Legal information
Privacy policy and data protection.
How we collect and process the personal data of those who contact us, and how you can exercise your rights. Client data is additionally protected by professional secrecy.
This policy explains how Ribesa Advogados Lda ("Ribesa"), based in Lisbon, processes personal data when you use this website, send us a request or an application, or become a client. It describes what the website actually does. Client data is also protected by professional secrecy (Article 92 of the Portuguese Bar Association Statute).
Last updated: 7 October 2026.
1. Who is responsible for your data
The controller is Ribesa Advogados Lda, Av. Júlio Dinis, n.º 2, 2.º Esq., 1050-131 Lisboa, tax no. (NIPC) 517790432. For any question about your data, or to exercise your rights, write to contacto@ribesa.pt or to the office address. Full firm details are on the Legal information page.
2. What we process, why, and on what legal basis
Not all processing is based on consent. The table shows, for each purpose, the data, the legal basis under the GDPR and how long the data is kept.
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact and consultation requests (website forms, email, phone, WhatsApp) | Name; phone and/or email; area and situation chosen (optional); message; website page and, where present, the campaign parameters that brought the visit. | Reviewing the request, replying, arranging the consultation and checking whether Ribesa can take on the matter (conflict of interest). Campaign parameters show which channels bring requests. | Steps taken at your request before entering into a contract (Art. 6(1)(b)); conflict checks: legal and professional obligation (Art. 6(1)(c)); campaign parameters: legitimate interest (Art. 6(1)(f)). Sensitive information you choose to include (for example about health or criminal proceedings) is processed only as needed to review the request and, where relevant, to establish, exercise or defend legal claims (Art. 9(2)(f)). | 12 months from the request, if it does not lead to an engagement. After that, personal data (name, contact details, message and notes) is deleted and only an anonymous statistical record is kept: date, area, originating page and campaign, and status of the request. If it leads to an engagement, the client data period applies. |
| Website triage assistant | The description of your situation you type in the assistant and your answers to the follow-up questions; if you ask to be contacted or to book, the same data as a contact request. To suggest the area of law, the description is analysed automatically by an artificial intelligence model run by Cloudflare (Workers AI), without email addresses, phone numbers or document and bank account numbers, which are removed beforehand. | Routing the request to the right area and team and avoiding questions about what you already described. The suggested area is neither legal advice nor a decision: you can confirm or change it, and the matter is always assessed by a lawyer. | As for contact requests: steps taken at your request before entering into a contract (Art. 6(1)(b)); sensitive information you choose to include, only as needed (Art. 9(2)(f)). | If you do not send the request, the description and answers stay only in your browser (up to 30 minutes or until you close the tab) and are not stored by Ribesa. Cloudflare does not keep the analysed description. If you send it, the contact request period applies. |
| Prospective clients (consultation arranged or held, before an engagement) | The request data; identification details and documents you provide for the consultation; consultation notes. | Preparing and holding the consultation, presenting a fee proposal and checking conflicts of interest. | Pre-contractual steps (Art. 6(1)(b)); legal and professional obligations (Art. 6(1)(c)), including professional secrecy; Art. 9(2)(f) for sensitive data. | 12 months from the request, if it does not lead to an engagement. After that, personal data (name, contact details, message and notes) is deleted and only an anonymous statistical record is kept: date, area, originating page and campaign, and status of the request. If it leads to an engagement, the client data period applies. |
| Clients (where applicable; outside the website) | Identification, contact details, tax and billing data, documents and case information. | Providing the legal services agreed, invoicing and meeting legal obligations (tax, anti-money laundering where applicable, and under the Bar Association Statute). | Performance of the engagement (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)); Art. 9(2)(f) and Art. 10 for sensitive data and data on criminal convictions. | During the engagement and afterwards for the periods that the law and professional rules require or allow for keeping case files and tax records. |
| Website and form security | An irreversible fingerprint (hash) of the IP address, without storing the address itself; browser type; anti-bot check result (Cloudflare Turnstile); technical hosting logs. | Preventing automated submissions and abuse, limiting repeated submissions and keeping the website available and secure. | Legitimate interest in website and information security (Art. 6(1)(f)). | Records linked to a request are deleted when the request is deleted or anonymised; technical hosting logs, for the period set by the provider. |
| Audience measurement (Google Analytics) | Cookie identifiers, pages viewed, where the visit came from, device and browser, interaction with pages. Form content is never sent to these tools. | Understanding how the website is used and improving it, in aggregated reports. | Consent given in the cookie panel under "Analytics and performance" (GDPR Art. 6(1)(a) and Art. 5 of Law 41/2004). You can withdraw it at any time. | Cookies: the durations listed in the Cookie Policy. Reports: for the period configured in each tool. |
| Advertising and campaign measurement (Google Ads) | Cookie and ad-click identifiers; a record that a consultation request was made (without the name, contact details, area chosen or message). | Measuring whether ads lead to consultation requests and showing more relevant ads. | Consent given in the cookie panel under "Advertising" (GDPR Art. 6(1)(a) and Art. 5 of Law 41/2004). You can withdraw it at any time. | Cookies: the durations listed in the Cookie Policy. Campaign data stored in your browser: until you withdraw consent. |
| Recruitment: applications for vacancies and speculative applications | Name, email, mobile phone, area of interest, professional profile, LinkedIn or professional page (optional), cover message, CV and, where relevant, the vacancy. | Assessing the application and, where relevant, contacting the candidate in the current selection process. | Pre-contractual steps at the candidate's request (Art. 6(1)(b)). It does not depend on consent. | 12 months from submission. After that, the CV and personal data are deleted and only an anonymous statistical record is kept: date, vacancy or area and status of the application. |
The website asks only for what is needed to reply. In a first request, please do not send documents or more personal details than needed to understand the matter; we will ask for anything else in the consultation. The fields marked as required on the forms are needed to reply; without them we cannot handle the request. If your request mentions other people (for example, the other party), we use that information only to review the request and to check for conflicts of interest.
