This website uses cookies to improve performance and your user experience on our website. If you do not agree with the use of cookies other than the essential ones, you can manage your preferences by clicking on "Cookie Settings"
This website uses cookies to improve performance and your user experience on our website. If you do not agree with the use of cookies other than the essential ones, you can manage your preferences by clicking on "Cookie Settings"
This Privacy and Personal Data Protection Policy (“Policy”) establishes the terms under which BMA – Baptista, Monteverde & Associados – Sociedade de Advogados, SP, RL, taxpayer identification number 508690820, with registered office at Edifício Heron Castilho, Rua Braamcamp, 40 – 5 E, 1250-050 Lisboa (“BMA”), processes personal data in the course of its business.
BMA processes personal data in compliance with Regulation (EU) 2016/679 of 27 April (General Data Protection Regulation – GDPR) and with Law No. 58/2019 of 8 August, which ensures the implementation of the GDPR in Portugal.
The protection of personal data is a core commitment of BMA and forms an integral part of its organisational culture. This commitment is reflected in the implementation of appropriate technical and organisational measures, the application of the principles of privacy by design and privacy by default, and the promotion of responsible, secure and transparent information processing practices.
This applies solely to personal data processed by BMA in the context of its activities. It does not extend to third-party websites, platforms or services, even where these are accessible through the BMA website and BMA assumes no responsibility for the processing of personal data carried out by such entities.
For the purposes of this Policy, the concepts set out in the GDPR shall apply, namely:
The processing of personal data by BMA is carried out in full compliance with the principles established in the GDPR, namely:
The controller responsible for the processing of personal data is:
BMA – Baptista, Monteverde & Associados – Sociedade de Advogados, SP, RL
NIPC: 508690820; Address: Edifício Heron Castilho, Rua Braamcamp, 40 – 5 E, 1250-050 Lisboa; Data Protection Contact: [email protected]
BMA determines the purposes and means of the processing of personal data and ensures compliance with applicable legislation throughout all stages of the data lifecycle.
BMA collects and processes personal data solely where this is necessary, proportionate and supported by an appropriate legal ground, in particular in the following contexts:
Where applicable, data subjects are provided with the relevant information at the time their personal data is collected.
BMA processes, in particular:
Common personal data, including identification and contact details, professional and academic information, financial and banking information, image and sound data, communication and interaction records, authentication credentials, access logs and browsing data, as well as identification, contact and access log data of visitors to BMA’s premises and identification and contact details of third parties provided by employees or other persons associated with BMA, such as emergency contacts, for the purposes of security, access control, emergency management and the protection of persons and property.
Special categories of personal data, where legally permitted and strictly necessary, including data concerning health and data relating to criminal convictions and offences, always subject to enhanced protection measures.
BMA processes personal data from:
Personal data is processed by BMA solely for legitimate, specific and clearly defined purposes, in accordance with the principles of purpose limitation and proportionality. Such data is not used for purposes other than those for which it was collected, unless otherwise permitted by law.
In particular, personal data may be processed for the following purposes:
In certain circumstances, particularly in the context of institutional communications, newsletters, event invitations and other interactions arising from a prior professional or institutional relationship, the processing of personal data may be based on BMA’s legitimate interests, without prejudice to the data subject’s right to object.
The processing of personal data by BMA is based, depending on the nature of the data concerned and the purposes pursued, on one of the legal grounds set out in the GDPR, namely:
Where the processing of personal data is based on the legitimate interests of BMA or of third parties, a prior assessment is conducted. This assessment takes into account the nature of the relationship with the data subject, the reasonable expectations of the data subject regarding the processing, the proportionality of the processing and the existence of adequate measures to safeguard their fundamental rights and freedoms.
The retention of personal data is determined in accordance with the purposes of the processing, applicable legal grounds and BMA’s legal and ethical obligations. In particular, the following retention periods apply:
At the end of the applicable period, the data is securely deleted or anonymised.
BMA may share personal data, where necessary, with professional advisers, experts, arbitrators, mediators, courts, public authorities, regulatory bodies, registries, insurers, technology service providers, document storage providers, IT support providers, translation service providers, secure confidential waste disposal providers, as well as other entities involved in the provision of legal services or in the fulfilment of legal obligations.
Data sharing is carried out in accordance with the law and subject to the implementation of appropriate safeguards to ensure the protection of personal data. The above list is not exhaustive.
Where BMA engages processors, it ensures that they provide sufficient guarantees of security and confidentiality through written agreements governing their responsibilities, security measures, and notification duties.
