Privacy Policy

01Purpose and scope

This Policy explains, clearly and concisely, how Torres Soares Advocacia processes personal data in the course of its activities, in accordance with Law No. 13.709/2018 - the Brazilian General Personal Data Protection Law (LGPD) - and with the applicable regulations of the Brazilian National Data Protection Authority (ANPD).

It applies to website visitors, individuals who contact the firm, clients and prospective clients, their representatives and agents, suppliers, correspondent lawyers, partners, applicants and natural persons whose data appears in documents, proceedings, records or databases processed in the provision of legal services and in projects related to legal management.

This is the firm's public transparency instrument. Processing records, contracts, matrices, assessments, evidence and detailed procedures are kept internally and will be presented where legally applicable, subject to professional secrecy, trade and industrial secrets, information security and the rights of third parties.

02Controller and Data Protection Officer

Controller: Torres Soares Advocacia, CNPJ (Brazilian company register) No. 39.349.984/0001-56, with registered office at Avenida Luiz Carlos Prestes, No. 410, Suite 319, Barra da Tijuca, Rio de Janeiro/RJ, CEP 22.775-055.

Controller contact: atendimento@torressoares.com

Data Protection Officer (DPO): Larissa Nascimento Soares.

Channel for privacy matters and data subject rights: dpo@torressoares.com

03The firm's role in processing operations

The firm's role is defined according to the operation carried out and the decisions actually taken. The firm acts as controller when it determines the purposes and the essential elements of the processing for its own activities. When it processes personal data on behalf of a client that defines those purposes and provides documented instructions, it acts as processor and cooperates with the controller client in complying with the applicable obligations.

04Data processed, purposes and legal bases

The firm processes only the data that is adequate and necessary for the purposes of each relationship or service. Depending on the context, the main operations are:

• Enquiries and engagement: identification and contact data and the content of the request, as well as, where applicable, documents submitted through the dedicated applications channel, in order to respond to the contact, assess the demand and take preliminary steps towards engagement.
• Provision of legal services and projects: data contained in contracts, documents, proceedings, communications, records and databases provided or lawfully accessed, in order to perform the service, comply with professional duties and exercise or defend rights.
• Administrative, contractual and legal management: data of representatives of clients, suppliers, correspondent lawyers and partners, including information necessary for payments, invoicing and compliance with legal, regulatory and professional obligations.
• Recruitment: curricular data, contact details, education, experience and application documents submitted through the dedicated channel, in order to conduct a selection process or to assess the application submitted.
• Website and security: data provided through the digital channels and the minimum technical records necessary for operation, protection of the environment, fault diagnosis and the prevention or investigation of incidents.

Data may be obtained directly from the data subject or, depending on the activity, from clients, representatives, documents, parties and participants in proceedings, authorities, lawfully accessible sources and service providers.

Processing is carried out, as the case may be, for the performance of a contract or of preliminary procedures requested by the data subject, compliance with a legal or regulatory obligation, the regular exercise of rights, the pursuit of legitimate interests assessed and documented, or on the basis of specific consent, where that is the appropriate basis.

Sensitive personal data is processed only where indispensable and on the grounds of Article 11 of the LGPD, in particular for compliance with a legal or regulatory obligation, the regular exercise of rights or, where applicable, on the basis of specific and highlighted consent.

05Data sharing

The firm does not trade personal data. Sharing occurs only where necessary for the stated purpose or for compliance with an applicable obligation, including with: controller clients and persons authorized by them; the Judiciary, public bodies, arbitral tribunals, parties and other participants in proceedings; correspondent lawyers and partners necessary for the provision of the service; providers of technology, hosting, communications, accounting and financial services; and competent authorities.

The firm is accountable for the processing in which it acts as controller. Providers acting as processors must process the data in accordance with the applicable legislation.

06International transfers

As a result of the use of technology, hosting and communications services, international transfers of personal data may occur. Where applicable, the firm will observe Articles 33 to 36 of the LGPD and the ANPD regulations, adopting a valid legal mechanism and limiting the operation to what is necessary for its purpose.

Additional information on international transfers will be made available clearly and accessibly when required by the applicable legislation or regulations, according to the operation actually carried out.

07Retention and erasure

Data is retained for as long as necessary for the stated purposes and, where applicable, for compliance with legal, regulatory, contractual and professional obligations, the regular exercise of rights, the preservation of evidence or the instructions of the controller client.

Data submitted through the website forms is forwarded to the institutional service channel and is not stored by the form in a database of its own or in the website's uploads directory. Its subsequent retention, where necessary, takes place in the firm's communications environment and observes the purpose of the contact, the applicable time limits and the legal grounds for retention. Data relating to services and contracts follows the time limits applicable to the relationship and to the corresponding obligations. Applicants' data is retained during the selection process or for as long as necessary to assess the application submitted.

Once the purpose has been fulfilled and in the absence of a legal ground for retention, the data is erased or anonymized, within the scope and the technical limits of the activities.

