Privacy Policy

1. Who controls your data

The controller of the personal data processed under this Policy is Wilton Gomes Advogados, a law firm registered with the Brazilian Bar Association, with professional addresses at Rua Leopoldo Couto de Magalhães Júnior, 758, suite 12, Itaim Bibi, São Paulo/SP, 04542-000, Brazil, and at SHIS, Quadra 9, Conj. 9, Casa 16-18, Brasília/DF, Brazil.

For any question concerning this Policy or the processing of your personal data, our Data Protection Officer can be reached at contato@wiltongomes.com.br.

2. Definitions

For the purposes of this Policy, the definitions in article 5 of the LGPD apply, notably:

• Personal data: information relating to an identified or identifiable natural person.
• Sensitive personal data: data concerning racial or ethnic origin, religious belief, political opinion, membership of a trade union or of a religious, philosophical or political organisation, data concerning health or sex life, and genetic or biometric data.
• Data subject: the natural person to whom the personal data relates.
• Processing: any operation carried out with personal data, such as collection, use, access, storage, sharing and deletion.
• Controller: the party responsible for decisions regarding the processing of personal data.
• Processor: the party that processes personal data on behalf of the controller.

3. Personal data we process

3.1. Data you provide. This is the data you give us of your own accord when contacting us, engaging our services or applying for a position, such as full name, taxpayer or company registration number, identity document, address, telephone number, email, occupation, marital status, professional and career details, and the information required to bring and conduct judicial, administrative and advisory matters.

3.2. Third-party data. In the practice of law we may process personal data of third parties provided to us by the client or obtained from documents, case files and public sources, where necessary to defend the client's interests.

3.3. Sensitive personal data. Certain legal matters require the processing of sensitive data. In such cases, processing takes place solely to the extent necessary for the regular exercise of rights in judicial, administrative or arbitration proceedings, or on the basis of specific and prominent consent.

3.4. Data collected automatically. While you browse the website, we may collect your IP address, date and time of access, browser and device type, operating system, pages visited and referral source, by means of cookies and similar technologies, as described in section 7.

We do not intentionally collect personal data of children or adolescents, except where strictly necessary for the practice of law and having regard to the best interests of the minor, in accordance with article 14 of the LGPD.

4. Purposes and legal bases

We process personal data only for legitimate, specific purposes disclosed to the data subject, always relying on one of the legal bases set out in articles 7 and 11 of the LGPD. The main purposes are:

• Provision of legal services: bringing, analysing and conducting judicial, administrative, arbitration and advisory matters — legal basis: performance of a contract and the regular exercise of rights in proceedings.
• Responding to enquiries: replying to messages, questions and proposals — legal basis: legitimate interest and preliminary procedures related to a contract.
• Compliance with legal and regulatory obligations: tax, accounting and employment obligations and the duties imposed by the Brazilian Bar Statute and the Bar's Code of Ethics and Discipline — legal basis: compliance with a legal or regulatory obligation.
• Recruitment: assessment of résumés and applications — legal basis: preliminary procedures related to a contract, and consent.
• Website security and improvement: fraud prevention, information security and statistical analysis of browsing — legal basis: legitimate interest.
• Institutional communications: sending newsletters, articles and invitations when requested — legal basis: consent, which may be withdrawn at any time.

Should personal data come to be used for a purpose other than those described here, you will be informed in advance and, where required, your consent will be sought.

5. Professional privilege

The information entrusted to the Firm by its clients is protected by attorney-client privilege, an inalienable prerogative and duty set out in article 7, items II and XIX, of Federal Law No. 8,906/1994 (the Brazilian Bar Statute) and in articles 35 to 38 of the Bar's Code of Ethics and Discipline.

Professional privilege is observed by every lawyer, member of staff and service provider of the Firm, all of whom undertake confidentiality obligations, and it survives the end of the professional relationship. No privileged information is disclosed to third parties except by court order or in the narrow circumstances permitted by law.

