Privacy Policy

Last updated: 29 July 2026

Duarte & Associados Sociedade de Advogados, SP, RL. (the «Firm», «we», «us») respects the privacy of everyone who visits this website and processes personal data in strict compliance with Regulation (EU) 2016/679 of 27 April 2016 (the General Data Protection Regulation, «GDPR»), with Portuguese Law no. 58/2019 of 8 August, and with the duty of professional secrecy imposed on lawyers by the Statute of the Portuguese Bar Association (Ordem dos Advogados).

This policy explains what data we collect, for which purposes and on which legal bases, who we share it with, how long we keep it and what rights you have.

1. Data controller

The controller of the personal data collected through duarte-advogados.com is:

For any question regarding the protection of personal data, including the exercise of your rights, you may contact us by email at duarte@duarteadv.pt or by post at the address above.

2. Scope of this policy

This policy applies to the processing of personal data carried out in the context of this website and of the enquiries addressed to us through it. Processing carried out in the course of legal representation and of the provision of legal services is additionally governed by the duty of professional secrecy and by the specific information provided to each client at the outset of the relationship.

This website contains links to third-party sites (for example Google Maps and Facebook), which have their own privacy policies and for which we are not responsible.

3. Data we process, purposes and legal bases

3.1. Browsing and security data

This website consists of static pages hosted on Cloudflare's infrastructure. As with any communication over the Internet, technical data must be processed in order to deliver the pages to you: your IP address, the date and time of the request, the address of the requested page, the type and version of your browser and operating system and, where applicable, the referring page.

Purpose: to make the website available and deliver it, to ensure its stability and to protect the infrastructure against abuse, automated traffic and attacks.
Legal basis: our legitimate interest in the security and proper functioning of the website — Article 6(1)(f) GDPR.

We use no audience analytics, advertising or profiling tools, and we do not combine this data with other information in order to identify visitors.

3.2. Contact form

The form in the «Contact» section collects your name and email address (mandatory fields) and, optionally, your phone number and the subject, together with the content of the message you send us. The message is forwarded by email to the Firm's mailbox, with your address set as the reply recipient.

Purpose: to receive, assess and answer your enquiry and, where applicable, to take the first steps towards a possible legal services relationship.
Legal basis: steps taken at your request prior to entering into a contract — Article 6(1)(b) GDPR — and, in all other cases, our legitimate interest in replying to those who contact us — Article 6(1)(f) GDPR.

Providing the fields marked as mandatory is necessary for us to be able to reply; without them the enquiry cannot be processed. Please do not include confidential or sensitive information, or documents concerning your matter, in the form (for example health data or data relating to court proceedings or criminal convictions). Describe only what is essential: we will agree with you on a suitable channel for such information at a later stage.

3.3. Direct contact by email, phone or social media

If you contact us directly by email, by phone, through our Facebook page or via Messenger, we process the identification and contact details you provide and the content of the communication, for the purposes and on the legal bases set out in section 3.2. Communications through Facebook and Messenger are also processed by Meta Platforms Ireland Limited under that platform's own privacy policy, over which we have no control.

3.4. Data processed in the course of legal services

When you become a client, we process identification, contact and billing data as well as the data required to handle the matter entrusted to us, including, where indispensable, special categories of data (for example health data) and data relating to criminal offences and convictions.

Legal bases: performance of the services contract — Article 6(1)(b) GDPR; compliance with our legal obligations, in particular tax obligations and the obligations on the prevention of money laundering and terrorist financing under Portuguese Law no. 83/2017 of 18 August — Article 6(1)(c) GDPR; and, as regards special categories of data, the establishment, exercise or defence of legal claims — Article 9(2)(f) GDPR. All such data is covered by professional secrecy.

4. Cookies and local storage

This website uses no analytics, advertising or profiling cookies and shares no data with advertising networks.

• Record of your decision on third-party content: when you accept or reject the notice shown on your first visit, that choice is stored in your browser's local storage under the key cookie-consent. It stays on your device, is never transmitted to our servers and serves only to avoid repeating the notice on every page.
• Strictly necessary cookies: the security and content delivery infrastructure (Cloudflare) may set technical cookies that are indispensable for detecting automated traffic and protecting the site. Such cookies are exempt from consent under Article 5(3) of Portuguese Law no. 41/2004 of 18 August.

