Privacy statement
Who is responsible for processing my personal data?
Banco L. J. Carregosa is responsible for the processing of the personal data of its clients and/or potential clients. The contact details for Banco L. J. Carregosa are as follows:
Address: Avenida da Boavista, 1083, 4100-129, Porto.
Tel.: 22 608 6460
How can I contact the Banco L. J. Carregosa Data Protection Officer?
Banco L. J. Carregosa has appointed a Data Protection Officer, who is responsible for monitoring compliance with legislation, managing interactions with the holders of the personal data collected and cooperating with the National Commission for Data Protection, the national supervisory authority. Any questions regarding the processing of your personal data should be sent to the following email address:
dataprotection@bancocarregosa.com
How are my personal data collected?
Banco L. J. Carregosa collects your personal data through the following means:
- Completion of online and in-person account opening forms;
- Subscription to authentication and validation services for homebanking operations;
- Completion of forms to obtain consent to send marketing communications or to participate in events and other promotional activities; and
- Use of the Banco L. J. Carregosa website.
For what purposes and on what basis does Banco L. J. Carregosa collect and process my data?
Under the General Data Protection Regulation, processing is "an operation or set of operations which is performed on personal data or sets of personal data, by automated or non-automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction".
Banco L. J. Carregosa promotes the lawful and transparent processing of your data, using validated forms of legitimation and using them only for the purposes described below.
Processing in the framework of the execution of a contract
Certain personal data is processed by Banco L. J. Carregosa because it is necessary for the execution of a contract or the implementation of pre-contractual procedures:
Opening of accounts and registration and maintenance of information necessary for the provision of banking and financial intermediation services.
Provision of information within the scope of the marketing of products and services provided by the Bank and assessment of their suitability to the customer's profile.
Management of the business relationship through the registration of banking operations, namely: transfers, transfer of securities, cheque and cash deposits, execution of orders on financial instruments, etc.
Consideration and response to complaints, requests for clarification and suggestions.
Subscription to and management of services linked to electronic channels, such as homebanking and electronic trading platforms.
Management of credit operations, regarding their simulation and granting, as well as the provision of associated guarantees.
Processing based on a legal obligation
The activity of Banco L. J. Carregosa is subject to a set of legal requirements that require it to collect and process a set of data, namely:
- Legislation on the prevention of money laundering and terrorist financing;
- The set of financial intermediation documents, topped by the Markets in Financial Instruments Directive II (MiFID II);
- Legislation applicable to the exercise of the banking activity, especially the General Regime of Credit Institutions and Financial Companies; and
- Regulatory documents issued by the Bank of Portugal and the Securities Market Commission;
Determination of risk profiles and verification of knowledge, experience and investment objectives for the acquisition of certain financial instruments.
Use of screening and filtering tools to prevent crimes related to money laundering and the financing of terrorism.
Regulatory documents issued by the Bank of Portugal and the Securities Market Commission.
Compliance with tax and accounting obligations.
Image capture through video surveillance cameras, in compliance with Decree-Law no. 34/2013.
Logging and recording of communications maintained when placing orders on financial instruments.
Establishment of a documentary archive.
Processing based in the legitimate interest of the Bank
Data processing performed based on the legitimate interest of Banco L. J. Carregosa aims, above all, to continuously improve business relationships and customer experience, unless the interests or fundamental rights and freedoms of the data subject prevail and require protection of personal data, in particular if the data subject is a minor.
Provision of information to clients on financial markets, technical analysis, etc.
Sending marketing communications through SMS and email, regarding promotional campaigns or aimed at promoting the acquisition of products and services offered by the Bank.
Use of historical data from interactions with customers and the financial information collected to define profiles and categories and increase the quality of communications and services provided.
Verification of satisfaction levels and quality of services provided.
Non-compliance management (litigation) or exercise/defence of
a right, regardless of whether it is a judicial proceeding or an administrative or extrajudicial proceeding.
Access to credit information systems with a view to determining credit risk.
Conservation and management of information systems, with a view to protecting their integrity through access control and monitoring.
Processing based on the data subject’s consent
The data subject may authorise Banco L. J. Carregosa to process certain data by giving free, express, informed, specific and explicit consent (orally or by other verifiable means):
Collection of biometric data for authentication of access to homebanking and validation of operations.
Adaptation of the browsing experience on the Bank's website, based on:
- Number of visits, their origin, consultation time and pages consulted within the site;
- Content optimisation, based on browsing history; and
- Browsing optimisation, based on the operating systems and browsers used.
Call recording to monitor the quality of services.
Other legal grounds for processing personal data invoked by the General Data Protection Regulation are as follows:
- where processing of the data is necessary in order to safeguard the vital interests of the data subject or of any other person; and
- Where processing is carried out in the public interest by a duly authorised compliance officer.
What types of personal data can be collected by Banco L. J. Carregosa?
