Last updated · April 2026

Privacy Policy

This Privacy Policy explains how Ferraz & Whitmore, Lda ("Ferraz & Whitmore", "we", "us") collects and processes personal data through our website ferrazwhitmore.com and our newsletter. We comply with the EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, and Portuguese Law 58/2019.

1. Data controller

Ferraz & Whitmore, Lda
Rua Carlos Alberto da Mota Pinto 17, Amoreiras Plaza, 1070-313 Lisboa, Portugal
Email: info@ferrazwhitmore.com
Phone: +351 21 000 0000

2. Personal data we collect

Contact form

When you submit our contact form we collect: first name, last name, email address, optional phone number, jurisdiction of interest, practice area, and the content of your message. Legal basis: your consent (Art. 6(1)(a) GDPR) and our legitimate interest in responding to legal-services enquiries (Art. 6(1)(f)).

When you subscribe to our newsletter we collect: email address, your selected interest tags (general / Portugal-EU / sanctions-CIS), the date and IP address of subscription, and your subscription confirmation timestamp. We use Mailchimp (Intuit Inc., USA) as a data processor for newsletter delivery; cross-border transfers rely on the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) where applicable. Legal basis: your consent via double opt-in (Art. 6(1)(a) GDPR).

Server logs

Our hosting provider (Beget, Russia/EU servers) stores standard server logs containing: IP address, timestamp, requested URL, HTTP status code and User-Agent. Logs are retained for 30 days for security and abuse-prevention purposes. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

3. Cookies

We use only essential cookies required for the operation of our PHP session (CSRF protection on forms) and a single fw_consent entry in your browser's localStorage to remember your cookie-banner choice. We use Google Fonts for typography, which loads font files from Google's servers; this does not place tracking cookies. We do not use analytics cookies, advertising cookies or third-party tracking pixels.

4. Your rights under the GDPR

You have the following rights:

Access (Art. 15) — request a copy of your personal data.
Rectification (Art. 16) — correct inaccurate data.
Erasure (Art. 17, "right to be forgotten") — request deletion.
Restriction (Art. 18) — ask us to limit processing.
Data portability (Art. 20) — receive your data in a structured format.
Object (Art. 21) — object to processing based on legitimate interest.
Automated decision-making (Art. 22) — not be subject to a decision based solely on automated processing. We do not perform automated decision-making on your data.
Withdraw consent (Art. 7) — at any time, without affecting prior lawful processing.
Lodge a complaint with the Portuguese supervisory authority (CNPD) at cnpd.pt.

5. How to exercise your rights

To exercise any of the rights above — including data deletion — email info@ferrazwhitmore.com from the email address associated with your data. We respond within 30 days as required by Art. 12(3) GDPR.

6. Retention

Contact-form submissions are retained for as long as our client relationship is active and for 5 years thereafter for legal and accounting compliance. Newsletter data is retained until you unsubscribe (one-click via every email). Server logs: 30 days.

7. Disclosure to third parties

We do not sell your data. We share it only with: (a) Mailchimp (newsletter processor); (b) our hosting provider Beget (server logs); (c) competent authorities when required by law. All processors operate under written data-processing agreements.

8. Changes to this Policy

We will notify users of material changes by email (newsletter subscribers) and via a banner on the site. The "Last updated" date at the top of this page indicates the most recent revision.

9. Contact

For any privacy-related question or to exercise your rights, write to info@ferrazwhitmore.com.