What companies keep
The lines below come from the companies' own official privacy policies, read on the dates shown. Among them are TikTok, which records the rhythm of your typing, and WhatsApp, which uploads your full contact list. Pick a company and write it a request.
72 companies
Telecoms
-
DIGI
DIGI logs your TV viewing and the sites and apps you use. The operator also keeps your device's location, obtained through the mobile network or GPS, and recordings of calls to customer support.
Privacy policy, read on 21 August 2026.
-
MEO / Altice Portugal
On its official data-protection page, MEO writes that it processes the origin and destination numbers of your communications, with date, time and duration, along with an interests profile and the location of your device.
Privacy policy, read on 21 August 2026.
-
NOS
According to the official policy, NOS processes the numbers and length of your calls, the films you watched and the cinema rooms you visited. Among the data there is also an interests profile, which can include your football club.
Privacy policy, read on 21 August 2026.
-
Vodafone Portugal
The official declaration says Vodafone processes the numbers you call, the time and length of your calls, the data volume you use and your location, obtained from the network masts your phone connects to.
Portal de Privacidade, read on 21 August 2026.
Shops and marketplaces
-
AliExpress
Your messages exchanged with sellers and anything you disclose in discussion forums are among the personal data AliExpress collects. The company may also infer individual preferences from your shopping patterns, such as the style and colours you favour.
Privacy Policy, read on 21 August 2026.
-
Amazon
Whenever you speak to Alexa, Amazon retains the voice recording, says its official notice, along with your profile photo and the images and videos tied to its services. Your browsing history on the site remains too.
Aviso de Privacidade da Amazon.es, read on 21 August 2026.
-
Auchan Portugal
Your fingerprint is one of the biometric data types Auchan may collect, and premises with video surveillance capture your image.
Política de Privacidade, read on 21 August 2026.
-
Continente / Cartão Continente (Sonae MC)
Continente keeps the item, store and time of each purchase and analyses your consumption preferences to personalise offers, its official policy writes. If there is a medical incident in a store, the policy provides for processing health data.
Política de Privacidade, read on 21 August 2026.
-
Darty Portugal
Darty Portugal, the brand that replaced MediaMarkt in the country (mediamarkt.pt now redirects to darty.pt), keeps personal data only for as long as needed for the purpose it was collected for, without setting a concrete period in the policy itself.
Política de Privacidade, read on 22 August 2026.
-
Decathlon Portugal
Decathlon transmits your identification data such as your email and phone number, in encoded form, to third-party advertising platforms to show you personalised ads and to find profiles similar to yours, according to the policy.
Privacy policy, read on 21 August 2026.
-
Douglas Portugal
In the App, the one-year-after-contract period applies to contact data used to show you products similar to ones you already bought. All other data, on the site and in the App, remains in place only for as long as the purpose behind its collection stays active, a period that can extend for legal obligations.
Privacy policy, read on 21 August 2026.
-
Fitness Hut Portugal
Your personal data is kept only for as long as necessary for the purposes of processing, without a fixed duration stated in the policy, and you may request erasure by emailing dados.pessoais@vivagymgroup.com.
Política de Privacidade, read on 21 August 2026.
-
Fnac
To provide the services you contracted, FNAC may pass your data to insurance companies and to payment-processing entities.
Privacy policy, read on 21 August 2026.
-
Glovo
Glovo processes your location data and the number of orders you made and, from what it collects, places you in segments to personalise the app. So says the official policy.
Política de Privacidade da Glovo, read on 21 August 2026.
-
Holmes Place Portugal
The policy does not state that data is deleted afterward. It only says data remains in place while the processing purpose lasts, until consent is withdrawn unless another legal basis exists, or for the legally required period when a legal obligation applies.
Política de Privacidade, read on 21 August 2026.
-
IKEA Portugal
If you give your consent, IKEA analyses your habits and your sales profile as a consumer to build a profile of you and offer you the things it knows you will like most.
Política de privacidade, read on 21 August 2026.
-
Intermarché
Intermarché's policy provides for passing customers' personal data on to commercial partners for targeted advertising, and for building and enriching customer profiles for analysis, targeted marketing and commercial prospecting.