Identity:
- Full name;
- Signature;
- Sex;
- Date of birth;
- Tax identification number or equivalent number issued by a competent foreign authority;
- Social Security identification number;
- Civil identification number (citizen’s card, identity card, passport or residence permit), its issuing authority and dates of issue/validity;
- Nationality;
- Birthplace
- Affiliation;
- Marital status;
- Marriage regime;
- Name, address and NIF of tax representative, if applicable;
- Statute of the Politically Exposed Person;
Biometric data
- Facial images;
- Voice samples;
Professional data
- Qualifications and academic background;
- Profession and employer;
- Business Address;
Contacts
- Tel.;
- Mobile
- Email address;
- Permanent Home Address;
- Tax Address;
Financial data and data relating to the commercial relationship
- Knowledge and experience of investment services and financial instruments;
- Financial situation;
- Purposes to be assigned to the personal bank account;
- Business correspondence;
- History of monetary transactions and financial instruments from, to and in accounts held at Banco L. J. Carregosa;
- Recordings of telephone calls.
Data collected indirectly through the Banco Carregosa website
- Date, duration and location of the website visit;
- Browser type, operating system and device details;
- IP address
To whom will my data be transmitted?
Banco L. J. Carregosa will transmit your personal data to service providers and public authorities as required by law or only when necessary for the performance of financial intermediation and banking services contracts.
Your data is not transferred to countries outside the European Economic Area unless the country in question is subject to an adequacy decision of the European Commission offering safeguards at least equivalent to those in the General Data Protection Regulation regarding the protection of the privacy rights of data subjects.
Whenever requested by the data subjects, Banco L. J. Carregosa shall identify the subcontractors engaged in the provision of its services.
Please contact our Data Protection Officer with any queries regarding the transfer of your data to third parties.
What security measures are in place to keep my data safe?
- Implementation of controls for information transmission by computer;
- Existence of restricted access profiles to data, on a need-to-know basis, and respective control of consultations;
- Installation of Firewalls to prevent unauthorised access.
For how long are my data kept?
In the case of processing based on consent, the data shall be deleted as soon as the data subject withdraws consent or exercises the right to erasure. With regard to data collected under a legal order, Banco L. J. Carregosa is obliged by Article 51(1) of Law No. 83/2017 to keep, for a period of 7 years after termination of the business relationship, the following elements:
- Electronic copies, records or data extracted from all documents obtained or made available by customers or any other persons, within the scope of the identification and due diligence procedures provided for in that law;
- The integral documentation of processes or files relating to customers and their accounts, including the business correspondence sent;
- Any documents, records and analyses, of an internal or external nature, which formalise compliance with the provisions of the aforementioned law.
Furthermore, pursuant to Article 6(f) of the General Data Protection Regulation, the data indicated above and also those relating to the use of accounts held with Banco L. J. Carregosa - including, but not limited to, bank and financial statements, proof of transactions and invoices - may be kept until the limitation period for contractual liability which, under civil law, is set at 20 years.
How can I withdraw consent for the processing of my data?
If you are a customer of Banco L. J. Carregosa, you can withdraw consent for the processing of data collected on the basis of this form of legitimation through your homebanking service, in the "Settings" tab, or by contacting the Data Protection Officer. If you do not have access to homebanking, you should contact our Data Protection Officer.
If you are not our customer, you can manage the matters of interest you have subscribed to and consented to through the link provided in the marketing communications we send to you. Otherwise, you can contact our Data Protection Officer.
What rights do I have in relation to the processing of my personal data?
The General Data Protection Regulation will, on the one hand, reinforce guarantees already provided by previous legislation and, on the other, grant new rights to data subjects. Therefore, you may exercise the following rights with Banco L. J. Carregosa:
- Request additional information regarding the types of data kept, the purposes of their processing and to whom they are transmitted;
- Request copies of data;
- Request the portability of the data provided during the execution of the contract to another controller;
- Demand the correction of any incorrect or inaccurate data;
- Request the erasure of data whose processing has become unlawful, for example, because you have withdrawn consent or because the mandatory retention period has expired;
- Object to the processing where it is carried out in the public interest or in the interest of the controller and there are no compelling legitimate grounds overriding the interests, rights and freedoms of the data subject or the data are not necessary for the establishment, exercise or defence of legal claims.
- Demand the limitation of processing operations in the following cases:
- When you dispute the accuracy of your data;
- When the processing has become unlawful, but you do not intend to request erasure;
- When processing has already ceased, but L. J. Carregosa Bank needs the data for the purposes of the declaration, exercise or defence of a right in legal proceedings.
Whenever you exercise any of these rights, Banco L. J. Carregosa or the Data Protection Officer will respond to you within one month. In cases where the request is particularly complex, this deadline shall be extended by one month and the reply shall be accompanied by a statement of reasons.
If the response from Banco L. J. Carregosa or our Data Protection Officer is not in line with your expectations or if the processing operations carried out leave you unsatisfied, you must lodge a complaint with the National Commission for Data Protection, the competent supervisory authority, via the following contacts:
Address: Rua de São Bento, n.º 148, 3º, 1200-821, Lisbon.
Tel.: 213928400
Email: geral@cnpd.pt