Skip to content
Pontes & Araújo
Legal

Privacy policy

Pontes & Araújo respects the privacy of the users of this website and undertakes to process their personal data lawfully, fairly, transparently and securely. This English text is a translation provided for convenience; in case of any discrepancy, the Portuguese version prevails.

This Privacy Policy describes the personal data that may be collected through the website, the purposes and legal bases for processing, the applicable retention periods and the rights of data subjects, under Regulation (EU) 2016/679 — the General Data Protection Regulation — and Portuguese Law no. 58/2019 of 8 August.

1. Data controllers

Pontes & Araújo is a professional name used by two lawyers in individual practice working together:

  • Bruna Eugénia Araújo — Lawyer in individual practice
  • Sara Pontes — Lawyer in individual practice

Each lawyer is the controller for the processing of personal data carried out in connection with the professional matters entrusted to her.

As regards data collected through this website and the shared contact channels, which lawyer acts as controller will depend on the intended recipient of the enquiry and on the matter subsequently assigned.

Professional address:
Avenida Barjona de Freitas, n.º 248, Loja 14
4850-521 Vieira do Minho, Portugal

Email address:
vm.pontesearaujo@gmail.com

2. Personal data collected

We may collect the personal data that you voluntarily provide through the website form, by email, by telephone or by any other means of contact, namely:

  • name;
  • email address;
  • telephone number;
  • subject and content of the message;
  • information needed to assess the request;
  • documents or other material sent voluntarily;
  • technical and browsing data, where applicable.

Within a professional relationship, other data necessary for the provision of legal services may also be processed, including identification and contact details, personal, family, professional, asset or financial circumstances, as well as information relating to court or administrative proceedings.

The nature and extent of the data processed will always depend on the specific matter and the services requested.

3. Particularly sensitive data

In providing legal services it may be necessary to process special categories of personal data, such as health data, racial or ethnic origin, religious beliefs or other specially protected data, as well as data relating to criminal convictions and offences.

Such data will only be processed where it is relevant and necessary for the legal assistance requested and where there is a legal basis for doing so, in particular for the establishment, exercise or defence of a legal claim.

Information disclosed within the professional relationship will likewise be handled in accordance with the legal, professional and ethical duties applicable to the legal profession.

4. Purposes of processing

Personal data may be processed for the following purposes:

  • responding to requests for information or contact;
  • booking and managing consultations;
  • assessing the request submitted and whether legal services can be provided;
  • carrying out pre-contractual steps;
  • providing the legal services requested;
  • communicating with clients, prospective clients and others connected with the matters handled;
  • managing the professional and administrative relationship with clients;
  • issuing invoices and meeting accounting and tax obligations;
  • complying with legal, regulatory, professional and ethical obligations;
  • exercising or defending rights in judicial, administrative or out-of-court proceedings;
  • ensuring the operation, maintenance and security of the website;
  • preventing misuse, fraud or security incidents.

Personal data will not be used for purposes incompatible with those for which it was collected.

5. Legal bases for processing

Depending on the purpose and context, the processing of personal data may be based on:

  • pre-contractual steps requested by the data subject;
  • performance of a contract for the provision of legal services;
  • compliance with legal, regulatory, professional or ethical obligations;
  • the legitimate interest in responding to enquiries received, managing the professional activity and protecting the security of the website and communications;
  • the data subject's consent, where required;
  • the establishment, exercise or defence of legal claims;
  • other grounds permitted by the applicable legislation.

Where processing is based on consent, that consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out beforehand.

6. Form and enquiries through the website

When you send a message through the website or to the email address given, the data provided will be used to assess and respond to your enquiry.

Sending a message does not, in itself, constitute:

  • acceptance of the matter;
  • the conclusion of a contract for the provision of legal services;
  • the creation of a lawyer-client relationship;
  • a guarantee that there is no conflict of interest;
  • the assumption of any obligation of representation or legal aid.

The provision of legal services is only considered to have begun once the matter has been accepted and the applicable terms defined.

On a first enquiry, we recommend that you do not send confidential documents or particularly sensitive personal information beyond what is essential to outline the matter in general terms.

7. Data retention

Personal data will be kept only for as long as necessary to fulfil the purposes for which it was collected and processed.

Data relating to enquiries that do not lead to the provision of legal services will be kept only for as long as needed to assess and answer the enquiry, and may be retained for a further period where necessary to prevent conflicts of interest, protect rights or comply with legal obligations.