Política de Dados Pessoais e Cookies, read on 26 August 2026.
-
Lidl
With your consent, Lidl records your behaviour on the site and app, including the coupons you used and how often you shop in store with Lidl Plus, and can add your age and gender to your user profile.
Privacy policy, read on 21 August 2026.
-
OLX
To verify identity, its official policy says, OLX can process your ID document number, tax number and date of birth. Address, phone and approximate location are retained as well.
Privacy policy, read on 21 August 2026.
-
Pingo Doce
If you allow it, Pingo Doce shares your phone's unique identifier with Google and Facebook, which can use it to build consumption profiles and show ads matched to your interests.
Privacy policy, read on 21 August 2026.
-
Primor
Personal data is kept only for as long as strictly necessary to handle the user's request, and for a registered account, until deletion is requested, after which the data may sit blocked for the legal limitation period before being erased.
Política de privacidade, read on 21 August 2026.
-
Rádio Popular
Rádio Popular automatically logs the IP address of everyone who visits its website and uses it to learn the visitor's location, for example the municipality, and to target tailored information about its stores and services at them.
Política de Privacidade, read on 26 August 2026.
-
Temu
When an order requires customs clearance in certain EU countries, Temu may collect and share your passport number or your tax identification number.
Privacy policy, read on 21 August 2026.
-
Well's
Wells keeps billing data for ten years, while other personal data is only processed for as long as the customer's account stays active, or for up to two years for purchases made without an account, according to the company's privacy policy.
Politica de Privacidade, read on 21 August 2026.
-
Worten
Worten builds a profile with your tastes, interests and preferences, alongside the history of what you searched for and bought, according to its official policy.
Política de Privacidade, read on 21 August 2026.
-
Zalando
Even after the account is closed, Zalando still keeps order and payment data for up to ten years, as required by German tax and commercial law, before final deletion becomes possible.
Privacy policy, read on 21 August 2026.
-
Zara
If you use the Try On feature, the images you send are used to create an avatar of you, which stays in your account for up to one year.
Privacy policy, read on 21 August 2026.
Platforms and social networks
-
Discord
Message drafts you never sent count among the content Discord collects about you. After you delete your account, some content may still be retained under its data retention policy.
Privacy Policy, read on 21 August 2026.
-
Facebook (Meta)
Meta's policy, the same one Instagram runs on, says it collects the content you create and what passes through your camera or camera roll, what you view and how you interact, and the GPS location shared by your device settings.
Política de Privacidade da Meta, read on 21 August 2026.
-
Google
Google processes your searches, the videos you watched, voice and audio information, your purchase activity, the people you communicate with and your location, per its official policy. This entry links to Google's form for getting your name out of search results.
Privacy policy, read on 21 August 2026.
-
Indeed
Indeed Ireland Operations Limited retains your personal data until it is no longer needed for the purpose it was collected for, unless the law requires otherwise, with periods that vary by data type, such as ten years for messages exchanged on the platform.
Privacy policy, read on 21 August 2026.
-
Instagram (Meta)
According to Meta's official policy, the content you create and what passes through your camera or camera roll is collected, along with what you view, how you interact, and the GPS location shared by your device settings.
Política de Privacidade da Meta, read on 21 August 2026.
-
LinkedIn
Using automated systems and AI, LinkedIn builds inferences about you, according to its official policy, which also warns that other people may post or write about you on the platform.
Privacy Policy, read on 21 August 2026.
-
Microsoft
Windows collects data about you, your device and the way you use it, including voice recognition and location services, says Microsoft's official statement. And if the device is managed by an organisation, such as your employer or school, that organisation can access your data.
Declaração de Privacidade da Microsoft, read on 21 August 2026.
-
Netflix
The official statement reads that Netflix keeps your viewing history, your searches and your voice entries, including recordings, and that it draws inferences about you and your household from what it collects.
Declaração de Privacidade, read on 21 August 2026.
-
Reddit
The IP address used to create your account is the only one Reddit does not delete after 100 days. Even after you delete your account, old posts and comments stay visible unless you delete each one first.
Privacy policy, read on 21 August 2026.
