Privacy policy

Who processes the data

The data sent through this site is processed by Renzo Barroso Sociedade Individual de Advocacia, as controller, under the terms of Brazilian Law 13.709/2018 (LGPD).

What data is collected

The site collects only the data the person enters in the contact form: name, e-mail, phone and company when filled in, the matter indicated and the content of the message. The date and time of the submission are recorded alongside it. There is no other form on the site, and nothing is collected from those who merely browse.

There is no profiling, no advertising cookie and no audience-measurement tool — there is no Google Analytics or equivalent on this site. Typefaces are served by the site's own domain, not by Google: opening a page generates no request to a third-party server.

The IP address

The IP address of whoever submits the form is used for a single purpose: to limit how many submissions come from the same source, which is what keeps the form from being used by a bot. It stays in the server's memory for the duration of that count, ten minutes, and is not written to the database. The stored message does not keep the address it was sent from, and the site keeps no history of IP addresses.

Cookies

For those visiting the site there is no cookie at all — neither a session cookie nor a language-preference cookie, since the language travels in the page address itself. There is a single cookie in the system, named barroso_sessao, and it is only created after signing in to the firm's administrative panel. It is a technical cookie, needed to keep the session of whoever manages the content: it is not readable by JavaScript, travels only over an encrypted connection and expires in seven days.

Content loaded from third parties

On the offices page, the map for each office is only loaded when the person clicks to see it. From then on the content comes from Google Maps, and Google begins recording the IP address and writing its own cookies in the browser, under its own privacy policy. Until the map is opened, no request is made to Google — and the office addresses are written on the page, as text, without depending on the map. Videos in publications follow the same rule: they load only when the person clicks to watch, and are served from the no-cookie domains of YouTube and Vimeo.

Who else has access to the data

Two companies take part in running the site, each to the extent required. The new-message notification is delivered by Resend, which receives the content of the form in order to get it to the firm's address. The site and the database are hosted by Railway. Neither uses this data for its own purposes, and there is no other recipient: messages are not shared, sold or assigned to anyone.

International transfer

The servers of those two companies are located outside Brazil. Submitting the form therefore involves an international transfer of data. It takes place under the ground that article 33 of the LGPD allows for carrying out preliminary procedures related to a contract, at the request of the data subject — which is what happens when someone writes to the firm asking to be contacted.

What the data is used for

The data is used exclusively to reply to the contact, assess whether the firm can act on the matter and, where an engagement follows, to perform the service. The legal basis is the preliminary procedure to a contract and the regular exercise of rights, provided for in article 7 of the LGPD.

Messages are not used to send promotional communication and are not shared with third parties, except where necessary to comply with a legal duty or an order from a competent authority.

Sending a message does not create a lawyer-client relationship

A message sent through this site is an initial contact. It does not establish a lawyer-client relationship, does not create a duty of professional confidentiality over the content sent and does not interrupt any deadline. For that reason, do not attach documents or include confidential information before the firm confirms that it can act on the matter — not least because a conflict of interest with an existing client may prevent it from doing so.

How long the data is kept

Messages received are kept for as long as needed to handle the contact and, where an engagement follows, for the period required for the safekeeping of professional documents. Once the purpose is exhausted and the legal periods have elapsed, the records are deleted.

Rights of the data subject

The data subject may request confirmation that processing exists, access to the data, correction of incomplete or outdated data, anonymisation or deletion of unnecessary data, portability and withdrawal of consent. They may also petition Brazil's National Data Protection Authority in relation to their data.

How to exercise these rights

Requests may be made by e-mail to contato@barroso.law and are answered within the periods set by the LGPD. For requests for access, correction or deletion, the firm may ask for additional information confirming the identity of the person making the request — a step that exists to prevent one person's data from being handed to another.

Automated decisions

No decision about the person writing is taken automatically. The message is read by a lawyer at the firm, and the reply — including a reply saying the firm will not be able to act on the matter — follows from that reading. The site does not classify, score or profile those who approach it.

Security

The site is served exclusively over an encrypted connection and messages are stored in a restricted-access environment, available only to the people involved in handling the contact. Access to the panel requires a password, which is not kept: what is stored is the output of a slow key-derivation function, from which the original password cannot be recovered. Sessions have an expiry date and can be terminated at any time.

Changes

Changes to this policy are published on this same page. The version in force is always the one here.