Privacy Policy

1. Data controller and data protection officer

The controller responsible for the processing of your personal data is T. S. FUSTINONI SOCIEDADE INDIVIDUAL DE ADVOCACIA (FUSTINONI ADVOCACIA), registered under CNPJ No. 54.489.975/0001-54, with its registered office at Rua Amaro de Morais, 233, anexo 231, Vila Sabrina, São Paulo/SP, CEP 02138-070.

The data protection officer (DPO) is responsible for handling data subject requests and for ensuring compliance with the obligations set forth in the LGPD. To exercise your rights or clarify any questions about the processing of your data, please contact us at: contato@fustinoni.adv.br.

2. Personal data processed and the purposes thereof

We process only the data necessary for the specific purposes indicated below. We do not collect data beyond what is described in this Policy.

• Contact and request form: we collect name, telephone number, email, a brief description of the matter (free-text field), browsing language, and the source of the visit (campaign or advertisement). This data is used to respond to the inquiry, conduct an initial screening, and carry out preliminary procedures for the eventual provision of legal services. The data subject should not include more information than strictly necessary; should the data subject voluntarily include sensitive data, it will be processed with the same care and confidentiality, on the basis of Articles 7, V and IX, and 11 of the LGPD.
• Legal newsletter: we collect email, name (optional), areas of law of interest, and the record of consent. The purpose is to periodically send informative legal content exclusively to those who have opted to receive it, by means of double confirmation (double opt-in). Unsubscription may be requested at any time through the link present in all emails.
• Browsing and cookies: through the Google Ads (gtag) tools, we collect cookies, session and conversion identifiers, IP address, and technical data of the device and browser. The purpose is exclusively to measure the effectiveness of campaigns and conversions. The firm does not engage in remarketing or target advertisements based on personal characteristics or sensitive situations of the user.
• WhatsApp buttons: by clicking on the WhatsApp buttons present on the website, you are redirected to Meta Platforms' application. From that redirection onward, the communication also becomes governed by WhatsApp's Privacy Policy, and the data exchanged through that channel is subject to the control of Meta Platforms, outside the scope of this firm's direct control.

3. Legal bases for processing (LGPD)

All data processing carried out by this firm is based on one of the legal bases provided for in the LGPD (Art. 7 and Art. 11). The bases applicable to each type of data are as follows:

• Contact and request form data: performance of preliminary procedures relating to an eventual contract, at the request of the data subject (Art. 7, V); and the firm's legitimate interest in responding to inquiries, conducting initial screening, and managing its legal practice (Art. 7, IX, subject to Art. 10 of the LGPD). The regular exercise of rights in judicial, administrative, or arbitration proceedings (Art. 7, VI) may be invoked when the processing arises from a judicial or extrajudicial demand already initiated.
• Newsletter: the data subject's free, informed, unequivocal, and specific consent, provided through the double-confirmation process (Art. 7, I), revocable at any time.
• Measurement and advertising cookies (Google): the data subject's consent (Art. 7, I), which may be managed or revoked in the browser settings or through Google's opt-out tools.
• Sensitive data that may be voluntarily provided by the data subject in the form: the data subject's specific and highlighted consent (Art. 11, I); or, where the processing is indispensable for the firm's regular exercise of a right, the hypothesis of Art. 11, II, item 'd', of the LGPD.
• Compliance with legal and regulatory obligations, including those inherent to the practice of law (the OAB Statute, CFE/OAB regulations, and other applicable rules): legal obligation (Art. 7, II).

4. Cookies and tracking technologies

Our website uses two types of cookies:

Strictly necessary cookies: indispensable to the basic functioning of the website, such as security, session control, and language preferences. They do not require consent, as they do not involve collection for marketing or profiling purposes.

Measurement and advertising cookies: these are Google's cookies (Google Ads (gtag)), which collect information about your interactions with the website to measure the performance of campaigns and conversions. These cookies are activated upon your consent. You may manage, limit, or refuse them at any time in your browser's privacy settings or through the opt-out tools made available by Google (https://adssettings.google.com). Refusal of measurement cookies does not prevent the use of the website.

