Privacy Policy | BMA Advogados

Privacy Policy
Last updated 18 June 2026
Barbosa, Müssnich e Aragão Advogados (“BMA Advogados”) is committed to respecting the privacy and protecting the personal data of data subjects with whom we interact, in compliance with applicable law and especially Law 13.709/2018 (“LGPD” – Lei Geral de Proteção de Dados Pessoais).
The purpose of this Privacy Policy (“Policy”) is inform clients, commercial partners, suppliers, service providers, website users, candidates for positions in BMA, participants in our events and other external data subjects about how their personal data will be processed when they access and use our website or when they interact with BMA by other means.
We recommend that you read this Policy carefully, especially when initiating your interaction with BMA. If you have any questions about the contents of the Policy, please contact our Data Protection Officer directly by e-mail: encarregado@bmalaw.com.br.

1. Types of Data Processed and How We Use That Data
When you access and use our website, contract our services (or the company you represent contracts our services), provide services to us, or interact with BMA in any other way, we will process your personal data for various purposes. Some examples are given below:

Data processed	How we use the data	Legal Bases
Registration data for our website, newsletters, or events (name, e-mail, organization, position, and areas of interest)	To send content produced by BMA, such as institutional communications, letters, e-books, material on specific legal issues, invitations to events, and feedback surveys. To enable you to participate in events organized by BMA and to interact at events by sending questions and comments.	Legitimate interest.
Identification and contact data (name, e-mail, organization, position, telephone number, and address)	To respond to your questions, praise, complaints, and suggestions, and to communicate with you, especially when you send us a message via the Contact Us page on our website or by e-mail. To manage our relationship with you or the organization you represent, if you are a client, former client, or potential client. To hold in-person or virtual meetings, telephone calls, and conversations in general. To manage invoicing and receipt of payment of our fees, costs, and expenses in providing legal services contracted by you or the organization you represent.	Legitimate interest. Contract, specifically when our services are contracted by individuals.
Data contained in your CV (name, address, telephone number, e-mail, academic record, professional background, position applied for, objectives, skills, languages spoken, and any other information you choose to include in the CV you send us)	To recruit new personnel, to contact candidates, and to enable them to participate in the steps of the selection process, such as interviews, group sessions, and practical and theoretical tests. To assess your professional profile for positions open in BMA or for which you have applied.	Legitimate interest, when your CV has been sent to us by someone who recommended you. Contract, including procedures preliminary to an employment contract where you applied for a position directly to BMA.
Personal particulars (full name, nationality, civil status, profession, address, identification card number (RG), tax identification number (CPF), driving license number (CNH), and e-mail address)	To draft, revise, and negotiate agreements to which you are a party, a representative of a party, or otherwise involved. To conduct administrative, judicial, or arbitration proceedings in which you are a party, a representative of a party, or otherwise involved. To conduct or participate in legal due diligence investigations to check organizations’ compliance with Brazilian law and to conduct risk assessments, especially in mergers and acquisitions, business reorganizations, and capital market transactions. To draft, revise, and negotiate legal instruments or documents required under applicable law.	Legitimate interest. Contract, specifically when our services are contracted by individuals. Lawful exercise of rights in administrative, judicial, or arbitration proceedings.
Data collected at student fairs (name, telephone number, e-mail, educational institution, program, and current term)	To contact you about internship opportunities at BMA that might interest you. To invite you to internship interviews. To send internship offers.	Legitimate interest.
Data on your participation, involvement, or work in organizations (position, salary, benefits, job duties, document data, data on your qualifications, etc.)	To draft, revise, and negotiate agreements, especially employment agreements. To conduct administrative, judicial, or arbitration proceedings, especially labor proceedings. To conduct or participate in legal due diligence investigations to check organizations’ compliance with Brazilian law and to conduct risk assessments, especially in mergers and acquisitions, business reorganizations, and capital market transactions.	Legitimate interest. Contract, specifically when our services are contracted by individuals.
Interaction data related to content produced by BMA (clicks on our website or newsletter, number of accesses, opening of newsletters, time spent, engagement index, and analytic data)	To improve our communication with you and develop website functionalities and services. To send content that we think will interest you. To analyze the effectiveness and relevance of the content we produce.	Legitimate interest.
Security camera images	To ensure the security of our physical premises and our personnel.	Legitimate interest.
Information on your accesses to our website and other apps made available by BMA (IP address, date, and time of access)	To comply with our legal obligations.	Legal obligation.