You can change your decision at any time through the «Cookie preferences» link in the site footer, and you can clear local storage and cookies in your browser settings. Blocking strictly necessary cookies may affect how the website works.

5. Map and third-party content

The map showing the location of our office is provided by Google and is not loaded automatically. Only after you expressly click the «Load map» button is a connection to Google's servers established, which involves transmitting data such as your IP address and information about your device, and may allow Google to set its own cookies.

Legal basis: your consent — Article 6(1)(a) GDPR — which you may withdraw at any time without affecting the lawfulness of processing already carried out, simply by reloading the page without loading the map and clearing your browser data. This processing is carried out by Google Ireland Limited under its privacy policy, available at policies.google.com/privacy. Alternatively, you can open the map directly in Google Maps using the link provided.

6. Recipients and processors

We do not sell, rent or otherwise transfer personal data to third parties for marketing purposes. Your data may be disclosed to service providers acting as processors, bound by a contract under Article 28 GDPR and required to process the data only on our instructions, as well as to the parties to whom we must disclose it by law or in order to pursue the matter entrusted to us:

• Cloudflare, Inc. — hosting, content delivery network and website security (privacy policy);
• Resend — delivery of the messages submitted through the contact form to the Firm's mailbox (privacy policy);
• the Firm's email, IT and accounting service providers, strictly to the extent necessary for its activity;
• courts, administrative authorities, registry offices, notaries, opposing parties and other participants, where necessary to pursue the matter entrusted to us or required by law.

Everyone within the Firm who has access to personal data is bound by the duty of professional secrecy.

7. International transfers

Some of the providers listed above are established outside the European Economic Area, in particular in the United States of America. In those cases, transfers take place under an adequacy decision of the European Commission — Article 45 GDPR — or, failing that, subject to appropriate safeguards, namely the standard contractual clauses approved by the European Commission — Article 46 GDPR — supplemented by the applicable technical and organisational measures. You may request further information about these safeguards using the contact details in section 1.

8. Retention periods

• Contact messages: kept only for as long as necessary to answer them and to manage any follow-up. If no professional relationship follows, they are deleted once they are no longer needed.
• Client and case data: kept for the duration of the engagement and, thereafter, for the applicable statutory periods, in particular the seven-year period laid down in Law no. 83/2017 for identification records and the ten-year period applicable to documents of tax and accounting relevance, as well as for as long as necessary to defend legal claims.
• Technical and security logs: kept for short periods defined by the hosting provider, for security and diagnostic purposes.
• Your decision on third-party content: remains in your browser until you delete or change it.

9. Security

We implement appropriate technical and organisational measures to protect personal data against destruction, loss, alteration and unauthorised access or disclosure, including encrypted transmission of the entire website over HTTPS/TLS, restriction of access to what is strictly necessary and confidentiality obligations for all members of the Firm.

10. Your rights

Under Articles 15 to 22 GDPR you have the right to:

• access your personal data and obtain information about how it is processed;
• rectification of inaccurate or incomplete data;
• erasure of your data where there is no ground justifying its retention;
• restriction of processing in the cases provided for by law;
• portability of the data you have provided to us, in a structured and commonly used format;
• object to processing based on legitimate interests, on grounds relating to your particular situation;
• withdraw your consent at any time, without affecting the lawfulness of processing carried out on that basis before its withdrawal.

To exercise these rights, simply contact us at duarte@duarteadv.pt. We may ask for additional information to confirm your identity. We will reply within one month of receiving your request, extendable by up to two further months where the request is particularly complex, and exercising these rights is free of charge. The right to erasure and the other rights may be restricted where retention is required by law or necessary for the defence of legal claims, as well as where the duty of professional secrecy applies.

11. Complaint to the supervisory authority

If you consider that the processing of your data infringes applicable law, you have the right to lodge a complaint with the competent supervisory authority:

We would nevertheless appreciate it if you contacted us first, so that we can try to resolve the matter straight away.

12. Automated decisions and minors

We take no decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.

This website is not directed at children under the age of 16 and we do not knowingly collect their personal data.

13. Changes to this policy

This policy may be updated whenever the processing operations described here or the applicable legal framework change. The version in force is the one published on this page, with the date of the current version shown at the top of the document.