Privacy Policy

This is a translation provided for convenience. The Portuguese version, at fanton.adv.br/politica-de-privacidade, is the authentic text and prevails in the event of any divergence. Statutory references are to Brazilian law.

1. Purpose

This document describes how Fanton Advogados processes personal data arising from the operation of its institutional website, states the legal basis for each processing activity, and explains how data subjects exercise the rights set out in Law No. 13.709/2018 — the Brazilian General Data Protection Law (LGPD).

It applies to the domain fanton.adv.br and its subdomains. References in this policy to the site cover that set.

This policy describes the processing that arises from the site and, beyond it, the processors the firm relies on and the periods for which it retains its archive.

The processing of data within established professional relationships — clients, court files, powers of attorney, case documents — has its substantive regime in the rules of the legal profession and in the engagement agreement, which this policy does not replace. What this policy states as to that archive are the retention periods in section 8, so the data subject knows for how long the firm keeps it and on what basis.

2. Controller

Controller: Fanton Sociedade Individual de Advocacia, trading as Fanton Advogados, enrolled with the Brazilian taxpayer registry (CNPJ) under No. 65.457.748/0001-63 and registered with the São Paulo Chapter of the Brazilian Bar Association (OAB/SP) under No. 66.030, based in Campinas, State of São Paulo, Brazil.

All contact concerning this policy, including the exercise of the rights in section 12, is directed to privacidade@fanton.adv.br, which is the channel designated by the controller for that purpose.

3. Data protection officer and channel of communication

Data protection officer: Jonas Pereira Fanton.

Channel of communication: privacidade@fanton.adv.br.

The firm qualifies as a small-scale processing agent under art. 2, I, of ANPD Resolution No. 2 of January 27, 2022, and falls within none of the exclusions in art. 3 of that resolution, since the processing described in this policy does not amount to high-risk processing within the meaning of its art. 4. In that capacity it is not required to appoint a data protection officer (art. 11 of ANPD Resolution No. 2/2022); it need only make a channel of communication available to data subjects, as provided in art. 41, § 2, I, of Law No. 13.709/2018. The officer is appointed voluntarily, as a matter of governance.

Sections 8, 12 and 13 indicate, where applicable, the simplified regime authorized by that resolution.

4. Processing activities

4.1 Contact form

The single point at which the site actively collects data.

Data collected: name, email address, telephone (an optional field), subject and message.

Purpose: to receive the communication, reply to the sender and, where applicable, assess whether legal services can be provided.

Legal basis: art. 7, V, of Law No. 13.709/2018 — performance of preliminary steps relating to a contract to which the data subject is a party, at the data subject's own request. Where the message does not concern a possible engagement (institutional communications, press enquiries, general questions), the processing rests on art. 7, IX, of Law No. 13.709/2018, limited to what is strictly necessary to reply to the communication addressed to the firm, with no ancillary purpose.

The telephone field is optional, in observance of art. 6, III, of Law No. 13.709/2018.

Data supplied through the form is not used to send the communications described in section 4.4 unless the sender opts in by a separate and specific act. The data is not used for prospecting, profiling, or any purpose other than those stated in this section.

4.2 Technical access logs

The hosting infrastructure automatically records the originating IP address, the date and time of access, the browser identification and the page requested.

Purposes: retention of internet application access logs, and maintenance of the security and availability of the site.

Legal bases: art. 7, II, of Law No. 13.709/2018 — compliance with a legal obligation — as regards retention of the logs, under art. 15 of Law No. 12.965/2014 (the Brazilian Internet Civil Rights Framework); and art. 7, IX, of Law No. 13.709/2018 — legitimate interests — as regards detecting and mitigating abusive access, a use confined to what is necessary to keep the site working.

4.3 Audience measurement

The site uses Cloudflare Web Analytics. Measurement is carried out without cookies, without a persistent identifier and without tracking the visitor across different sites. What the firm receives is aggregate access metrics.

Purpose: to gauge the volume of visits and identify which pages are consulted, for the maintenance and correction of the site.

Legal basis: art. 7, IX, of Law No. 13.709/2018 — legitimate interests. In the balancing exercise required by art. 10 of the same law, it was considered that collection is confined to what is necessary for the stated purpose, that no identifier capable of recognizing the visitor on later visits is produced, and that the metrics delivered to the firm do not permit the data subject to be singled out. The right to object is assured under art. 18, § 2.

