1. Data controller

The controller of your personal data is:
Fidexico S.A.
Rua Frederico George nº 39, 1600-468 Lisboa, Portugal
NIPC 503533726

For any question relating to the protection of your data or to exercise your rights, you may contact our Data Protection Officer (DPO) at the following address:
dpo@fidexico.eu or by post to the registered office address, for the attention of the DPO.

2. Data collected

As part of your relationship with Fidexico, we are required to collect and process the following categories of personal data:

• Identification data: surname, first name, date and place of birth, nationality, identity document number and expiry date.
• Contact data: postal address, email address, landline and mobile phone number.
• Financial data: income, monthly expenses, professional situation, bank details (IBAN), history of current loans.
• Browsing data: IP address, cookie data, pages visited, visit duration, browser and operating system type.
• Contractual data: contracts taken out, payment history, correspondence with our services.

3. Purposes and legal bases of processing

Your personal data is processed for the following purposes:

• Processing your credit application (legal basis: performance of the contract and legal obligations) — We use your data to assess your creditworthiness, establish your credit score, consult the national register of repayment incidents (CRC) managed by the Banco de Portugal, and decide whether to grant or refuse credit.
• Management of your contract (legal basis: performance of the contract) — Monitoring of repayments, management of payment incidents, modification of the contract terms.
• Legal and regulatory obligations (legal basis: legal obligation) — Anti-money laundering and combating the financing of terrorism (AML-CFT), tax declarations, legal archiving.
• Improvement of our services and statistics (legal basis: legitimate interest) — Analysis of browsing behaviour, audience measurement, improvement of the site's usability.
• Commercial prospecting (legal basis: consent or legitimate interest depending on the channel) — Sending offers and information about our products and services, subject to your express consent or the existence of a prior commercial relationship.

4. Retention periods

Your data is kept for specific periods according to its nature and the purpose of the processing:

• Data relating to a credit agreement: 5 years from the end of the contract (civil limitation period).
• Anti-money laundering data: 5 years from the end of the business relationship.
• Commercial prospecting data: 3 years from the last contact.
• Analytical cookie data: 13 months maximum in accordance with the CNPD's recommendations.
• Accounting data and invoices: 10 years in accordance with legal accounting obligations.

5. Your rights

In accordance with the GDPR (Articles 15 to 22) and the amended Portuguese Data Protection Act (Law No. 58/2019), you have the following rights concerning your personal data:

• Right of access (Art. 15 GDPR): you may obtain a copy of all the personal data concerning you that we hold.
• Right to rectification (Art. 16 GDPR): you may request the correction of inaccurate or incomplete data.
• Right to erasure (Art. 17 GDPR): you may request the deletion of your data in the cases provided for by the regulation.
• Right to restriction of processing (Art. 18 GDPR): you may request the suspension of the processing of your data in certain circumstances.
• Right to portability (Art. 20 GDPR): you may receive your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR): you may object to the processing of your data for commercial prospecting purposes at any time and without justification.
• Rights relating to automated decisions (Art. 22 GDPR): you may request that a credit refusal decision based on automated processing be reviewed by a human advisor.

To exercise these rights, send a written request accompanied by a copy of your identity document to our DPO. You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1º — 1200-651 Lisboa.

6. Cookies and trackers

Our site uses cookies and trackers to improve your browsing experience, measure site traffic and offer you personalised content. In accordance with the CNPD's recommendations and the GDPR, we obtain your consent before placing non-essential cookies.

You can manage your cookie preferences at any time by clicking on the "Cookie management" link at the bottom of the page, or by configuring your browser directly to accept or refuse cookies. Please note that refusing certain cookies may affect the operation of some site features.

Cookies strictly necessary for the operation of the site (authentication, cart, security) do not require your consent and are placed automatically.

Last update of this policy: June 2026.

7. Contact details of the Data Protection Officer

Fidexico S.A. has appointed a Data Protection Officer (DPO), responsible for ensuring the compliance of our processing activities with the GDPR. You may contact them for any question relating to your personal data via our contact form, specifying "Data Protection" as the subject.

8. Data collected during your credit application

As part of your credit application, we collect: your marital status, your contact details, your employment situation and income, your expenses, your bank details (IBAN), as well as the supporting documents necessary to assess your creditworthiness (identity document, proof of income).

9. Data collected while browsing

While you browse the Site, we collect certain technical data: IP address, browser type, pages viewed, length of visit, under the conditions described on our dedicated cookies page.

