This Policy applies to the processing of personal data by Rogério Alves & Associados, Sociedade de Advogados, SP, RL (“RA”), tax number (NIPC) 510784135, with registered office at Av. Álvares Cabral 61, 4.º andar, 1250-017 Lisboa, Portugal, as data controller, including data collected through the website www.raassociados.pt (“Website”).
I. DATA COLLECTED AND PROCESSED BY RA
Data subjects are the natural persons to whom the personal data relate.
In this context, RA may collect and process the following categories of personal data: (i) identification data – such as name, date of birth, biological sex, address, contact details, citizen card, passport and tax number details, nationality, etc.; (ii) education and professional experience data – such as educational establishments attended, qualifications, certifications, languages, CV, information on previous professional experience, etc.; (iii) professional and occupational data – such as previous and current positions, duties performed, job description, employer or contracting entity, business address, business activities, information on closed, ongoing or pending proceedings, information on procedural steps, etc.; (iv) billing and expenses data – such as fee amounts and fee notes, and travel, representation and communication expenses incurred on behalf of the client, etc.; (v) image and sound recordings – such as audio recordings, photographs and video recordings, collected in the course of professional activity and always with the knowledge of all those involved.
The categories of personal data indicated above may belong to different groups of data subjects, such as clients, clients' staff, prospective clients, counterparties, or applicants seeking to join RA.
Personal data may be collected by various means and at various times, in particular: (i) when RA receives an e-mail; (ii) when a personal identification card is given to RA, to our staff or to one of our lawyers; (iii) when you subscribe to our information, publication notices, news or events; (iv) when you submit a job application or engage our services; (v) when you fill in a form on the Website; among others.
Data collected through the Website. Through the forms on the Website, RA collects only the data the user provides: (a) contact request – first name, surname, mobile number, e-mail address and message; (b) application (New Talents) – first name, surname, e-mail address, mobile number and position applied for; (c) newsletter subscription – e-mail address. When the Website is used, technical data (such as the IP address and browser data) are also processed by the service providers referred to in section III, for hosting, security and protection against automated submissions (spam).
RA may collect personal data indirectly, from public sources. Where RA processes personal data that it has collected indirectly, it will provide the data subjects, at the first opportunity, with all information regarding the processing of those data.
II. PURPOSE, LEGAL BASIS FOR COLLECTION AND PROCESSING, DATA RETENTION PERIOD
RA may collect and process personal data for the purposes and on the legal bases set out below. RA will keep the data for as long as necessary to fulfil the purposes defined in this Policy or for the period required by applicable laws or regulations.
(i) Provision of legal services (the legal basis being the performance of a contract), which may include opening a client record and file; recording the proposals for services submitted and the communications with the client, with other parties and/or with public bodies, including courts; and archiving documentation in digital and physical form. It is in RA's interest, in providing legal services, to process the data and information made available by the Client efficiently and securely, maintaining their integrity. (The data are kept from the start of the engagement until 20 years after its end.)
(ii) Communications and sending of information (the legal basis being the data subject's consent, given when requesting to subscribe to news, briefings or alerts, on RA's Website or elsewhere), including the dissemination of legal information, whether general or targeted, which includes sending news, briefings, alerts of legal relevance, etc. The data subject may unsubscribe at any time, using the link included in each message. A subscription made on the Website only becomes active after the data subject confirms it, using the link sent to the e-mail address provided. The sending tool records when e-mails are opened and when links are clicked, in order to measure interest in the communications and manage the list of subscribers. (The data are kept until the data subject withdraws consent.)
(iii) Event management (the legal basis being consent), which may include sending invitations to events and registering participants. (The data are kept from the start of the contact or of participation in an event, as applicable, until 2 years after its end.)
(iv) Billing and accounting management (the legal basis and legitimate interest being the performance of the contract and compliance with a legal obligation), which includes accounting for expenses, controlling costs and reimbursements to be borne by the Client; billing and management of current accounts; and keeping accounting records and supporting documentation. (The data are kept from the start of the engagement until 10 years after its end.)
(v) Submissions to legal directories (the legal basis and legitimate interest being RA's interest in promoting the excellence of the work carried out by its lawyers. The data are kept for the duration of the case or file).
(vi) Debt collection and claims (judicial and extrajudicial) (the legal basis and legitimate interest being the performance of the contract and the satisfaction of RA's claims), which includes collecting and recovering amounts owed by Clients. (The data are kept from the time of billing until the amounts owed are paid or the dispute is resolved, as applicable, or for the statutory period of 10 years applicable to accounting records, if longer.)
(vii) Recruitment and selection (the legal basis and legitimate interest being the taking of pre-contractual steps at the request of the data subject), which includes reviewing applications and CVs, as well as the internal process of selecting lawyers and staff according to RA's needs. (The data are kept from the time the application is submitted and, if the applicant is not selected, until 2 years after the date on which the application was submitted.)
(viii) Replying to contact requests made through the Website (the legal basis being pre-contractual steps at the request of the data subject and RA's legitimate interest in replying to the contacts it receives), which includes reviewing the request and replying to the data subject. Messages sent through the forms on the Website are forwarded to RA's e-mail, where they are processed in accordance with the purposes of this Policy; the copy stored on the Website's hosting platform is deleted within a maximum of 3 months.
