Privacy Policy

Our commitment

ALC & Associados – Sociedade de Advogados, RL (ALC) is firmly committed to privacy and the rights of data subjects, acting in accordance with the provisions of applicable legislation.

Privacy policy

This Privacy Policy provides you with information regarding the collection and processing of your personal data.

The “data controller” is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data. Unless otherwise notified, ALC acts as the data controller for your personal data.

Data subjects are the natural persons to whom the data relates. We want you to be aware of how ALC processes your personal data, as well as the rights you enjoy as a data subject.

With this Policy, we aim to answer the following questions:

1. What personal data does ALC process, to whom does it relate, and how is it collected?
2. For what purposes and on what legal basis does ALC process personal data?
3. How long do we retain personal data?
4. To whom does ALC disclose personal data?
5. Is personal data secure?
6. What rights do you have as a data subject?
7. How can you exercise your rights?
8. How can you contact us?
9. How can you keep up to date with the processing of personal data?

1. What personal data does ALC process, who does it relate to, and how is it collected?

Personal data is any information relating to an identified or identifiable natural person. A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identification number or to a combination of specific elements relating to their physical, physiological, mental, economic, cultural or social identity. Consequently, this does not include personal data from which the identity has been removed (anonymous data).

Categories of sensitive personal data include information about your philosophical or political beliefs, your party or trade union membership, your religious beliefs, your private life, your race or ethnicity, your sex life and health, including genetic data.

In specific and limited circumstances, ALC collects categories of sensitive personal data, namely when such information is provided to us in the course of providing our services.

ALC may process the following categories of personal data:

a) Identification and contact details (e.g., name, date of birth, gender, address, contact details, identity card details, passport and tax identification number, nationality);

b) Data relating to education and professional experience (e.g., education, qualifications, certifications, languages, CVs, information from former employers);

c) Professional data (e.g., position, role, job description, company, office address);

d) Data relating to professional activity (e.g., business activities, information relating to cases and files, information relating to proceedings);

e) Billing details (e.g., account number and payment card details, fees, travel expenses and communications charged to the customer);

f) Expense and travel data (e.g., dietary requirements, travel booking details, expenses, travel references and vouchers);

g) Image and sound recording data (e.g., photographic and video images);

h) Browsing data (e.g. cookies).

The categories of personal data listed above may relate to different categories of data subjects, such as clients, clients’ employees (companies), counterparties, applicants or ALC alumni.

Collection of personal data

ALC collects personal data through various means and at various times.

Direct collection of personal data: personal data is provided directly by data subjects through direct interactions with ALC. Such direct interactions include, in particular:

• contact via email and telephone and responses to invitations;
• submission of your personal details;
• subscription to our newsletters or events;
• job applications;
• contracting of services.

Indirect collection of personal data: in some cases, ALC may collect personal data indirectly, namely through public sources or clients. Without prejudice to limitations arising from professional confidentiality, other ethical standards and judicial secrecy, when ALC processes personal data it has collected indirectly, it will provide all information relating to the processing of such data to the data subjects at the earliest opportunity.

Where it is necessary to collect personal data due to a legal requirement or under the terms of a contract you have with ALC, and such data is not provided when requested, we may not be able to perform the contract (for example, provide our services). In such situations, ALC may refuse to provide or receive the services, in which case you will be notified, if applicable.

2. For what purposes and on what legal basis does ALC process personal data?

ALC uses personal data for the purposes for which it was collected, as detailed below, unless it reasonably considers it necessary to use the personal data for other purposes and such purposes are compatible with the original purpose.

ALC processes your personal data in strict compliance with the law, where there is a legal basis permitting it. Accordingly, we use your personal data in the following circumstances:

• performance of a contract: when we need to fulfil a contract we have entered into or are about to enter into.
• legitimate interest: where necessary to pursue our interests (or the interests of third parties), provided that your fundamental rights do not override such interests; indeed, before processing your personal data, we ensure that we assess and balance any potential impact on you and your rights.
• legal obligation: when we need to comply with legal or regulatory obligations to which we are subject.
• consent: where you have given us your consent to process your personal data.

ALC may process personal data for the following purposes and on the following legal grounds:

a) To provide legal services, which may include:

• Opening a client file and managing it
• Recording of service proposals submitted;
• Communications with the client, other parties and/or public bodies, including courts; and
• Archiving of documentation in digital and physical formats.

The legal basis, in this case, is the performance of a contract entered into with clients and legitimate interest, specifically:

• ALC’s interest in processing its clients’ information in a sustainable and efficient manner, ensuring its quality and integrity and enabling the provision of excellent services;
• ALC’s interest in processing information relating to counterparties, witnesses and other persons who may be involved in transactions, matters and proceedings in which ALC is involved; and
• The interest of clients represented by ALC in the context of the execution of the mandate and the provision of legal assistance.

b) For communications and the sending of information, including the dissemination of legal information (e.g., newsletters, briefings, legal alerts), in accordance with your preferences.

