Privacy Policy L.ai – Holistic Waste Management

Comunidade Ondulante, Lda., a company registered under NIPC 518554325 and owner of the L.ai – Holistic Waste Management solution, values your privacy and is committed to protecting your personal data, in accordance with the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679) and other applicable legislation in Portugal and the European Union.

1.Who we are

Comunidade Ondulante, Lda. is the data controller for the L.ai – Holistic Waste Management solution, hereinafter referred to as "L.ai", which promotes an integrated improvement of urban and green waste management by connecting citizens, businesses, municipalities and waste operators. At the heart of its mission, L.ai also fosters the transition to a circular economy and, to that end, includes the L.ai Circular feature, designed for community sharing of objects between citizens. This feature involves making personal data available such as contact details and collection locations, with the explicit consent of the user.

As the data controller, Comunidade Ondulante, Lda. ensures that data collected through the L.ai solution is processed securely and in accordance with the terms set out in this privacy policy, guaranteeing that such access only occurs for legitimate purposes and in compliance with data protection rules.

Where applicable, Comunidade Ondulante, Lda. may also process data on behalf of management bodies for waste streams covered by extended producer responsibility (EPR) schemes and other entities with specific responsibilities within the waste management cycle.

For any question relating to the privacy of your data, you may contact us at:

Email: contacto@laiwastesolutions.com
Address: Rua Dr. Carlos Araújo, nº 9, 1º – Green Hub Business Incubator, 4980-631, Ponte da Barca

2.Data collected and purpose

Through the two technology interfaces of the L.ai solution — the mobile application (app) and the smart control panel (dashboard) — the personal data collected depends on the type of user and their interaction with the solution.

2.1 Citizens (app users)

• Identification data: Name, email address, phone number, address.
• Location and time data: GPS coordinates (subject to consent) and time stamp when submitting a report.
• Ecological profile data: answers to questions about the consumer profile, from the perspective of waste generation, reuse and recycling.
• Report data: Photographs submitted, types of incidents reported, types of waste reported and additional information associated with the report.
• Collection request data: address of the location where waste collection will take place, according to the citizen's request; name, phone number and email address of the person responsible for overseeing the collection (if provided by the citizen); waste to be collected, its types and quantities.
• Interaction data: Communications with municipalities, request history and browsing history.
• Satisfaction data: answers to the satisfaction survey.
• Professional data: for citizens who choose to create a business profile, which allows collection requests to be submitted on behalf of a company, categorised data on the relationship between the citizen and the company named in the business profile will also be collected.

Purpose: Processing service requests, reporting incidents, sending communications from the entities that resolve incidents and provide the requested services — municipal councils, parish councils and/or waste management operators — and improvement of the technology solution.

When taking photographs for upload to the app, users may inadvertently capture sensitive data (images of people, vehicle number plates, etc.). Comunidade Ondulante, Lda. does not analyse, process or systematise any such information.

As regards the "ecological profile", the data incorporated derive directly from the use of the app; no additional information is requested from the user for this purpose. The profile is intended to fulfil the objective of transparency about the user's ecological activity within the exclusive domain of the L.ai – Holistic Waste Management app, covering both its operational and educational components.

Data related to L.ai Circular: description of the objects shared, photographs submitted, place where they are made available or collected (address or reference point provided by the user), contact preferences (phone, email address or other means provided).

External responsibility: Once contact or location data has been shared within L.ai Circular, Comunidade Ondulante, Lda. accepts no liability for interactions, agreements or transactions carried out directly between users outside the application, as set out in the L.ai Circular Terms and Conditions.

L.ai Circular purpose: To facilitate the community sharing of objects between citizens, promoting reuse and the circular economy, with the explicit consent of the user.

2.2 Businesses (app and/or dashboard users)

• Company identification data: Company name, address of the location where the service will be provided, NIPC (tax number), email address, phone number.
• Operational data: Types of waste disposed of, service requests and interactions with municipalities.
• Service request data: waste, respective types and quantities to be collected, equipment to be provided by the municipality or the waste management operator.

