Data protection
Privacy Policy
Last updated:
This Privacy Policy describes how NAA handles the personal data collected through the naa.pt website, in compliance with the General Data Protection Regulation (the GDPR, Regulamento (UE) 2016/679) and applicable national law.
1. Identity of the data controller
NAA — N Advogados Associados, Sociedade de Advogados, S.P. R.L.
Registered office: R. dos Sapateiros 39, 3.º Esq., 1100-576 Lisboa
Email: [email protected] · Phone: +351 21 481 8540
2. Personal data collected
Through this website we may collect the following personal data:
- First and last name;
- Email address;
- Telephone number;
- Information relating to the subject of your enquiry.
- IP address and date of submission, when you use the forms, to prevent abuse.
We do not ask for sensitive data in the forms on this website and we would ask you not to include any. To describe your case in detail, please use the telephone or a consultation. If you nevertheless provide data of that nature on your own initiative, it is processed under Article 9(2)(f) GDPR and is covered by lawyer's professional secrecy.
3. Purposes and legal bases for the processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Responding to enquiries and contact requests | Art. 6.º, n.º 1, al. b) |
| Provision of legal services | Art. 6.º, n.º 1, al. b) |
| Compliance with legal obligations | Art. 6.º, n.º 1, al. c) |
| Technical operation and security of the website | Art. 6.º, n.º 1, al. f) |
| Website usage statistics (Google Analytics and Microsoft Clarity) | Art. 6.º, n.º 1, al. a): your consent |
| Spam and abuse prevention on contact forms (Turnstile) | Art. 6.º, n.º 1, al. f): legitimate interest in the security of the service |
4. Retention periods
Contact details are kept for up to 1 year after the last contact, unless a legal obligation requires otherwise. Data relating to legal matters is kept for the applicable statutory periods.
The analytics data collected through Google Analytics is kept for the period set in that tool (at most, 14 months). In Microsoft Clarity, session recordings are kept for 30 days and aggregated data, such as heatmaps, for up to 9 months.
5. Recipients of the data
Your data may be disclosed to technical service providers acting as data processors (in particular the website hosting service) and to public authorities where this is legally required. We do not sell or transfer your data to third parties for marketing purposes.
If you consent to analytics cookies, we also use Google Analytics, provided by Google (Google Ireland Limited / Google LLC), which acts as a data processor solely to measure usage statistics. If you allow analytics cookies, we also use Microsoft Clarity, provided by Microsoft (Microsoft Ireland Operations Limited), which likewise acts as a data processor, to understand how the pages are used through heatmaps and anonymous session replay, with sensitive content masked.
When you submit a contact form we do not use any third-party form service. Your message is received by our own service, running on Cloudflare, and forwarded directly to our email. To prevent spam and abuse we use Turnstile, also from Cloudflare, which processes only your IP address and technical signals from your browser, never the content of your message. Turnstile is contacted only when you interact with the form.
On the Contact page we include a Google Maps map that is only loaded if the user chooses to load it. At that point, the request is sent to Google (Google Ireland Limited and Google LLC, in the United States), which may process the corresponding IP address. Any resulting transfers outside the European Economic Area rely on the mechanisms referred to in point 6.
6. International transfers
The website is served through the global network of Cloudflare, Inc., a company based in the United States, which includes servers in the European Economic Area. Any resulting transfers of data outside the European Economic Area rely on the safeguard mechanisms provided for in the GDPR, in particular the EU-US Data Privacy Framework and/or the European Commission's standard contractual clauses.
If you consent to analytics cookies, the use of Google Analytics may involve the processing of data by Google outside the European Economic Area, in particular in the United States. Those transfers are covered by the safeguards provided for in the GDPR (the EU-US Data Privacy Framework and/or the European Commission's standard contractual clauses), and the IP address is anonymised. If you do not consent to analytics cookies, no data is transferred to Google. The same applies to Microsoft Clarity, as Microsoft is likewise certified under the EU-US Data Privacy Framework.
Contact form submissions are handled by Cloudflare, Inc., acting as a processor and the same entity that serves this website, referred to above in this section. No other provider is involved, so any resulting transfers outside the European Economic Area rely on the same safeguards indicated there.
7. Your rights
As the data subject, you have the rights of access, rectification, erasure, restriction of processing, portability and objection, as well as the right to withdraw your consent at any time (for example, in relation to analytics cookies), without affecting the lawfulness of the processing carried out up to that point. No automated decisions are made on the basis of your data.
To exercise these rights, contact us at [email protected]. You also have the right to lodge a complaint with the supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.
8. Cookies
The use of cookies on this website is described in our Cookie Policy, where you can also review or withdraw your consent.
9. Changes to this policy
NAA may update this policy whenever necessary. The version in force is the one published on this page, together with its update date.