Privacy Policy
Our commitment
Morais Leitão, Galvão Teles, Soares da Silva & Associados, Sociedade de Advogados e Consultores, SP., RL. (Morais Leitão) is firmly committed to privacy and the rights of personal data subjects, acting in accordance with the provisions of the General Data Protection Regulation (GDPR) and other applicable legislation.
Privacy policy
This Privacy Policy provides you with information regarding the collection and processing of your personal data.
A "data controller" is the natural or legal person who, individually or jointly with other entities, determines the purposes and means of processing personal data. Unless otherwise notified, Morais Leitão assumes responsibility for the processing of your personal data.
Data subjects are the natural persons to whom the data relate. We want you to be aware of how Morais Leitão processes your personal data, as well as your rights as a data subject.
The aim of this policy is to answer the following questions:
- What data does Morais Leitão process, to whom does it relate and how is it collected?
- For what purposes and on what legal basis does Morais Leitão process personal data?
- How long do we keep personal data for?
- Who does Morais Leitão transfer personal data to?
- Is your personal data secure?
- What rights do you have as a data subject?
- How can you exercise your rights?
- How can you contact us?
- How can you stay informed on the processing of personal data?
1. What data does Morais Leitão process, to whom does it relate and how is it collected?
Personal data is any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. As such, this does not include personal data where the identity has been removed (anonymous data).
Special categories of personal data include information about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health information, and genetic and biometric data.
Morais Leitão only collects special categories of data in specific and limited circumstances, such as when this information is provided to us in the context of our services.
Morais Leitão may process the following categories of personal data:
a) Identification and contact details (e.g., name, date of birth, gender, address, contact details, citizen card details, passport and tax number, nationality).
b) Education and work experience data (e.g., education, qualifications, certifications, languages, CVs, information from former employers).
c) Professional details (e.g., position, job title, job description, company, office address).
d) Professional activity data (e.g., business activities, information relating to processes and files, information relating to proceedings).
e) Billing data (e.g., account number and payment card details, fees, travel and communication expenses on behalf of the client).
f) Expense and travel data (e.g., dietary requirements, travel booking details, expenses, travel references and vouchers).
g) Image and sound recording data (e.g., photographic and video images).
h) Browsing data (e.g. cookies).
The categories of personal data indicated above refer to different categories of data subjects, whether they are clients, client employees (companies), counterparties, witnesses, candidates, guests at events or alumni of Morais Leitão.
Collection of personal data
Morais Leitão collects personal data through various means and at different times.
Direct collection of personal data: personal data is provided directly by data subjects through direct interactions with Morais Leitão. Such direct interactions include, in particular:
a) Contacts via emailand telephone and responses to invitations.
b) Delivery of your business card.
c) Subscribing to our information or events.
d) Job/professional applications.
e) Contracting services.
Indirect collection of personal data: in some cases, Morais Leitão may collect personal data indirectly, namely through public sources or clients. Without prejudice to limitations arising from professional secrecy, other ethical rules and legal confidentiality, when Morais Leitão processes personal data that it has collected indirectly, it will provide all information relating to the processing of such data to the respective data subjects at the earliest opportunity.
When it is necessary to collect personal data by legal requirement or under a contract with Morais Leitão and such data is not provided when requested, we may not be able to perform the contract (e.g., provide our services). In such situations, Morais Leitão may refuse to provide or receive the services, and you will be notified when the personal data is collected, if applicable.
Access to and use of the Morais Leitão website does not depend on the provision of personal data. However, the use of certain features of the website requires the provision of personal data. For more information, please see our Terms and Conditions .
2. For what purposes and on what legal basis does Morais Leitão process personal data?
Morais Leitão uses personal data for the purposes for which it was collected, as detailed below, unless it reasonably considers that it is necessary to use the personal data for other purposes and such purposes are compatible with the original purpose.
Morais Leitão processes your personal data in strict compliance with the law, when there is a legal basis that allows it. We therefore use your personal data in the following circumstances:
— Performance of a contract: when we need to fulfil a contract that we have entered into or are about to enter into.
— Legitimate interest: when necessary to pursue our interests (or the interests of third parties), provided that your fundamental rights do not override such interests, and that, before processing your personal data, we ensure and balance any potential impact on you and your rights.
— Legal obligation: when we need to comply with legal or regulatory obligations to which we are subject.
— Consent: when you have given us your consent to process your personal data.
Morais Leitão may process personal data for the following purposes and on the following legal bases:
a) To provide legal services, which may include:
- Opening and managing client matters.
- Recording of submitted service proposals.
- Communications with the client, other parties and/or public entities, including courts.
- Archiving documentation in digital and physical formats.