-
Spotify
Spotify can process your phone's sensor data about how you move or hold the device, when a feature requires it, says the official policy. With voice features on, audio recordings of your voice are processed.
Política de Privacidade do Spotify, read on 21 August 2026.
-
Steam
Valve keeps transaction data for up to ten years. When you delete your account, games that affected other players' scores are not deleted, only your link to them is permanently anonymised.
Política de Privacidade, read on 21 August 2026.
-
Telegram
If Telegram receives a valid court order confirming you are a suspect in a criminal case that violates its Terms of Service, it may disclose your IP address and phone number to the authorities.
Privacy Policy, read on 21 August 2026.
-
TikTok
Even the rhythm and patterns of your typing are collected, according to TikTok's official policy, as is your clipboard content, if you copy and paste, and that of the messages you send and receive on the platform.
Privacy Policy, read on 21 August 2026.
-
WhatsApp (Meta)
Your phone's address book is uploaded regularly, including people who do not yet use the service, according to the official policy, which also covers your precise location and device signals such as battery level. The messages themselves are end-to-end encrypted.
Política de Privacidade do WhatsApp, read on 21 August 2026.
-
X (Twitter)
X may keep the email address and phone number of suspended accounts indefinitely to stop repeat offenders, and collects the content and recipients of your Direct Messages.
Política de Privacidade do X, read on 21 August 2026.
Transport and travel
-
Airbnb
Your facial recognition data, extracted from the photos and the government ID you submit for verification, is collected by Airbnb where this feature is available, with your consent where required by law.
Privacy policy, read on 21 August 2026.
-
Bolt
When you open the app, Bolt collects your phone's precise geolocation, by GPS and IP address, according to its official declaration. The company also holds onto your transaction history and official ID documents.
Declaração Global de Confidencialidade para Passageiros, read on 21 August 2026.
-
Booking.com
Booking.com processes your address, payment details and current location, and records whether you travel for work, its official statement provides. It also keeps the names and birth dates of those travelling with you and, for flights, your passport.
Declaração de privacidade, read on 21 August 2026.
-
eDreams
Data belonging to travellers is, as a rule, retained for up to ten years from the last trip or platform interaction, according to eDreams' privacy policy.
Política de privacidade, read on 21 August 2026.
-
FreeNow
Your face photo is automatically compared against your identification document through the external provider Onfido, a process FREE NOW classifies as biometric data subject to consent, according to the privacy policy of Intelligent Apps GmbH.
FreeNow closed its Portuguese operation on 3 April 2023. Anyone who used it before then can still ask for their data, because the company still holds it.
Privacy policy, read on 21 August 2026.
-
Grupo Pestana
When you book a stay, Grupo Pestana passes your full name, nationality, date of birth, passport or citizen card number, country of origin, and check-in and check-out dates to the insurer RNA, according to the official policy.
Privacy policy, read on 23 August 2026.
-
Ryanair
Ryanair keeps most of your booking data for seven years after the flight date. With your consent, it also runs a photo of your face and your identity document through automated processing, and the policy always guarantees a non-biometric alternative.
Privacy policy, read on 21 August 2026.
-
TAP Air Portugal
TAP holds your passport number, credit card and frequent-flyer history, per its official policy. For a flight, you can also be asked for your address at origin or destination and an emergency contact.
Política de Privacidade e Cookies, read on 21 August 2026.
-
Uber
During a trip, Uber's official notice says your location is tracked and the route gets linked to your account. Uber also determines your approximate location and, if you give permission on your phone, your exact one.
Aviso de privacidade da Uber, read on 21 August 2026.
-
Via Verde
For as long as the service lasts, Via Verde processes vehicle data and your geographic location, according to the official policy. The same document says calls are recorded and app usage is analysed to personalise offers.
Politica de Privacidade Clientes Via Verde, read on 21 August 2026.
Banks and payments
-
Ageas Seguros
When providing its services, Ageas Seguros may collect policyholders' health data, treated as a special category under GDPR. Data linked to the insurance contract, including health data, remains on file for the life of the contract, with a longer period for judicial defence or legal and regulatory obligations.
Política de Privacidade, read on 21 August 2026.
