This Policy explains which personal data we process, for what purposes, on what legal basis, for how long, and what rights you have in respect of those data. It applies to the website www.pt-on.com, to the forms available on it and to the relationships we maintain with clients, counterparties, suppliers, applicants and other persons with whom we are in contact in the course of our business.
1. Who is the controller
The controller is PT.EL Portugal Economics And Legal - Sociedade Multidisciplinar de Advogados e Economistas, SP, Lda., NIPC 518 828 190, with registered office at Rua dos Caminhos de Ferro, n.º 18, 1100-107 Lisboa.
For any matter relating to personal data, please write to privacidade@pt-on.com or by post to the registered office address. PT.EL has not appointed a data protection officer, as it is not required to do so; the privacy contact performs the same liaison function.
2. What data we process, for what purpose and on what legal basis
The table below summarises the processing we carry out. The legal bases indicated are those set out in Article 6 of Regulation (EU) 2016/679 (GDPR).
| Situation | Data | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Contact through the website or by e-mail | Name, e-mail address, telephone number, profile, content of the message | To respond to the request and, where applicable, to prepare a proposal or fee estimate | Steps taken at the request of the data subject prior to entering into a contract; legitimate interest in responding to those who contact us | 12 months after the last communication, if no engagement follows |
| Clients | Identification, contact details, tax identification number, details of the matter, documents, billing data. Special categories of data (for example, health or family circumstances) only where the matter so requires | To provide the services engaged; to open and manage the file; to check for conflicts of interest; to comply with professional and legal obligations | Performance of the contract; compliance with legal obligations (Statute of the Portuguese Bar Association, tax legislation, Law no. 83/2017); legitimate interest in managing the business. For special categories, Article 9(2)(f) GDPR | For the duration of the relationship and thereafter for as long as necessary to defend against any liability claim, in accordance with the applicable limitation periods; 10 years for tax documents; 7 years for the records required by Law no. 83/2017 |
| Counterparties, witnesses and other persons involved in a matter | Identification, contact details and data relating to the matter | To provide the services to the client; to establish, exercise or defend rights in proceedings | Legitimate interest of the client and of the firm; compliance with legal obligations | The same periods as apply to the file to which they relate |
| Suppliers and partners | Identification, contact details, billing data | To select and engage; to manage the relationship; to invoice | Performance of the contract; compliance with legal obligations | For the duration of the relationship and 10 years after the last invoice |
| Applicants for employment or traineeships | CV, academic and professional background, contact details, covering letter | To assess the application | Steps taken at the request of the data subject prior to entering into a contract | 12 months, unless erasure is requested earlier |
| Registration of interest in the Lexea platform and other institutional communications | Name, e-mail address, profile | To send information about the launch of the platform and about the firm’s activities | Consent, which may be withdrawn at any time | Until consent is withdrawn or after 3 years without any interaction |
| Events | Name, contact details, organisation; image and voice, where photographs or video are recorded | To manage registrations; to publicise the event | Performance of the contract; consent for the use of images; legitimate interest in institutional publicity | 12 months after the event; images for as long as the content remains published |
| Use of the website | IP address, browser and device data, pages visited, cookies | Operation and security of the website; usage statistics; display of third-party content | Legitimate interest, for strictly necessary cookies; consent, for all others | See the Cookie Policy |
We do not use your data for decisions based solely on automated processing which produce legal effects. Should the Lexea platform come to include features of that kind, we will inform you in advance and ensure the human intervention provided for in Article 22 GDPR.
3. Data of other persons provided to us by clients
When entrusting a matter to us, clients frequently provide us with data relating to other persons: counterparties, employees, family members, witnesses. We process those data solely for the matter concerned and subject to professional secrecy. Where the law exempts us from informing those persons directly, because the processing is covered by professional secrecy (Article 14(5)(d) GDPR), it is for the client to ensure that the data were lawfully obtained.
4. With whom we share the data
We do not sell or transfer personal data. We share them only where necessary:
with courts, registry offices, notaries, the Tax and Customs Authority (Autoridade Tributária), Social Security and other public bodies, in connection with the matters we handle or under a legal obligation;
with lawyers, solicitadores (registered legal agents), experts, certified accountants and other professionals involved in the matter, all of whom are bound by confidentiality;
with service providers acting on our behalf under a written contract (website hosting, e-mail and cloud storage, invoicing, case management), who may process the data only on our instructions;
with the Portuguese Bar Association (Ordem dos Advogados) and the Portuguese Association of Economists (Ordem dos Economistas), where the practice of the profession so requires;
with our insurer, in connection with professional indemnity insurance.
5. Transfers outside the European Economic Area
Our files are kept in Portugal or in other countries of the European Economic Area. Some of the services used on the website may transfer data outside that area: the platform on which the website is hosted (Wix) and the LinkedIn, Facebook and Google Maps content embedded in it. In those cases, the transfer is based on an adequacy decision of the European Commission or on standard contractual clauses approved by it. You may request a copy of the applicable safeguards from us.
6. Security and professional secrecy
The firm’s lawyers and economists are bound by professional secrecy, under Article 92 of the Statute of the Portuguese Bar Association and the rules of professional conduct of the Portuguese Association of Economists (Ordem dos Economistas). In addition, we apply technical and organisational measures appropriate to the risk: individual accounts with two-step authentication, encryption of communications and devices, back-ups, access logging and regular training. Our Information Security Policy describes these measures.
7. Your rights
You have the right to:
access your data and know how we process them;
rectify inaccurate or incomplete data;
erase the data, where they are no longer necessary or the processing is unlawful;
restrict processing, in certain circumstances;
receive the data you have provided to us in a structured, commonly used format (data portability);
object to processing based on legitimate interest;
withdraw consent, where processing is based on it, without affecting the lawfulness of processing carried out before its withdrawal;
not be subject to decisions based solely on automated processing.
To exercise these rights, please write to privacidade@pt-on.com. We may ask you to confirm your identity. We will respond within one month, which may be extended by a further two months in complex cases, and we will inform you if this happens. Exercising your rights is free of charge, save in the case of manifestly unfounded or excessive requests.
Some rights are subject to limits. We cannot, for example, erase data that the law requires us to retain, or give access to information covered by the professional secrecy owed to another client.
8. Complaints
If you consider that the processing of your data infringes the law, you may lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority, Av. D. Carlos I, n.º 134, 1.º, 1200-651 Lisboa, geral@cnpd.pt, www.cnpd.pt. We would be grateful if you would contact us first, so that we may try to resolve the matter.
9. Cookies
The website uses cookies that are necessary for it to function and, with your consent, statistics cookies and third-party content cookies. The Cookie Policy explains what they are and how you can manage them.
10. Minors
Our services are not directed at minors. If we become aware that we have collected data from a minor without the consent of the holder of parental responsibility, we will erase them.
11. Changes
We may update this Policy when the law or our business changes. The version in force is always published on the website, together with its date. If a change is relevant to you, we will notify you by e-mail, where we hold your contact details.
Version 3.0 · Approved by the management on 1 October 2026 · Supersedes the version of 3 March 2026.