The legal basis in this case is the performance of a contract entered into with clients and legitimate interest, specifically:
- The processing of client information in a sustainable and efficient manner, ensuring its quality and integrity and enabling the provision of excellent services.
- The processing of information from counterparties, witnesses and other persons who may participate in operations, matters and proceedings in which Morais Leitão is involved. And
- The satisfaction of the interests of clients represented by Morais Leitão in the performance of its mandate and legal assistance.
b) For communications and sending information, including disclosure of legal information (e.g., newsletters, briefings, legal alerts), in accordance with your preferences.
The legal basis is legitimate interest, specifically:
- To respond to requests from subscribers to the forms on the Morais Leitão website and to tailor the respective communication.
- Contributing to the development of legal science and playing a relevant role in the legal profession.
- To strengthen Morais Leitão's culture and maintain a close relationship with its alumni.
c) For event management, which includes:
- Sending invitations to events and registering participants in events.
- Internal and external publicity for events.
The applicable legal grounds are consent and legitimate interest, specifically:
- Responding to requests from subscribers to the forms on the Morais Leitão website and tailoring the respective communication.
- Contributing to the development of legal science and playing a relevant role in the legal profession.
- Publicising events promoted by Morais Leitão.
d) For the protection of persons and property, which includes the collection of images through video surveillance.
The legal basis is legitimate interest, specifically:
- To ensure the protection of persons on Morais Leitão's premises.
- Detecting and preventing security incidents.
- Detect and prevent unauthorised access to Morais Leitão's premises and restricted areas.
- Reviewing security incidents, including security training exercises.
e) To comply with legal obligations in relation to compliance.
The legal basis is compliance with a legal obligation incumbent on Morais Leitão.
f) For billing and accounting management, which includes:
- Accounting for expenses, cost control and reimbursements (e.g., travel and mobile communication expenses to be borne by clients).
- Invoicing and management of current accounts. And
- Maintenance of accounting records and supporting documentation.
The legal basis is the performance of a contract, compliance with a legal obligation and legitimate interest, specifically:
- Maintaining efficient management control, invoicing services provided in a timely manner and ensuring compliance with applicable legal obligations.
g) For submission of files to legal directories.
The legal basis is legitimate interest, specifically:
- To publicise and independently characterize the work of Morais Leitão and its lawyers.
h) For judicial and extrajudicial collection and claims, which includes the collection and recovery of amounts owed by clients.
The legal basis is legitimate interest, specifically:
- Satisfying its claims and defending its rights.
i) For recruitment and selection, including the analysis of applications and CVs, as well as the internal selection process for lawyers and employees in accordance with the needs identified.
The legal bases are pre-contractual diligence at the request of the data subject and legitimate interest, specifically:
- Analysing applications and subjecting candidates to an internal selection process in accordance with previously defined criteria.
j) For statistical purposes, including the analysis of personal data contained in proposals, the results of which correspond to aggregated data. This data will be anonymised or pseudonymised in order to protect the data subjects, in particular with regard to the impossibility of re-identification once the statistical operation has been completed.
As this is considered a further processing operation provided for by the GDPR, it is considered lawful processing compatible with the original purposes.
k) To optimise the browsing experience, which includes the collection of browsing information through cookies.
The legal basis is consent.
3. How long do we keep personal data for?
Morais Leitão will only keep your data for as long as necessary to fulfil the purposes set out in this Policy or for as long as required by applicable legal or regulatory standards.
To determine the appropriate retention period for personal data, Morais Leitão considers the amount, nature and sensitivity of the personal data, the potential risk of harm resulting from unauthorised disclosure or use of such personal data and the purposes for which the personal data is processed.
The retention periods for personal data, according to each purpose of processing, are as follows:
Purpose of processing > Retention period
- Provision of legal services > Duration of the mandate, plus 20 years.
- Communications and sending information > Until the data subject expresses their opposition.
- Event management > 2 years from the date of contact or participation in the event (as applicable), if there is no contact or participation in another event by the data subject.
- Protection of persons and property > 30 days.
- Compliance with legal obligations in matters of compliance and > 7 years after the moment when the customer was identified or, in the case of business relationships, after the end of the same.
- Billing and accounting management > 10 years.
- Submission of cases to legal directories > The data will be kept for the period corresponding to the retention period of the file to which it relates, which may be adjusted according to the nature and duration of the process or subject matter.
- Collection and judicial and extrajudicial claims > Until payment of the amounts owed or resolution of the dispute, as applicable.
- Recruitment and selection > 5 years, counted from the date of submission of the application or CV, if the candidate is not selected.
- Response to contact requests > Until the conclusion of the request.
- For statistical purposes> For as long as deemed necessary, with the appropriate technical and organisational measures in place to guarantee the rights of data subjects.
