KYC PRIVACY POLICY
General Data Protection Regulation (EU) 2016/679
1. DATA CONTROLLER
Catarina Zuccaro — Global Law Advisor, with professional offices at Av. da França, 256, loja 48, 4050-276 Porto, Portugal.
Catarina Zuccaro, Esq., lawyer enrolled with the Portuguese Bar Association under professional number 46606P.
Data protection contact: rgpd@czadvogados.com.
2. LEGAL BASIS FOR PROCESSING
The processing of personal data collected under the KYC process is based on the controller’s compliance with a legal obligation, pursuant to Article 6(1)(c) of Regulation (EU) 2016/679, in conjunction with Portuguese Law no. 83/2017, of 18 August (Anti-Money Laundering and Counter-Terrorist Financing Act) and Portuguese Law no. 58/2019, of 8 August.
3. PURPOSES OF PROCESSING
Personal data are collected and processed exclusively for the following purposes:
- Identification and verification of the client’s identity;
- Compliance with due-diligence obligations imposed by anti-money-laundering legislation;
- Issue of the power of attorney and execution of the legal services agreement;
- Invoicing and compliance with related tax obligations;
- Institutional communication strictly connected with the professional engagement.
4. CATEGORIES OF DATA
The following categories of personal data, among others, are processed: full name, date and place of birth, nationality, marital status, profession, identification document number and validity, tax identification number, address, telephone and electronic contacts, data concerning the source of funds and information relevant to compliance with the legal obligations on the prevention of money laundering.
5. RETENTION PERIOD
Personal data are kept for a period of seven years after the end of the professional relationship, pursuant to Article 51 of Portuguese Law no. 83/2017. Once this period has elapsed, the data are securely deleted or anonymised.
6. DATA SUBJECT RIGHTS
As a data subject, the client has the right to:
- Access their personal data and obtain information about the processing thereof;
- Request the rectification of inaccurate or incomplete data;
- Request erasure of the data, where legally permissible;
- Request limitation of processing, under the terms of the law;
- Object to processing, where applicable;
- Exercise the right to data portability.
These rights are exercised by written communication sent to rgpd@czadvogados.com, accompanied by a copy of an identification document. The client is also entitled to lodge a complaint with the Portuguese National Data Protection Commission (www.cnpd.pt).
7. DISCLOSURE OF DATA TO THIRD PARTIES
Personal data collected are not transferred to third parties, save in the cases provided for by law, in particular to judicial authorities, tax authorities, financial supervisory authorities — including the Financial Intelligence Unit and the Public Prosecutor’s Office — or to the Portuguese Bar Association, in compliance with legal obligations.
8. INTERNATIONAL TRANSFERS
Where the engagement involves the intervention of the Lisbon or São Paulo branches, or professional correspondents in foreign jurisdictions, data may be transferred subject to the appropriate safeguards provided for in Chapter V of the GDPR, including standard contractual clauses or adequacy decisions of the European Commission.
9. DATA SECURITY
The firm has implemented appropriate technical and organisational measures to ensure the security of personal data against unauthorised access, accidental loss, alteration or destruction, including access controls, storage in protected systems and regular staff training.