The legal basis is legitimate interest, specifically:

• To respond to requests from subscribers to forms on the ALC website and tailor the relevant communications;
• To contribute to the development of legal scholarship and play a significant role in the legal profession; and
• Strengthening ALC’s culture and maintaining a close relationship with its alumni.

c) For event management, which includes:

• Sending invitations to events and registering participants; and
• Internal and external promotion of events.

The applicable legal grounds are consent and legitimate interest, specifically (1):

• Responding to requests from subscribers to forms on the ALC website and tailoring communications accordingly;
• Contributing to the development of legal science and playing a significant role in the legal profession community; and
• To publicise events promoted by ALC.

d) For the protection of persons and property, which includes the collection of images via CCTV, once authorisation has been obtained from the Data Protection Agency (“APD”).

The legal basis is legitimate interest, specifically:

• To ensure the protection of persons on ALC’s premises;
• To detect and prevent security incidents;
• To detect and prevent unauthorised access to ALC’s premises and restricted areas;
• Reviewing security incidents, including security training exercises.

e) To comply with legal obligations regarding compliance.

• The legal basis is compliance with a legal obligation.

f) For invoicing and accounting management, which includes:

• Accounting for expenses, cost control and reimbursements (e.g., travel and mobile phone expenses to be borne by customers);
• Invoicing and current account management; and
• Maintenance of accounting records and supporting documentation.

The legal basis is the performance of a contract; compliance with a legal obligation and legitimate interest, specifically:

• Maintain an efficient management system, invoice for services rendered in a timely manner, and ensure compliance with applicable legal obligations.

g) For the submission of cases to legal directories, in accordance with the applicable ethical standards.

The legal basis is legitimate interest, specifically:

• To promote the culture and excellence of ALC and its lawyers.

h) For debt collection and judicial and extrajudicial claims, which includes the collection and recovery of amounts owed by clients.

The legal basis is legitimate interest, specifically:

•  To satisfy its claims and defend its rights.

i) For recruitment and selection, which includes the review of applications and CVs, as well as the internal selection process for lawyers and staff in accordance with identified needs.

The legal bases are pre-contractual measures at the data subject’s request and legitimate interest, specifically:

• Reviewing applications and subjecting candidates to an internal selection process, in accordance with pre-defined criteria.

j) For statistical purposes, which includes the analysis of personal data contained in proposals, with the results of this processing corresponding to aggregated data. This data will be anonymised or pseudonymised, making it impossible to re-identify the data subjects once the statistical operation has been completed.

k) To optimise the browsing experience, which includes the collection of browsing information via cookies.

The legal basis is consent.

3. How long do we retain personal data?

ALC will only retain your data for as long as is necessary to fulfil the purposes set out in this Policy or for as long as required by applicable legal or regulatory standards.

The retention periods for personal data, according to each processing purpose, are as follows:

Purpose of processing > Retention period

• Provision of legal services > Duration of the client-solicitor relationship, plus 20 years, based on limitation periods applicable to certain civil, commercial and criminal liabilities, as well as on the need to safeguard the legitimate interests of ALC and its clients in the event of any litigation, audits or administrative proceedings. This extended period will be reviewed periodically and personal data will cease to be processed for operational purposes once the mandatory minimum legal time limits have been met, and will, wherever possible, be anonymised or pseudonymised.
• Communications and sending of information > Until the data subject objects.
• Event management > 2 years from the date of contact or participation in an event (as applicable), provided there is no further contact or participation in another event by the data subject.
• Protection of persons and property > 30 days.
• Compliance with legal obligations > 10 years, from the time the customer was identified or, in the case of business relationships, from the end of such relationships.
• Invoicing and accounting management > 10 years.
• Submission of cases to legal directories > For the duration of the case or file.
• Debt collection and judicial and extrajudicial claims > Until the outstanding amounts have been paid or the dispute has been resolved, as applicable.
• Recruitment and selection > 2 years from the date of submission of the application or CV, in the event that the candidate is not selected;
• Response to contact requests > Until the request has been dealt with.
• For statistical purposes > For as long as deemed necessary, with appropriate technical and organisational measures in place to safeguard the rights of data subjects.
• For the purpose of optimising the browsing experience > Up to 2 years and
  for the duration of the professional relationship with ALC, in all other cases.

4. To whom does ALC disclose personal data?

ALC does not disclose your personal data to third parties, except where this is necessary for the provision of the services you have contracted or to comply with legal obligations to which ALC is subject.

The transfer of personal data to third parties is carried out in accordance with applicable data protection legislation and within the limits, purposes and legal grounds defined in this Policy.

ALC requires any person or entity to whom it discloses personal data to respect the confidentiality and security of such data and to process it in accordance with applicable laws and regulations. We do not permit such recipients to use personal data for their own purposes and only permit the processing of personal data for specific purposes and in accordance with the instructions we provide.