- For the purpose of optimising the browsing experience > Up to 2 years.
- During the period in which the professional relationship with Morais Leitão is maintained, in all other cases.
4. To whom does Morais Leitão transfer personal data?
Morais Leitão does not transfer your personal data to third parties, except in cases where this is necessary for the provision of the services you have contracted or to comply with legal obligations to which Morais Leitão is subject.
The transfer of data to third parties is carried out in accordance with applicable data protection legislation and within the limits of the purposes and legal grounds set out in this Policy.
Morais Leitão requires any person or entity to whom it discloses personal data to respect the confidentiality and security of such data and to treat it in accordance with applicable laws and regulations. We do not allow such recipients to use personal data for their own purposes and only allow the processing of personal data for specific purposes and in accordance with the instructions provided by us.
Morais Leitão may share personal data with the following entities:
- Parties relevant to the legal advice we provide, such as counterparties, courts, police authorities, regulatory authorities, government institutions or other lawyers
- Law firms belonging to the Morais Leitão Legal Circle network or the Lex Mundi network, in order to ensure the efficient functioning of Morais Leitão and the quality of the services provided
- Public authorities and the Bar Association, in compliance with legal obligations
- Service providers that provide services to Morais Leitão for the purposes described above, such as information technology (IT) providers, communications services, translation services and digital and physical archiving services
We may be required to disclose your information to comply with legal or regulatory obligations. We will make every reasonable effort to notify you before doing so, unless we are legally prevented from doing so.
In cases where the transmission of personal data to the above entities involves an international transfer of personal data (i.e., outside the European Union), Morais Leitão:
(i) carry out such transfer on the basis of an adequacy decision by the Commission, pursuant to which the country or international organisation in question guarantees a level of protection of personal data equivalent to that provided by European Union law; or
(ii) in the absence of an adequacy decision by the Commission, ensure that such data transfers are carried out in strict compliance with the legal provisions and that appropriate safeguards are implemented to ensure the protection of personal data. In this context, Morais Leitão undertakes to sign the Standard Contract Clauses approved by the Commission.
You can consult the existing adequacy decisions at www.eur-lex.europa.eu.
5. Is your personal data safe?
Morais Leitão has a very strict security policy, from a technical and organisational point of view, in order to protect personal data against destruction, loss, alteration, unauthorised disclosure or access and against any other form of unlawful or abusive processing, including:
- Pseudonymisation and encryption of personal data
- Measures to ensure confidentiality, integrity, availability and resilience of systems and services
- Measures to enable the timely restoration of availability and access to personal data in the event of security incidents
- Additional security measures for access to computer systems.
The technical and organisational security measures created and implemented by Morais Leitão are also required of Morais Leitão's service providers who may process personal data on its behalf.
If you have any questions in this regard, would like more details about our data security or are aware of any improper situation, please contact us through any of the channels listed in point 9 below.
6. What rights do you have as data subject?
As a data subject, you have the following rights:
Right of access
At any time, you may request confirmation as to whether Morais Leitão processes your data, access to your personal data and information about its processing.
You may also obtain a copy of the personal data subject to processing.
Right to rectification
If your personal data is incorrect or incomplete, you may request that it be rectified or completed.
Right to erasure
In certain situations, you have the right to request the erasure of your personal data.
This right may be limited in certain situations, such as when the processing of the data is necessary for compliance with legal obligations to which Morais Leitão is subject, or when such processing is necessary for the purposes of declaring, exercising or defending a right in legal proceedings.
Right to restriction of processing
In certain situations, you may request Morais Leitão to restrict access to personal data or to suspend processing activities. This will happen, for example, if you contest the accuracy of your personal data, for a period of time that allows Morais Leitão to verify its accuracy, or if you have objected to the processing, until it is verified whether the legitimate interests of Morais Leitão or a third party prevail over yours.
Right to data portability
In cases where the processing of data is based on a contract to which you are a party or on your consent, you may request Morais Leitão to provide you with the data you have supplied in a structured, commonly used and machine-readable format. You may also ask Morais Leitão, where technically possible, to transmit this data to other data controllers.
Right to object
When the processing of data is based on the legitimate interest of Morais Leitão or when it is carried out for purposes other than those for which the data was collected, but which are compatible with those purposes, you have the right to object to the processing of your personal data for reasons related to your particular situation.
In such cases, Morais Leitão will no longer process your personal data, unless it has legitimate reasons for doing so and these reasons override your interests.
Right not to be subject to automated individual decisions
Morais Leitão does not adopt automated individual decisions, including profiling, which produce legal effects concerning you or similarly significantly affect you.
