1. Introduction and scope

M A – Antunes Reis & Associados – Sociedade de Advogados, SP, RL (“M&A”) values and respects your privacy, and is committed to protecting it and your personal data, in accordance with the applicable legislation, namely Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR).
This Privacy and Data Protection Policy (hereinafter the “Policy”) contains information on how we collect and process users’ personal data when they access to and browse our website (hereinafter the “Website”), including the categories of data we process, the purposes and legal basis for the processing, the period for which the personal data will be stored and the rights that can be exercised by data subjects.
This Policy applies solely to the personal data of users of our Website collected and processed by M&A.
We advise you to read this Policy in conjunction with our Cookie Policy, which can be found here.
Please note that our Website may contain links to third parties’ websites or other content, which we do not control or are responsible for, and are therefore not covered by this Privacy Policy. Since these third parties may collect and process personal data, we suggest that you consult their respective privacy policies.

2. Data controller

M A – Antunes Reis & Associados – Sociedade de Advogados, SP, RL, legal person number 507468740, with registered office at Rua Castilho, 13 D – 3.º A, 1250-066 Lisbon, registered with the Portuguese Bar Association under number 54/05, is the data controller regarding the personal data collected and processed in the context of the use of the Website.

3. Concept of personal data and categories of personal data processed

“Personal data” means information relating to an identified or identifiable natural person (“data subject”), and an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
In connection with the use of our Website, we may process the following personal data of users:

• Name, address and telephone contact details.
• Marital status.
• Email address.
• Curriculum Vitae.
• IP address, data on cookies and other online identifiers.

4. Purposes of and basis for the processing

The personal data referred to in the previous section may be collected by filling in the contact form and the recruitment/application form with CV available on our Website, in order to respond to the contact requests submitted and to proceed with the applications submitted for selection and recruitment purposes. Such data may also be collected through the subscription to our newsletter, for the purpose of sending it, and may be further obtained within the scope of the cookies settings, in accordance with the respective Cookie Policy, for the purposes of the operation and management of the Website.

Therefore, personal data may be processed with the consent of the respective data subject for the specific relevant purpose(s), for the purposes of the legitimate interests pursued by M&A, and may also be processed for the purposes of complying with legal obligations to which M&A is subject.

5. Period for which the personal data will be stored

Personal data will only be stored for the period necessary for the fulfilment of the purposes for which they are processed, after which they will be securely deleted.
If the law stipulates a longer storage period, we will store the personal data for the time period laid down in law.

6. Disclosure of personal data to third parties

In connection with the operation of our Website, we may use third parties to provide certain services, such as computer and information technology service providers. Sometimes, the provision of these services implies access by these third parties to your personal data. In this case, we ensure that the third-party subcontractors are reputable entities and that they have implemented the appropriate security measures to protect personal data.
In addition, for the purposes of processing personal data in accordance with the purposes set out above, we may, if justified, use third-party processors. In this case, we will carefully select the service providers and will only use processors that provide sufficient guarantees of the adoption of appropriate technical and organizational measures so that the processing to be carried out by them on our behalf is always in accordance with the applicable laws and regulations, namely the “GDPR”. In accordance with their respective data processing contracts to be concluded, these service providers will only process personal data in accordance with our instructions and in strict compliance with our guidelines.

7. International transfers of personal data

Your personal data may be transferred to and processed in third countries, including outside the European Economic Area, which may have a lower level of protection of personal data.
In such cases, we will strictly comply with the applicable legal and regulatory provisions, in particular as regards to the assessment and determination of the adequacy of the destination country regarding the protection of personal data and the requirements applicable to such transfers, including, where appropriate, the conclusion of the appropriate legal instruments to comply with the applicable legal requirements.

8. Security of personal data

M&A commits to ensuring the security and protection of the personal data it processes, and to this end it has adopted several appropriate technical and organisational measures, namely to protect personal data against accidental or unlawful destruction, loss and alteration and unauthorised disclosure or access.
The personal data provided to us is stored on servers and computer systems located in controlled facilities, to which only a limited number of people who need to know the data can have access to perform their tasks and fulfil the purposes of their processing.

9. Data subject’s rights and how to exercise them

As the data subject regarding the data we process, you can exercise the following rights under the terms provided for by law:

• Right to information about the personal data we collect.
• Right of access to personal data.
• Right to rectification of data.
• Right to erasure of data (“right to be forgotten”).
• Right to restriction of data processing.
• Right to data portability.
• Right to object to data processing.
• Right not to be subject to automated individual decision-making, including profiling.
• Right to withdraw, at any time, the consent you have given us for the processing of your personal data, without such withdrawal affecting the lawfulness of the processing based on the consent given before its withdrawal.
The above rights may be exercised by email or by post to the contact details set out below in paragraph 10 of this Policy.

The data subject also has the right to lodge a complaint with the National Data Protection Commission (CNPD), using the contact details made available by this authority for this purpose (https://www.cnpd.pt).

10. Contact details

If you have any questions regarding this Policy or the processing of personal data that we carry out, or if you wish to exercise any or more of the rights as a data subject, you can contact us at the following email address: lawfirm@malaw.pt
You can also contact us by post at the following address:

M&A – Antunes Reis & Associados – Sociedade de Advogados, SP, RL
Rua Castilho, 13 D – 3.º A, 1250-066 Lisboa

11. Review of and amendment to the Privacy and Data Protection Policy

We may review and amend this Policy whenever we deem it necessary or whenever amendments are required. Therefore, we advise all users to check it periodically.
Any amendments to this Policy, as well as its updated version in force at any given time, will be timely and duly disclosed in the privacy section of our Website.