10. Data relating to your creditworthiness

As part of the assessment of your creditworthiness, we consult the credit incidents file (CRC) held by the Banco de Portugal, in accordance with our legal obligation to carry out checks before any credit is granted.

11. Purpose: management of your contractual relationship

Your data is processed for the management of your entire contractual relationship with Fidexico: processing of your application, management of your credit agreement, monitoring of your instalments, and handling of any complaints you may make.

12. Purpose: compliance with our legal obligations

Certain processing operations are carried out to enable Fidexico to comply with its legal and regulatory obligations: combating money laundering, reporting to the CRC file, and retention of accounting and contractual documents for the applicable legal periods.

13. Purpose: fraud prevention

Certain data is processed for the purposes of fraud prevention and detection, in particular as part of the monitoring of suspicious login attempts to your client area, described on our fraud prevention page.

14. Purpose: improvement of our services

With your consent, certain browsing data may be processed for the purposes of statistical analysis and continuous improvement of our services and our Site, under the conditions described in our cookie policy.

15. Purpose: commercial prospecting

Subject to your prior consent, your contact details may be used for commercial prospecting purposes to inform you of our offers. You may withdraw this consent at any time, without affecting the management of your current contract.

16. Legal basis: performance of the contract

The processing of your data necessary for the handling and management of your credit is based on the performance of the contract binding you to Fidexico, in accordance with Article 6(1)(b) of the GDPR.

17. Legal basis: legal obligation

Certain processing operations (combating money laundering, CRC reporting, accounting retention) are based on compliance with a legal obligation to which Fidexico is subject, in accordance with Article 6(1)(c) of the GDPR.

18. Legal basis: legitimate interest

The processing of your data for the purposes of fraud prevention or improvement of our services is based on Fidexico's legitimate interest, balanced against respect for your fundamental rights and freedoms, in accordance with Article 6(1)(f) of the GDPR.

19. Legal basis: consent

Certain processing operations, in particular commercial prospecting or the placing of non-essential cookies, are based on your explicit consent, which you may withdraw at any time, without retroactive effect on the lawfulness of processing already carried out.

20. Recipients of your data

Your data may be transmitted, strictly to the extent necessary, to our technical service providers (hosting, payment), to our insurance partner in the event of taking out borrower insurance, as well as to the competent authorities (Banco de Portugal, judicial authorities) upon legal request.

21. No transfer outside the European Union

All of your personal data is processed and stored exclusively within the territory of the European Union. No transfer of your personal data is made to a country located outside the European Economic Area without the appropriate safeguards required by the GDPR.

22. Retention period: credit file

Data relating to your credit file is retained for the entire duration of your contract, then for the applicable legal limitation period after its end, for evidentiary purposes and to comply with our accounting and regulatory obligations.

23. Retention period: prospecting data

Data collected for commercial prospecting purposes, in the absence of a contractual relationship, is retained for a maximum period of 3 years from the last relevant contact, unless you exercise your right to object.

24. Right of access

You have the right to access all the personal data concerning you processed by Fidexico, as well as information relating to the purposes, recipients and retention periods of that data.

25. Right to rectification

You may at any time request the rectification of any inaccurate or incomplete personal data concerning you, directly from your client area for certain information, or via our customer service for the rest.

26. Right to erasure

You may request the erasure of your personal data in the cases provided for by the GDPR, subject to the legal retention obligations to which Fidexico is subject (in particular accounting and regulatory obligations), which may limit the exercise of this right while your contract is ongoing or while limitation periods have not elapsed.

27. Right to restriction and portability

You may request the restriction of the processing of your data in certain circumstances provided for by the GDPR, as well as the portability of the data you have provided to us, in a structured, commonly used format.

28. Right to object and complaint to the CNPD

You may object to any processing of your data based on Fidexico's legitimate interest or on commercial prospecting. If you believe that your rights are not being respected, you may lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese supervisory authority.

29. Frequently asked questions about your personal data

How can I exercise my rights? Via our contact form or directly from your client area for certain requests.
Within what time frame does Fidexico respond? Within a maximum period of one month, in accordance with the GDPR.
Is my data sold to third parties? No, Fidexico never sells its clients' personal data.

30. Contact us about your personal data

To exercise your rights or for any question relating to the processing of your personal data, contact our Data Protection Officer via our contact form, or consult our legal notice.