Privacy Policy

What are the controller’s contact details?

At the Ascendi, the main Controllers are Ascendi O&M, S.A., with respect to the processing personal data are Ascendi O&M, S.A., for processing related to the toll collection activity, including processing related to the use of the Ascendi Portal and APP, and Ascendi IGI, Inovação e Gestão de Infraestruturas, S.A., for processing activities concerning research, development, product commercialisation, and the provision of services related to the management, operation, maintenance, exploitation, and technical support of infrastructures and toll operations.

Ascendi domain platforms may contain links to websites and services of other entities with their own privacy policies. Ascendi is not responsible for data processing carried out by third parties that are not controlled by Ascendi. Therefore, we recommend that you read the privacy policies of these third parties carefully.

Ascendi can be contacted as follows:

Address: Edifício Litografia Lusitana
Praça Mouzinho de Albuquerque, 197
4100 – 360 Porto
Phone: 229980200

What personal data do we process?

The personal data that we process are information that directly or indirectly enable identifying an identified or identifiable natural person, such as a personal identification number or any specific factors of the physical, physiological, mental, economic, cultural or social identity of that natural person.

The processed personal data depend on the context of the interactions with Ascendi and may include the following:

Identification:
- Name; - Taxpayer Identification Number (NIF); - Nationality; - Citizen Card; - Driving License;

Contacts:
- Address / Postal Code / Town / Country; - E-mail address; - Telephone number and /or mobile phone.

Registration and use of the Ascendi and Ascendi GO Apps:
- User/e-mail;
- Password.

Other:

- Location data: vehicle passages at charging points;
- Video: Ascendi facilities or travelling through motorway networks;
- Voice: recording of calls;
- Vehicle data: license plate number / vehicle identifier / registration certificate or equivalent;
- Billing data: Notification / Billing document / Invoice / Receipt;
- Payment data: payment method(s); payment authorization; payment history;
- Banking data: IBAN;
- Customer support data: contact history; contact preferences; copies or photographs of documents;
- Registration and browsing data: user/email; password; access and interaction logs through websites, portals, and mobile applications;
- Browsing data: access and interaction logs; through webs, portals and mobile applications; - Data on outstanding payments: toll charges, administrative costs and fines;
- Applications: CV, curricular information, professional experience, training and other; - Whistleblowing complaints: content of the complaint; relationship with Ascendi; supporting information; Optional: name; e-mail.

Ascendi will process personal data only to the extent strictly necessary for the performance of its activities, in accordance with the appropriate legal basis for such processing. This includes, but is not limited to, situations where personal data are required for compliance with legal obligations to which Ascendi is subject, for the performance of a contract to which the data subject is a party, based on the data subject’s consent, or for the pursuit of legitimate interests, provided that such interests do not override the interests or rights of the data subjects.

Why do we process personal data?

Personal data are processed by Ascendi or by the entities subcontracted by Ascendi for the following purposes: - Collection of outstanding toll charges, under the terms of the toll collection legislation in force, namely Law 25/2006 of 30 June; - Operation and maintenance of the roads under its management, with a view to compliance with the obligations arising from Concession, Sub-concession or Service Provision Contracts; - Response to requests for information or complaints, based on the data subject’s consent; - Carrying out other commercial activities, including registration in the Ascendi Portal or in the Ascendi and Ascendi GO Apps, and electronic communications, when consented by the data subject; - Manage internal and external whistleblowing channels, based on the consent of the whistleblower and the applicable legislation and regulations, namely the general regime for the protection of whistleblowers established in the Portuguese Law 93/2021 of 20 December.

With which entities may we share your data?

Personal data may be disclosed to third parties, provided that the data subject’s consent has been obtained to that end, or when:

- The transmission is carried out in the context of compliance with a legal obligation, a resolution or authorisation of the competent data protection supervisory authority (CNPD - Comissão Nacional de Proteção de Dados) or court order;

- The disclosure is carried out to protect the vital interests of users or any other legitimate purpose established in the law;

- Ascendi subcontracts other entities for the provision of services in order to enable the operationalisation of internal processes and obligations, namely contractual, tax-related or legal;

- The personal data processing corresponds to a legitimate interest of Ascendi or third parties, unless the interests or fundamental rights and freedoms of the data subject prevail.

When there are legal grounds for transmission of the user’s personal data to third parties, Ascendi guarantees that these entities’ access to the collected information shall be limited to that required to pursue the legitimate specific purpose.

The transmission of personal data, as described in this Privacy Policy, does not, as a rule, include the international transfer of personal data to countries outside the European Economic Area, except in specific situations, namely when based on the use of subcontracted international services, such as cloud services, in which transfers may be made to an international organisation, under the condition that an adequate level of protection is ensured.

