Company: Coelho Ribeiro & Associados, SCARL (“CRA”)
Head Office: Av. Engenheiro Duarte Pacheco, Empreendimento das Amoreiras, Torre II, 13º A, 1099-042 Lisboa
NIPC: 501696962
Telephone: 213839060 (working days (9.30am – 1pm and 2.30pm – 7pm)
E-mail: cra@cralaw.com

Personal data is collected and processed for the following purposes:

a) Practice of lawyers’ exclusive acts
CRA as a law firm may, depending on the services required by its Clients, perform all lawyers’ exclusive acts, namely the following: exercise of forensic mandate, legal consultation, drafting of contracts and the practice of preparatory acts aimed at the constitution, amendment or termination of legal transactions, namely those carried out at registries and notaries public, negotiation aimed at debt collection, exercise of a mandate within the scope of complaints or challenges to administrative or tax acts, accompanying Clients before any authority, etc.

b) Compliance with the legal duties of identification and due diligence within the scope of preventing and combating money laundering and financing of terrorism
CRA for certain activities/operations in which it intervenes or assists its Clients, is obliged to collect and process personal data regarding the legal representatives and beneficial owners, including the respective documentation as well as that provided through forms for compliance with the legal duties of identification and diligence within the scope of preventing and combating money laundering and financing of terrorism.

c) Management of the contractual relationship
Within the scope of the relationship with its Clients, CRA collects and processes personal data in order to ensure (i) the execution of the contract (ii) contact with its Clients and (iii) the fulfilment of its contractual and deontological duties.

d) Newsletter and events
When subscribing to CRA Newsletters or registering for CRA events some personal data will be collected and processed in order to be able to send CRA Newsletters and ensure registration for CRA events requested by Clients. You can unsubscribe from CRA Newsletters at any time in each email we send you or by emailing us at cra@cralaw.com.

e) Invoicing
As part of the relationship with its Clients, CRA collects and processes personal data of its Clients in order for us to be able to invoice the agreed fees and expenses as well as manage their payment and collection.

The processing of personal data carried out by the CRA is based on various legal basis, depending on the purposes:

a) Execution of a contract or pre-contractual steps at the request of the data subject (practice of Lawyers’ exclusive acts and management of the contractual relationship);

b) Consent of the data subject (subscription to newsletters when not yet our Client, participation in events);

c) Compliance with legal obligations to which CRA is subject, namely tax obligations and obligations relating to the prevention and combat of money laundering and the financing of terrorism (invoicing and compliance with legal duties of identification and due diligence within the scope of the prevention and combat of money laundering and the financing of terrorism).

When the personal data is necessary for the practice of lawyer’s exclusive acts, conclusion or execution of a contract or to comply with a legal obligation to which CRA is subject, the provision of the data is mandatory. When collecting personal data, it will be indicated which are mandatory or optional. The Client is free not to provide the personal data requested, but when these are mandatory and are not provided this will imply the impossibility to perform the requested service, obtain the desired information, receive the Newsletter, participate in events.

Data is processed directly by CRA and/or subcontracted entities (information technology service providers, maintenance and access management services for applications and sites, server hosting), which will process the data for the purposes described above, on behalf of and according to the instructions of CRA, being bound to CRA by a written contract in accordance with applicable law and which are required to implement the necessary measures to ensure data security. The duty of confidentiality to which CRA is legally subject extends to all persons collaborating with CRA.

Data may also be communicated to administrative authorities, regulatory bodies, courts or other third parties (lawyers, auditors) pursuant to law and to comply with legal obligations that are applicable to the CRA or to exercise, establish or defend legal rights of the CRA.

The communication of data referred to above concerns only data which is not covered by professional secrecy to which CRA is legally bound and which covers all facts which come to its knowledge in the course of the performance of its duties or the provision of its services.

No transfers of personal data outside the European Economic Area (EEA) are envisaged when processing personal data for the purposes identified above. However, should transfers of personal data occur outside the EEA, where the level of protection of personal data is not considered to be the same as in the EEA, CRA will adopt appropriate safeguards under the GDPR to ensure the same level of protection applied in the EEA. For more information on what safeguards have been adopted you can contact us by email at cra@cralaw.com.

The personal data provided shall be kept for a maximum period of one year after the last contact or, in the case of provision of services, ten years after termination of the contract, without prejudice to their being kept to prove compliance with contractual, legal or other obligations, as long as the corresponding rights have not expired.

As a data subject, you have the right to:

• obtain access to the personal data stored concerning them;
• request the correction of incorrect, inaccurate or incomplete personal data;
• request the erasure of personal data which are no longer necessary or if their processing is unlawful;
• to object to the processing of your personal data for marketing purposes or for reasons relating to your particular situation;
• request the limitation of the processing of their personal data in specific cases;
• receive your personal data in machine-readable format and send them to another controller (“data portability“);
• revoke consent at any time, without compromising the lawfulness of the processing carried out on the basis of the consent previously given;
• designate a person to exercise their rights, after their death (failing which, their heirs) or determine the impossibility of exercising these rights with regard to special categories of personal data or when they relate to privacy, image or data relating to communications.

You can find out more about what each of these rights entail and what restrictions apply at https://www.cnpd.pt/bin/direitos/direitos.htm.

Requests to exercise the above rights can be made by e-mail to cra@cralaw.com. If you send a request concerning your data, please specify the nature of your request and the type of processing it concerns. We may also request further information to verify your identity.

You may also lodge a complaint with the National Data Protection Commission (www.cnpd.pt) in case:
(i) We do not respond to you within the statutory period and provided you have submitted your claim by the means made available to you by the CRA for this purpose;
(ii) We do not follow up on your request or unreasonably refuse to deal with your request;
(iii) Believing that his or her rights have not been adequately guaranteed, in particular with regard to the right to restriction of processing and the right to object to processing.