Privacy Policy
Our commitment
Morais Leitão, Galvão Teles, Soares da Silva & Associados, SP, RL (Morais Leitão) is firmly committed to the privacy and rights of data subjects and acts in accordance with the provisions of the General Data Protection Regulation (GDPR) and other applicable legislation.
Privacy policy
This Privacy Policy provides you with information on the collection and processing of your personal data.
A "data controller" is the natural or legal person who, individually or jointly with other entities, determines the purposes and means of processing personal data. Unless otherwise notified, Morais Leitão assumes responsibility for the processing of your personal data.
Data subjects are the natural persons to whom the data relate. We want you to know how Morais Leitão processes your personal data, as well as your rights as a data subject.
The aim of this Policy is to answer the following questions:
- What data does Morais Leitão process, who does the data concern and how is the data collected?
- For what purposes and on what lawful basis does Morais Leitão process personal data?
- How long do we keep your personal data for?
- Who does Morais Leitão transfer your personal data to?
- Are your personal data safe?
- What rights do you have as data subject?
- How can you exercise your rights?
- How can you contact us?
- How can you stay informed about the processing of your personal data?
1. What data does Morais Leitão process, who does it concern and how is it collected?
Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, electronic identifiers or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. As such, this does not include personal data where the identity has been removed (anonymous data).
Special categories of personal data include information about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political beliefs, trade union membership, health information and genetic and biometric data.
In specific and limited circumstances, Morais Leitão collects special categories of data, notably when this information is transmitted to us within the ambit of the provision of our services.
Morais Leitão may process the following categories of personal data:
a) Identification and contact details (e.g., name, date of birth, gender, address, contact details, identity card, passport and tax number details, nationality);
b) Education and work experience data (e.g., education, qualifications, certificates, languages, CVs, information from former employer);
c) Professional details (e.g., job title, position, job description, company, office address);
d) Professional activity data (e.g., business activities, information on files and dossiers, information on endeavours);
e) Billing data (e.g., account number and payment card details, fees, travel expenses and communications on behalf of the client);
f) Expenses and travel data (e.g., dietary requirements, travel booking details, expenses, travel references and vouchers);
g) Image and sound recording data (e.g., photographic and video images);
h) Browsing data (e.g., cookies).
The categories of personal data listed above refer to different categories of data subjects, whether they are clients, employees of clients (companies), counterparties, witnesses, candidates, guests at events or alumni of Morais Leitão.
Collection of personal data
Morais Leitão collects personal data through various means and at various times.
Direct collection of personal data: personal data are provided directly by data subjects through direct interactions with Morais Leitão. Such direct interactions include, in particular:
a) contacts via email and telephone and responses to invitations;
b) delivery of your personal card;
c) subscribing to our information or events;
d) professional applications;
e) contracting services.
Indirect collection of personal data: in some cases, Morais Leitão may collect personal data indirectly, namely through public sources or clients. Without prejudice to limitations arising from professional secrecy, other ethics rules and legal confidentiality, when Morais Leitão processes personal data that it has collected indirectly, it will provide all information regarding the processing of such data to the respective data subjects at the earliest opportunity.
When it is necessary to collect personal data by legal imposition or pursuant to a contract you have with Morais Leitão and such data is not provided when requested, we may not be able to perform the contract (for example, provide our services). In these situations, Morais Leitão may refuse to provide or receive the services, and you will be notified at the time the personal data are collected, if applicable.
Access to and use of the Morais Leitão website does not depend on the provision of personal data. However, the use of certain functionalities of the website implies the provision of personal data. For more information, please consult our Terms and Conditions of website use.
2. For what purposes and on what lawful basis does Morais Leitão process personal data?
Morais Leitão uses personal data for the purposes for which it was collected, as detailed below, unless it reasonably considers that it is necessary to use the personal data for other purposes and such purposes are compatible with the original purpose.
Morais Leitão processes your personal data in strict compliance with the law, when there is a legal basis that allows it. We therefore use your personal data in the following circumstances:
- performance of a contract: when we need to fulfil a contract we have entered into or are about to enter into.
