About the HELDER NASCIMENTO ADVOGADOS firm
Helder Nascimento Advogados – “HNADV” is a firm located at Rua Marcos Macêdo, 1333, sala 1018, torre II, registered with the Ordem dos Advogados do Brasil [Brazilian Bar Association], Ceará Section, under no. 726, book B, CNPJ [Company Taxpayer’s Number] 14.063.926/0001-30, hereinafter referred to as “HNADV”.
HNADV is a legal entity that provides legal services, dealing with personal data every single day and, as such, undertakes to the regulated matters and obligations imposed by the Brazilian legislation on data protection, as set forth in Law 13709/2018 and respective regulation, hereinafter referred to as LGPD. For this reason, this Personal Data Protection Policy is approved herein, so as to consolidate its commitment to the privacy and personal data protection rules. As per the terms herein, this Data Protection Policy is directly applicable to all operations developed and activities carried out by HNADV.
Personal Data Protection Policy
HNADV acknowledges that people are entitled to have their personal data protected and hereby ensures that all personal data subjects who trust in our processing are aware of the purpose and how the information received is being treated; these subjects are also aware of the rights the can exercise on this matter and how to do it, under the terms and in compliance with the principles as follows: purpose (processing data for legitimate, specific, explicit, and informed purposes, to which the subject is aware of; this set of purposes cannot change in the future); adequacy (consistency of processing, with the purposes duly informed to the subject, according to the processing context), and necessity (limiting the processing to the minimum required to have its purpose achieved, encompassing relevant, proportional, and non-excessive data for the data processing purposes), as well as other principles outlined in article 6th of LGPD.
In this context and in view of all that is takes to reach a robust combination of responsible users, proper technologies, and safe processes, HNADV, based on article 5th, paragraph 2nd, item I, “a” and “d”, hereby sets forth this Personal Data Protection Policy, in order to make the effective compliance with LGPD a part of the elements that, together, form this service provision firm.
As such, procedures to duly request the access, rectification, or elimination of personal data is hereby defined, provided that they do not present any conflicts with other legal bases supporting the HNADV rights. Mechanisms are created to make it easier to exercise the rights regarding processing limiting, portability, and opposition, and new rules to supplement personal data processing and protection rules, as provided for in Terms and Conditions governing several products and services duly available in public in the respective services used by the clients.
Therefore, HNADV informs its clients and other Users the general rules regarding personal data privacy and processing, which were taken and is duly based on the Data Protection scenario currently in force in Brazil, that is hereby respected and strictly complied with.
As the entity responsible for the personal and information data processing activities, HNADV hereby ensures that it executes and promotes the proper technical and organizational measures to comply with the data protection principles, as outlined in LGPD, and that is always considers the nature, scope, context, and purposes of the referred to information processing, as well as the risk of errors in the protection of rights and the freedom of individuals. As such, HNADV extensive and clearly discloses this Personal Data Protection Policy and asks to all clients and users to read it carefully.
In compliance with the new governance model recommended for organizations and set forth by LGPD, HNADV appoints an officer to be the communication channel between the controller, the data subjects, and the Autoridade Nacional de Proteção de Dados [ANPD, the Brazilian Data Protection Authority].
Scope
This Personal Data Protection Policy is solely applied to the data personal processing carried out by HNADV.
Personal Information
In this Personal Data Policy, “Personal data” is considered the information concerning an individual that was identified or is identifiable (“data subject”).
Considering that, an individual may be directly or indirectly identifiable if he/she can be identified, particularly due to an identifying element (such as name, identification card number, localization data, electronic identifiers), or to one or more specific elements of the physical, physiological, genetic, mental, economic, cultural, or social identify of this single individual.
Data processing responsibility at HNADV
HNADV is the entity responsible for collecting and processing personal data; under the entity’s scope, it is the responsible for deciding what are the data to be collected, how to process them, for how long they should be stored, and the respective use purposes.
Types of personal data collected
HNADV, under the scope of its activities, collects and processes the personal data required to fulfill its mission and assignments, as outlined in its articles of incorporation.
Personal data collection
HNADV collects personal data on-site, by the phone, in written, or even through computer systems. The personal data collected are processed by non-automatized means (such as manual sheets), through computer systems, and, in strict compliance with the personal data protection laws, are stored in dedicated databases. Under no circumstances the data collected shall be used for purposes that are not the ones for which the data subject gave consent, or that hinder the legitimacy of the processing.
Legality of personal data processing
At HNADV, personal data processing is subject to legitimacy conditions and, further, to have the legality of the processing purposes and the lato sensu proportionality principle checked.
It is unequivocal that the personal data at HNADV will only be processed if:
– it is a required action to fulfill legitimate interests and if the data subject unequivocally gives consent; – it is required to celebrate an agreement/contract or to comply with legal liabilities the responsible for the processing is subject to; – it is required to protect vital interests of the data subject or another single individual; – it is required to exercise activities of public interest or by a public authority the responsible for the processing is subject to; – it is required to fulfill legitimate interests of the responsible for the processing, or a third party to which the data are communicated, provided that the interests or rights, freedom and warranties of the data subject are not prevailing; – it is provided for, or outlined as optional in LGPD, or as defined by ANPD.
Purposes of personal data processing
The information on the personal data processing is provided to the data subject when they are collected or, if the personal data have been obtained otherwise, within a reasonable period, based on the circumstance in particular.
