Privacy Policy

1. Data controller

The controller of the data collected on this website is Dr. Ricardo Garcia, lawyer, with offices at Rua Raul Proença, n.º 19 R/C, 2500-248 Caldas da Rainha, Portugal (“Garcia Advocacia & Assessoria Jurídica”).

For any matter relating to your data, write to [email protected].

2. What data we process

When you contact us (form, email, phone or WhatsApp): name, contact details, country, the area of your matter and what you describe, including any documents you choose to send.

When you browse: the server logs technical data (IP address, date and time, page requested) for security and operation of the website. Audience measurement is only enabled if you accept it in the cookie notice.

Please do not send health data or other sensitive data in your first message unless necessary. If it is necessary for your case, it will be handled with additional care.

3. Purposes and legal basis

Replying to your request and assessing the case: pre-contractual steps at your request (Art. 6(1)(b) GDPR).

Providing the legal services engaged: performance of the engagement (Art. 6(1)(b)).

Complying with legal obligations, including tax obligations and those arising from the Portuguese Bar Statute and anti-money laundering rules (Art. 6(1)(c)).

Website security and defence of rights: legitimate interest (Art. 6(1)(f)).

4. Professional secrecy

All information you provide in a consultation or engagement is covered by the lawyer’s professional secrecy under the Portuguese Bar Statute.

5. Who receives the data

Data is not sold or shared for commercial purposes. It may be processed by providers who support us (website hosting, email service), bound by contract and only for that purpose, and disclosed to courts, authorities or partner colleagues when necessary for your case and with your knowledge.

Brevo (Sendinblue SAS, France): sends form requests to the firm and the acknowledgement of receipt. Resend (Plus Five Five, Inc., USA): only used if Brevo fails, under the European Commission’s standard contractual clauses.

Google (Google Ireland Limited): reCAPTCHA v3 protects the form against bots (legitimate interest in website security); Google Analytics 4 only runs if you accept audience measurement; Google Maps only loads if you click the map button.

The reviews shown on the website are loaded from Google through the Trustindex service (Hungary).

DIX7, the agency that maintains the website, only receives technical notices without personal data (for example, “a request arrived” or “sending failed”). It never receives the content of requests.

6. How long we keep data

Requests that do not lead to an engagement: up to 12 months after the last contact. Clients: for the duration of the engagement and the legal retention periods applicable to lawyers and tax obligations.

Technical form records (IP address, anti-spam counters, a backup of a request whose sending failed and the log for the weekly summary to the firm): 30 days at most, stored outside the public part of the server.

7. Your rights

You may request access, rectification, erasure, restriction or portability, or object to processing, by writing to [email protected]. We reply within one month.

You may also lodge a complaint with the Portuguese data protection authority, CNPD (www.cnpd.pt).

8. Changes

This policy may be updated. The date of the last update is shown at the top of the page.