- legitimate interest: when necessary to pursue our interests (or the interests of third parties), provided that your fundamental rights do not override such interests, it being certain that, before we process your personal data, we make sure and balance any potential impact on you and your rights.
- legal obligation: when we need to fulfil legal or regulatory obligations to which we are subjected.
- consent: when you have given us your consent to process your personal data.
Morais Leitão may process personal data for the following purposes and on the following legal grounds:
a) To provide legal services, which may include:
- Opening a client and dossier and the management hereof;
- Registration of service proposals submitted;
- Communications with the client, other parties and/or public entities, including courts; and
- Archiving documentation in digital and physical format.
The legal basis in this case is the execution of a contract entered into with clients and the legitimate interest:
- Morais Leitão's interest in processing its clients' information in a sustained and efficient manner that ensures its quality and integrity and enables it to provide excellent services;
- Morais Leitão's interest in processing the information of counterparties, witnesses and other persons who may participate in operations, matters and processes in which Morais Leitão is involved; and
- The interests of the clients represented by Morais Leitão within the ambit of the execution of the mandate and legal assistance.
b) For communications and the sending of information, including the dissemination of information of a legal nature (e.g. newsletters, briefings, legal alerts), in accordance with your preferences.
The legal basis is the legitimate interest:
- To correspond to the requests of subscribers to the forms on the Morais Leitão website and to tailor the respective communication;
- To contribute to the development of legal science and assume a relevant role in the community of legal professions; and
- To reinforce Morais Leitão's culture and maintain a close relationship with its alumni.
c) For event management, which includes:
- Sending invitations for events and registering event participants; and
- Internal and external publicising of events.
The applicable legal grounds are the legitimate interest and consent:
- To respond to requests from subscribers to the forms on the Morais Leitão website and to tailor the respective communication;
- To contribute to the development of legal science and assume a relevant role in the community of legal professions; and
- To publicise events promoted by Morais Leitão.
d) For the protection of persons and property, which includes the collection of images through video surveillance.
The legal basis is the legitimate interest:
- To guarantee the protection of people on Morais Leitão's premises;
- To detect and prevent security incidents;
- To detect and prevent unauthorised access to Morais Leitão premises and restricted areas;
- To review security incidents, including security training exercises.
e) To fulfil legal compliance obligations.
- The legal basis is the fulfilment of a legal obligation imposed on Morais Leitão.
f) For invoicing and accounting management, which includes:
- Accounting of expenses, cost control and reimbursements (e.g. travel expenses and mobile communications to be borne by clients);
- Invoicing and management of current accounts; and
- Maintaining an archive of accounting records and supporting documentation.
The legal basis is the execution of a contract; the fulfilment of a legal obligation and the legitimate interest:
- To maintain efficient management control, timely invoice for services rendered and ensure compliance with applicable legal obligations.
g) To submit cases to legal directories.
The legal basis is the legitimate interest:
- To promote the culture and excellence of Morais Leitão and its lawyers.
h) For collection and judicial and extrajudicial claims, which includes the collection and recovery of amounts owed by clients.
The legal basis is the legitimate interest:
- To satisfy its claims and defending its rights.
i) For recruitment and selection, which includes analysing applications and CVs, as well as the internal process of selecting lawyers and staff according to the needs detected.
The legal grounds are pre-contractual diligence at the request of the data subject and the legitimate interest:
- To analyse applications and subject candidates to an internal selection process, in accordance with previously defined criteria.
j) For statistical purposes, which includes analysing personal data contained in proposals, whereby the results of this processing correspond to aggregated data. Such data will be anonymised or pseudonymised in order to protect the data subjects, notably with regard to the impossibility of re-identification once the statistical operation has been completed.
As this is considered a subsequent processing operation under the GDPR, it is considered lawful processing compatible with the original purposes.
k) To optimise the browsing experience, which includes the collection of browsing information through cookies.
The legal basis is consent.
3. How long do we keep your personal data for?
Morais Leitão will only keep your data for the period necessary to fulfil the purposes defined in this Policy or for the period required by applicable legal or regulatory standards.
To determine the appropriate retention period for personal data, Morais Leitão considers the quantity, nature and sensitivity of the personal data, the potential risk of damage resulting from the unauthorised disclosure or use of such personal data and the purposes for which the personal data are processed.
