Privacy Policy

“Personal data” means any information, of any nature and regardless of its medium (including sound and image), relating to a living, identified or identifiable natural person (data subject).

An identifiable person is one who can be recognized directly or indirectly, in particular by reference to an identification number or other specific elements of their physical, physiological, psychological, economic, cultural or social identity.

TAP Air Portugal collects your personal data through various means, directly – through in-person contact, by telephone or via electronic channels – or indirectly, namely from other entities, such as:

• Our suppliers who provide services to you on our behalf;
• Our partners;
• Travel agents or other operators who book a flight for you.

Categories of personal data that we process:

1. When you use our Platforms to search for or book flights:
   To streamline the process of searching for and booking flights, you will be asked for data related to your geographic location if this feature is enabled on your devices.
2. When you book a flight or join the TAP Miles&Go Programme:
   Data such as your first and last name, date of birth, contact details (email address, telephone number and postal address), passport details or other identification document, tax identification number, preferred language, frequent passenger number (if applicable) and details of your credit card or other payment method will be required.
   TAP Air Portugal also collects passengers’ gender solely as a metric for calculating passenger weight on board.
   The collection of certain data is mandatory for the conclusion and performance of contracts and compliance with legal obligations by TAP Air Portugal. Therefore, if such data is not provided, TAP Air Portugal will not be able to provide the requested service or make the product available. In these cases, the Customer will always be duly informed of the mandatory provision of such data in order to continue the process of purchasing services or products.
3. When you make a booking for certain destinations:
   In addition to the data specified in point 2. above, information may be requested, in accordance with the applicable legislation, which also includes your full name, nationality, number and type of travel document — passport or identification document — as well as its validity date and country of issue, address at the origin and/or destination as well as emergency contact.
4. When managing your flight:
   In addition to the data set out above, you may voluntarily provide us with other relevant information related to your booking and itinerary, including, but not limited to, purchases of additional travel-related services, among others.
5. When you make a booking on behalf of other passengers:
   You will have to provide personal data related to these passengers, you must for this reason ensure that you have their consent or another lawful basis for this purpose.
6. When you Check in or use our services at the airport:
   You will have to provide information about your flights (including connecting flights), about the baggage carried, contact details in the event of any operational disruption, as well as present your passport or other identification document, visas, vaccination certificates and other documents, which may vary depending on the destination or circumstances of your trip.
   If you need to declare a baggage irregularity, you may also have to provide contact details and addresses at the destination, as well as the description and value of the respective contents.
7. When you use our onboard sales or entertainment services:
   This point refers to information about the purchase of products available on board. Have in mind that the data necessary for the commercial transaction will be collected, namely payment data.
   As a Miles&Go Customer, if you select one of our entertainment offers and register on the system with the code on your boarding pass, we will save your content preferences so you can select them on a future trip.
   When browsing the internet, your browsing data is not stored.
8. When you contact TAP Air Portugal or are contacted by TAP Air Portugal:
   All communications between you and us, in particular through the communication channels made available on our website, chatbots, emails, letters, or telephone calls made with the TAP Air Portugal Contact Centre, and which, when consented to, may be recorded for previously established purposes and duly communicated to data subjects.
9. When you interact with us on social media:
   All social media posts and messages you voluntarily send to TAP Air Portugal, as well as your social media profile data.
10. When you participate in our surveys, market research, promotions or satisfaction questionnaires:
    Information collected when you share your opinion about us through these means.
11. When you use our Platforms, in accordance with our Cookies and other Tracking Technologies Policy:
    Information about how you use our Platforms, in particular your flight searches.

Special categories of personal data / sensitive data:

When we provide our services, we may collect information that may reveal your racial or ethnic origin, data relating to your health, your religious beliefs or possible criminal offenses. Under the applicable law, this information is considered “sensitive data” and may only be collected under the following conditions:

• If you have given your explicit consent;
• If you have made such data manifestly public;
• Where necessary for the establishment, exercise or defence of a legal claim, or where courts, in the exercise of their jurisdiction, request specific personal data;
• To ensure fraud prevention and the security of the data subject in registration and authentication processes in electronic systems, subject to legal limits and except where the data subject’s fundamental rights and freedoms requiring the protection of personal data prevail.