5. Data sharing with third parties

The firm does not sell, assign, or share personal data for the commercial purposes of third parties. Sharing occurs exclusively with the processors listed below, to the extent strictly necessary for the provision of their services, and always under a contractual obligation of confidentiality and compliance with the applicable data protection legislation:

• Vercel: hosting and delivery of the website; it also provides aggregated, anonymized usage metrics (Vercel Analytics) without personal-identification cookies.
• Cloudflare: security, protection against attacks, and content delivery (CDN). Cloudflare acts as a sub-processor in handling the website's traffic, including visitors' IP addresses, with servers located outside Brazil.
• Google: measurement of campaigns and conversions through Google Ads.
• Supabase: storage of the data originating from the contact form.
• Resend: platform for sending the newsletter emails.
• Meta Platforms / WhatsApp: when the visitor chooses to initiate a conversation through the WhatsApp button available on the website, the conversation data becomes subject to Meta Platforms' policies.

6. International data transfers

The processors listed in the previous section may process personal data on servers located outside Brazil, including the United States of America. These international transfers are carried out on the basis of the safeguards provided for in Art. 33 of the LGPD, notably through standard contractual clauses and/or based on the adequacy of the level of protection recognized by the National Data Protection Authority (ANPD).

The firm exercises due diligence in selecting its processors and contractually requires that the data be processed with a level of protection equivalent to that required by Brazilian legislation.

7. Data retention and deletion

Personal data is retained for as long as necessary to fulfill the purposes for which it was collected, subject to the applicable legal time limits, including the document retention obligations inherent to the practice of law.

Contact form data that does not result in the engagement of services is deleted or anonymized when it is no longer necessary for the described purposes. Newsletter data is retained until the data subject unsubscribes. Browsing data and cookies are subject to the retention policies of the respective processors (Google, Cloudflare, and Vercel).

8. Rights of the data subject (Art. 18 of the LGPD)

You, as a personal data subject, have the following rights, which may be exercised at any time by submitting a request to contato@fustinoni.adv.br:

• Confirmation of the existence of processing of your personal data.
• Access to the personal data we hold about you.
• Correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion of unnecessary or excessive data or data processed in non-compliance with the LGPD.
• Portability of your data to another service or product provider, upon express request and subject to the regulations of the ANPD.
• Deletion of data processed on the basis of your consent.
• Information about the public and private entities with which we share your data.
• Information about the possibility of not providing consent and about the consequences of such refusal.
• Revocation of consent at any time, without prejudice to the lawfulness of the processing previously carried out on that same legal basis.
• The right to file a complaint with the National Data Protection Authority (ANPD) in the event of non-compliance with data protection legislation.

9. How to exercise your rights

To exercise any of the rights listed above, send a request to contato@fustinoni.adv.br, identifying yourself and describing the right you wish to exercise. We will respond within up to 15 (fifteen) days, as provided for in Art. 18, § 3, of the LGPD.

We may request additional information to confirm your identity before processing the request, as a security measure and for the protection of the data subject.

10. Information security

We adopt appropriate technical and administrative measures to protect personal data against unauthorized access and accidental or unlawful destruction, loss, alteration, communication, or dissemination, in compliance with Art. 46 of the LGPD.

In the event of a security incident that may result in significant risk or harm to data subjects, we will report the matter to the ANPD and to the affected data subjects within the legal time limit, in accordance with Art. 48 of the LGPD and ANPD Board Resolution No. 15/2024, with the necessary information regarding the nature of the data involved, the related risks, and the measures adopted for mitigation.

11. Applicable law and jurisdiction

This Privacy Policy is governed by the LGPD (Law No. 13.709/2018), the Brazilian Internet Civil Framework (Law No. 12.965/2014) and, where applicable, the Consumer Protection Code (Law No. 8.078/1990), without prejudice to other relevant regulatory rules, including the resolutions and guidelines of the ANPD.

Any disputes will be submitted to the jurisdiction of the judicial district of the domicile of the law firm FUSTINONI ADVOCACIA, unless otherwise provided by law.

12. Changes to this Policy

This Privacy Policy may be updated periodically to reflect changes in the services offered, in the applicable legislation, or in data processing practices. The version in force is always the one published on this page, identified by the date of last update indicated at the beginning of the document.

We recommend that you review this Policy regularly. Significant changes will be communicated in an appropriate manner, including to newsletter subscribers when the processing related to that data is affected.