The retention periods for personal data, according to each processing purpose, are as follows:
Purpose of processing > Retention period
- Provision of legal services > Duration of the mandate relationship, plus 20 years.
- Communications and sending information > Until the data subject expresses its opposition.
- Event management > 2 years from contact or participation in the event (as the case may be), if there has been no contact or participation in another event by the data subject.
- Protection of persons and property > 30 days.
- Fulfilment of legal compliance obligations > 7 years from the moment the customer's identification was processed or, in the case of business relationships, from the end of the relationship.
- Invoicing and accounting management > 10 years.
- Submission of cases to legal directories > For the duration of the case or dossier.
- Collection and judicial and extrajudicial claims > Until the amounts owed are paid or the dispute is resolved, as applicable.
- Recruitment and selection > 5 years from submission of the application, or CV in the event the candidate is not selected.
- Responding to contact requests > Until the request has been finalised.
- For statistical purposes > For as long as deemed necessary, with the adoption of appropriate technical and organisational measures to guarantee the rights of data subjects.
- For the purpose of optimising the browsing experience > Up to 2 years.
- For the duration of the professional relationship with Morais Leitão, in all other cases.
4. Who does Morais Leitão transfer your personal data to?
Morais Leitão does not transmit your personal data to third parties, except in cases where this is necessary for the provision of the services you have contracted or for the fulfilment of legal obligations to which Morais Leitão is subjected.
The transmission of data to third parties is carried out in accordance with the applicable data protection legislation and within the limits of the purposes and legal grounds defined in this Policy.
Morais Leitão requires any person or entity to whom it discloses personal data to respect the confidentiality and security hereof and to treat the data in accordance with applicable laws and regulations. We do not allow such recipients to use personal data for their own purposes and we only allow the processing of personal data for specific purposes and in accordance with the instructions provided by us.
Morais Leitão may share personal data with the following entities:
- Parties relevant for the legal advice we provide, such as counterparties, courts, police authorities, regulatory authorities, government institutions or other lawyers;
- Law firms belonging to the Morais Leitão Legal Circle network or the Lex Mundi network, in order to ensure the efficient operation of Morais Leitão and the quality of the services provided;
- Public authorities and the Portuguese Bar Association, in order to fulfil legal obligations;
- Service providers that provide services to Morais Leitão within the scope of the purposes described above, such as Information Technology (IT) providers, communications services, translation services and digital and physical archive services.
We may be required to disclose your information to fulfil legal or regulatory obligations. We will use reasonable endeavours to notify you before we do so, unless we are legally prevented from doing so.
In cases where the transmission of personal data to the aforementioned entities involves an international transfer of the personal data (i.e., outside the European Union), Morais Leitão:
(i) shall carry out such transfer on the basis of an adequacy decision by the Commission, pursuant to which the country or international organisation concerned guarantees a level of protection of personal data equivalent to that resulting from European Union legislation; or
(ii) if there is no adequacy decision by the Commission, it will ensure that such data transfers are carried out in strict compliance with legal provisions and that adequate guarantees are implemented to ensure the protection of personal data. In this context, Morais Leitão undertakes to sign the Standard Contractual Clauses approved by the Commission.
You can consult the existing adequacy decisions at www.eur-lex.europa.eu.
5. Is your personal data safe?
Morais Leitão has a very strict security policy, from a technical and organisational point of view, in order to protect personal data against unauthorised destruction, loss, alteration, unauthorised disclosure or access, and against any other form of illicit or abusive processing, including:
- Pseudonymisation and encryption of personal data;
- Measures to ensure the confidentiality, integrity, availability and resilience of systems and services;
- Measures to restore availability and access to personal data in a timely manner in the event of security incidents;
- Additional security measures for access to computer systems.
The technical and organisational security measures created and implemented by Morais Leitão are also required of Morais Leitão's service providers who may process personal data on its behalf.
If you have any questions in this regard, would like more details about our data security or are aware of any improper situation, please contact us through any of the channels mentioned in point 7 below.
6. What rights do you have as data subject?
As the data subject, you enjoy the following rights:
- Right of access
At any time, you may request confirmation as to whether Morais Leitão processes your data, access to your personal data and information on the processing of your data.