4.4 Communications from the firm

Anyone interested may opt in, by their own act, to receive informational content produced by the firm. The opt-in is offered in two ways: a checkbox on the contact form, presented unticked and set apart from the sending of the message; and a standalone subscription form in its own area of the site.

Data collected: email address and, where given, name.

Purpose: sending the communications the data subject has opted in to.

Legal basis: art. 7, I, of Law No. 13.709/2018 — consent of the data subject, given in writing in a clause set apart from the others and referring to a specific purpose, as provided in art. 8, §§ 1 and 4, of the same law. Opting in is optional and does not condition the sending of a message through the contact form, the receipt of a reply, or the handling of any request.

The content sent is informational and is not tailored to browsing behavior. No profile of the recipient is built and the address is not shared with third parties.

Withdrawal: the data subject may withdraw at any time, by a free and facilitated procedure, using the unsubscribe link in every communication or by a request to the channel in section 3, as provided in art. 8, § 5, and art. 18, IX, of Law No. 13.709/2018. Once withdrawn, the sending stops and the address is deleted.

The firm retains evidence of the opt-in and of any withdrawal, as required by art. 8, § 2, of Law No. 13.709/2018.

The content of these communications observes the limits on advertising and information in the legal profession set out in Provimento No. 205/2021 of the Federal Council of the Brazilian Bar Association and in the Bar's Code of Ethics and Discipline, which prohibit soliciting clients and commercializing the profession, under art. 34, IV, of Law No. 8.906/1994.

4.5 Absence of other processing

The site consists of static pages. Save for the opt-in described in section 4.4, there is no restricted area, user registration, authentication, e-commerce, or automated processing intended to define a personal, professional, consumer or credit profile.

No automated decisions affecting the data subject's interests are taken, and for that reason the right to review provided in art. 20 of Law No. 13.709/2018 does not apply to this site.

5. Limits on what is sent through the form

The form page warns senders not to include documents, case numbers, the names of third parties, or any confidential information. The form is not a suitable channel for sending case material.

The site is not intended for the collection of sensitive personal data (art. 5, II, of Law No. 13.709/2018) and the firm does not request it. If, despite the warning, a data subject includes data of that nature in the message, the processing arises from the data subject's own voluntary provision for the specific purpose of obtaining a reply, under art. 11, I, of Law No. 13.709/2018, and is confined to that purpose, following the deletion period in section 8.

Third-party data that may be mentioned in a message is not used for any purpose other than replying to the sender and is subject to the same deletion period.

6. Processors and recipients

Data is processed by the following agents, in the roles indicated:

1. Web3Forms — processor; receives the form submission and forwards it to the firm's mailbox.
2. Cloudflare, Inc. — processor; hosting of the site, access logging and audience measurement.
3. Google LLC — processor; the firm's email and storage (Google Workspace). It is there that a message sent through the form is received and kept, and it is the environment in which the firm works on documents.
4. Anthropic PBC — processor; an artificial intelligence tool used to support analysis, drafting and the organization of the work. The content of pleadings, case updates and documents may be submitted to it. Sensitive personal data is not submitted to the tool, as defined in art. 5, II, of Law No. 13.709/2018 — a decision of the controller, recorded in the register of processing activities. Its use supports the lawyer's work, and the lawyer remains responsible for the analysis and for the decision: there is no automated processing intended to define a profile or to decide on the data subject's interests, which places it outside art. 20 of the same law and the right to review provided there.
5. D4Sign — processor; electronic signature of the engagement proposal, once the prospective client has indicated acceptance and the engagement is being formalized. It processes the signatories' name, email address, Brazilian taxpayer number (CPF), IP address and the record of the signing act itself. The signature precedes the constitution of the professional relationship — it is the act that constitutes it — and therefore still falls within the preliminary steps under art. 7, V. This agent is based in Brazil, so no international transfer arises from that processing.

The communications in section 4.4 are sent by the firm itself or by a processor it engages, which is added to the list above upon engagement.

Personal data is not shared with companies in the same economic group, correspondent law firms, advertising companies, data brokers, or any third party pursuing its own purposes. Personal data is not sold, assigned for consideration, or exchanged.