Applications. Sending an application does not require consent: we process it to assess the application you chose to send. Keeping it for future opportunities is a separate, optional choice, which is never pre-selected and which you can withdraw at any time by writing to contacto@ribesa.pt. Refusing it does not affect your application.
This website does not make automated decisions or profiling with legal or similarly significant effects on you.
The triage assistant uses an artificial intelligence model only to suggest the area of law from the description you wrote. That suggestion has no legal effect: you can confirm or change it, and the decision to take on the matter and any legal assessment are always made by a lawyer.
3. Who receives the data
Requests and applications are only accessible to the Ribesa lawyers and staff who handle them, in a restricted area protected by the firm's professional accounts, in the firm's mailbox and in Ribesa's internal case management system. Access and changes are logged.
The following providers process data on Ribesa's behalf and on its instructions (Article 28 GDPR):
- Cloudflare: website hosting, storage of requests and applications (including CVs), anti-bot protection (Turnstile) and automated analysis of the description typed in the triage assistant to suggest the area of law (Workers AI). Cloudflare does not use that text to train artificial intelligence models and does not keep it.
- Microsoft (Microsoft 365): the firm's email, including request notifications and automatic replies.
- Ribesa's internal management system (Arka), which receives requests from the website.
Only if you accept the corresponding cookie categories: Google (Google Tag Manager and Google Analytics, Google Ads). If you choose to contact us by WhatsApp, that conversation is also subject to WhatsApp's terms and privacy policy.
Data may also be disclosed to courts, public authorities or the Bar Association where the law requires it.
4. Transfers outside the European Economic Area
Some of these providers belong to groups based in the United States (Cloudflare, Microsoft, Google). Where data is transferred outside the EEA, the transfer relies on the European Commission adequacy decision for the EU-US Data Privacy Framework, for certified companies, or on the standard contractual clauses approved by the Commission.
5. How long we keep data
We keep data only for as long as needed for the purpose for which it was collected, and then delete it, or for longer where the law requires it or where it is needed to establish, exercise or defend legal claims. At the end of the period, requests and applications received through the website are anonymised automatically: personal data and CVs are deleted and only an anonymous statistical record is kept (date, area, originating page and campaign, status). You can ask for earlier deletion at any time. The table above shows the period or criteria for each purpose.
6. Your rights
You have the right to access your data, to have it rectified or erased, to restrict or object to its processing, to data portability and, where processing is based on consent, to withdraw consent at any time without affecting processing carried out before. To exercise them, write to contacto@ribesa.pt or to the office address. We reply within one month, which may be extended in the cases provided by law. Where processing is based on legitimate interest (campaign parameters and website security), you may object to it at any time on grounds relating to your particular situation. Some rights may be limited where professional secrecy or a legal obligation requires us to keep the data; if so, we will tell you why.
You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD) (opens in a new tab).
7. Security
The website uses encrypted connections (HTTPS). Requests and CVs are stored with access restricted to authenticated staff, CVs are only downloadable from the restricted area, IP addresses are not stored (only an irreversible fingerprint), and form content never enters analytics or advertising tools. Please bear in mind that email and messaging are not fully secure channels.
8. Cookies
Analytics and advertising tools are only used after you accept them in the cookie panel, and only in the categories you accept. The list of cookies and how to change or withdraw your choice are in the Cookie Policy.
9. Changes to this policy
We will update this policy whenever the way we process data changes. The date of the current version is shown at the top. Previous versions are kept and can be requested at contacto@ribesa.pt.
Book a consultation
Tell us what is happening
Write to us in your own words or call us. In our reply we confirm availability, the consultation format and the fee.
- Professional secrecy from the first contact
- No obligation to go ahead
- Reply within 24 working hours
- In person or by video call