PRIVACY POLICY
FELIPE ALEXANDRE ADVOGADOS ASSOCIADOS
1. PURPOSE AND SCOPE
This Privacy Policy explains how the firm Felipe Alexandre Advogados Associados, CNPJ No. 28.899.181/0001-59, OAB/DF No. 4028-17-R.S., hereinafter referred to as the Firm, processes personal data on the institutional page and in the legal services related thereto. The page is available at https://www.felipealexandre.adv.br. Its application observes Law No. 13.709/2018, Brazil's General Data Protection Law (LGPD).
The document covers visitors, interested parties, clients, representatives and family members whose data are necessary for the analysis or handling of the legal matter. The public page has a contact request form, without document upload or authenticated area. Contact also occurs via external WhatsApp, phone and email links; the sending of documents must occur through the channels indicated by the team.
2. IDENTIFICATION OF THE CONTROLLER
The data controller for the purposes described herein is Felipe Alexandre Advogados Associados, registered under CNPJ No. 28.899.181/0001-59 and with the OAB/DF under No. 4028-17-R.S., with its address at Complexo Brasil 21, Tower E, rooms 405/406, Quadra 6, Setor Hoteleiro Sul, Asa Sul, CEP 70316-000, Brasília/DF.
The institutional channel for privacy questions and requests is contato@felipealexandre.adv.br, with the subject “Privacy and Data Protection”. The data protection officer (encarregado) is Felipe da Silva Cunha Alexandre, OAB/DF No. 41.028. The service procedures are described on the Privacy and Data Protection page.
3. DATA PROCESSED AND ITS SOURCES
In the initial contact, name, email, phone, preferred language and essential information about the request and, when relevant to the service, nationality and country of residence may be processed. The necessary documentation is defined according to the service requested, avoiding the prior collection of information that is not useful for the analysis. Personal and business documents, certificates, contracts, reports and documents of dependents must be sent through the channels indicated by the team, after guidance on their necessity.
On the institutional page, the contact request uses name, email, phone number with country and area code, subject and an optional brief message to allow the team to respond. Please avoid entering sensitive information, documents or health details in this first contact. Submission does not constitute a confirmed appointment or engagement.
In the provision of services, processing may cover identification documents, CPF or CNPJ, certificates, parentage, family ties, addresses, professional, academic, asset, tax and financial data, corporate acts, criminal records, powers of attorney, contracts and judicial and administrative proceeding documents and, in immigration matters, passport, migration registration and CRNM, photographs and migration history. Not all of this set is indiscriminately requested: the requirement depends on the nature of the matter and the contracted service.
Data may be provided by the data subject, by an authorized representative or by a person linked to the case, as well as obtained from documents, public records and competent authorities, when necessary and legally permitted. The public origin of the information does not remove the duty of protection.
Access to the website involves communicating the IP address and technical browser information to the hosting infrastructure. The browser stores privacy choices locally, through the fa_lp_consent_v3 key, valid for 180 days. Google Analytics and Google Ads are configured to operate only on authorized domains and after specific consent for the respective category, with no loading of the tools before such authorization. The terms of use of these technologies are described in the Cookie Policy and Cookie Settings.
4. PURPOSES AND LEGAL BASES FOR PROCESSING
For non-sensitive personal data, responding to requests, initial assessments, and pre-contractual measures requested by the interested party rely on Article 7 of the LGPD, under the legal basis of contract execution or preliminary procedures requested by the data subject. This basis covers document organization, communication regarding the case, and the performance of the contracted service, when the data subject is a party to the contractual relationship.
Compliance with tax, professional and legal retention obligations is based on the legal or regulatory obligation of art. 7º of LGPD. Processing necessary for representation in judicial, administrative and arbitral proceedings, including visa, residence permit or nationality proceedings, and for the defense of rights is based on the regular exercise of rights in administrative, judicial or arbitral proceedings, as applicable.
The prevention of abuse and the security of digital environments may rely on legitimate interest, under arts. 7º and 10 of LGPD, subject to a documented assessment of purpose, necessity, and balance with the rights of the data subject. This hypothesis does not apply to sensitive data nor does it authorize the use of clients' documents for purposes incompatible with service provision.