Purpose: Planning appropriate disposal and optimising business waste management. Companies in the HoReCa sector (hotels, restaurants and cafés), as well as other economic activities, may also use the L.ai solution to combat food waste and other forms of material resource waste by submitting shares or collection requests in coordination with municipalities, operators, management bodies and social sector institutions.

2.3 Municipalities, waste management operators, management bodies for waste streams covered by extended producer responsibility (EPR) schemes and other entities involved in the waste management cycle (dashboard users)

• Institutional data: Entity name, entity type, address, phone numbers and email address.
• Data of staff with dashboard access: name, email address, phone number, role.
• Operational and management data: history of operations carried out on the dashboard relating to service requests and incident reports, including changes to their status and any comments or justifications associated with such changes and, where necessary, correction of information provided through the app; communications sent to citizens and businesses in the context of resolving incidents or delivering services; communications uploaded directly to the application; educational content uploaded to the application; collection calendars; communications between municipality, waste management operator, EPR management body and other entities involved in the waste management cycle.

Purpose: Day-to-day management, operational improvement and strategic planning. Communications made by municipalities and waste management operators, as well as the delivery of requested services and the resolution of reported incidents within the L.ai solution, are the sole responsibility of those entities, in accordance with their legal and contractual competencies.

2.4 Website visitors (contact form and lead generation)

• Data collected: Name, email address, phone number, company (if applicable), and any other information voluntarily provided by the user in the contact form.
• Purpose: To respond to contact requests, provide information about the L.ai solution and send relevant communications about services, events or news, always subject to the user's consent.
• Legal basis: The user's consent, which may be withdrawn at any time.

2.5 Website visitors (cookies and similar technologies)

The L.ai website uses cookies and similar technologies (such as tracking pixels and web beacons) to ensure its correct operation, improve the user experience, analyse usage statistics and, where consent is given, personalise content and communications.

Cookie consent management is handled through the "Real Cookie Banner" tool, provided by devowl.io. Further information is available at: https://devowl.io/rcb/data-processing/

Legal basis for processing:

• Legitimate interest: use of strictly necessary cookies to ensure the functionality and security of the website.
• Consent: use of optional cookies, such as those for statistical analysis or personalisation, only after express acceptance by the user.
• Legal obligation: compliance with applicable rules on the collection and management of consent for cookies.

Providing personal data through cookies is not a legal or contractual obligation. However, refusing consent to certain cookies may limit the browsing experience or prevent access to some website features.

Users may, at any time, manage or change their consent preferences through the cookie banner or panel available on the website.

3.Legal basis for processing data

Comunidade Ondulante, Lda. processes personal data on the following legal grounds.

• Performance of the purpose of the L.ai solution: Provision of waste management-related services to registered users.
• Consent: For the collection of optional data (e.g. address, GPS location, among others).
• Explicit consent for L.ai Circular: For participation in the L.ai Circular feature, contact and location data associated with community sharing listings are used.
• Legitimate interest: To improve the technology solution and ensure the quality of the services provided, including the assistive use of artificial intelligence technologies for image recognition and natural language processing, as well as geolocation services.
• Legal obligation: To support the achievement of environmental targets applicable to urban and green waste established by national public policies (e.g. PERSU 2030 and PAPERSU 2030) and international policies (e.g. Waste Framework Directive 2008/98/EC), as well as to support compliance with regulatory reporting requirements to environmental authorities (e.g. ERSAR).
• Performance of tasks carried out in the public interest: Municipalities, waste management operators and management bodies of EPR waste streams use the solution to act on service requests and incident reports, making decisions on their status and communicating changes directly to citizens and businesses.

Certain processing operations may have more than one legal basis, depending on the context and specific purpose of the data processing.

