1. AOP's Commitment

AOP – Corretor de Seguros, Lda (hereinafter referred to as AOP) values the privacy and protection of the personal data of its clients, employees and other data subjects with whom it interacts.

AOP is committed to full compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), as well as with all applicable national legislation on privacy and data protection.

This Privacy Policy aims to provide transparent information on how AOP collects, uses, shares and protects the personal data of natural persons, namely applicants, policyholders, insured persons, persons covered by insurance policies, beneficiaries, injured parties or other natural persons with whom it maintains professional relationships.

2. Data Controller

AOP is, as a rule, the controller of personal data, determining the purposes and means of processing.

In certain situations, AOP may act as a processor, processing personal data on behalf of another entity (for example, insurance companies), which assumes the role of data controller.

In such cases, it is recommended that the privacy policy of the respective entity be consulted.

3. Essential Concepts

3.1. Personal Data

Any information, of any nature and in any format, relating to an identified or identifiable natural person (for example: name, identification number, location data, electronic identifiers, health data or financial data).

3.2. Data Subjects

Natural persons to whom the personal data relate, including clients, former clients, potential clients, policyholders, beneficiaries, insured persons, witnesses or injured parties.

3.3. Categories of Data Processed

AOP may process, depending on the circumstances:

• Identification data: name, address, contact details, civil and tax identification numbers, nationality, marital status, profession, among others;

• Contractual and policy data: policy number, insurance class, coverage, premiums and term;

• Claims-related data: medical information, reports, accident notifications, beneficiaries, witnesses and supporting documentation;

• Billing and payment data: IBAN, account holder, bank and address;

• Data relating to the insured object: vehicles, real estate, vessels, works of art, jewellery, among others;

• Health and lifestyle data, when necessary for insurance purposes;

• Records of communications and calls (for evidence of transactions or clarification of requests).

4. Purposes and Legal Bases for Processing

AOP processes personal data only where there is a valid legal basis and for the following purposes:

4.1. Performance of a contract or pre-contractual steps (Art. 6(1)(b))

For the preparation of proposals and quotations, conclusion and management of insurance contracts, claims handling and recording of commercial transactions.

4.2. Compliance with legal obligations (Art. 6(1)(c))

For compliance with legal and regulatory obligations, namely tax, accounting and reporting obligations to the competent authorities, as well as obligations relating to the prevention of money laundering and terrorist financing.

4.3. Legitimate interests of AOP (Art. 6(1)(f))

For the improvement of services provided, management of complaints, defence of legal rights and maintenance of communications with clients.

4.4. Consent of the data subject (Art. 6(1)(a))

Where processing is based on explicit consent, namely for marketing communications, promotional campaigns or newsletters.

Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out prior to its withdrawal.

4.5. Processing of special categories of data (Art. 9(2)(h) and (f))

AOP may process health data exclusively where necessary for the performance of insurance contracts (e.g. life, health or accident insurance), ensuring confidentiality and enhanced security measures.

4.6. Processing as a processor

When acting on behalf of other entities, AOP strictly follows the instructions of the data controllers, ensuring compliance with security and confidentiality requirements.

5. Disclosure of Personal Data

AOP may disclose personal data to the following entities, only where necessary:

• Insurance and reinsurance companies with which it has entered into contracts;

• Service providers (e.g. data centre management, IT support, auditing and authorised marketing), subject to contractual confidentiality obligations;

• Public authorities (such as the Tax Authority, Courts or supervisory authorities), where legally required.

AOP ensures that only the data strictly necessary for the purpose of the disclosure are communicated.

6. International Data Transfers

As a rule, AOP processes and stores personal data within the European Economic Area (EEA).

Where it is necessary to transfer data to third countries, AOP will ensure that:

• The country concerned provides a level of protection considered adequate by the European Commission; or

• Standard Contractual Clauses or other compliance safeguards provided for under the GDPR are applied.

7. Retention of Personal Data

Personal data will be retained only for the period strictly necessary to fulfil the purposes for which they were collected and processed, taking into account the applicable legal retention periods.

In particular:

• Performance of insurance contracts: data may be retained for up to 10 years after the termination of the contractual relationship, namely for compliance with applicable tax and legal obligations;

• Claims handling: data will be retained for the legally applicable period relating to the respective process;

• Marketing and communication: data will be retained until consent is withdrawn or the data subject exercises the right to object;

• Call recordings: recordings will be retained for up to 6 months, unless a legal obligation requires a different retention period.

After the applicable retention periods have expired, personal data will be securely deleted or anonymised, unless their continued retention is necessary to comply with a legal obligation.

8. Rights of Data Subjects

Under the law, data subjects have the right to:

• Access: obtain confirmation as to whether their data are being processed and access their personal data;

• Rectification: correct inaccurate or incomplete data;

• Erasure: request the deletion of data when they are no longer necessary;

• Restriction: restrict processing in certain circumstances;

• Portability: receive their data in a structured format and transfer them to another controller;

• Objection: object to processing, namely for direct marketing purposes;

• Withdrawal of consent: where processing is based on consent;

• Complaint: lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados – CNPD) at www.cnpd.pt.

9. Exercise of Rights

The exercise of these rights is free of charge and may be carried out through the following means:

• Email: rgpd@aopseguros.pt

• Postal address: AOP – Corretor de Seguros, Lda
  Rua Gonçalo Sampaio 271 4 ESQ
  4150-367 Porto

AOP undertakes to respond to all requests within a maximum period of 30 working days.

10. Data Protection Officer (DPO)

AOP has appointed a Data Protection Officer (DPO), responsible for supervising compliance with the GDPR and acting as the point of contact for data subjects and the CNPD.

• DPO contact: rgpd@aopseguros.pt

11. Automated Decision-Making and Profiling

AOP does not carry out automated decision-making or use profiling mechanisms that produce legal effects or significantly affect data subjects.

Any relevant decision is always reviewed by a member of staff.

12. Security Measures

AOP adopts appropriate technical and organisational measures to protect personal data against destruction, loss, alteration, unauthorised disclosure or unauthorised access.

Entities acting as processors are also required to comply with high standards of security and confidentiality.

13. Indirect Collection of Data

AOP may collect personal data through third parties, namely insurance companies, intermediaries, family members or other entities involved in insurance contracts.

Whenever possible, the data subject will be informed of such collection and of their respective rights.

14. Websites and Cookies

AOP's website may use cookies to improve the user experience.

Users are advised to consult AOP's Cookie Policy, available on the respective website.

AOP is not responsible for the content or privacy policies of third-party websites accessed through external links.

15. Updates to the Privacy Policy

AOP reserves the right to amend or update this Privacy Policy whenever necessary, ensuring that the most recent version is published on its website.

Last updated: 24 October 2025