Where personal data is transferred outside the European Economic Area, BMA implements appropriate safeguards, including the standard contractual clauses approved by the European Commission, in order to ensure a level of protection equivalent to that required by the GDPR.
Under the terms and for the purposes of the General Data Protection Regulation, data subjects are entitled, where applicable, to exercise the rights of access, rectification, erasure, restriction of processing, objection and data portability, as well as the right not to be subject to a decision based solely on automated processing, including profiling.
As a rule, these rights may be exercised free of charge at any time by contacting [email protected].
BMA undertakes to respond to requests submitted by data subjects within a maximum period of one month from receipt, without prejudice to the possibility of extending this period, in accordance with the law, taking into account the complexity and number of requests received.
Data subjects have the right to object at any time to the processing of their personal data based on BMA’s legitimate interest, including processing for institutional communications or newsletters and processing for these purposes will cease after this right is exercised, unless there are compelling and legitimate reasons that prevail.
BMA ensures compliance with the information obligations set out in the General Data Protection Regulation by providing data subjects with all legally required information regarding the processing of their personal data in a transparent, clear and accessible manner. This includes, in particular, the respective purposes, the applicable legal grounds, the retention periods, their rights and relevant contact details, without prejudice to the exceptions provided for by law.
BMA maintains a Record of Processing Activities, in accordance with Article 30 of the GDPR. This record is kept up to date and subject to periodic review, and documents, in particular, the purposes of processing, categories of personal data and data subjects, legal grounds, recipients, international transfers, retention periods and security measures.
BMA implements appropriate technical and organisational measures to ensure the confidentiality, integrity, availability and resilience of systems and personal data. These measures involve management and all employees and are aligned with BMA’s internal information security policies.
Where processing is likely to result in a high risk to the rights and freedoms of data subjects, BMA carries out a prior Data Protection Impact Assessment, which is reviewed whenever relevant changes occur.
BMA has internal procedures in place for the detection, management and reporting of personal data breaches. These procedures include notification to the Portuguese Data Protection Authority within the applicable legal timeframe and communication to data subjects whenever there is a high risk.
Without prejudice to any other administrative or judicial remedy, data subjects have the right to lodge a complaint with the competent supervisory authority, the Portuguese Data Protection Authority (CNPD), in accordance with the General Data Protection Regulation and applicable legislation.
Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa
Telephone: (+351) 213 928 400
Email: [email protected]
BMA may update this Policy at any time. Any relevant changes will be communicated through the website or by other appropriate means.
Date of last update: 2025
This Privacy and Personal Data Protection Policy (“Policy”) establishes the terms under which BMA – Baptista, Monteverde & Associados – Sociedade de Advogados, SP, RL, taxpayer identification number 508690820, with registered office at Edifício Heron Castilho, Rua Braamcamp, 40 – 5 E, 1250-050 Lisboa (“BMA”), processes personal data in the course of its business.
BMA processes personal data in compliance with Regulation (EU) 2016/679 of 27 April (General Data Protection Regulation – GDPR) and with Law No. 58/2019 of 8 August, which ensures the implementation of the GDPR in Portugal.
The protection of personal data is a core commitment of BMA and forms an integral part of its organisational culture. This commitment is reflected in the implementation of appropriate technical and organisational measures, the application of the principles of privacy by design and privacy by default, and the promotion of responsible, secure and transparent information processing practices.
This applies solely to personal data processed by BMA in the context of its activities. It does not extend to third-party websites, platforms or services, even where these are accessible through the BMA website and BMA assumes no responsibility for the processing of personal data carried out by such entities.
For the purposes of this Policy, the concepts set out in the GDPR shall apply, namely:
The processing of personal data by BMA is carried out in full compliance with the principles established in the GDPR, namely:
The controller responsible for the processing of personal data is:
BMA – Baptista, Monteverde & Associados – Sociedade de Advogados, SP, RL
NIPC: 508690820; Address: Edifício Heron Castilho, Rua Braamcamp, 40 – 5 E, 1250-050 Lisboa; Data Protection Contact: [email protected]
BMA determines the purposes and means of the processing of personal data and ensures compliance with applicable legislation throughout all stages of the data lifecycle.
BMA collects and processes personal data solely where this is necessary, proportionate and supported by an appropriate legal ground, in particular in the following contexts:
Where applicable, data subjects are provided with the relevant information at the time their personal data is collected.
BMA processes, in particular:
Common personal data, including identification and contact details, professional and academic information, financial and banking information, image and sound data, communication and interaction records, authentication credentials, access logs and browsing data, as well as identification, contact and access log data of visitors to BMA’s premises and identification and contact details of third parties provided by employees or other persons associated with BMA, such as emergency contacts, for the purposes of security, access control, emergency management and the protection of persons and property.