The personal data collected under the toll collection services may be transferred for processing for the same purposes, to concessionaires, sub-concessionaires or any road infrastructure operator for which Ascendi provides toll collection services.

Concerning the interconnection of toll collection portals, aimed at enabling the consultation, on a single platform, in a transversal and voluntary manner, of all outstanding toll charges and their payment, relative to the different portals, Ascendi O&M S.A., Portvias – Portagem de Vias, S.A., ViaLivre, S.A. And Via Verde Portugal – Gestão de Sistemas Eletrónicos de Cobrança, S.A. are jointly responsible for this processing, specifically, pursuant to Article 26(1) of the General Data Protection Regulation (GDPR).

For all due purposes, the entities responsible for the processing (controllers) have signed a joint liability agreement pursuant to Article 26(1) of the GDPR, establishing their responsibilities, the essence of which, in accordance with Article 26(2), can be consulted  here**.** (PDF · 97 kB) (opens in a new window)

How long do we keep personal data?

The data shall be stored and kept only for the minimum time required for the purposes for which they were collected and subsequently processed, after which they shall be treated appropriately, being destroyed or anonymised, without prejudice to their retention beyond that period where required by a legal obligation, court order, or when necessary to demonstrate compliance with contractual or other obligations.

What security measures are taken?

Ascendi does its utmost to protect the users’ personal data against unauthorised access by implementing suitable logical, physical and organisational measures and access controls in order to ensure the encryption, pseudonymisation and anonymisation of personal data, whenever possible as well as the appropriate, necessary and sufficient security measures to protect personal data against destruction, loss, alteration, dissemination, unauthorised access or any other form of accidental or unlawful treatment.

The measures taken by Ascendi include the implementation of appropriate access controls, in order to ensure the encryption, pseudonymisation and anonymisation of personal data, whenever possible.
Access to personal data is only allowed on a need-to-know basis and subject to strict contractual confidentiality obligations when processed by third parties.

However, the user is responsible for ensuring that the terminal being used is adequately protected against harmful software, computer viruses and worms. Furthermore, the user is responsible for taking adequate security measures (e.g., secure browser configuration, up-to-date antivirus software, security barrier software and non-use of software of doubtful origin), without which the risk of personal data and passwords being accessed by unauthorised third parties is enhanced.

Although data transmission via the internet or website cannot guarantee full security against intrusion, Ascendi and its service providers engage their best efforts to implement and maintain physical, electronic and procedural security measures to protect personal data in compliance with the applicable data protection requirements.

What are your data protection rights?

Pursuant to the GDPR, Ascendi guarantees that data subjects may exercise their rights, in particular the right of access, the right to rectification, the right to erasure, the right to object, the right to restriction of processing, the right to data portability, the right not to be subject to automated decisions, and the right of representation.

How to access and rectify your data?

The following means can be used to exercise your rights:

- Submission of form available on the Ascendi website: https://portal.ascendi.pt/en/apoio-a-clientes (opens in a new window) -> Processing of Personal Data -> Exercise My Rights option.
- E-mail to the address dataprotection@ascendi.pt ;

- Letter addressed to the Ascendi Data Protection Officer - C/O Ascendi’s Data Protection Officer, Edifício Litografia Lusitana, Praça Mouzinho de Albuquerque, 197, 4100-360 Porto, Portugal;

- In person by completing the form in paper format available during business hours at the Ascendi customer service office located at Rua de Agramonte 130, Porto, Portugal.

What are the DPO’s contact details?

The following means can be used to contact the Data Protection Officer (DPO):

- Submission of form available on the Ascendi website: https://portal.ascendi.pt/en/apoio-a-clientes (opens in a new window) -> Processing of Personal Data -> Exercise My Rights option.
- E-mail to the address dataprotection@ascendi.pt ;

- Letter addressed to the Ascendi Data Protection Officer - C/O Ascendi’s Data Protection Officer, Edifício Litografia Lusitana, Praça Mouzinho de Albuquerque, 197, 4100-360 Porto, Portugal;

- In person by completing the form in paper format available during business hours at the Ascendi customer service office located at Rua de Agramonte 130, Porto, Portugal.

How to exercise your right to complain?

Ascendi has appointed a Data Protection Officer who can be contacted by the means described above. The data subject also has the right to submit a complaint with the competent data protection supervisory authority, using the contacts using the contacts provided for the effect by that entity.

How to stay informed about privacy policy updates?

Any change to this Privacy Policy shall be disclosed immediately on this page and referenced through the version number and date of update.

Accordingly, we advise users to periodically review this Privacy Policy so as to keep up-to-date on how Ascendi collects and processes personal data, and how data subjects can exercise their rights concerning that data.

If the change to the Privacy Policy directly affects the consent given by the data subjects, Ascendi undertakes to request a new consent for the processing of personal data in accordance with the new Privacy Policy.