Optional informational communications and non-essential cookies, when provided, depend on specific consent, under Arts. 7, 8, and 9 of the LGPD. Reading this Policy, sending an inquiry, or browsing the site does not constitute blanket authorization for other purposes. Legal assistance will not be conditioned on authorization for advertising or optional communications.
The legal basis will also be verified for the data of family members, employers, representatives, and other persons mentioned in the case. Engagement by a client does not, by itself, authorize the unrestricted processing of third-party data. When specific data is indispensable for analysis or filing, its necessity and the consequences of not providing it will be explained to the individual concerned.
5. SENSITIVE DATA AND PROTECTION OF CHILDREN AND ADOLESCENTS
Health documents, biometric records, and documents revealing racial or ethnic origin, religious conviction, or other sensitive information will only be processed when necessary for the case and supported by a specific legal basis under Art. 11 of the LGPD. Depending on the operation, compliance with a legal obligation, the regular exercise of rights—including in contracts or lawsuits—or specific and highlighted consent may serve as the basis for processing. Contract performance provided for in Art. 7 and legitimate interest do not replace this analysis.
In cases involving children and adolescents, especially in custody, child support, succession, family reunification and nationality, their best interests will prevail. Representation or assistance powers will be verified and an appropriate legal basis used; when the basis is consent for a child’s data, it will be specific and highlighted, provided by at least one parent or legal guardian. General site channels are primarily intended for adults and representatives. Art. 14 of LGPD and CD/ANPD Statement no. 1/2023. apply.
6. PROFESSIONAL CONFIDENTIALITY AND SHARING
Information learned in the practice of law is protected by professional confidentiality. Internal access must be restricted to professionals who need the data for their duties, including during the initial assessment of the matter, even if it does not result in engagement. Law No. 8.906/1994 (the Statute of the Legal Profession and the OAB) and Arts. 35 to 38 of the OAB Code of Ethics and Discipline, approved by CFOAB Resolution No. 02/2015, apply.
Sharing may occur, to the extent necessary for the case, with judicial bodies, the Public Prosecutor's Office, tax, oversight and other public administration bodies, courts of accounts, police authorities, consular authorities, the Ministry of Foreign Affairs, the Ministry of Justice and Public Security, the Federal Police, notaries, mediation and arbitration chambers, experts, accountants, public translators, interpreters, correspondents and professionals who legitimately participate in the execution of the service.
The service uses Google Workspace for corporate email, calendar and cloud storage, as well as WhatsApp, a commercial service platform, a ticketing system, case control, legal management software and immigration advisory software. These environments are distinct from the public page. Providers and professionals must receive only the data necessary for their role. Each agent’s responsibility arises from their actual actions, without presuming that every supplier is merely a data processor or may freely use the data.
Requests from authorities will be examined regarding their jurisdiction, legal basis, and legal limits, preserving the prerogatives of the legal profession. The compulsory disclosure of application access logs and the content of private communications will observe the requirement of a court order, under the circumstances and conditions of Art. 10 of the Marco Civil da Internet. Administrative access to registration data depends on specific legal authority and does not equate to unrestricted access to logs or communications. This Policy does not constitute a waiver of confidentiality, nor does it authorize the commercialization of data or the advertising disclosure of cases and documents.
7. INTERNATIONAL TRANSFERS
Sending data to professionals or authorities abroad and the storage or access by providers located outside Brazil may constitute international transfers. Each operation must have a defined purpose, a legal basis for processing, and a transfer mechanism permitted by Arts. 33 to 36 of the LGPD and by CD/ANPD Resolution No. 19/2024, as amended. The mere fact that the data subject is a foreign national does not characterize an international transfer.
The use of cloud and communication services may involve storage, processing, or access outside Brazil. Cookie selection does not equate to specific consent for international transfers. The data subject may request information about the recipients and operations related to their data through our privacy channel. The public disclosure obligations and access to contractual guarantees provided in CD/ANPD Resolution No. 19/2024 must also be observed; responding to individual requests does not replace these obligations.