Special categories of personal data, where legally permitted and strictly necessary, including data concerning health and data relating to criminal convictions and offences, always subject to enhanced protection measures.
BMA processes personal data from:
Personal data is processed by BMA solely for legitimate, specific and clearly defined purposes, in accordance with the principles of purpose limitation and proportionality. Such data is not used for purposes other than those for which it was collected, unless otherwise permitted by law.
In particular, personal data may be processed for the following purposes:
In certain circumstances, particularly in the context of institutional communications, newsletters, event invitations and other interactions arising from a prior professional or institutional relationship, the processing of personal data may be based on BMA’s legitimate interests, without prejudice to the data subject’s right to object.
The processing of personal data by BMA is based, depending on the nature of the data concerned and the purposes pursued, on one of the legal grounds set out in the GDPR, namely:
Where the processing of personal data is based on the legitimate interests of BMA or of third parties, a prior assessment is conducted. This assessment takes into account the nature of the relationship with the data subject, the reasonable expectations of the data subject regarding the processing, the proportionality of the processing and the existence of adequate measures to safeguard their fundamental rights and freedoms.
The retention of personal data is determined in accordance with the purposes of the processing, applicable legal grounds and BMA’s legal and ethical obligations. In particular, the following retention periods apply:
At the end of the applicable period, the data is securely deleted or anonymised.
BMA may share personal data, where necessary, with professional advisers, experts, arbitrators, mediators, courts, public authorities, regulatory bodies, registries, insurers, technology service providers, document storage providers, IT support providers, translation service providers, secure confidential waste disposal providers, as well as other entities involved in the provision of legal services or in the fulfilment of legal obligations.
Data sharing is carried out in accordance with the law and subject to the implementation of appropriate safeguards to ensure the protection of personal data. The above list is not exhaustive.
Where BMA engages processors, it ensures that they provide sufficient guarantees of security and confidentiality through written agreements governing their responsibilities, security measures, and notification duties.
Where personal data is transferred outside the European Economic Area, BMA implements appropriate safeguards, including the standard contractual clauses approved by the European Commission, in order to ensure a level of protection equivalent to that required by the GDPR.
Under the terms and for the purposes of the General Data Protection Regulation, data subjects are entitled, where applicable, to exercise the rights of access, rectification, erasure, restriction of processing, objection and data portability, as well as the right not to be subject to a decision based solely on automated processing, including profiling.
As a rule, these rights may be exercised free of charge at any time by contacting [email protected].
BMA undertakes to respond to requests submitted by data subjects within a maximum period of one month from receipt, without prejudice to the possibility of extending this period, in accordance with the law, taking into account the complexity and number of requests received.
Data subjects have the right to object at any time to the processing of their personal data based on BMA’s legitimate interest, including processing for institutional communications or newsletters and processing for these purposes will cease after this right is exercised, unless there are compelling and legitimate reasons that prevail.
BMA ensures compliance with the information obligations set out in the General Data Protection Regulation by providing data subjects with all legally required information regarding the processing of their personal data in a transparent, clear and accessible manner. This includes, in particular, the respective purposes, the applicable legal grounds, the retention periods, their rights and relevant contact details, without prejudice to the exceptions provided for by law.
BMA maintains a Record of Processing Activities, in accordance with Article 30 of the GDPR. This record is kept up to date and subject to periodic review, and documents, in particular, the purposes of processing, categories of personal data and data subjects, legal grounds, recipients, international transfers, retention periods and security measures.
BMA implements appropriate technical and organisational measures to ensure the confidentiality, integrity, availability and resilience of systems and personal data. These measures involve management and all employees and are aligned with BMA’s internal information security policies.
Where processing is likely to result in a high risk to the rights and freedoms of data subjects, BMA carries out a prior Data Protection Impact Assessment, which is reviewed whenever relevant changes occur.
BMA has internal procedures in place for the detection, management and reporting of personal data breaches. These procedures include notification to the Portuguese Data Protection Authority within the applicable legal timeframe and communication to data subjects whenever there is a high risk.
Without prejudice to any other administrative or judicial remedy, data subjects have the right to lodge a complaint with the competent supervisory authority, the Portuguese Data Protection Authority (CNPD), in accordance with the General Data Protection Regulation and applicable legislation.
Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa
Telephone: (+351) 213 928 400
Email: [email protected]
BMA may update this Policy at any time. Any relevant changes will be communicated through the website or by other appropriate means.
Date of last update: 2025
