Updated in May 2026

TFRA – Sociedade de Advogados e Consultores SP RL (“TFRA”) is committed to protecting the privacy and personal data of those who use its services, contact the firm or visit its website at www.tfra.pt (the “Website”).

This Policy describes how we process personal data, in compliance with the General Data Protection Regulation (“GDPR”), Law No. 58/2019, the Statutes of the Bar Association (“EOA”) and other applicable regulations. It is supplemented by the Cookies Policy and the Website’s Terms of Use.

1. Data controller

TFRA is the data controller responsible for processing your personal data.

Address: Av. da República, 32, 4th Floor Left, 1050-193 Lisbon

Telephone: (+351) 217 815 660

Email: lawfirm@tfra.pt

2. To whom this applies

This Policy applies to the processing of personal data of clients (and their representatives or counterparties) and former clients of TFRA, visitors to the Website, candidates for career opportunities, suppliers and partners, as well as third parties whose data is provided to us in the course of providing legal services.

3. Data we process

Depending on our relationship with the data subject, we may process identification and contact details, professional and academic details, financial and billing details, procedural and mandate details, website browsing data, and data required by anti-money laundering legislation.

In the course of providing legal services, we may process special categories of data (such as health data or data relating to criminal convictions) where this is necessary to defend the client’s interests or to comply with legal obligations, subject to enhanced safeguards.

Data is collected directly from the data subject or, indirectly, from clients, counterparties, courts, public authorities or legally accessible sources.

4. Third-party data provided by the client

Where, in the course of providing legal services, we are provided with personal data relating to third parties (namely employees, counterparties, witnesses, beneficial owners or family members), the client is responsible for informing those data subjects that their data may be disclosed to TFRA and processed for the purposes described in this Policy, unless such notification may be waived in accordance with the law.

5. Purposes and legal bases

We process your personal data on the following grounds:

• Performance of a contract or pre-contractual measures: opening a case file, provision of legal services, representation in court, invoicing, supplier management and applications.
• Compliance with a legal obligation: checking for conflicts of interest, prevention of money laundering, tax and ethical obligations.
• Legitimate interest: responding to contact requests, marketing communications to clients regarding similar services, organising events, maintaining relationships with former clients, participation in legal directories and applications for international awards and rankings, and defending rights in legal proceedings.
• Consent: subscription to newsletters and legal communications, analytical cookies, recording of meetings and submission of personal data to directories or for awards where legally required.

Where processing is based on consent, this may be withdrawn at any time, without affecting the lawfulness of processing carried out previously. Where it is based on legitimate interest, we carry out a prior balancing test against the rights of data subjects, who may always object to the processing.

6. Professional community

TFRA maintains an ongoing relationship with former employees, clients and partners by sending legal communications, invitations to events and information about the firm’s activities. This processing is based on TFRA’s legitimate interest in maintaining its professional community or, where applicable, on the data subject’s consent, which they may object to or withdraw at any time.

7. Participation in legal directories and awards

TFRA participates in evaluation and recognition processes organised by international legal directories and specialist publications (such as Chambers and Partners, The Legal 500, IFLR, Best Lawyers and similar organisations). For this purpose, lawyers’ professional identification details may be shared, and, with the client’s consent, references to mandates and testimonials may also be shared.

8. Retention periods

We retain data only for as long as is necessary for the purposes for which it was collected, in accordance with the applicable legal time limits:

• Client and case data: for the duration of the mandate, plus 20 years after its conclusion.
• Billing and accounting: 10 years.
• Anti-money laundering: 7 years after the end of the client relationship.
• Job applications: 2 years.
• Newsletter subscribers and professional network contacts: until consent is withdrawn or an objection is raised.
• Contact requests via the Website: up to 1 year after the last contact.

The periods indicated may be extended whenever this proves necessary for the assertion, exercise or defence of rights in judicial, arbitral or administrative proceedings, for the duration of the potential dispute and for the applicable limitation period.

Once these time limits have expired, the data is securely deleted or anonymised.

9. Who we share your data with

In strict compliance with the duty of professional confidentiality, your data may be disclosed to:

• Subcontractors providing services to TFRA (information technology and cloud services, document management, archiving, postal services, accounting and auditing), subject to a contract and appropriate safeguards.
• Courts, public authorities and parties to legal proceedings, in the course of providing legal services.
• Other solicitors and law firms, including international correspondents, where necessary to defend the client’s interests.
• Members of the Ally Law international network, of which TFRA is a part, for cross-border legal services.
• Legal directories and