Where a professional relationship is established, data may be kept for the duration of the services and thereafter for the legally applicable periods, in particular to meet tax, accounting, professional or ethical obligations and for the establishment, exercise or defence of legal claims.

Once the applicable retention period ends, data will be deleted, anonymised or securely retained where a legal obligation requires it.

8. Sharing data with third parties

Personal data may be disclosed, strictly to the extent necessary to handle the matter, to:

  • courts and judicial authorities;
  • administrative authorities and public bodies;
  • registry offices and registration services;
  • notaries;
  • immigration and nationality services;
  • other lawyers, solicitors and enforcement agents;
  • experts, translators, interpreters and other professionals whose involvement is necessary;
  • banks, insurers or other entities connected with the matter;
  • accountants and administrative service providers;
  • providers of website hosting, email, storage, IT support and security;
  • other entities whose involvement is necessary to comply with legal obligations or to provide the service requested.

Whenever a service provider processes personal data on our behalf, appropriate measures will be taken to ensure confidentiality, security and compliance with the applicable legislation.

Personal data is not sold, rented or made available to third parties for commercial purposes.

9. International data transfers

Some technology service providers may process personal data outside the European Economic Area.

Where an international transfer takes place, the legally required mechanisms will be used to ensure an adequate level of protection, in particular adequacy decisions, standard contractual clauses or other safeguards permitted by the GDPR.

10. Security and confidentiality

Appropriate technical and organisational measures are in place to protect personal data against:

  • unauthorised access;
  • misuse;
  • disclosure;
  • alteration;
  • loss;
  • destruction;
  • any other form of unlawful processing.

These measures are adjusted to the nature of the data, the context of the processing and the risks involved.

Despite these measures, no system for transmitting or storing information can guarantee absolute security. You should therefore avoid sending particularly confidential information through channels that do not offer adequate protection.

11. Rights of data subjects

Under the applicable legislation, and where the relevant conditions are met, the data subject may exercise the following rights:

  • the right of access to their personal data;
  • the right to rectification of inaccurate or incomplete data;
  • the right to erasure;
  • the right to restriction of processing;
  • the right to object to processing;
  • the right to data portability;
  • the right to withdraw consent, where processing is based on consent;
  • the right to know to whom the data has been disclosed;
  • the right to lodge a complaint with the competent supervisory authority.

The right of access allows the data subject to find out whether their data is being processed and to obtain information about, among other things, the purposes, the categories of data, the recipients and the retention periods.

These rights are not absolute. Their exercise may be limited where the processing or retention of the data is necessary to comply with a legal obligation, to protect the rights of third parties or for the establishment, exercise or defence of legal claims.

12. Exercising your rights

These rights may be exercised through the following contact details:

E-mail:
vm.pontesearaujo@gmail.com

Morada:
Avenida Barjona de Freitas, n.º 248, Loja 14
4850-521 Vieira do Minho, Portugal

The request should clearly identify the right being exercised and the data to which it relates.

Where it is necessary to confirm the requester's identity, additional information may be requested, solely to prevent improper access to or alteration of another person's data.

The data subject also has the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese supervisory authority for personal data protection.

13. Cookies and browsing data

The website may use cookies or similar technologies necessary for its operation.

Where analytics, advertising or other non-essential cookies are used, they should only be set after the user's consent has been obtained, through the mechanism provided on the website.

Detailed information on the cookies actually used, their purpose, duration and the entity responsible should be set out in a dedicated Cookie Policy.

You can also manage or delete cookies through your browser settings.

14. Links to external websites

The website may contain links to third-party pages or platforms.

Pontes & Araújo does not control and is not responsible for the privacy policies, security measures, content or practices of those third parties. You are advised to consult their policies before providing personal data.

15. Changes to this Privacy Policy

This Privacy Policy may be amended whenever necessary to reflect:

  • legislative or regulatory changes;
  • guidance from the competent authorities;
  • changes in how the website operates;
  • changes to the services or to the data processing carried out.

The updated version will be published on the website, stating the date of the last revision.

16. Contact

For any question relating to this Privacy Policy, to the processing of personal data or to the exercise of data subject rights:

Pontes & Araújo
Avenida Barjona de Freitas, n.º 248, Loja 14
4850-521 Vieira do Minho, Portugal

E-mail:
vm.pontesearaujo@gmail.com

Last updated: July 2026