Data protection
Privacy Policy
Last updated:
This Privacy Policy describes how NAA handles the personal data collected through the naa.pt website, in compliance with the General Data Protection Regulation (the GDPR, Regulamento (UE) 2016/679) and applicable national law.
1. Identity of the data controller
NAA — N Advogados Associados, Sociedade de Advogados, S.P. R.L.
Registered office: R. dos Sapateiros 39, 3.º Esq., 1100-576 Lisboa
Email: info@naa.pt · Phone: +351 21 481 8540
2. Personal data collected
Through this website we may collect the following personal data:
- First and last name;
- Email address;
- Telephone number;
- Information relating to the subject of your enquiry.
- IP address and date of submission, when you use the forms, to prevent abuse.
We do not ask for sensitive data in the forms on this website and we would ask you not to include any. To describe your case in detail, please use the telephone or a consultation. If you nevertheless provide data of that nature on your own initiative, it is processed under Article 9(2)(f) GDPR and is covered by lawyer's professional secrecy.
You are not obliged to give us this data, either by law or by contract. The fields marked with an asterisk on the forms are nonetheless needed so that we can reply to you or book the consultation. Without them the request does not go through. The remaining fields are optional and leaving them blank has no consequences. When you accept or refuse cookies, we keep a record of that choice, with a random identifier, the date, the version of this policy and what you chose. It carries neither your name, nor your email, nor your IP address.
3. Purposes and legal bases for the processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Responding to enquiries and contact requests | Art. 6.º, n.º 1, al. b) |
| Provision of legal services | Art. 6.º, n.º 1, al. b) |
| Compliance with legal obligations | Art. 6.º, n.º 1, al. c) |
| Technical operation and security of the website | Art. 6.º, n.º 1, al. f): legitimate interest in keeping the website running and protected |
| Website usage statistics (Google Analytics and Microsoft Clarity) | Art. 6.º, n.º 1, al. a): your consent |
| Spam and abuse prevention on contact forms (Turnstile) | Art. 6.º, n.º 1, al. f): legitimate interest in the security of the service |
| Notifying you when a topic you suggested is published | Art. 6.º, n.º 1, al. f): legitimate interest in notifying the person who suggested the topic |
| Record of form submissions, so that no contact is lost | Art. 6.º, n.º 1, al. b) |
| Record of your cookie choices, as evidence of consent | Art. 6.º, n.º 1, al. c): obligation to be able to demonstrate consent (Art. 7(1)) |
4. Retention periods
Contact details are kept for up to 1 year after the last contact, unless a legal obligation requires otherwise. Data relating to legal matters is kept for the applicable statutory periods. The IP address processed for abuse prevention does not appear in the message that reaches us and is not kept by us beyond the moment of sending.
The analytics data collected through Google Analytics is kept for the period set in that tool (at most, 14 months). In Microsoft Clarity, session recordings are, as a rule, kept for 30 days, but Microsoft keeps a random sample of those recordings and any marked as favourites for up to 9 months. Aggregated data, such as heatmaps, is kept for up to 9 months.
5. Recipients of the data
Your data may be disclosed to technical service providers acting as data processors (in particular the website hosting service) and to public authorities where this is legally required. Not all the providers listed below act in that capacity, as explained there. We do not sell or transfer your data to third parties for marketing purposes.
If you allow analytics cookies, we also use Google Analytics, provided by Google Ireland Limited, which is the Google entity that contracts with customers established in the European Economic Area. For the measurement of usage statistics, Google acts as our processor. It processes that data on our behalf and on our instructions. That same consent also activates Microsoft Clarity, which helps us understand how our pages are used, through heatmaps and session replay in strict masking mode, the most restrictive the service offers, in which all text is masked. The recordings show where you clicked and how far down the page you scrolled, never what you typed or what you read. The service is provided by Microsoft Corporation, which contracts with customers established in the European Union through Microsoft Ireland Operations Limited. With Microsoft, the relationship is different, and it is important to be clear about that. The Clarity terms of use treat Microsoft and NAA as separate and independent controllers and expressly rule out any controller-processor relationship, so Microsoft does not process this data on our behalf or on our instructions. In practice, Microsoft is not limited to what we ask of it and may use the data it collects for its own purposes, including improving its products and building user profiles for purposes that include advertising, as set out in its Privacy Statement, which we recommend you read. For our part, Clarity is only loaded after you accept analytics cookies, and we pass your consent status to Microsoft with storage for advertising purposes denied.
When you submit a contact form we do not use any third-party form service. Your message goes straight to our mailbox. We also keep a record of the submission, with the date, the form used and your contact details, so that we can telephone you if the message does not reach us. That record does not include what you wrote and is deleted after 30 days. To prevent spam and abuse we use Turnstile, from Cloudflare, which processes only your IP address and technical signals from your browser, never the content of your message. As to those signals, Cloudflare states that it acts on our behalf in providing us with the service and on its own account in so far as it uses them to improve its bot detection. Turnstile is contacted only when you interact with the form. The record of your cookie choice is stored in a Cloudflare database, and in that respect Cloudflare acts as our processor, processing it in accordance with our instructions. That record does not include your name, your email address or your IP address.
On the Contact page we include a Google Maps map that is only loaded if the user chooses to load it. At that point, the request is sent to Google (Google Ireland Limited and Google LLC, in the United States), which may process the corresponding IP address. As to the map, Google does not process this data on our behalf. It is responsible for that processing in its own right and uses it for its own purposes, under its privacy policy. Any resulting transfers outside the European Economic Area rely on the mechanisms referred to in point 6.
6. International transfers
The website is served through the global network of Cloudflare, Inc., a company based in the United States, which includes servers in the European Economic Area. Any resulting transfers of data outside the European Economic Area rely on the safeguard mechanisms provided for in the GDPR, in particular the EU-US Data Privacy Framework and/or the European Commission's standard contractual clauses. You may ask us for a copy of the applicable standard contractual clauses at info@naa.pt, or check each provider’s certification in the public Data Privacy Framework register.
If you consent to analytics cookies, the use of Google Analytics may involve the processing of data by Google outside the European Economic Area, in particular in the United States. Those transfers are covered by the safeguards provided for in the GDPR (the EU-US Data Privacy Framework and/or the European Commission's standard contractual clauses), and the IP address is anonymised. If you do not consent to analytics cookies, Google Analytics is never loaded and transmits nothing. The Google Maps map depends on a separate permission, explained in section 5. The same applies to Microsoft Clarity, as Microsoft is likewise certified under the EU-US Data Privacy Framework.
Contact form submissions and the record of your cookie choice are handled by Cloudflare, Inc., which acts as a processor and is the same entity that serves this website, referred to above in this section. Any resulting transfers outside the European Economic Area rely on the same safeguards indicated there.
7. Your rights
As the data subject, you have the rights of access, rectification, erasure, restriction of processing, portability and objection, as well as the right to withdraw your consent at any time (for example, in relation to analytics cookies), without affecting the lawfulness of the processing carried out up to that point. No automated decisions are made on the basis of your data.
Right to object. You may object, at any time and on grounds relating to your particular situation, to the processing that rests on our legitimate interest, identified in the table in section 3.
To exercise these rights, contact us at info@naa.pt. You also have the right to lodge a complaint with the supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.
8. Cookies
The use of cookies on this website is described in our Cookie Policy, where you can also review or withdraw your consent.
9. Changes to this policy
NAA may update this policy whenever necessary. The version in force is the one published on this page, together with its update date.