BAS’s Privacy Policy is based on the utmost respect for the privacy and protection of the personal data of all those who entrust us with this valuable asset.
BAS processes all personal data in strict compliance with the General Data Protection Regulation (“GDPR”), as well as all other applicable data protection laws.
In particular, BAS’s processing of personal data is governed by the following principles: lawfulness, fairness, and transparency in data processing; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability.
Through this Privacy Policy, BAS sets forth the terms and conditions governing its processing of personal data, as well as the procedures for exercising the rights granted to data subjects under the applicable legal framework.
- Who is responsible for processing the data?
BAS Sociedade de Advogados, SP RL, legal entity number 509100007, with its headquarters at Rua Artilharia Um, 52, Páteo Bagatela, Building 1, 4th floor, 1250-137 Lisbon, T. +351 211 554 330, F. +351 211 554 350, geral@bas.pt, is the entity responsible for processing personal data collected through the website.
- What data is processed, and how is it collected?
BAS collects only data that is appropriate, relevant, and limited to what is strictly necessary for the purposes for which it is processed, namely:
a) Customers, customers’ employees, counterparties, suppliers, partners, and workers: identification, professional, employment, or accounting data—either their own, in the case of individuals, or that of their representatives, in the case of legal entities—such as name, nationality, contact information, national ID card details, job title, duties, professional contacts, and any personal data whose processing is strictly necessary for the performance of a contract or to comply with legal obligations;
b) Contact requests: identifying information such as name, email address, and phone number;
c) Newsletter subscription: identifying information such as an email address;
d) Applications: identifying information such as name, email address, and any information contained in resumes.
Personal data is collected through various means, including by filling out forms on the BAS website, sending emails, making phone calls, submitting a business card, requesting quotes, submitting job applications, and contracting services from or through BAS.
BAS may process health data only in connection with the provision of legal services, provided it has been duly authorized to do so and only with the consent of the data subjects.
- What is the legal basis for processing personal data, and for what purposes is it processed?
BAS processes personal data only when there is a legal basis for doing so.
The legal basis for processing the personal data of customers, suppliers, partners, and employees is the performance of a contract and compliance with legal obligations, as provided for in Article 6(1)(b) and (c) of the GDPR.
The processing of personal data belonging to clients, clients’ employees, counterparties, suppliers, partners, and employees is intended for any purposes directly related to the performance of the respective contracts or to compliance with legal obligations, including, but not limited to, recruitment, hiring, contract management, project management, accounting, business activities, client management, communication, submitting proposals, and providing legal services.
The processing of personal data for purposes other than those mentioned above—specifically, personal data collected through the BAS website or as a result of emails sent requesting contact—is subject to the consent of the data subjects, as provided for in Article 6(a) of the GDPR.
The processing of personal data collected through BAS’s website or email address is intended to respond to contact requests, including sending proposals/quotes and other information about services, sending marketing communications such as newsletters, service updates, technical articles, information about events or other related activities, and recruitment.
- To whom is personal data disclosed?
BAS only discloses personal data to third parties when such disclosure is necessary for the provision of legal services or to comply with legal obligations to which BAS is subject, namely counterparties, judicial and regulatory authorities, and other public entities, agents, and BAS service providers, such as information technology, communications, translation, and archiving providers, who are selected based on strict criteria and are bound to comply with applicable legal standards regarding the protection of personal data.
When the transfer of data is necessary to provide legal services, to comply with legal obligations to which BAS is subject, or as a result of the data subject’s consent, the data transferred is limited to what is strictly necessary to fulfill such obligations and is carried out with appropriate security measures in place. Personal data will not be disclosed in any other circumstances without the data subject’s consent.
- How long is personal data retained?
BAS retains personal data in a form that allows for the identification of data subjects only for the period strictly necessary to fulfill the purposes for which it is processed, without prejudice to the need to retain it for longer periods to comply with legal obligations.
In particular, and without prejudice to the exercise of the right to erasure, personal data is erased after:
a) For contact requests: 6 months from the date the request was submitted, provided there has been no subsequent contact;
b) In the case of personal data collected through newsletter subscriptions: 2 years from the date consent is obtained;
c) In the case of personal data collected from job applications: 1 year from the date of submission, if the applicant is not selected.
- What are the rights of data subjects?
Data subjects have the right, at any time, to withdraw their consent—without affecting the lawfulness of processing carried out on the basis of previously given consent—to request access to their personal data, as well as its rectification or erasure, and to restrict processing, and to request data portability, when permitted by law and contract.
To exercise their rights, data subjects should send an email to geral@bas.pt.
Data subjects also have the right to lodge complaints with the competent authority for this purpose.
- How is data security guaranteed?
BAS adopts and undertakes to apply the appropriate technical and organizational measures at any given time to safeguard that processing is carried out in accordance with the GDPR, taking into account the nature, scope, context and purposes of the data processing, as well as the risks to the rights and freedoms of natural persons, the likelihood and severity of which may vary.
The measures mentioned are updated whenever necessary and reviewed annually.
BAS may update this Privacy Policy, so it is advisable to consult this Policy regularly.
