Privacy policy | MEO Institutional

Privacy Policy

Object

The MEO Group and its member companies are committed to guaranteeing the protection of personal data entrusted to them, ensuring its rigorous and transparent processing.

Therefore, as part of this commitment, the purpose of this privacy policy ("Policy") is to inform you of the way in which the personal data provided when using the website is processed https://institucional.meo.pt/ ("Website").

The provision of personal data in connection with the use of the Website implies knowledge and express acceptance of the provisions of this Policy. Users ("Users" or, in the singular, "User") should therefore read the Policy carefully and decide freely and voluntarily whether or not to use the Website.

The User hereby declares and warrants that he/she is of legal age and that the data provided in connection with his/her use of the Website is true, accurate, complete and current, and that he/she is responsible for any non-compliance. Whenever the data communicated belongs to a third party, the User guarantees that they have informed that third party of the conditions set out in this document and that they have obtained their authorization to provide their data for the purposes indicated therein.

We recommend reading this Policy, together with the Cookie Policy, and also the MEO Group Whistleblowing Channel Privacy Policy.

1. Responsible for treatment

This Policy regulates the processing of personal data collected in the context of the User's interactions with MEO SGPS, S.A., headquartered at Av. Fontes Pereira de Melo, nº 40, 1069-300 Lisbon, with corporate entity number 507690737 ("MEO SGPS"), in its capacity as the entity managing the Website, and as the entity responsible for the processing of personal data, being responsible for defining what data to collect, the purposes for which it is used, and the means of processing to be applied, in accordance with the General Data Protection Regulation ("GDPR") and other applicable legislation on the protection of personal data ("Data Protection Legislation").

2. Processing and collection of personal data

The personal data we collect, as well as how it is collected, may vary depending on the nature of your interactions with the Website.

Access and browsing do not necessarily imply the provision of personal data. However, there are certain functionalities that require the provision of personal data (for example, if the User wishes to submit contact forms via the Website).

The Website may also include access links to other websites that are unrelated to MEO SGPS. A

2.1 Personal data processed within the scope of the Website

Users are given the option of submitting contact forms, namely media contact forms (for media representatives) and institutional contact forms. The forms ask for the following personal data: name, telephone number and e-mail address, which are mandatory and without which it is not possible to respond to the requests submitted. In the institutional contact form, the type of contact in question must also be indicated.

The User may also send communications to the Customer Ombudsman, if they have previously submitted the matter to be reported through MEO's customer support services. The form asks for the following personal data: name, VAT number, customer number, account number, e-mail address and telephone number, which are mandatory, since without them it is not possible to identify the customer and respond to the communication sent. The User may also submit documents to support their communication, which may contain personal data. In any case, the submission of these files is purely optional.

The User may also file a complaint through the MEO Group's complaint channel, for which purpose they must complete the form available on the website. In this regard, the following personal data may be collected: name of the complainant and any witnesses (or other form of identification), email address of the complainant and any witnesses, relationship of the complainant to the MEO Group, type of complaint, description of the complaint and information about the incident, any supporting documents that may contain personal data, and complaint tracking code. The submission of documents supporting the report and the provision of your identification data is purely optional, while the data describing the report, the degree of certainty about the reported incident, and data relating to your relationship with the MEO Group are mandatory, as without them it is not possible to follow up and/or respond to the report made. For more information on how this data is collected and processed, please refer to the MEO Group Whistleblowing Channel Privacy Policy.

All of these forms also include free-writing fields where the user can state the subject and content of their message (in particular, a description of the complaint or malpractice), and where other personal data can be provided spontaneously. In these fields, the User should only provide the information that is strictly necessary according to the subject or request, refraining as far as possible from providing, for example, sensitive or third-party data.

3. Purposes and grounds for processing

Personal data will be processed to follow up and respond to contacts made, namely doubts, suggestions or requests for information that are submitted, within the scope of the execution of the contract entered into or for pre-contractual steps at the request of the User, or based on the legitimate interest of MEO SGPS in maintaining contact with the User and responding to their requests and suggestions.

Personal data may also be processed as part of the management of contractual and commercial relations with suppliers and service providers, including pre-contractual due diligence.

Personal data will be processed for communication with the authors of the reports/complaints and for the purposes of managing, investigating and resolving the reported infringements, based on the legitimate interests of MEO SGPS in collecting and investigating the reports/complaints, as well as in knowing the matters reported, and in complying with legal obligations borne by MEO SGPS, including the reporting of illicit practices to the competent authorities, whenever necessary.

4. Retention of personal data

Personal data will only be kept for the period necessary for the purposes for which they are processed, unless the right to object or erasure is exercised within the legal limits.

Exceptionally, data may be retained for longer periods, particularly in cases where there is a specific legal requirement, for the exercise of a right in legal proceedings, or for archiving purposes in the public interest, with MEO SGPS applying the appropriate technical and organizational measures for this purpose.

5. Sharing personal data

In certain cases, personal data may be transmitted to subcontractors, which process personal data on behalf of MEO SGPS and in accordance with its instructions (for example, IT service providers and Website maintenance service providers), which adopt appropriate technical and organizational measures to ensure the protection of personal data.

MEO SGPS may also transmit personal data to other entities of the MEO Group (third parties for the purposes of this processing), which will process it as data controller, when this is necessary for the purposes described above and for other internal administrative purposes.

Finally, MEO SGPS may also disclose Users' personal data to other third parties, provided that the disclosure is made in compliance with a legal obligation, a court order, a decision by the National Data Protection Commission or another relevant supervisory authority, or in response to requests from public or government authorities.

