovirtual

    While the account stays active, Imovirtual holds your data, and transactional data can be kept for up to ten years after the end of the fiscal year to meet tax and accounting obligations.

    Privacy policy, read on 21 August 2026.

    Write to Imovirtual Full entry