Privacy policy

Ferraz Ivamoto e Furlan Sociedade de Advogados (the “Firm”), acting as Data Controller of the personal data processed through this institutional website, hereby establishes this Privacy Policy, in compliance with Law No. 13,709/2018 (Brazilian General Data Protection Law – “LGPD”).

1. SCOPE
This Privacy Policy (“Policy”) applies exclusively to visitors and users of the Firm’s institutional website, including individuals who fill out contact forms or request information about the services offered (“Data Subjects”).
This website is institutional in nature and does not provide a client login area, client portal, or any other environment granting access to information about cases, proceedings, or legal opinions handled by the Firm. Data relating to clients and parties in connection with the Firm’s professional practice is not processed through this website and is not covered by this Policy.

2. APPLICABLE LEGISLATION
This Policy is governed by applicable Brazilian legislation, in particular Law No. 13,709/2018 (Brazilian General Data Protection Law) and Law No. 12,965/2014 (Brazilian Internet Civil Rights Framework – “Marco Civil da Internet”).

3. DEFINITIONS
• Data Subject: a natural person to whom the personal data subject to processing relates;
• Personal Data: information related to an identified or identifiable natural person;
• Sensitive Personal Data: personal data concerning racial or ethnic origin, religious belief, political opinion, membership in a trade union or religious, philosophical or political organization, data concerning health or sex life, genetic or biometric data;
• Processing: any operation carried out with personal data, such as collection, use, access, storage, and elimination;
• Controller: the party responsible for decisions regarding the processing of personal data;
• Processor: the party that carries out the processing of personal data on behalf of the controller;
• Data Protection Officer (DPO): the person appointed to act as the communication channel between the Controller, the Data Subjects, and the Brazilian National Data Protection Authority (“ANPD”).

4. PERSONAL DATA COLLECTED
Through this website, the Firm collects exclusively the data voluntarily provided by the Data Subject when filling out the contact form available on the website, such as name, e-mail address, phone number, and the content of the message sent.
We do not collect sensitive personal data through this website, as defined under Article 5, item II, of the LGPD.
In addition, the website may automatically collect browsing data (such as pages accessed and device/browser information), as further detailed in Section 9 (Cookies) and Section 10 (Tracking and International Data Transfer) of this Policy.

5. PURPOSE AND LEGAL BASIS FOR PROCESSING
Data provided through the contact form is processed for the purpose of responding to the Data Subject’s requests, providing information about the Firm’s services, and enabling business contact, based on the Firm’s legitimate interest (Article 7, item IX, of the LGPD), with due regard for the Data Subject’s fundamental rights and freedoms.
Where required by law, processing may also be based on the Data Subject’s consent (Article 7, item I, of the LGPD), which may be revoked at any time by request through the channel indicated in Section 7.

6. RIGHTS OF THE DATA SUBJECT
Pursuant to Article 18 of the LGPD, the Data Subject has the right to, upon request:
• confirmation of the existence of processing of their personal data;
• access to their personal data;
• correction of incomplete, inaccurate, or outdated data;
• anonymization, blocking, or elimination of unnecessary or excessive data, or data processed in violation of the law;
• portability of data to another service or product provider, upon express request;
• elimination of data processed based on consent, except where legal retention grounds apply;
• information about the public and private entities with which the Firm has shared data;
• information about the possibility of not providing consent and the consequences of refusal;
• revocation of consent, where consent is the applicable legal basis;
• filing a complaint with the National Data Protection Authority (ANPD).
We do not process personal data collected through this website by means of automated decisions that affect the Data Subject’s interests.
Requests relating to confirmation of the existence of processing and access to personal data will be answered within 15 (fifteen) days of the request, pursuant to Article 19 of the LGPD, and this period may be extended for an equal period upon express justification.

7. CONTACT CHANNEL WITH THE DATA PROTECTION OFFICER (DPO)
To exercise the rights set forth in this Policy, the Data Subject may contact the Firm’s Data Protection Officer through the following channel:
E-mail: mprado@fifsa.com.br
Responsible: Mirian Regina Passarelli Prado

8. SECURITY MEASURES
The Firm adopts technical and administrative measures designed to protect personal data from unauthorized access and from accidental or unlawful destruction, loss, alteration, communication, or disclosure, in accordance with Article 46 of the LGPD.
Any security incident that may pose a relevant risk or damage to Data Subjects will be reported to the ANPD and, where applicable, to the affected Data Subjects, pursuant to Article 48 of the LGPD.

9. COOKIES
Cookies are small files stored on the user’s device that record information about preferences and browsing activity, providing greater convenience when using the website.
Cookies strictly necessary for the website’s operation are used regardless of prior consent, as they are essential for browsing. Non-essential cookies (performance, functionality, or advertising cookies), when used, will require the user’s specific consent, obtained through a dedicated preference management mechanism (“cookie banner”), independent of acceptance of this Policy.
Users may, at any time, manage or disable cookies directly through their browser settings, provided that disabling strictly necessary cookies may affect the operation of the website.

10. TRACKING AND INTERNATIONAL DATA TRANSFER
This website may use third-party tools for traffic analysis, audience measurement, and social media integration (such as, by way of example, Google Analytics, Google Ads, Meta Ads/Pixel, LinkedIn Insight Tag, and similar tools), which may involve the processing of browsing data on servers located outside Brazilian territory, including in the United States.
In such cases, processing will observe the safeguards set forth in Articles 33 to 36 of Law No. 13,709/2018, and such transfers will be carried out on the basis of the contractual clauses and data protection policies adopted by the respective providers.

11. SHARING OF PERSONAL DATA
Data collected through the contact form is not sold or transferred to third parties for commercial purposes. It may be shared exclusively with service providers engaged by the Firm to enable the website’s operation (Processors, as defined in Article 5, item VII, of the LGPD), such as hosting providers and e-mail service providers, always limited to the purpose set forth in this Policy.