This information will be collected and processed by TAP Air Portugal only in the following situations:

• If you have a specific health condition that we need to be aware of in order to provide the transportation service or if you require special assistance for or during a flight;
• If you give us any specific dietary requirements (requirements that may be related to your religious beliefs);
• When you provide us with your travel document details (your nationality may indicate your racial or ethnic origin);
• To respond to complaints or to ongoing legal or other proceedings;
• When using a biometric boarding system, when available at any airport served by TAP Air Portugal. The operator in question will be the data controller, as set out in the applicable law.

Your personal data is used exclusively in connection with the provision and management of the contracted services, namely for sending communications related to these services, as well as for the analysis, improvement and tailoring of our services to your interests and needs, with your consent.

You may, however, provide us with your personal data for other purposes, such as to receive institutional information from the TAP Air Portugal, to participate in contests, auctions and market studies, to receive marketing communications from TAP (namely, campaigns and promotions related to our services and products), as well as from partners, whose products or services may contribute to improving your travel experience.

In this sense, we use your personal data for the following purposes and in accordance with the following legal bases:

A. Execution of contracts or pre-contractual steps, namely:

1. confirmation or modification of bookings and issuing of tickets;
2. sending information concerning the confirmation and / or changes to bookings;
3. sending information related to other contracted services and / or products;
4. sending information about payments and billing;
5. sending information related to your flights, including operational ones;
6. management of the Check-in process, including documentation verification, boarding, acceptance and handling of baggage;
7. access to Fast Track, Lounges and on-board services;
8. management of operational disruption situations;
9. response to requests, complaints, suggestions or contacts;
10. registration and management of the TAP Miles&Go Programme;
11. the sending of communications strictly related to the TAP Miles&Go Programme and are not promotional or marketing in nature.

B. Legitimate interests of TAP Air Portugal, namely:

1. in order to provide you with relevant information about your trip;
2. for the evaluation of the service we have provided to you following your flight;
3. for the purposes of preventing, investigating and prosecuting criminal offences, such as fraud, e.g. credit card or identity fraud, use of fraudulent means to obtain special terms or fares;
4. for the establishment, exercise or defence of legal claims, including debt collection;
5. for audit purposes;
6. tor ensuring the safety of your flight;
7. for sending marketing communications about products and / or services similar to those you have already purchased from us, provided that you have not objected to such use of your data.
   

C. Express consent of the data subject, including but not limited to:

1. for communications about regular offers from TAP Air Portugal and, if you are a member of the TAP Miles&Go Programme, including from this programme; these communications may be sent by email, SMS or voice, and you may choose and manage how you wish to be contacted;
2. for sending you information and offers from partners relating to ancillary services or products, or to your travel, provided you have given your consent to do so;
3. for market research and Customer surveys;
4. for the personalisation of website content and customised offers, including profiling;
5. for supporting processes related to website usage, with reminders and live chats;
6. for the processing of sensitive data necessary to provide a service suited to your needs;
7. for analytics purposes, so that we can optimise our offering for you.

Any consent given may be withdrawn at any time. The withdrawal of consent only has effect for the future and does not affect the lawfulness of processing carried out prior to its withdrawal.

D. Compliance with legal obligations, including legal requirements for security, customs and immigration control, and public health

TAP Air Portugal may collect and process personal data in order to comply with national and / or international legislation on immigration, territorial security, prevention, detection, investigation and repression of terrorism and serious and organized crime, in accordance with the legal regulations applicable to each trip, as well as to comply with the requirements established by health authorities, in terms of public health.

E. Defense of the vital interests of the data subject

TAP Air Portugal may also collect personal data where processing is necessary to protect the vital interests of the data subject (for example, in the event of incapacity resulting from a health issue during a flight).