08Security and governance

The firm adopts technical and administrative measures compatible with the nature of the data, the purposes and the risks of the processing, intended to protect personal data against unauthorized access and accidental or unlawful destruction, loss, alteration, disclosure or improper processing.

Controls, evidence, responsibilities and procedures are documented internally. Incidents involving personal data are handled and communicated to the ANPD and to data subjects where required by the applicable legislation and regulations.

09Data subject rights

Under the LGPD, the data subject may request, where applicable:

• confirmation of the existence of processing and access to the data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or erasure of unnecessary or excessive data, or of data processed in breach of the law;
• portability of the data, subject to the ANPD regulations and to trade and industrial secrets;
• erasure of data processed on the basis of consent, except in the cases of retention provided for by law;
• information on the public and private entities with which the data has been shared;
• information on the possibility of withholding consent and on the consequences of doing so;
• withdrawal of consent;
• objection to processing carried out without consent, in the event of non-compliance with the LGPD; and
• review of decisions taken solely on the basis of automated processing that affect the data subject's interests.

Requests must be sent, free of charge, to dpo@torressoares.com. The firm may request information strictly necessary to confirm the identity of the requester and will respond within the applicable time limits. Where it acts as processor, it will forward the request to the controller client and cooperate with the appropriate measures.

The data subject may also petition the ANPD, subject to the procedures published by the Authority and to the prior submission of the request to the controller where required for such petition.

10Website, cookies and digital channels

The torressoares.com website uses cookies and similar resources as described on the Cookies page, including for the operation of the pages, security and the receipt of enquiries.

Audience measurement and website improvement

When you authorise analytics cookies, we use Google Analytics 4 and Google Tag Manager (Google LLC) and Microsoft Clarity (Microsoft Corporation) to understand, in aggregate, how the website is used. Google Tag Manager is a tool for managing and firing measurement tags, loaded only after consent for analytics cookies.

Data processed: pages visited, time on page, source of the visit, device and browser type, approximate region derived from the IP address, clicks on buttons and links and, in Clarity, replay of navigation with masking applied in accordance with the configuration adopted by the firm, at the most restrictive level offered by the tool.

What we do not process: we do not send to these tools any name, e-mail address, telephone number, content typed into forms, information about legal matters or any documents. The content of the contact form goes exclusively to the firm's e-mail.

On masking. Masking reduces, but does not entirely eliminate, the possibility of re-identification — which is why we treat this data as pseudonymised rather than anonymous. The actual behaviour of the masking is verified by us in testing before publication and reassessed whenever the website changes materially.

Legal basis: consent, under article 7, I, of Law No. 13,709/2018, given through the cookie notice and revocable at any time under “Cookie preferences” in the footer of every page. Withdrawal does not prevent use of the website.

Retention. In Google Analytics 4, detailed event and user data — that which allows exploratory and custom analysis — is retained for 14 months, a period set by us, after which it is deleted. Standard aggregated reports, such as totals of sessions, users and views per period, remain available regardless of that period, as they contain no individual-level data. In Microsoft Clarity, navigation recordings are retained for 30 days and aggregated data, including heatmaps, for 9 months, in accordance with the provider's periods, which we reconfirm in the official documentation on the date this Policy is published.

International transfer. Google and Microsoft process this data on servers outside Brazil, including in the United States, on the basis of the contractual clauses and data protection commitments of the respective processing agreements, under articles 33 et seq. of Law No. 13,709/2018.

Members of the firm may exclude their own visits from measurement. The exclusion is stored only in the browser's local storage, is not a cookie and does not identify anyone.

The forms and other digital channels process the data indicated in the fields and the content of the messages in order to assess and respond to the request or to take preliminary steps towards engagement. The institutional contact channel does not accept attachments. The Work With Us channel may receive exclusively application documents, subject to the limits disclosed in the form itself.

Senders should submit only the information and documents necessary for the purpose of the contact and should avoid sensitive data or third-party data that is not relevant or whose submission is not authorized. The form displays a brief notice of purpose and access to this Policy; its submission will not be treated as general consent for different purposes.

CVs should be sent through the channel indicated for recruitment. Submitting a CV through the website does not constitute authorization for any purpose other than the selection process or the assessment of the application submitted.

11Children and adolescents

The firm's institutional services and channels are not directed at children or adolescents. Data of minors that may appear in proceedings, documents or records is processed only where necessary for the corresponding purpose, with due regard for their best interests and for the applicable legislation.

12Amendments and effective date

The version of this Policy in force and its start date will be stated in the header. Material changes to the manner of processing or to data subject rights will be communicated by means proportionate to their relevance.

Version 1.0 of this Policy took effect on 28 August 2026 and replaced the draft previously made available.

Version 1.1 — effective date: 1 September 2026. This version describes the audience measurement tools addressed in section 10 — Google Analytics 4, Google Tag Manager and Microsoft Clarity — and replaces Version 1.0, of 28 August 2026.