6. Data sharing

The Firm does not sell personal data. Sharing occurs only where necessary to fulfil the purposes described in this Policy, subject to professional privilege and our security duties, with:

• the courts, the public prosecution service, administrative tribunals, arbitration chambers, notary and registry offices and public bodies, in the course of matters and proceedings;
• corresponding lawyers, court experts, technical assistants, consultants and other professionals engaged in the client's interest;
• technology suppliers acting as processors, such as hosting, cloud storage, email and case management services, contractually bound to process data in accordance with our instructions;
• public authorities, in order to comply with a legal or regulatory obligation or a court order.

7. Cookies and similar technologies

Cookies are small files stored on your device that allow the website to function properly and help us understand how it is used. We may use:

• Necessary cookies: essential to browsing and to the website's basic functionality.
• Performance and analytics cookies: allow us to measure audience and understand browsing behaviour, on an aggregated basis, in order to improve our content.

You can manage, block or delete cookies at any time in your browser settings. Disabling certain cookies may impair the website's functionality.

8. Storage and retention periods

Personal data is kept for as long as necessary to fulfil the purposes for which it was collected. Once that purpose has been served, the data is deleted, unless its retention is permitted or required for:

• compliance with a legal or regulatory obligation, including the retention periods for tax, accounting and employment records;
• the regular exercise of rights in judicial, administrative or arbitration proceedings, subject to the applicable limitation periods;
• the retention of case files, documents and records relating to the practice of law, in accordance with Bar regulations;
• the controller's exclusive use, with third-party access prohibited and the data anonymised.

9. Information security

We adopt technical and administrative measures capable of protecting personal data from unauthorised access and from accidental or unlawful destruction, loss, alteration, disclosure or dissemination, including need-to-know access control, internal confidentiality policies, encryption and network protection, backups and periodic staff training.

No system is entirely immune to incidents. Should a security incident occur that may create relevant risk or harm to data subjects, we will notify the affected data subjects and the Brazilian National Data Protection Authority (ANPD), in accordance with article 48 of the LGPD.

10. International data transfers

Certain technology suppliers engaged by the Firm may store or process data on servers located outside Brazil. In such cases we adopt the safeguards required by article 33 of the LGPD, ensuring that the destination country or the supplier itself affords a degree of protection adequate to that provided under Brazilian law, by means of specific contractual data protection clauses.

11. Data subject rights

Under article 18 of the LGPD, you may at any time request:

• confirmation that your personal data is being processed;
• access to the data;
• correction of incomplete, inaccurate or out-of-date data;
• anonymisation, blocking or deletion of data that is unnecessary, excessive or processed unlawfully;
• portability of the data to another service or product provider;
• deletion of data processed on the basis of consent;
• information about the public and private entities with which the data has been shared;
• information about the option not to give consent and about the consequences of refusing;
• withdrawal of consent;
• objection to processing carried out under one of the grounds that dispense with consent, where the law has not been complied with.

The exercise of these rights is subject to the limits imposed by professional privilege and by legal document retention obligations, which may prevent the immediate deletion of certain data.

12. How to exercise your rights

Requests concerning personal data should be addressed to our Data Protection Officer:

• Email: contato@wiltongomes.com.br
• Telephone: +55 11 3777-0791
• São Paulo: Rua Leopoldo Couto de Magalhães Júnior, 758, suite 12 | Itaim Bibi | São Paulo/SP | 04542-000 | Brazil
• Brasília: SHIS, Quadra 9, Conj. 9, Casa 16-18 | Brasília/DF | Brazil

To keep data secure, we may ask for additional information confirming the requester's identity. Requests are answered within the time limits set by the LGPD.

13. Changes to this Policy

This Privacy Policy may be updated at any time as a result of legislative changes, ANPD guidance or changes to our internal processes. The version in force is always the one published on this page, showing the date it was last updated. We recommend checking it periodically.