-
Banco CTT
The official policy lists, among the data Banco CTT collects, call recordings, video recordings and photographs, and also the description of suspicious or fraudulent behaviour.
Privacy policy, read on 23 August 2026.
-
Banco BPI
Banco BPI keeps the images captured by its video surveillance cameras on its premises for a period of 30 days.
Política de privacidade, read on 21 August 2026.
-
Caixa Geral de Depósitos
With your consent, CGD can profile you using statistical techniques to tailor product and service offers. Your data can remain on file for up to ten years after the relationship ends.
Política de Privacidade e Proteção de Dados Pessoais, read on 21 August 2026.
-
Cofidis
With your consent and to confirm the information you provided, Cofidis checks external databases from the Tax Authority and Social Security, helping prevent fraud and money laundering, according to the Cofidis Portugal privacy policy (cofidis.pt).
Privacy policy, read on 21 August 2026.
-
Crédito Agrícola
Crédito Agrícola admits using the data from your contracts and the transactions you make to build profiles, namely for credit risk analysis, solvency assessment and the presentation of the products and services deemed most suitable.
Política de Privacidade e Proteção de Dados, read on 26 August 2026.
-
Fidelidade
Fidelidade processes policyholders' health data for health and personal-accident insurance, based on consent, to assess risk and manage claims, and may decline cover if that data is not provided.
Privacy policy, read on 21 August 2026.
-
MB WAY (SIBS)
Your geolocation and the value and volume of the operations you make appear in the app's official policy. The type of operations on the Multibanco network and your phone's make and model are recorded too.
Privacy policy, read on 21 August 2026.
-
Millennium bcp
Whenever you give stock exchange orders by phone, Millennium bcp records the call as proof and may keep that recording for up to ten years after your contract ends.
Privacy policy, read on 21 August 2026.
-
Novo Banco
For as long as necessary to fulfil the purposes of processing or legal and regulatory obligations, Novo Banco keeps and processes its clients' personal data, applying retention criteria specific to each case.
Privacy policy, read on 21 August 2026.
-
PayPal
PayPal records your official ID document, bank account number, card details, including the CVV, and IBAN, its official statement says, to which it adds the amount you send or request and your income.
Privacy Statement, read on 21 August 2026.
-
Revolut
When you use the app or the website, Revolut collects behavioural biometric data such as how you navigate or type. After the relationship ends, it may keep your personal data for up to ten years.
Privacy policy, read on 21 August 2026.
-
Santander Portugal
Santander keeps your voice and your image as biometric data to identify you. It also records geographic information about the bank branches and ATMs you use.
Política de Privacidade, read on 21 August 2026.
Energy and services
-
CTT - Correios de Portugal
Depending on the service, the CTT group's official policy provides for processing images of your ID documents, your address, your household composition and even your degree of disability.
Política de Privacidade, read on 21 August 2026.
-
EDP Comercial
The official policy says EDP receives the meter readings from your home and analyses your consumption data. If you join the energy advice feature, the same policy provides for building an energy profile of you.
Política de privacidade, read on 21 August 2026.
-
Endesa
With your consent, Endesa builds profiles of your preferences and consumption habits using the hourly and daily load curve from your meter and statistics about the area where you live, in order to target commercial offers at you.
Política de Privacidade e Cookies, read on 26 August 2026.
-
Galp
Loyalty card, payment methods and transactions all figure in Galp's official policy. Video surveillance images remain on file for up to thirty days, it adds, and geolocation is processed with your consent.
Privacy policy, read on 21 August 2026.
-
Goldenergy
Goldenergy builds profiles of your preferences and consumption habits from the hourly and daily load curve of your energy use and from statistics about the area where you live, based on your consent or on the company's own legitimate interest.
Política de Privacidade, read on 26 August 2026.
-
Idealista Portugal
The retention period depends on the purpose, but in every case the data is deleted only when the data subject requests it, after which it stays blocked for the legal limitation period of that purpose.
Privacy policy, read on 21 August 2026.
-
Imovirtual
While the account stays active, Imovirtual holds your data, and transactional data can be kept for up to ten years after the end of the fiscal year to meet tax and accounting obligations.
Privacy policy, read on 21 August 2026.
