Recruitment Privacy Policy

  • Name: CP – Comboios de Portugal, E.P.E. (hereinafetr “CP”);
  • Head office: Calçada do Duque, 14, 16, 18 and 20, 1249-109 Lisbon;
  • NIPC: 500 498 601;
  • Email:  institucional@cp.pt;
  • Telephone:

Domestic calls:

  • 210 900 032 (Price of a call to the fixed network according to your tariff).

International calls:

  • +351 210 900 032 (Price of a call to Portugal according to your tariff).

808 line:

  • 808 109 110 (Price of a local call according to your tariff, with a maximum of €0.07 + VAT for the first minute and €0.0277 + VAT for each subsequent minute on working days from 9 a.m. to 9 p.m. or €0.0084 + VAT from 9 p.m. to 9 a.m. and weekends and public holidays, as defined by Anacom).

The protection of personal data of natural persons is governed in Portugal by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, (“General Data Protection Regulation” or “GDPR”), which ensures the protection of natural persons about the processing of personal data and the free movement of such data, and by Law No. 58/2019 of 8 August (“LPDP”). “Personal data” is considered to be any information, of any nature and regardless of its medium, including sound and image, relating to an identified or identifiable natural person, and therefore does not include data relating to legal persons. A person is considered identifiable if they can be identified directly or indirectly, namely by reference to an identification number or to one or more specific elements of their physical, physiological, psychological, economic, cultural or social identity (for example, their name associated with their telephone number or email address).

By reading this Privacy Policy, the Candidate is informed about the processing of personal data carried out by CP in the context of recruitment processes.

The personal data we collect and process in the context of recruitment processes will only be used for the following purposes:

a)    Receiving unsolicited applications via recrutamento@cp.pt or the application portal;
b)    Receiving applications for job vacancies by filling in the application forms available on the CP website;
c)    Use of applications for other vacancies;
d)    Evaluating and selecting or rejecting candidates;
e)    Internal evaluation of recruitment processes.

CP guarantees the confidentiality of all data provided. Although CP collects and processes data securely and prevents its loss or manipulation using the most appropriate techniques for this purpose, it is important to note that data collection on open networks does not guarantee absolute security for personal data. There is a risk that it may be accessed and used by unauthorised third parties.

Failure to respond to data marked as mandatory may result in the application not being submitted.

CP processes the personal data of Applicants when:

i.    The Candidate has given their consent to the processing of their personal data for one or more specific purposes (in the case of special categories of personal data);
ii.    It concerns pre-contractual steps at the Candidate's request;
iii.    The processing is necessary for the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

The Candidate guarantees that the information provided is true, accurate, complete and up to date, and is responsible for any direct or indirect damage or loss that may be caused as a result of a breach of this guarantee. 

If a third party provides the Candidate's data, the latter guarantees that they have informed the Candidate of the aspects contained in this document and have obtained their authorisation to provide their personal data to CP for the purposes indicated.

CP only retains and processes personal data for as long as is necessary or mandatory to fulfil the purposes described above, applying information retention criteria appropriate to each type of processing, in accordance with the applicable legal and regulatory obligations. 

CP retains personal data in its systems in accordance with the following criteria:

  • for a period not exceeding the completion of the recruitment process, provided that legal or contractual obligations do not provide otherwise;
  • for a period of one (1) year or until the Candidate exercises their right to object to the processing of their personal data for other vacancies;
  • to comply with specific legal or contractual obligations;
  • where applicable and legitimate, until the Data Subject exercises their right to object or request erasure.

At the end of the retention period, CP will delete the data, using appropriate technical and functional safeguards, as documented in each relevant process.

In addition to communications made in compliance with legal obligations, the Data Subject's personal data may be disclosed to partners and subcontractors, exclusively for the purposes of providing the contracted service, whether they are:

  • Subsidiaries belonging to the CP Group;
  • Other internal and external service providers in the areas of support and consultancy for CP's activities.

The data provided may also be transferred to official entities to comply with legal obligations. 

Personal data may also be disclosed, exclusively for the purposes indicated above, in accordance with the consents granted by the data subject.

The personal data collected will be processed within the European Economic Area, and there will be no international transfers of data to third countries or international organisations.

In the event of any processing of personal data outside the European Economic Area, this will only occur with the adoption of adequate safeguards and the required level of protection, in accordance with personal data protection legislation.

CP has implemented appropriate technical and organisational security measures to ensure the security of the personal data the Candidate provides, to prevent its alteration, loss, unauthorised processing and/or access, taking into account the current state of technology, the nature of the data stored and the risks to which it is exposed.

Personal data is processed with the level of protection required by law to ensure its security and prevent alteration, loss, unauthorised processing, or access, taking into account the state of technology. The Candidate is aware and accepts that Internet security measures are not impregnable. 

Whenever CP accesses personal data, it undertakes to:

  • Store it using legally required technical and organisational security measures to ensure its security, thus preventing its alteration, loss, unauthorised processing or access, in accordance with the state of technology at any given time, the nature of the data and the possible risks to which it is exposed;
  • Use the data exclusively for the purposes previously defined;
  • Implement physical security measures to protect the facilities;
  • Ensure that the data is only processed by employees whose intervention is necessary to satisfy the data subject's request, and that a duty of secrecy and confidentiality binds them. If there is a possibility that the information may be disclosed to third parties for the purposes above, they are obliged to maintain the necessary confidentiality in accordance with the provisions of this document.

If CP subcontracts other entities to provide services involving the transfer of personal data, those entities shall be obliged to take the necessary technical and organisational measures to protect personal data against destruction, loss, alteration, disclosure, unauthorised access or any other type of unlawful processing.
 

In accordance with the provisions of the GDPR, the Candidate may exercise their rights of access, rectification, erasure, restriction of processing, portability, objection and withdrawal of consent, as applicable, by sending a written communication to CP's Data Protection Officer, by the following means, specifying the right or rights they wish to exercise:

The Candidate also has the right to complain to the National Data Protection Commission (CNPD) when they consider that the processing of personal data concerning them violates the GDPR, through www.cnpd.pt.

The CP website may contain advertising, links, or other content that links to or redirects to pages and services of suppliers, advertisers, affiliates, sponsors of CP, and other third parties. 

However, CP does not control the content or links that appear on these pages and is not responsible for the practices used by these pages or websites. CP advises Candidates to visit the privacy policy of these pages, as well as their terms and conditions. 

Searching or interacting on any other website, including those that have an external link to the website, is subject to the terms and conditions of that website, and CP shall in no case be liable for any access and/or use thereof.

CP reserves the right to revise this Policy at any time it deems appropriate. It is recommended that Candidates check this privacy policy regularly and/or each time they access the website.

Updated on 22 September 2025