Privacy Policy
In force since 10/06/20261. Framework and commitment
This Privacy Policy sets out the terms under which CrediSegur processes personal data, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and other applicable national legislation. CrediSegur is guided by the core principles of transparency, security, confidentiality, data minimization, and respect for data subjects’ rights.2. Identification of the data controller
CrediSegur is the registered national trademark (INPI no. 668183) of CRRF – Brokerage, Lda., a private limited company (sociedade por quotas), with its registered office at Rua da Terça, no. 11, Casal de Ermio, 3200-010 Lousã, registered with the Lousã Commercial Registry Office under the single registration and tax number 509 447 970, with share capital of € 5.000,00, which acts as:Tied Credit Intermediary, registered with Banco de Portugal under no. 0001290;Insurance Agent, registered with the Insurance and Pension Funds Supervisory Authority (ASF) under no. 421571530.CRRF - BROKERAGE, LDA is the entity responsible for processing personal data.Contact for data protection matters, exercising rights and complaints: Ricardo Ferreira, sede@credisegur.pt.CRRF – Brokerage, Lda. is not required to appoint a data protection officer (Article 37 of the GDPR) and has not appointed one.3. Data subjects
This Policy applies to clients, prospective clients, users of digital channels, job applicants, whistleblowers using the reporting channel, partners, suppliers and other natural persons whose data are processed in the context of CrediSegur’s activity.4. Categories of personal data processed
CrediSegur may process, in particular:- Identification and contact data;
- Biographical, professional and family data;
- Financial data required for solvency analysis;
- Data related to credit and insurance products;
- Browsing data and use of digital channels;
- Records of written or telephone communications, where applicable;
- Consent and communication data: version of the Terms accepted, status of consent checkboxes, date and time, record of emails sent and of cancellations;
- Internal indicators of contact priority, calculated from the request data (section 8).
5. Source of the data
Personal data are collected directly from the data subject, through digital channels, electronic, telephone or in-person communications, as well as through partners, where necessary for the performance of the requested services.6. Purposes and legal grounds for processing
Personal data are processed for the following purposes, on the legal grounds indicated.| Purpose | Legal ground (GDPR, Article 6(1)) |
|---|---|
| Intermediation of Mortgage and consumer credit; mediation of Life and Non-Life insurance | Performance of pre-contractual steps at the request of the data subject and of contracts (point (b)) |
| Compliance with legal, regulatory and supervisory obligations; prevention of fraud and money laundering | Legal obligation (point (c)) |
| Management of the relationship with clients and partners; customer service, follow-up and case management | Performance of a contract or pre-contractual steps (point (b)) and legitimate interest (point (f)) |
| Provision of energy services (comparison of suppliers, solar panels and electric mobility) that you request | Pre-contractual steps at your request (point (b)) |
| Forwarding of contacts to third-party partner entities | Consent (point (a)), given in the forwarding checkbox on the form |
| Follow-up emails regarding the request (up to two, section 7.1) | Pre-contractual steps at the data subject’s request (point (b)) and legitimate interest in following up the request and facilitating contact (point (f)) |
| Communication and marketing (news, tips and offers) | Consent (point (a)). Legitimate interest (point (f)), with the right to object where permitted by law, for example for clients and similar services |
| Suppression list and proof of consent and of the version of the accepted Terms | Obligation to respect objections and to demonstrate consent (point (c)) and legitimate interest in the defense of rights (point (f)) |
| Sending proposals for other areas you did not request | Consent (point (a)), in the optional checkbox on the form |
| Audience and campaign measurement: we record the pages visited and the source of the visit and, if you accept it in the cookie banner, we send this data, from our servers, to Google (Google Analytics and Google Ads) and to Meta (Conversions API) | Consent (point (a)), which you can withdraw in “Cookie settings” |
| Recruitment: assessing your application | Pre-contractual steps at your request (point (b)) |
| Whistleblowing channel: receiving and handling reports | Legal obligation (point (c)), Law no. 93/2021, of December 20 |
7. Electronic communications
7.1 Follow-up emails. After a simulation or a contact request, we send you up to three emails about your request, from the address of the advisor handling it, with ways to contact them directly. We use your name, your email address and the details of your request. Information about other areas (credit, insurance, savings or energy that you did not request) is only sent to you if you have ticked the optional communications box.7.2 Marketing. News, tips and offers from CrediSegur, by email or other means, are only sent to you if you give us specific consent, via the optional checkbox on forms and comparison tools. You can withdraw it at any time.7.3 Unsubscribing. You can unsubscribe from communications at any time, free of charge and with immediate effect, using the “Unsubscribe from informational communications” link included in each email. Unsubscribing does not affect your request, and your manager may continue to contact you about it, unless you indicate that you do not wish to be contacted.7.4 Suppression list. To respect your unsubscribe request, we store your email, in a protected format, on a suppression list for as long as we send electronic communications.7.5 Identification. Each email identifies CRRF – Brokerage, Lda., the manager who sends it and how to contact them. To exercise your rights, contact sede@credisegur.pt.8. Profiling and decision support