The period of time during which personal data is stored and retained varies according to the purpose for which the information is processed.

In fact, there are legal requirements that require data to be kept for a minimum period of time. Therefore, and whenever there is no specific legal requirement, the data will be stored and retained only for the minimum period necessary to pursue the purposes that motivated its collection or subsequent processing, under the terms defined by the law.

For example, when you make a booking with us, we will retain the information necessary to provide the contracted travel services and, thereafter, for as long as necessary to handle any complaint or enquiry relating to your booking or to comply with legal obligations. We may also retain this information to improve your experience with TAP Air Portugal and to ensure you receive the benefits of our loyalty programme.

Our databases are reviewed periodically and actively, so personal data will be deleted or anonymized at the end of its respective retention period, without prejudice to its retention in the event of any disputes.

Under applicable law, the data subject may request, at any time, access to their personal data, as well as its rectification, erasure or restriction of processing, and the right to data portability, or object to its processing of their personal data, by submitting a request directly via our platform available for this purpose, accessible here.

Under the terms of the law, you are also guaranteed the right, through the means mentioned above, to withdraw your permission for the processing of data whose consent constitutes the basis for the legitimacy of the respective processing. To this end, you have the right to withdraw your consent at any time, which does not, however, invalidate the processing carried out up to that date based on the consent previously given.

You may also request the erasure of your personal data at any time, including deletion of your TAP Miles&Go account, in accordance with applicable law.

Without prejudice to any other administrative or judicial remedy, if you consider that your data is not being legitimately processed by TAP Air Portugal, the data subject has the right to submit a complaint to the National Data Protection Commission (CNPD), located at Avenida Dom Carlos I, 134 - 1 º, 1200-651 Lisbon, Portugal (www.cnpd.pt).
If you are a resident in Brazil, you may also lodge a complaint with Brazil’s National Data Protection Authority (ANPD), located at Setor Commercial Norte - SCN, Quadra 6, Ed. Venâncio 3000, Bloco A, Asa Norte, CEP 70716-900, Brasília / DF, Brazil (www.gov.br/anpd/pt-br).

This Privacy Policy applies to all Users of TAP Platforms. However, given the specific nature of the use of the aforementioned digital platforms (social networks, websites and TAP Air Portugal applications), it is important that some particularly relevant issues are duly regulated.

1. TAP Air Portugal is aware that the submission of personal information is a major concern for the Customer when using the Internet. On all our websites and applications, personal data collection forms require encrypted browser sessions.
2. All personal data you voluntarily provide to us is stored securely in our systems. Once stored, the best technical and procedural security practices are implemented to protect it.
3. Notwithstanding the security measures adopted by TAP Air Portugal, we warn that, when accessing the Internet, you should regularly take precautions and adopt additional security measures, namely by using an updated computer and browser. You must take precautions when using shared computers and while accessing your personal Customer accounts, avoiding sharing your access data with third parties.
4. Through our Platforms, we provide links to third party websites, which are subject to independent Privacy Policies. Please note that this Privacy Policy does not apply to such websites and that TAP Air Portugal is not responsible for the collection of your information by the aforementioned websites.
5. For your protection, access to some features available on some of our Platforms is protected by a password, which you should not share with third parties. For security reasons, we recommend that you memorize it and change it frequently.
6. We only request your credit / debit card details if you wish to make a booking or payment for a service or TAP product. We offer security in the use of our Platforms through SSL technology – Secure Socket Layer, which encrypts communications produced between your personal computer and the server, so that they cannot be intercepted. TAP does not save or store credit card data in its technological infrastructure, this process is carried out through external partners (PSP - Payment Service Providers), in compliance with international standards defined by the industry (PCI DSS Compliance).

For more information about cookies and how TAP Air Portugal uses them on its websites and applications, please see the Cookies Policy and Other Tracking Technologies Policy.