Right to withdraw consent
In cases where data processing is carried out on the basis of your consent, you may withdraw your consent at any time.
If you withdraw your consent, your personal data will no longer be processed, unless there is another legal basis for such processing.
Right to lodge complaints with the supervisory authority
You have the right to lodge complaints with the competent supervisory authority regarding matters related to the processing of your personal data.
In Portugal, the competent supervisory authority is the National Data Protection Commission.
For more information, please visit www.cnpd.pt.
Morais Leitão warns that the exercise of the above rights may be limited due to the existence of rights and freedoms of third parties, legal or confidentiality obligations, and the prevailing legitimate interests of Morais Leitão or a third party.
When personal data is processed for statistical purposes, the rights of access, rectification, restriction of processing and objection are limited to the extent necessary if these rights are likely to render impossible or seriously impair the achievement of those purposes.
Morais Leitão may request specific information for the exercise of the above rights in order to confirm the identity of the data subject. This request is a security measure to ensure that personal data is not shared with persons who are not entitled to access it. Morais Leitão may contact the data subject to request information related to the request made in order to speed up the response to such request.
7. How can you exercise your rights?
You can exercise your rights through any of the following channels:
- Email: to the email address privacidade@mlgts.pt; or
- Letter: addressed to Martim Krupenski, Morais Leitão, Galvão Teles, Soares da Silva & Associados - Sociedade de Advogados e Consultores, SP, RL. Rua Castilho, 165, 1070-050 Lisbon.
Morais Leitão will act in a timely manner and in accordance with applicable laws and regulations. Morais Leitão will endeavour to respond to legitimate requests within one month. However, occasionally, the response may take longer when the request is particularly complex or when several requests have been made. In such cases, Morais Leitão will inform you and keep you updated.
The exercise of your rights is free of charge. However, Morais Leitão may charge a reasonable fee or refuse the request if it is manifestly unfounded, repetitive or excessive.
8. How can you contact us?
If you have any questions or require further information regarding the processing of personal data or your rights as a data subject, please contact us through the channels indicated in point 7 above.
9. How can you stay informed on the processing of personal data?
This Privacy Policy may be updated, so Morais Leitão advises you to consult this Policy regularly.
It is important that your personal data is accurate and up to date. We therefore ask you to keep us informed of any changes to your personal data during the course of your relationship with Morais Leitão.
For more information on the processing of personal data, please consult the "Cookie Policy" in the Terms and Conditions on our website.
[1] Prior consent will be requested from the data subject in cases where the event is recorded, either in sound or image, or where photographs are taken.
Addendum A (Singapore)
If you reside in Singapore, in addition to the above, the following applies to the processing of your personal data in accordance with the Personal Data Protection Act (PDPA):
9.1. What specific rights apply in Singapore?
Data subjects in Singapore have the following additional rights:
- Response time for requests: ML undertakes to respond to requests for access, correction or withdrawal of consent within a maximum of 30 working days;
- Access fees: A reasonable fee may be charged for access requests, in accordance with the PDPA;
- Withdrawal of consent: Withdrawal of consent must be made in writing and may have an impact on the employment contract. ML undertakes to assess and inform the legal consequences within 30 working days.
9.2. What personal data does Morais Leitão process, to whom does it relate and how is it collected for the Singapore market?
The collection, use and disclosure of personal data in Singapore comply with the PDPA. Morais Leitão may collect your personal data directly or through authorised third parties, with your consent, or in situations provided for in applicable law.
In addition to the personal data already provided, Morais Leitão may collect, use and disclose the following specific data in Singapore, in accordance with the PDPA:
Legal information related to the contracted service
This data may be collected through direct interactions (e.g. online forms, emails or telephone calls) or from public sources and duly authorised business partners.
9.3. How does Morais Leitão transfer your personal data?
Morais Leitão may only transfer personal data outside Singapore with your express consent. Before any international transfer, you will be informed of the destination and purpose of the transfer.
We have adopted appropriate technical and organisational measures to ensure that your personal data remains protected, ensuring that the recipient applies a level of protection equivalent to that required by the PDPA.
9.4. How can you contact the Data Protection Officer (DPO)?
You can contact our data protection officer in Singapore if you have any questions about our personal data protection policies and procedures. Our DPO is available to answer questions, receive requests to exercise rights or any questions related to the processing of personal data
Name: SIOW WEN LON, KEN
Contact number: +65 6631 9890
Email address: dpo@heysara.sg
Address: 111 North Bridge Road
9.5. How will updates to this Policy be communicated?
This Policy will be reviewed periodically to ensure compliance with the PDPA. Any changes will be communicated through our official channels, including our website and direct notifications to customers, where applicable.
Public Document
26/06/2025