CrediSegur may use analysis or pre-qualification mechanisms based on the data provided, solely to support the initial assessment, and no automated decisions with legal effects are taken.We also use an internal contact-priority indicator, calculated from the request data, to decide the order and timeframe in which we respond to requests. This indicator does not determine the approval or rejection of any credit or insurance and does not produce automated decisions with legal effects. You can object to this processing, request human intervention and contest the outcome, under the terms of point 11.“How much does gambling cost me?” simulator. The answers to the self-assessment test and the two quick questions in this simulator are processed only on your device: they are not sent to CrediSegur, are not stored in the browser and are not used for statistical analysis or advertising. To calculate the cost of gambling, CrediSegur receives the weekly amount spent, the type of game and the household income you indicate, and uses them only to show you the result, without keeping them. It only stores an indication that the last result exceeded the threshold above which CrediSegur does not present commercial offers, in order to refuse a contact request in that case, and a record that the simulator was used, without any value. This indication is deleted when you exercise your right to erasure (point 11). If you request contact, the request includes your contact details and the amount you want to save per month, and never the test answers, type of game or income. This simulator does not make decisions with legal effects and does not replace clinical support.9. Sharing of personal data
Personal data may be shared with:- Credit institutions and insurers;
- Business partners and third-party entities, within the scope of the authorized verticals;
- Technology service providers and processors, including Google (Google Analytics and Google Ads) and Meta (Conversions API), which, with your consent, receive audience and campaign measurement data (point 6);
- Electronic communications service providers, for sending emails;
- Public and regulatory authorities, where legally required.
10. Data retention
Personal data is kept for the following periods, without prejudice to compliance with legal, tax and regulatory obligations or the protection of the rights of CrediSegur.| Data | Period | Reason |
|---|---|---|
| Customer file with contracted credit or insurance (identification, contract, assessment) | For the duration of the relationship and 7 years after it ends | Legal and supervisory obligations, and defense of rights |
| Billing and accounting documents | 10 years | Tax and commercial obligations |
| Requests and simulations without contracting | 5 years from the last interaction | Long decision cycles in Mortgages and insurance, and the expectation of the data subject who requested contact |
| Proof of consent, version of the accepted Terms and communication history | For as long as the processing lasts and 5 years thereafter | To demonstrate consent and defend rights |
| Suppression list (e-mail in protected format) | For as long as electronic communications are carried out | Without it, the data subject would again receive communications they refused |
| Recruitment applications | Up to 1 year after the end of the process, unless consent is given for a longer period | To assess the application and respond to any complaints about the process |
| Reports received through the whistleblowing channel | At least 5 years and, after that period, while any judicial or administrative proceedings regarding the report are still pending | Law no. 93/2021, of December 20 |
| Health declarations that pass through CrediSegur | Up to 7 days (deleted as soon as they are communicated to the insurer) | To communicate the declaration to the insurer |
| Proof of delivery of emails and SMS | 1 year | To demonstrate that the communications were delivered |
| Technical application logs | 1 year | Website security and incident investigation |
| Unfinished authorization requests and unused links | 30 days | To allow the request to be completed within a reasonable period |
11. Rights of data subjects
Under the GDPR, the data subject has the right of access, rectification, erasure, restriction, portability, objection to processing, withdrawal of consent and lodging a complaint with the Portuguese Data Protection Authority (CNPD).These rights can be exercised via the address sede@credisegur.pt.The data subject may object, at any time and free of charge, to receiving commercial communications and to processing based on legitimate interest, through the “Cancel informational communications” link in each e-mail or via sede@credisegur.pt. They may also request human intervention and challenge the result of any automated analysis.12. Information security
CrediSegur adopts appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, alteration or improper disclosure.13. Cookies and similar technologies
The CrediSegur website only uses its own cookies, set by credisegur.pt. It does not install third-party cookies for measurement or advertising.| Cookie | Purpose | Duration |
|---|---|---|
| gdpr-consent | Stores the choices you made in the cookie banner | 1 year |
| zqme-KLwTpdxN | Identifies your visit so the website works between pages, and records the page you entered through and the source of the visit (including the campaign). This data is only sent to Google and Meta if you accept it (section 6) | 30 days |
| vcrl-QXmpzAhe | Stores the simulation in progress so you can continue it and link it to your request | 30 days |
| jtwb-MNrdkVuy | Confirms your contact when you access the client area | 24 hours |
| xgth-HYzqLpse | Keeps your session active in the client area | 24 hours |
| i18next | Stores the language in which you view the website | 1 year |