8. RETENTION AND DELETION
Prospective client data will be retained for the period necessary to fulfill the request and for any subsequent negotiation, with a review of its necessity after the contact ends. Client data and case documents may be retained during the provision of services and, subsequently, for as long as there is a retention obligation or a grounded need for the regular exercise of rights.
Retention criteria consider the document category, the conclusion of the service, applicable obligations, and relevant statutes of limitations. The need for retention will be re-evaluated to avoid indefinite retention without justification. Once the purpose has been fulfilled and there is no legal basis for retention, the data will be deleted or anonymized, in accordance with Arts. 15 and 16 of the LGPD. Data in backup copies will remain subject to access restrictions and the applicable disposal cycle; the existence of a copy does not authorize its reuse for an incompatible purpose.
Application access logs subject to Art. 15 of Law No. 12.965/2014 (Marco Civil da Internet) will be kept confidential and in a controlled environment for a period of 6 (six) months, except in the event of valid preservation orders. This period does not apply indiscriminately to client documents, service history, or the validity of cookie consent.
The data subject may request clarification regarding the retention period or criteria applicable to their data. The revocation of consent interrupts future processing that relies on consent, but does not, by itself, invalidate prior lawful processing. Any retention for compliance with a legal obligation or for the regular exercise of rights will depend on its own legal basis and a defined purpose, which will be communicated to the data subject; there will be no automatic substitution of the legal basis to circumvent revocation.
9. SECURITY AND TECHNOLOGICAL RESOURCES
Personal and business documents, passports, certificates, powers of attorney, contracts, family documents and other case information must receive protection commensurate with the risks, including access restriction by role, credential management and control of sharing with service providers. Incidents will be assessed and handled under arts. 46 to 49 of LGPD and ANPD Board Resolution No. 15/2024, with notification to the ANPD and to the data subjects when the legal requirements are met and within the applicable deadlines.
Automation or artificial intelligence resources, when used in support activities, must observe necessity, confidentiality, and professional supervision. This Policy does not authorize the indiscriminate sending of documents to external tools or their use for training models with purposes incompatible with the service.
10. DATA SUBJECT RIGHTS
The data subject may request confirmation of processing, access, correction of incomplete, inaccurate, or outdated data, and information about the entities with which data sharing has occurred. They may request the anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in noncompliance with the LGPD, as well as the deletion of data processed with consent, subject to the exceptions of Art. 16. Portability will observe applicable regulations and commercial and industrial secrets, and will not cover data that has already been anonymized.
The data subject may revoke consent, obtain information about the possibility of not providing it and its consequences, and object to processing carried out without consent in violation of the LGPD. When a decision is made solely based on automated processing that affects their interests, they may request its review and clear information about the criteria and procedures used, safeguarding commercial and industrial secrets. Arts. 18 to 20 of the LGPD apply.
Requests are free of charge and may be submitted through the channel indicated in this Policy. The response will observe the rights of third parties, professional secrecy and the legal grounds for retention. Any impossibility of compliance will be explained. Corrections, deletions, anonymizations or blockings will be immediately communicated to the agents with whom the data have been shared so that they repeat the procedure, except when such communication is demonstrably impossible or entails a disproportionate effort, under art. 18, § 6º. The data subject retains the right to petition the ANPD and to seek other legally available remedies.
11. ASSISTANCE AND UPDATES
To protect the data subject, information proportionate to confirm identity or representation may be requested, without indiscriminately requiring document copies. The procedures and response times are presented on the Privacy and Data Protection page.
This Policy takes effect upon its publication. Relevant changes will be disclosed in an accessible manner and, when required, communicated to the data subjects. New purposes dependent on consent will be subject to a specific choice before they are carried out.
12. APPLICABLE RULES
This Policy is based on Law No. 13.709/2018 (LGPD), Law No. 12.965/2014 (Brazilian Civil Rights Framework for the Internet), Decree No. 8.771/2016 and ANPD Board Resolutions No. 15/2024, No. 18/2024 and No. 19/2024, according to the regulated subject matter. Good faith and professional duties also comply with Law No. 10.406/2002 (Civil Code), Law No. 8.906/1994 and the OAB Code of Ethics and Discipline, as amended.