ALC may share personal data with the following entities:

• Parties relevant to the legal advice we provide, such as counterparties, courts, law enforcement authorities, regulatory authorities, government institutions or other lawyers;
• Law firms belonging to the Morais Leitão Legal Circle network or the Lex Mundi network, for purposes related to the management, coordination and integrated provision of legal services within the scope of ALC’s activities
• Public authorities and the Bar Association, in the context of compliance with legal obligations;
• Service providers who provide services to ALC in connection with the purposes described above, such as, for example, providers of Information Technology (IT), communications services, translation services and digital and physical archiving services.

We may be required to disclose your information to comply with legal or regulatory obligations. We will make every reasonable effort to notify you before doing so, unless we are legally prevented from doing so.

5. Is personal data secure?

ALC has a very strict security policy, both technically and organisationally, to protect personal data against unauthorised destruction, loss, alteration, disclosure or access, and against any other form of unlawful or abusive processing, including:

• Pseudonymisation and encryption of personal data;
• Measures to ensure the confidentiality, integrity, availability and resilience of systems and services;
• Measures to restore the availability of and access to personal data in a timely manner in the event of security incidents;
• Additional security measures for access to IT systems.

The technical and organisational security measures established and implemented by ALC are also required of ALC’s service providers who may process personal data on its behalf.

If you have any questions in this regard, would like further details about our data security, or are aware of any inappropriate situation, please contact us via any of the channels listed in point 9 below.

6. What rights do you have as a data subject?

As a data subject, you have the following rights:

• Right of access
  At any time, you may request confirmation as to whether ALC is processing your data, access to your personal data, and information regarding the processing of such data, including details of the purpose(s) for which your personal data is processed and the recipients or categories of recipients to whom your personal data is disclosed. If you wish, you may request a copy of the personal data currently being processed; however, the provision of further copies may be subject to a reasonable fee, taking into account the applicable administrative costs. If the request is made in electronic format, and unless you specify otherwise, we will provide the information in a commonly used electronic format.

• Right to rectification and updating
  If your personal data is incorrect or incomplete, you may request that it be rectified or completed without undue delay.

• Right to erasure
  You have the right to request the erasure of your personal data.
  This right may be restricted in certain situations, such as where ALC has a legitimate interest in retaining the data, in particular for the purposes of complying with legal obligations to which ALC is subject, or for the exercise of a right.

• Right to object
  Where provided for in the applicable data protection legislation, and where the processing of the data is based on ALC’s legitimate interest, you have the right to object to the processing of your personal data on compelling and legitimate grounds relating to your particular situation

• Right not to be subject to automated individual decision-making
  ALC does not make automated individual decisions, including profiling, which produce legal effects concerning you or similarly significantly affect you.

• Right to withdraw consent
  Where data processing is carried out on the basis of your consent, you may withdraw your consent at any time. If you withdraw your consent, your personal data will no longer be processed, unless there is another legal basis for such processing.

• Right to lodge a complaint with the supervisory authority
  You have the right to lodge a complaint with a public body responsible for supervising and promoting compliance with the rules on the processing of personal data and ensuring the protection of data subjects’ fundamental rights.

In Angola, this body is the Data Protection Agency.

ALC draws attention to the fact that the exercise of the rights set out above may be limited due to the existence of the rights and freedoms of third parties, legal or confidentiality obligations, and the overriding legitimate interests of ALC or a third party.

Where personal data is processed for statistical purposes, the rights of access, rectification/updating, and objection are restricted to the extent necessary, if these rights are likely to render the fulfilment of such purposes impossible or seriously impair it.

ALC may request specific information for the exercise of the aforementioned rights, in order to confirm the identity of the data subject. This request is a security measure, designed to ensure that personal data is not shared with persons who do not have the right to access it. ALC may contact the data subject to request information relating to the request made, in order to expedite the response to such a request.

7. How can you exercise your rights?

You may exercise your rights through any of the following channels:

• Email: to the email address geral@alcadvogados.com ; or
• Letter: addressed to Catarina Levy Osório, ALC & Associados - Law Firm, RL, Masuika Office Plaza, MKO A Building, 5th Floor, Office A, Talatona, Municipality of Belas, Luanda – Angola.

Exercising your rights is free of charge. However, ALC may charge a reasonable fee or refuse the request if it is manifestly unfounded, repetitive or excessive.

8. How can you contact us?

If you have any questions or require further information regarding the processing of personal data or the rights you enjoy as a data subject, please contact us via the following channels:

• Email: to the email address geral@alcadvogados.com ; or
• Letter: addressed to Catarina Levy Osório, ALC & Associados - Sociedade de Advogados, RL, Masuika Office Plaza, MKO A Building, 5th Floor, Office A, Talatona, Municipality of Belas, Luanda - Angola.

9. How can you keep up to date with the processing of personal data?

This "Privacy policy" may be subject to updates, so ALC advises you to consult this Policy regularly.

It is important that your personal data is accurate and up to date. We therefore ask that you keep us informed of any changes to your personal data during your relationship with ALC.

Find out more about the processing of personal data by consulting the "Cookie Policy", which is included in the "Terms and Conditions" on our website.