4.Sharing of personal data

Personal data may be shared with:

• Municipalities and waste operators to respond to requests.
• Within the L.ai Circular feature, the necessary personal data (contact, location) is shared with other users who access the list of available offers.
• Technology service providers essential to the platform. Comunidade Ondulante, Lda. engages technology service providers, including cloud computing infrastructure, artificial intelligence, geolocation and other services necessary to ensure the full functioning and continuous improvement of the L.ai solution. All providers processing personal data on our behalf operate under Data Processing Agreements (DPAs), ensuring compliance with the GDPR and safeguarding the rights of data subjects. Any sub-processor is required to maintain adequate levels of data protection.
• Regulatory and supervisory authorities, where required by law.
• Sub-processors that ensure GDPR compliance, with Comunidade Ondulante, Lda. remaining the data controller.
• In addition to the entities mentioned above, data collected through the website contact form may be shared with marketing and communications service providers that support Comunidade Ondulante, Lda., solely for the purposes of communications consented to by the user.

Comunidade Ondulante, Lda. does not sell or market personal data to third parties.

5.Data security and retention

• Data protection: Technical and organisational measures to prevent unauthorised access.
• Retention periods:
  • Reports and interactions: Five years after the last activity;
  • Account data: Until deletion is requested by the user; such requests will be processed within 90 days, unless there is a legal obligation to the contrary.
  • Anonymised data used for statistical analysis may be retained indefinitely.
  • L.ai Circular data: Object offers, municipality, parish and, where applicable, collection neighbourhood, as well as associated contact details, are kept for as long as necessary to ensure the operation of L.ai Circular, the integrity of its internal database and compliance with applicable legal obligations. The user may, at any time, request the deletion or anonymisation of their data. Such requests will be complied with in accordance with applicable data protection legislation.

6.Rights of data subjects

Under the GDPR, users may:

• Access, rectify or delete their data.
• Request the portability of their data.
• Object to processing or request restriction of the use of the data.
• Withdraw consent at any time.
• For the L.ai Circular feature, a request for data deletion may result in the unavailability of active listings or the cancellation of ongoing shares.

Exercising rights: To exercise any of these rights, please contact us at contacto@laiwastesolutions.com.

7.Management of consent and preferences

Users may manage their privacy and consent preferences at any time. Depending on the interface used (app, dashboard or website), the following methods are available:

• Mobile application: Users may manage or withdraw consent through their account settings. L.ai Circular: Participation requires specific, separate consent, including confirmation via an additional check-box that the user is at least 18 years old.
• Website: A cookie banner and preferences panel allow users to change consent for the collection of optional data.
• Dashboard: Institutional users may request consent adjustments by email.

If a user withdraws consent for certain data processing, some features of the L.ai solution may be limited, in line with their technical requirements and/or applicable regulations.

8.International data transfers

Where data is transferred outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place, including but not limited to:

• Standard contractual clauses approved by the European Commission;
• Certification mechanisms recognised by the EU, such as the Data Privacy Framework, where applicable;
• Transfers to countries deemed by the European Commission to provide an adequate level of data protection.

Where international data transfers are necessary, they will only be carried out to countries or entities that guarantee an adequate level of protection under the GDPR. Any material change will be reflected in this policy. These provisions apply equally to technology providers that supply artificial intelligence, geolocation or other critical services for the solution.

9.Changes to the Privacy Policy

Comunidade Ondulante, Lda. may update this privacy policy whenever there are new features, changes to services or relevant legal changes.

Some application features, such as "Report an incident", "L.ai Circular" and "I want advice", use artificial intelligence systems to generate results automatically. In most cases, these results are presented directly to the user. Human intervention by Comunidade Ondulante, Lda. takes place primarily upstream, through the definition of the technical criteria that guide how the AI operates. Downstream, it is for the user to confirm, change or ignore the suggested results, in particular when completing forms. Where results may have a significant impact, the user always retains the right to request human intervention, express their point of view and contest the automated decision, in accordance with applicable data protection legislation.

If, in the future, additional systems are implemented that make automated decisions capable of having significant effects on users, the policy will be updated to reflect those changes, ensuring full transparency.

Updates to this policy may be consulted at any time in the application, the dashboard and the Comunidade Ondulante, Lda. website. Previous versions may be requested by emailing contacto@laiwastesolutions.com. Where significant legal changes affect this policy or the rights of users, they will be informed through the application, the website and/or by email, whenever applicable.

Last updated: 30.09.2025