Service providers’ registration data (name, address, telephone number, e-mail, identification document data, social security (INSS) data, etc.)	To manage our business relationship and pay for services provided.	Legitimate interest.

2. With Whom Is Your Personal Data Shared?
We may share your personal data with:
• The BMA offices and BMA PI. BMA maintains an integrated technology infrastructure across all its offices. As a result, your personal data will be shared among BMA’s offices in Rio de Janeiro, São Paulo, Brasília and Belo Horizonte, with BMA PI, and with any offices BMA may open in the future. This internal sharing enables us to manage our business efficiently and benefit from the synergies created by integrated systems.
• Our commercial partners, service providers, and suppliers. In conducting our activities, we maintain relationships with and contract various commercial partners, service providers and suppliers, who are essential to our business. Some of these commercial partners, service providers and suppliers may require access to the personal data we collect in order to perform their functions, such as IT service providers, data hosting services, selection and recruiting services, facility management services, event management services, productivity software services, auditors, correspondents, translators, and other service providers, in which case we may share your personal data with them.
• Governmental authorities. We may share your personal data with any and all governmental authorities that request it, including labor standards and financial activities oversight bodies, regulatory agencies, judicial authorities, and law enforcement authorities.
• Legal publications and rankings. If you are a contact person at one of our clients, we may share your name, e-mail address, job title and the company you represent with legal publications and ranking organizations, in connection with their review of the work we performed for your organization.
• Third parties interested in a combination with or acquisition of our business. We may share your personal data with third parties who are interested in a combination with or acquisition of our business, in the context of negotiations on a potential merger, acquisition or amalgamation.
• Third parties indicated by you. We may share your personal data with third parties indicated by you, at your request.
3. For How Long Is Your Data Processed?
BMA undertakes to process your personal data only as long as necessary to achieve the purposes of each processing activity, and to retain your data for as short a time as possible, in view of all applicable legal and regulatory obligations and the defense of BMA’s interests in current or future judicial, administrative or arbitration proceedings.
BMA establishes the retention period for each category of personal data according to the nature of the data, the purpose for processing the data, applicable legal and regulatory obligations, and limitation periods, among other criteria.
In addition, we have legal obligations that require us to keep some personal data for a specific period of time, as in the case of your IP address and the time and date of each access to our website, which must be retained for at least six months, according to article 15 of the Civil Rights Framework for the Internet (Marco Civil da Internet).
4. International Data Transfers
In some circumstances, as when we use cloud hosting services located in other countries, or when we need to involve partner law firms located outside Brazil, your personal data may be transferred internationally.
In such cases, we will take appropriate measures to protect your personal data, in compliance with Brazilian law. Personal data transferred to other countries may be subject to local rules and legislation.
Our main technology provider for productivity applications has data centers in the United States. Other international transfers may occur depending on the circumstances of each matter, including where we involve foreign law firms to assist with our clients’ matters.
5. Cookies
Cookies are small text files that are stored on your browser or device and are triggered when you access most websites available on the internet, including ours. Among other purposes, cookies allow your preferences to be recognized, so that our website is displayed according to your preferences, such as your choice of language. Cookies are also used to evaluate performance metrics, identify usage problems, allow our website to function correctly, and collect information on user behavior.
There are different types of cookies. On our website, we may use the following cookies:
• Strictly necessary cookies. These are essential to ensure adequate security and performance of our website. Without these cookies, our website will not function properly.
• Preference cookies. These store information on your preferences, such as, for example, your language and your region, allowing for a better experience when navigating our website.
• Analysis cookies. These collect information on your behavior while navigating our website, such as pages accessed, time spent, and pages not accessed, to allow us to improve the quality of our website.
If you are opposed to their use, you can refuse to allow installation of these cookies, or you can remove them from your browser or device, with the exception of the strictly necessary cookies, which are needed for our website to function properly.
For more information on how to remove cookies from your device, you can access the following websites, according to which browser you use. On accessing these websites, you will be subject to the privacy policies of other companies, which may not be compatible with or similar to this Policy:
• How to remove cookies on Google Chrome
• How to remove cookies on Mozilla Firefox
• How to remove cookies on Internet Explorer
• How to remove cookies on Safari
6. Your Rights as a Data Subject
You have various rights with respect to your personal data and BMA is committed to respecting those rights and ensuring that you can exercise them at any time.