TAP Air Portugal is committed to ensuring the confidentiality, protection and security of your personal data, through the implementation of appropriate technical and organizational measures that aim to protect it against any form of improper or illegitimate processing and against any accidental loss or destruction. To this end, we have systems and teams that guarantee data security, creating and updating procedures that prevent unauthorized access, accidental loss and / or destruction of personal data.

Always committed to complying with legislation regarding the protection of the Customers' personal data, TAP Air Portugal ensures that it processes this data only for the purposes for which it was collected or for which it is legally admissible, with the guarantee that it is processed with the appropriate levels of security and confidentiality.

Because we recognize the sensitivity of this information, our employees receive ongoing training on data protection and undertake not to disclose to third parties or use, for purposes contrary to the law, any personal information of TAP Air Portugal Customers that they have become aware of in the course of their duties.

In this context, TAP Air Portugal has also appointed a Data Protection Officer (or “DPO” – find out how to contact them in point 12 of this Privacy Policy), to monitor compliance with the applicable policies and standards regarding the protection of personal data.

As set out in this Privacy Policy (see point 9. “Under what circumstances do we communicate data to other entities?”), we may, in some cases, transmit your personal data to third parties. TAP Air Portugal has defined clear rules for contracting the processing of personal data with its subcontractors and requires them to adopt the necessary technical and organizational measures to protect it. However, in some situations, we may be legally required to disclose your personal data to third parties, such as government authorities, over whom we have limited control in terms of personal data protection.

Your personal data may be communicated to third parties in the following situations:

1. TAP Air Portugal may use other entities to provide certain services (such as handling services, information technology service providers, marketing, consultancy or auditing services, among others), which may imply access by these entities to your personal data. We ensure, however, that any subcontracting entity will process your data in our name, on our behalf and with the strict obligation to follow our instructions. These subcontracting entities offer sufficient guarantees for the implementation of technical and organizational measures so that data processing meets the requirements of the applicable law and ensures the security and protection of the rights of the data subjects, under the terms of the subcontracting agreements that were signed.
2. TAP Air Portugal may also transmit your personal data to third parties when part of the itinerary involves a flight operated by another airline, or when it considers such data communications to be necessary or appropriate (1) in light of the applicable law, (2) in compliance with legal obligations/court orders, (3) to respond to requests from public or government authorities or (4) due to complementary travel services, including those contracted by you from our partners (such as car rental companies, hotels and other third parties).
3. TAP Air Portugal may also send your personal data to airports, customs and immigration authorities, police, government and regulatory bodies when notified to do so or when necessary to transport you to your destination, in accordance with the law, and also to credit and debit card companies, credit information agencies and fraud control service providers, law firms and judicial bodies within the scope of legal, administrative, judicial or extrajudicial actions and proceedings and / or insurance companies.
   

In any of the above-mentioned situations, TAP Air Portugal undertakes to take all reasonable measures to ensure the effective protection of the personal data it processes.

The provision of certain services by TAP Air Portugal may involve the transfer of your personal data to other countries (not belonging to the European Union or the European Economic Area), in order to manage the services contracted by you, comply with the legal obligations to which it is bound and respect the contractual commitments it establishes with third parties established in the countries in question.

TAP Air Portugal undertakes to take the necessary and appropriate measures, under the applicable law, to ensure the protection of all personal data that is subject to an international transfer.

TAP Air Portugal reserves the right, at any time, to amend or update this Privacy Policy; such changes will be duly published on our Platforms. We recommend that you check them regularly for any changes. Where material changes are made to the Privacy Policy, TAP Air Portugal will notify Customers.

You may contact TAP Air Portugal’s Data Protection Officer (“DPO”) for further information on the processing of your personal data, as well as for any questions relating to the exercise of the rights conferred on you by applicable law, in particular those referred to in this Policy, using the link provided or by sending an email to [email protected].
TAP Air Portugal, registered with the CNPJ/MF under number 33.136.896/0001-90, has an office in Brazil at Avenida Paulista no. 453, 14° andar, São Paulo-SP.