Privacy Policy

01 Controller and contact details

The controller of your personal data — the entity that decides how it is processed — is:

Data Protection Officer (DPO)

For any matter involving personal data or this Policy, contact our DPO:

02 Personal data we collect

2.1 · Data collected through the website

• Contact and newsletter forms: name, email address, telephone number and the message submitted.
• Browsing and cookies: IP address, device and browser, pages visited, date and time, and other cookie data (Section 10).

We also process traffic sources, campaign parameters (UTM), referring domain, landing and current pages, language and interaction signals for attribution and estimated traffic quality; this estimate does not verify human identity.

2.2 · Data collected through WhatsApp (Meta / Cloud API)

• Telephone number and profile name displayed in the application;
• Messages exchanged with our team or automated assistant;
• Delivery metadata (date, time, and sent/received status).

2.3 · Client data (engagement)

• Identification: full name, CPF/CNPJ and identity document;
• Contact and address: full address, telephone number and email;
• Tax data needed for billing and tax invoices.

Because of the nature of legal services, we may occasionally process sensitive personal data (article 11 of the LGPD) when strictly necessary to represent a client or exercise rights in judicial, administrative or arbitral proceedings.

03 How we use personal data

• Provide legal services and carry out retained work;
• Respond to and communicate with you, including through WhatsApp;
• Issue bills and tax invoices and manage financial matters;
• Send newsletters and informational communications when consent (opt-in) has been given;
• Manage contacts and clients in our CRM, including relationship and interaction history;
• Comply with legal obligations and exercise rights in proceedings.

04 Legal bases under the LGPD

All processing relies on one of the legal bases provided by articles 7 and 11 of the LGPD:

05 With whom we share data

We do not sell your data. We share it only with service providers acting as processors and with third parties in legally permitted circumstances, always limited to what is necessary:

Data collected through WhatsApp is used only for the purposes described in this Policy.

06 International transfers

Some processors, including Meta, Cloudflare and Brevo, may store or process data on servers outside Brazil. Such transfers must comply with articles 33 to 36 of the LGPD and the applicable protection mechanisms. Information about destinations and safeguards applicable to the processing may be requested from the DPO.

07 Your rights and how to exercise them

Article 18 of the LGPD gives you the right, upon request, to:

• Confirm that processing exists;
• Access your data;
• Correct incomplete or outdated data;
• Request anonymisation, blocking or deletion of non-compliant data;
• Request portability to another service provider under applicable regulations, subject to trade and industrial secrets;
• Delete data processed on the basis of consent;
• Receive information about sharing;
• Receive information about the choice not to consent and its consequences;
• Withdraw consent.

08 Retention and deletion

We retain data only for as long as necessary for its purposes, subject to these criteria:

• Clients and contracts: during the relationship and afterwards for applicable limitation periods (the Civil Code sets a general 10-year period where no shorter period applies; retention depends on the purpose and the actual applicable period) and any period required by rules governing legal practice;
• Tax and billing data: for the statutory tax-record period (generally at least 5 years);
• WhatsApp and form contacts: for as long as needed for the interaction, followed by a deletion assessment, subject to legally justified retention;
• Newsletter: until consent is withdrawn or the recipient unsubscribes.

Once the purpose and applicable periods expire, deletion or anonymisation must be assessed, subject to statutory retention grounds. Data subjects may request retention information and exercise the rights in Section 07.

09 Information security

We adopt technical and organisational measures to protect data against unauthorised access, loss, alteration or improper disclosure, including access controls, providers that use encryption, activity records and the professional duty of confidentiality inherent in legal practice.

No system is completely invulnerable. If an incident presents a relevant risk, we will take appropriate measures and provide any notice required by the LGPD.

10 Cookies

Our website uses cookies to ensure that pages work properly and to improve your experience:

• Necessary: essential for the website to operate;
• Performance / analytics: help us understand how the website is used;
• Session storage (sessionStorage): retains traffic attribution and interaction signals within the browser session; it is not the same as a cookie.

You may manage or block cookies in your browser settings. Disabling some cookies may affect parts of the website.

11 Children and adolescents

Our services and channels are not directed to anyone under 18. If children's or adolescents' data is necessary for a legal service, processing must have an appropriate legal basis and give priority to their best interests (article 14 of the LGPD). Improperly collected data will be assessed for deletion, subject to statutory retention obligations.

12 Changes to this Policy

We may update this Policy at any time to reflect legal, regulatory or service changes. The current version will always be available at this stable public URL:

We recommend reviewing it periodically. This version is effective from the last-updated date above and remains in force until replaced.

Falchet e Marques Sociedade de Advogados · CNPJ 37.855.788/0001-28