Data may be disclosed to a judicial or administrative authority upon a lawfully grounded request, subject to the professional privilege described in section 9 and to the right to challenge the request.

7. International transfer of data

Some of the agents listed in section 6 are based outside Brazil. D4Sign is based in Brazil, and the processing entrusted to it involves no international transfer. As to the others, transfers occur under the following provisions of art. 33 of Law No. 13.709/2018:

1. Contact form data transmitted to Web3Forms: art. 33, IX, as a transfer necessary to give effect to art. 7, V, of the same law.
2. Technical access logs held by the hosting provider: art. 33, IX, as a transfer necessary to give effect to art. 7, II, as regards the retention required by art. 15 of Law No. 12.965/2014.
3. Other data transmitted to the hosting infrastructure, to audience measurement, to the email service and to the artificial intelligence tool: art. 33, II, subparagraph "b", under the standard contractual clauses approved by ANPD Resolution No. 19 of August 23, 2024, which established the International Data Transfer Regulation.

Subparagraph "d" of the same item — seals, certificates and codes of conduct — is not relied upon, because the Brazilian National Data Protection Authority has not, to date, approved any regime of that kind.

8. Retention and deletion

8.1 Data arising from the site

1. Messages received through the form that do not result in an engagement: deleted within twelve months of the last interaction with the sender.
2. Technical access logs: retained for the period set by art. 15 of Law No. 12.965/2014, save for a court order requiring longer retention.
3. Audience metrics: retained only in aggregate form, with no data permitting the visitor to be identified.
4. Opt-in data for the communications in section 4.4: retained while the opt-in remains in force. Once withdrawn, the address is deleted and only the record of the opt-in and of the withdrawal is kept, for the period necessary to the regular exercise of rights, under art. 16, III, of Law No. 13.709/2018.

8.2 The firm's archive

The archive is not homogeneous. Each layer answers to its own rule:

8.3 Common rules

Once processing ends, data is deleted under art. 15 of Law No. 13.709/2018, save for the retention grounds in art. 16 of the same law, in particular compliance with a legal or regulatory obligation and the regular exercise of rights.

Anonymization does not depend on any period elapsing. Once what identifies a person is removed, the document ceases to be personal data and falls outside the law, under its art. 12. The firm does this as soon as the matter closes, and the sooner the better: every anonymized document is one less item of personal data retained. The measure operates in the data subject's favor, who ceases to be identified or identifiable — it is not a reservation against them. A document containing sensitive personal data does not become part of the technical archive, even anonymized, because the risk of re-identification does not justify the gain.

There is no return of documents. The firm receives material in digital form only, and the copy it keeps deprives the client of nothing, since the original remains with them. The cycle has two phases — anonymize and delete. The duty to account under art. 12 of the Bar's Code of Ethics remains, but it bears on funds, not on documents.

Deletion is deliberate, not automatic: art. 16 requires that it be possible, not that it be routine, and in digital form what is erased cannot be undone.

As to data that merely passes through a processor: what is submitted to the artificial intelligence tool does not give rise to a separate record held by the firm, and its retention by the processor is governed by the contract with it. Electronic signature data is retained for the period necessary to evidence the engagement.

9. Professional privilege

Information received through the site is protected by the professional privilege of the lawyer even if no professional relationship comes about, and that privilege is an additional and independent layer of protection alongside the regime of Law No. 13.709/2018.

Applicable in that capacity are: art. 34, VII, of Law No. 8.906/1994, which makes it a disciplinary offense to breach professional privilege without just cause; art. 7, II, of the same law, on the inviolability of the lawyer's place of work, files, data and communications; and arts. 35 to 38 of the Bar's Code of Ethics and Discipline (Resolution No. 02/2015 of the Federal Council of the Brazilian Bar Association), which address the duty of confidentiality and its limits.

The privilege may be asserted against third parties and survives the end of the contact, save in the exceptions provided by the rules of the profession themselves.

10. Information security

The firm adopts technical and administrative measures to protect personal data from unauthorized access and from accidental or unlawful destruction, loss, alteration, communication or dissemination, as required by arts. 46 to 49 of Law No. 13.709/2018.

