Menu

Our offers
Insurance
Need help?
Credit tracking Client area Contact
Who we are
About us Become a partner Accessibility
Help & Contact
Track my application Sign in Sign in

Personal Data Protection Policy

Data controller and Data Protection Officer

The controller of your personal data is:
Sodefina S.A.
Rua Frederico George nº 39, 1600-468 Lisboa, Portugal
NIPC 503533726

Sodefina S.A. has appointed a Data Protection Officer (DPO), responsible for ensuring the compliance of our processing activities with the GDPR. For any question relating to the protection of your data or to exercise your rights, you may contact the DPO at dpo@sodefina.eu, by post to the registered office address for the attention of the DPO, or via our contact form, specifying "Data Protection" as the subject.

Data collected

As part of your relationship with Sodefina, we are required to collect and process the following categories of personal data:

  • Identification data: surname, first name, date and place of birth, nationality, identity document number and expiry date.
  • Contact data: postal address, email address, landline and mobile phone number.
  • Financial data: income, monthly expenses, professional situation, bank details (IBAN), history of current loans, marital status, and, as part of a credit application, the supporting documents necessary to assess your creditworthiness (identity document, proof of income).
  • Browsing data: IP address, cookie data, pages visited, visit duration, browser and operating system type, under the conditions described on our dedicated cookies page.
  • Contractual data: contracts taken out, payment history, correspondence with our services.
  • Solvency data: as a legal prerequisite for granting credit, we consult the national register of repayment incidents (CRC) held by the Banco de Portugal.

Purposes and legal bases of processing

Your personal data is processed for the following purposes:

  • Processing your credit application (legal basis: performance of the contract and legal obligations, Articles 6(1)(b) and 6(1)(c) of the GDPR) — We use your data to assess your creditworthiness, establish your credit score, consult the national register of repayment incidents (CRC) managed by the Banco de Portugal, and decide whether to grant or refuse credit.
  • Managing your contractual relationship (legal basis: performance of the contract, Article 6(1)(b) of the GDPR) — This covers the management of your entire contractual relationship with Sodefina: processing of your application, management of your credit agreement, monitoring of your payment due dates, and handling of any complaints you may make.
  • Legal and regulatory obligations (legal basis: legal obligation, Article 6(1)(c) of the GDPR) — Anti-money laundering and combating the financing of terrorism (AML-CFT), reporting to the CRC file, tax declarations, and retention of accounting and contractual documents for the applicable legal periods.
  • Fraud prevention and service improvement (legal basis: legitimate interest, balanced against respect for your fundamental rights and freedoms, Article 6(1)(f) of the GDPR) — In particular the monitoring of suspicious login attempts to your client area, described on our fraud prevention page, as well as the analysis of browsing behaviour, audience measurement and improvement of the site's usability.
  • Commercial prospecting (legal basis: consent or legitimate interest depending on the channel, Article 6(1)(a) or 6(1)(f) of the GDPR) — Sending offers and information about our products and services, subject to your express consent or the existence of a prior commercial relationship. You may withdraw your consent at any time, without retroactive effect on the lawfulness of processing already carried out and without affecting the management of your current contract.

Retention periods

Your data is kept for specific periods according to its nature and the purpose of the processing:

  • Data relating to a credit agreement: 5 years from the end of the contract (civil limitation period), then for the applicable legal limitation period, for evidentiary purposes and to comply with our accounting and regulatory obligations.
  • Anti-money laundering data: 5 years from the end of the business relationship.
  • Commercial prospecting data: 3 years from the last contact, in the absence of a contractual relationship, unless you exercise your right to object.
  • Analytical cookie data: 13 months maximum in accordance with the CNPD's recommendations.
  • Accounting data and invoices: 10 years in accordance with legal accounting obligations.

Your rights

In accordance with the GDPR (Articles 15 to 22) and the amended Portuguese Data Protection Act (Law No. 58/2019), you have the following rights concerning your personal data:

  • Right of access (Art. 15 GDPR): you may obtain a copy of all the personal data concerning you that we hold, as well as information about the purposes, recipients and retention periods of that data.
  • Right to rectification (Art. 16 GDPR): you may request the correction of inaccurate or incomplete data at any time, directly from your client account for some information, or via our customer service for the rest.
  • Right to erasure (Art. 17 GDPR): you may request the deletion of your data in the cases provided for by the regulation, subject to the legal retention obligations to which Sodefina is subject, which may limit the exercise of this right while your contract is ongoing or while limitation periods have not elapsed.
  • Right to restriction of processing (Art. 18 GDPR): you may request the suspension of the processing of your data in certain circumstances.
  • Right to portability (Art. 20 GDPR): you may receive the data you have provided to us in a structured, commonly used, machine-readable format.
  • Right to object (Art. 21 GDPR): you may object to the processing of your data based on Sodefina's legitimate interest or for commercial prospecting purposes, at any time and without justification.
  • Rights relating to automated decisions (Art. 22 GDPR): you may request that a credit refusal decision based on automated processing be reviewed by a human advisor.

To exercise these rights, send a written request accompanied by a copy of your identity document to our DPO. If you believe your rights are not being respected, you also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1º — 1200-651 Lisboa.

Cookies and trackers

Our site uses cookies and trackers to improve your browsing experience, measure site traffic and offer you personalised content. In accordance with the CNPD's recommendations and the GDPR, we obtain your consent before placing non-essential cookies.

You can manage your cookie preferences at any time by clicking on the "Cookie management" link at the bottom of the page, or by configuring your browser directly to accept or refuse cookies. Please note that refusing certain cookies may affect the operation of some site features.

Cookies strictly necessary for the operation of the site (authentication, cart, security) do not require your consent and are placed automatically.

Recipients of your data

Your data may be transmitted, strictly to the extent necessary, to our technical service providers (hosting, payment), to our insurance partner in the event of taking out borrower insurance, as well as to the competent authorities (Banco de Portugal, judicial authorities) upon legal request.

No transfer outside the European Union

All of your personal data is processed and stored exclusively within the territory of the European Union. No transfer of your personal data is made to a country located outside the European Economic Area without the appropriate safeguards required by the GDPR.

Frequently asked questions about your personal data

How can I exercise my rights? Via our contact form or directly from your client area for certain requests.
Within what time frame does Sodefina respond? Within a maximum period of one month, in accordance with the GDPR.
Is my data sold to third parties? No, Sodefina never sells its clients' personal data.
Is my data transferred outside the European Union? No, except with the appropriate safeguards required by the GDPR; see point 8 above.

Updates to this policy

Sodefina reserves the right to amend this data protection policy to reflect changes in our processing activities or the applicable regulatory framework.

Contact us about your personal data

To exercise your rights or for any question relating to the processing of your personal data, contact our Data Protection Officer via our contact form, or consult our legal notice.

This page was last updated in June 2026.