6. Data transfers to third countries

MEO SGPS has opted for servers located in the European Economic Area ("EEA") to support and operate the Website, thereby ensuring that data processing takes place in the EEA.

However, exceptionally, the processing of data for the purposes indicated may involve its transfer to entities established in third countries, i.e. outside the EEA. Users' personal data will be transferred when there is an adequacy decision by the European Commission for a particular country or when the appropriate safeguards provided for in the GDPR are implemented, namely the conclusion of standard contractual data protection clauses adopted by the European Commission and the adoption of additional measures to ensure that personal data enjoy a level of protection essentially equivalent to that existing in the European Union. Exceptionally, data may also be transferred on the basis of the derogations provided for in Article 49 of the GDPR, such as the User's explicit consent to the transfer.

Browsing the Website may also imply the transfer of the User's personal data collected through cookies or similar tracking technologies to third countries located outside the EEA (for example, to the United States of America). In these cases, MEO SGPS may not be able to configure the operation of these cookies or similar technologies and/or prevent such transfer.

For more information on the use of these cookies, please see our Cookie Policy.

To request more information about the safeguards adopted in data transfers, you can use the contacts indicated in section 10. "How you can contact us".

7. Cookies and similar technologies

The Website uses cookies and similar tracking technologies. For more information, please visit our Cookie Policy.

8. Security of personal data

MEO SGPS respects the best practices in the field of security and protection of personal data, having for this purpose adopted the necessary technical and organizational measures in order to comply with Data Protection Legislation at all times.

MEO SGPS makes its best efforts to protect Users' personal data against unauthorized access via the Internet. To this end, it uses security systems, rules and other procedures to guarantee the protection of personal data and prevent unauthorized access to data, its improper use, disclosure, loss or destruction. In this sense, for example, personal data collection forms require encrypted browser sessions and all personal data is stored securely in MEO SGPS systems which, in turn, are located in a MEO SGPS datacenter, covered by all the security measures that MEO SGPS has deemed indispensable for the protection of personal data.

Notwithstanding the security measures adopted, MEO SGPS warns that, since data circulates on an open internet network, it is not possible to completely eliminate the risk of unauthorized access and use; therefore, the User must implement appropriate security measures when using the Website (namely, ensuring that they use a device and browser that are up to date with security patches and that these are properly configured and protected against malicious software, computer viruses, and worms, with an active firewall, antivirus, and anti-spyware software, verifying the authenticity of the websites they visit on the internet, and avoiding websites whose reputation they do not trust). Without these measures, the risk of personal data and passwords being accessed by unauthorized third parties is increased.

In the event of detecting any defect, bug or anomaly in the Website, the User must immediately notify MEO SGPS and not seek to access commercial or sensitive information, personal data of other Users, alter the characteristics of the Website or, in any other way, exploit the defect, bug or anomaly to use the Website in an irregular, illicit or different manner from that designed or authorized by MEO SGPS.

9. Holders' rights

The data subject may exercise the rights listed below, in accordance with the law. To do so, they should use the contact details provided in section 10, "How to contact us."

Without prejudice to any other administrative or judicial remedy, the data subject also has the right to lodge a complaint with the National Data Protection Commission or another competent supervisory authority under the terms of the law, if they consider that the processing of their data violates the provisions of the law in force.

Right of access

Obtain confirmation that personal data is being processed about you, request access to it, obtain information about the processing, and obtain a copy of the personal data being processed. In this case, MEO SGPS reserves the right to apply a reasonable fee taking into account the administrative costs involved.

Right to rectification or updating

Request the rectification or updating of your personal data that is inaccurate or has changed since it was collected, or request that incomplete personal data be completed.

Right to erasure

Obtain the erasure of your personal data, including any links, copies or reproductions of such data, namely if your personal data is no longer necessary for the purpose for which it was collected or processed, or if you object to the processing and there are no overriding legitimate interests justifying it, and provided that there are no valid grounds for retaining it.

Right to restriction of treatment

Request the restriction of the processing of your personal data in certain cases, namely if the processing is unlawful and you oppose the erasure of the data, requesting the suspension of the processing or the restriction of the scope of the processing to certain categories of data or processing purposes.

Right to portability

Receive the data you have provided us in a commonly used and machine-readable digital format, or request the direct transfer of your data to another entity that will become the new data controller, if the processing of your data is carried out by automated means and is based on your consent or the performance of a contract.

Right to object

Object, at any time, (i) and for reasons related to your particular situation, to the processing of your data based on the pursuit of legitimate interests by the data controller or on the compatibility of the initial processing with the subsequent processing of such data, including profiling; and (ii) to the processing of your data for direct marketing purposes, including profiling for that purpose.

Right to withdraw consent

Withdraw your consent to the processing of data legitimized by this basis. Withdrawal of consent does not invalidate the processing carried out up to that date based on the consent previously given.

10. How to contact us

MEO Group has appointed a Data Protection Officer ("DPO").

For more information on the processing of your personal data, as well as to ask questions or send suggestions related to this Policy, you can do so through the following contact details:

• Postal address: Av. Fontes Pereira de Melo, n.º 40, 1069-300 Lisboa;
• E-mail address: dpo@meo.pt.

11. Changes to this Policy

MEO SGPS may, at any time and without prior notice, make adjustments or changes to this Policy, which shall be duly publicized on the Website (for example, through the display of a banner or pop-up) and/or other channels that MEO SGPS deems appropriate, whenever justified.

Update date: October 1, 2025.