Upon collection of data, it is at the HNADV’s discretion, as the responsible for the processing, to hand out more detailed information on the future use of the information, that is,
a) the identity and contact information of the responsible for the processing;
b) the contact information of the data protection officer;
c) the personal data processing purposes, as well as its legal basis;
para esse mesmo tratamento;
d) the recipients or categories of recipients of personal data;
e) the rights of data subjects;
f) the data storage period or the criteria used to define this period;
g) the mandatory and optional data.
The personal data processed by HNADV may be legally transmitted to third parties if the latter complies with purposes directly related to the activities carried out by the legitimate subject or the entity responsible for the processing.
If there is a chance of having the personal data legally transferred to another recipient, the data subject is informed in advance about it; if warranted, the subject is entitled to not having the respective personal data transferred, and should submit a request on the matter, provided that such action (the transfer refusal) does not hinder the vital and legitimate interest of one of the parties or the public interest.
Whenever HNADV intends or has to process the personal data for a purpose that is not the one it originally collected the data for, it will provide in advance, to the data subject, the information related to this new purpose, as well as other pieces of information required. If it is not possible to inform the data subject about the origin of the personal data the firm has collected, if such origin was actually more than one, the information available on the matter should be provided.
Personal data storage term
The period of data storage changes according to the purpose of the respective processing.
HNADV may have personal data stored throughout the term of a legal relationship, of an agreement term, or if pre-agreement measures are applied.
If there are no legal, specific requirements involved, the data will be stored only for the period required to comply with the purposes of their collection and processing, or for the term authorized by ANPD, to be eliminated as soon as both of them expire.
HNADV may store its data for longer periods in a processing facility dedicated, if they are of public interest, or for scientific or history investigation purposes, or for statistical purposes, notwithstanding the application of the proper guarantees to the data subject rights and freedom, under the current law. These guarantees require the adoption of technical and organizational measures, which aim at ensuring the respect to the principle of data minimization.
Rights for data subjects
Under the Personal Data Protection legal framework, HNADV ensures to the data subject the right to access, update, rectify, or erase his/her/their personal data; to do so, it is required to submit a written request to the entity responsible for the data protection.
The right to access by data subjects should be limited when it violates fundamental rights and the legitimate interests of individuals.
Security measures
HNADV makes all efforts to protect the personal data of its users, by taking the proper technical and organization measures, using encrypted mechanisms, pseudonymization, federated authentication, and other mechanisms available, with the purpose of ensuring confidentiality, integrity, and availability of personal data.
Aiming at ensuring the personal data security, HNADV implements the following measures:
– access restrictions to personal data based on the “need-to-know” criterion, and on the competencies and roles of the parties handing over the data, strictly applied to the what was outlined in the communication to the data subject when they were first collected;
– the transfer of personal data through encrypted communication channels;
– the storage of data within special categories is encrypted, as well as the respective security copies; protection of technological infrastructures with technical and organizational mechanisms, to prevent unauthorized access; monitoring of technological infrastructures, at different levels, such as access control, unauthorized use, and abnormal traffic, aiming at preventing, detecting, and stopping the unauthorized access to personal data.
Communication of personal data to other entities (subcontracted third parties)
HNADV, under the regular scope of its activities, may hire subcontracted third parties to provide determined services. When data processing is performed by a subcontracted or third party that is receiving data, HNADV will check if its presents sufficient grounds to have the proper technical and organizational measures executed, under the legislation in force and ensuring the defense of the data subject rights.
Under this scope, processing is governed by an agreement/contract or other types of normative acts, which bind the subcontracted or third party to the HNADV guidelines as the entity responsible for the data processing, also defining the purpose and term for the processing in question, its nature and purpose, the types of personal data used and the categories of data subjects, as well as the liabilities and rights of the entity responsible for the processing.
The agreement/contract sets forth that the subcontracted or third party:
a) Is responsible for processing only the data transmitted under documented instructions by HNADV, including the provisions outlined referring to data transfer to other countries or international organizations, except if it is prohibited by law to provide this information for important, public interest reasons; b) Ensures that the persons authorized to process personal data undertake a confidentiality commitment or are subject to appropriate, legal confidentiality liabilities; c) Adopts the most adequate security measures; d) Erases or returns to HNADV all personal data after the processing hired is completed, erasing the existing copies, except if the law requires the storage of data; e) Provides to HNADV all pieces of information required to support the compliance with the liabilities outlined herein and collaborates with audit procedures, including inspections conducted by the entity responsible for the processing, or by another auditor appointed by the latter; f) The subcontracted party shall not hire another subcontracted party without the HNADV authorization; the respective request shall be submitted to the entity responsible for the data processing.
For all cases above, HNADV remains as the entity responsible for the personal data it provides.
Transfer of personal data outside Brazil
In order to carried out some of the HNADV activities, data may have to be transferred to places outside Brazil. HNADV checks in advance if the recipient country or territory ensure the proper level of data protection. If so, HNADV will strictly comply with the legal, applicable provisions, as well as the guidance approved by the General Board of Directors.
HNADV websites
HNADV's websites feature a statement on their privacy practices. These statements identify the data collected, the technical information, and the security and confidentiality guarantees required by Law and under the rights of the data subjects.
HNADV respects the right to privacy and does not store personal information in its websites without the consent of the data subject, or under illegal ways.
As for the collection and use of technical information, the websites may use session cookies. cookies, nomeadamente de sessão.
The technical information will only used for statistical purposes.
Changes to the HNADV personal data protection policy
HNADV reserves the right to, at any moment, adjust or change this Privacy Policy; the referred changes will be subsequently disclosed under the appropriate means.
Doubts and suggestions
To learn more about how HNADV processes your personal data, or to clarify any doubts, submit a compliant or comments, you should send a communication to the firm’s head office.