You may also obtain a copy of the personal data being processed.
- Right to rectification
If your personal data are incorrect or incomplete, you can request the rectification or completion hereof.
- Right to erasure
In certain situations, you have the right to request the erasure of your personal data.
This right may be limited in certain situations, such as when the processing of the data is necessary to comply with legal obligations to which Morais Leitão is subjected, or when such processing is necessary for the purposes of declaring, exercising or defending a right in legal proceedings.
- Right to restriction of processing
In certain situations, you can ask Morais Leitão to limit access to personal data or to suspend processing activities. This will happen, for example, in cases where you contest the accuracy of your personal data, for a period of time that allows Morais Leitão to verify their accuracy, or in cases where you have objected to the processing, until it is established whether the legitimate interests of Morais Leitão or a third party prevail over yours.
- Right to data portability
Where the processing of your data is based on a contract to which you are a party or on your consent, you can ask Morais Leitão to provide you with the data you have provided in a structured, commonly used and machine-readable format. You can also ask Morais Leitão, as long as this is technically possible, to pass on this data to other data controllers.
- Right to object
When the processing of data is based on Morais Leitão's legitimate interest or when it is carried out for purposes other than those for which the data were collected, but which are compatible with them, you have the right to object to the processing of your personal data on grounds relating to your particular situation.
In such cases, Morais Leitão will stop processing your personal data unless it has legitimate reasons for doing so and these reasons outweigh your interests.
- Right not to be subject to automated individual decisions
Morais Leitão does not adopt automated individual decisions, including profiling, which produce effects in your legal sphere or significantly affect you in a similar way.
- Right to withdraw consent
In cases where data processing is carried out on the basis of your consent, you may withdraw your consent at any time.
If you withdraw your consent, your personal data will no longer be processed, unless there is another legal basis for such processing.
- Right to lodge complaints with the supervisory authority
You have the right to lodge complaints with the competent supervisory authority regarding matters related to the processing of your personal data.
In Portugal, the competent supervisory authority is the National Data Protection Commission (Comissão Nacional de Proteção de Dados).
For more information, go to www.cnpd.pt.
Morais Leitão warns that the exercise of the above rights may be limited due to the existence of rights and freedoms of third parties, legal or confidentiality obligations and prevailing legitimate interests of Morais Leitão or a third party.
When personal data are processed for statistical purposes, the rights of access, rectification, restriction of processing and objection are affected, to the extent necessary, if these rights are likely to make it impossible or seriously jeopardise the fulfilment of these purposes.
Morais Leitão may request specific information for the exercise of the above rights, in order to confirm the identity of the data subject. This request is a security measure to ensure that personal data are not shared with people who do not have the right to access it. Morais Leitão may contact the data subject requesting information related to the request made in order to speed up the response to such a request.
7. How can you exercise your rights?
You can exercise your rights through any of the following channels:
- Email: to the email address privacidade@mlgts.pt; or
- Letter: addressed to Martim Krupenski, Morais Leitão, Galvão Teles, Soares da Silva & Associados, Sociedade de Advogados, SP, RL Rua Castilho, 165, 1070-050 Lisbon.
Morais Leitão will act in a timely manner and in accordance with applicable laws and regulations. Morais Leitão will endeavour to respond to legitimate requests within one month. However, occasionally the response may take longer when the request made is particularly complex or when several requests have been made. In these cases, Morais Leitão will inform you and keep you updated.
The exercise of your rights is free of charge. However, Morais Leitão may charge a reasonable fee or refuse the request if it is manifestly unfounded, repetitive or excessive.
8. How can you contact us?
If you have any questions or require any further information regarding the processing of personal data or your rights as a data subject, please contact us through the channels indicated in point 7. above.
9. How can you stay informed about the processing of your personal data?
This "Privacy Policy" may be updated, so Morais Leitão advises you to consult it regularly.
It is important that your personal data are accurate and up-to-date. We therefore ask that you keep us informed of changes to your personal data for the duration of your relationship with Morais Leitão.
For more information on the processing of personal data, please consult the "Cookies Policy" in the Terms and Conditions of our website.
Public Document
19/10/2023