As a small-scale processing agent, the firm maintains a simplified information security policy, with essential and necessary requirements, under art. 13 of ANPD Resolution No. 2/2022, having regard to the structure, scale and volume of its operations. That is an internal document, subject to periodic review.

The measures in force comprise: encrypted transmission between the browser and the site; restriction of access to messages received to those who need them in order to reply to the data subject; and access control over the accounts used in processing.

No security measure eliminates risk entirely. The firm does not state or warrant that data transmitted over the internet or stored by the agents listed in section 6 is absolutely secure.

11. Security incidents

Where a security incident occurs that may give rise to relevant risk or harm to data subjects, the firm notifies the Brazilian National Data Protection Authority and the affected data subjects, under art. 48 of Law No. 13.709/2018 and ANPD Resolution No. 15 of April 24, 2024.

The regulatory period of three business days is doubled by force of art. 14 of ANPD Resolution No. 2/2022.

12. Rights of the data subject

In relation to data processed by reason of the site, the data subject may exercise the rights in art. 18 of Law No. 13.709/2018:

1. Confirmation that processing exists (item I).
2. Access to the data (item II).
3. Correction of incomplete, inaccurate or out-of-date data (item III).
4. Anonymization, blocking or deletion of unnecessary or excessive data, or data processed otherwise than in accordance with the law (item IV).
5. Portability to another service or product provider, upon express request, subject to the authority's regulations and to trade and industrial secrets (item V).
6. Deletion of data processed on the basis of consent, save in the cases in art. 16 (item VI).
7. Information about the public and private entities with which the controller has shared data (item VII).
8. Information about the possibility of withholding consent and about the consequences of doing so (item VIII).
9. Withdrawal of consent, under art. 8, § 5 (item IX).

The data subject may also object to processing carried out on a basis that dispenses with consent, where the law has not been complied with, under art. 18, § 2 — which reaches, in particular, the processing described in section 4.3.

Exercising these rights is free of charge (art. 18, § 5) and depends on the data subject being identifiable within the data held. Where the firm holds no means of linking the data to an identified person — as with the aggregate metrics in section 4.3 — art. 12 of Law No. 13.709/2018 applies and the request may not be capable of being met, which will be explained with reasons.

13. Exercising rights, and response times

Requests should be addressed to privacidade@fanton.adv.br, identifying the data subject and describing the right being exercised.

Applicable periods, in the firm's capacity as a small-scale processing agent:

1. Confirmation that processing exists and access to the data, in simplified format: within fifteen days of the request, under art. 15 of ANPD Resolution No. 2/2022, which relaxes the immediate response required by art. 19, I, of Law No. 13.709/2018.
2. A clear and complete statement as to the origin of the data, the absence of a record, the criteria used and the purpose of the processing: thirty days from the request, being the fifteen-day period in art. 19, II, of Law No. 13.709/2018 doubled by art. 14 of ANPD Resolution No. 2/2022.
3. Other requests by the data subject: twice the period applicable to other processing agents, under art. 14 of ANPD Resolution No. 2/2022.

A request that is not granted receives a reasoned reply stating the factual or legal grounds for the refusal, under art. 18, § 4, of Law No. 13.709/2018.

14. Complaint to the authority

The data subject may petition against the controller before the Brazilian National Data Protection Authority, under art. 18, § 1, of Law No. 13.709/2018, preferably after having exercised the right before the firm through the channel in section 13.

15. Changes to this policy

This policy may be amended at any time. The version in force is the one published on this page, identified by the last-updated date shown at the beginning of the document.

Where information changes as to the specific purpose of processing, the form and duration of processing, the identity of the controller, or the sharing of data, the controller informs the data subject with specific prominence given to the substance of the change, as provided in art. 8, § 6, of Law No. 13.709/2018. Where consent is required, the data subject may withdraw it if they disagree with the change.

16. Applicable law

Law No. 13.709/2018 (General Data Protection Law); Law No. 12.965/2014 (Internet Civil Rights Framework); Law No. 8.906/1994 (Statute of the Legal Profession and of the Brazilian Bar Association), the Bar's Code of Ethics and Discipline and Provimento No. 205/2021 of its Federal Council; ANPD Resolution No. 2 of January 27, 2022; ANPD Resolution No. 15 of April 24, 2024; ANPD Resolution No. 19 of August 23, 2024.