(ix) Measuring visits to the Website (the legal basis being the user's consent, given through the cookie notice), in order to know, in aggregate form, the number of visits, the most viewed pages and the origin of visits. See section VI.
In all other cases, RA may keep the data for as long as the specific contractual relationship lasts.
III. SECURITY AND DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES
RA has a strict security policy for the personal data it collects and processes, ensuring their protection against destruction, loss, alteration, disclosure and unauthorized access, as well as against any other form of unlawful or improper processing. The technical and organizational security measures created and implemented by RA are also required of RA's service providers that may process personal data.
Except where necessary to provide the agreed services or to comply with legal obligations, RA does not disclose personal data to third parties. Where the disclosure of data to third parties is provided for and authorized, it is carried out in accordance with applicable data protection legislation and within the limits of the purposes and legal bases defined in this Policy.
RA may – where necessary to defend the Client's best interests or where required by law – share personal data with entities relevant to the legal advisory services provided, such as other lawyers, counterparties, courts, administrative and regulatory authorities, local, regional or central public authorities, the Portuguese Bar Association, and providers of services to RA for one of the purposes described above, such as providers of IT, communications, translation, or digital and physical archiving services for information and documents.
Website service providers. For the operation of the Website, RA uses the following providers, which process data on RA's behalf: Webflow, Inc. (United States) – hosting of the Website and receipt of the contact and application forms; Cloudflare, Inc. (United States) – protection of the forms against automated submissions; Google Ireland Limited / Google LLC – measurement of visits (Google Analytics) and the map on the contact page (Google Maps), only with the user's consent; Brevo (Sendinblue SAS, France) – recording of subscriptions and sending of the newsletter.
Where disclosure involves a transfer of personal data outside the European Union, RA: (i) will carry out that transfer on the basis of an adequacy decision of the Commission, under which the country or international organization concerned ensures a level of personal data protection equivalent to that arising from European Union legislation; or (ii) where there is no adequacy decision of the Commission, will ensure that such data transfers are carried out in accordance with the legal provisions, with the appropriate safeguards necessary to ensure the protection of personal data.
IV. RIGHTS OF THE DATA SUBJECT
The data subject has the following rights: (i) access – the data subject may at any time request confirmation that RA processes their data, request to consult and access the personal data and information on how they are processed, and obtain a copy of the personal data stored and processed; (ii) rectification – the data subject may at any time request that the data be rectified or completed; (iii) erasure – the data subject may at any time request that the data be deleted; RA may, however, refuse such deletion on the basis of a legal obligation to store the data or of a prerogative under applicable law that gives it the right to store them; (iv) restriction / suspension of processing – the data subject may request that RA restrict and/or suspend the processing of the data where the accuracy of the personal data is contested, or where the data subject objects to their processing; in such cases RA must verify the legitimacy and reasonableness of the request and check for any conflict, and the processing will be restricted/suspended if it is concluded that doing so does not infringe the legitimate interests and/or legal obligations of RA or of a third party; (v) data portability – the data subject may at any time request that the data be provided to them in a structured, commonly used and machine-readable format, where technically feasible; (vi) objection – the data subject may at any time object to the processing of the data, where the processing is based on an exclusive interest of RA or is carried out for purposes other than those for which the data were collected. Unless there are legitimate grounds for refusing the objection, such as legal obligations or permissions/rights conferred by law to protect its interests, RA will accept the objection and stop processing those personal data; (vii) not to be subject to automated individual decision-making – RA has no automated procedures for decisions on individual cases; (viii) withdrawal of consent – the data subject may at any time withdraw consent to the processing of the data, where the processing is based on consent, including, for cookies, through the “Cookie settings” link in the footer of the Website. Unless RA has a legal basis and legitimate grounds for refusing such a request, the personal data will no longer be processed; (ix) lodging a complaint with the supervisory authority – the data subject may at any time lodge a complaint with the competent supervisory authority on matters relating to the processing of personal data (Comissão Nacional de Proteção de Dados, the Portuguese data protection authority).
Accordingly, where there are legal obligations, rights and freedoms of third parties, and/or legitimate interests of RA or of a third party that must prevail over the rights of the data subject, the exercise of the rights set out above may be limited or made subject to conditions.
V. EXERCISE OF RIGHTS BY THE DATA SUBJECT, RA CONTACT DETAILS
To exercise the rights set out above, and for further information about this Privacy and Cookie Policy or about the processing of personal data carried out by RA, the data subject may contact RA by e-mail at geral@raassociados.pt, or by letter addressed to Rogério Alves & Associados, Sociedade de Advogados, SP, RL, sent to Av. Álvares Cabral 61, 4.º andar, 1250-017 Lisboa, Portugal.
VI. COOKIES AND SIMILAR TECHNOLOGIES
Cookies are small files that the Website stores in the user's browser. The Website also uses the browser's local storage (localStorage), which serves the same purpose. Essential cookies are necessary for the Website to work and do not depend on consent. The others are only used after the user clicks “Accept” in the cookie notice. The user can change this choice at any time under “Cookie settings”, in the footer of the Website, and can also delete cookies in the browser settings.
The Website uses:
VII. CHANGES TO THE PRIVACY AND COOKIE POLICY
RA may change this Privacy and Cookie Policy at any time, and the changes will be published on the Website with the date of the last update. Data subjects are advised to consult this Policy regularly.
Last updated: 2 October 2026.