Some of the rights you have are:
• Confirmation that your personal data is processed.
• Access to your personal data.
• Correction of personal data that is incomplete, inaccurate or out-of-date.
• Anonymization, blockage or exclusion of your personal data when processing is unnecessary, excessive or contrary to law.
• Portability, as provided for in regulations issued by the National Data Protection Agency – ANPD (Agência Nacional de Proteção de Dados).
• Exclusion of data processed on the basis of your consent, where consent is the legal basis for processing data in a given situation, unless we are required to retain the data to comply with a legal or regulatory obligation or to defend our interests in judicial, administrative or arbitration proceedings.
• Information on sharing of data with public and private entities.
• Information on the possibility of refusing consent, where consent is the legal basis for processing data in a given situation, and on the consequences of a refusal.
• Revocation of consent, at any time, easily and free of charge, simply by communicating your decision to BMA’s Data Protection Officer. Revocation does not invalidate or make unlawful personal data processing that took place before the consent was revoked.
• Opposition to processing, in cases where consent is not the legal basis for processing your personal data, and you believe there has been a violation of the law. BMA will determine whether your opposition is justified, and either take steps to suspend processing or inform you of the reasons why we believe the processing is lawful.
• Filing a complaint with the National Data Protection Agency – ANPD.
All these rights may be exercised by you at any time, free of charge, unless a charge is permitted under applicable legislation and regulations. BMA undertakes to make its best efforts to respond to your requests quickly.
To ensure that rights are being exercised by you or your duly appointed representative, BMA may request information or proof of your identity, in order to avoid fraud, protect your privacy, and ensure that your personal data is not shared with persons who do not have authorization.
We will respond to your requests within a reasonable time, in compliance with applicable law, keeping in mind that we will only be able to respond to some requests after we have received confirmation of identity, as mentioned above.
7. Information Security
BMA has adopted technical and organizational measures based on good market practices to protect your personal data from unauthorized accesses, unlawful or accidental destruction, loss, alteration, and communication, and other types of inappropriate processing. Your data is stored in a segregated, secure operational environment, which is not accessible to the public. All practices adopted in the life cycle of personal data at BMA are based on national and international standards – ABNT and ISO.
Among the measures we have adopted to protect your personal data are:
• Access controls
• Least privilege protocols
• Local network access monitoring
• Monitoring of corporate services and devices
• User authentication
• Intruder prevention and detection
• Antivirus software
• Firewalls
• Data loss prevention
• Backup copies
• Tracking mechanisms
• Periodic system tests and sweeps
• Database segmentation
• Logical network segmentation
• Internet access rules
BMA has implemented these measures to minimize the risk of security incidents and unauthorized accesses, but it is impossible to guarantee absolute security for your personal data, especially against malicious attacks, which may be highly sophisticated and innovative, using techniques and methods previously unknown even to the best information security tools.
The safety of your data also depends on reasonable care by you in your use of devices and software. If you become aware of anything that may compromise the security of your personal data, or that may indicate a possible vulnerability in our website or systems, please contact us.
8. Third-Party Websites
Our website may contain links to websites maintained by third parties. Those websites may have their own privacy policies, which may not be compatible with our Policy. We recommend that you consult third parties’ privacy policies to learn about the personal data protection practices they have adopted.
BMA has no liability for the legality of data protection practices on third-party websites, or for the contents of third-party websites, which BMA does not validate, ratify or endorse in any way.
9. BMA’s Data Protection Officer
If you have any questions about this Policy or how your personal data is processed by BMA, do not hesitate to contact us.
Our Data Protection Officer (Amir Achcar Bocayuva Cunha, primary DPO; Rafael Padilha Calabria, alternate DPO) is the contact person for all requests related to your personal data, including the exercise of any of your rights under the Policy. You can contact the Data Protection Officer directly by e-mail: encarregado@bmalaw.com.br
10. Data Controller
The Controller of your personal data is Barbosa, Müssnich & Aragão, federal tax identification number CNPJ 00.450.968/0001-10, located in the city of Rio de Janeiro, State of Rio de Janeiro, at Largo do Ibam, 1, 5º andar, Humaitá, CEP 22271-070.
11. Policy Updates
As part of our efforts toward constant improvement of our services, this Privacy Policy may be updated and modified over time to better reflect our personal data processing practices and give greater security and transparency to our operations. We recommend that you check this Policy from time to time to familiarize yourself with any changes.