Our Privacy Policy

This Privacy Policy outlines how we handle and safeguard your personal data when you access and interact with our website available via https://www.paxrocket.pt/ or contact us via other communication channels.

The data processing explained in this Policy is managed by Patricio Pestana & Associados - Sociedade De Advogados SP RL, located at Av. Eng. Duarte Pacheco, Amoreiras, Torre 1 – 14.º andar – Sala 1 1070-101, Lisbon, Portugal (referred to as "the Law Firm", "we", "our", or "us"). The Law Firm is responsible for the data processing activities detailed in this policy and acts as data controller.

Unless stated otherwise in this Privacy Policy, the terms used here have the same definitions as in the European Union's General Data Protection Regulation ("GDPR").

Categories of personal data collected

We gather personal data for different purposes as you interact with us. We process:

• Contact information: full name, email address; social media handles/usernames;
• Professional affiliation: company/employer; role/title; company development phase;
• Inquiry and matter details: any free-text message via contact form, scheduled calls and time preferences;
• Communication data: content of emails, social media direct messages, comments, and our replies;
• Social media activity: public profile information and posts that mention or interact with our pages; engagement signals visible to us (follows, likes, shares, comments);
• Publicly available data: information obtained from social media, internet searches, and public directories.

You are under no obligation to provide your personal data. Nonetheless, it's important to be aware that we may not be able to fully work with you without the essential personal data required to fulfil the contractual obligations between you and us.

We acquire information about you as you engage with us, both directly and indirectly. This includes:

Direct collection

• When you submit inquiries or feedback through our website contact forms;
• When you email us or reply to our emails;
• When you engage us for services and provide information during intake, consultations, or ongoing matter handling (including via email and social media).

Indirect collection

• From public social media content on LinkedIn and Instagram;
• From internet searches (e.g., search engines surfacing public information);
• From public directories and registers (e.g., company websites, corporate registries, professional listings).

Overview of our purposes for data processing

The legal basis we use to process your personal data will depend on the category of personal data collected, as well as the purpose for which it is collected.

Contractual obligations: We process your personal data to fulfil our contractual obligations or to take pre-contractual measures related to a contract to be concluded with you. We rely on these contractual obligations:

• To evaluate and respond to your inquiry (contact forms, email, or social media) and take steps at your request before entering into an engagement;
• To verify your identity and contact details needed to discuss your matter and communicate with you;
• To schedule and conduct consultations, meetings, and communications about your inquiry or matter;
• To manage your matter, including managing documents, and service-related updates and alerts.

Consent: We may rely on the voluntary consent you provide when we collect your personal data. We do so:

• To publish your reviews, testimonials, and comments on our website or social media;
• To provide you with news and general information about the services we offer.

Legitimate interests: We rely on legitimate interests based on our assessment that the processing is necessary for the purposes we pursue and does not infringe on your interests, fundamental rights and freedoms. We rely on our legitimate interests:

• Operate, secure, and maintain our website, contact forms, email, and IT systems (spam/malware filtering, abuse detection, rate-limiting, error and access logs, uptime monitoring), keep services reliable, secure, and available;
• Analyse inquiries, Q/A responses, and feedback to improve our site, forms, communications, and services, as well as enhance user experience and service quality;
• Maintain a CRM of clients, prospects, referrers, and business contacts, in order to grow and manage our business relationships;
• Detect, prevent, and investigate suspicious or unlawful activity;
• Establish, exercise, or defend legal claims; manage complaints and disputes.

Legal compliance: We process personal data when necessary to fulfil the legal and regulatory obligations we are subject to. We rely on our legal obligations:

• To comply with applicable laws, regulations, and professional conduct rules governing legal services;
• To perform mandatory client due diligence (KYC/AML), conflict checks, and sanctions screening where required.

Our contact form

You can use the contact form on our website to contact us for any request. We will process the personal data included therein, such as your name, e-mail address and any other information you choose to provide to us in your message only for answering your request. We do so to take steps at your request prior to entering a contract with you or to perform an already existing contract with you.

Links to third-party apps and websites

Our website contain links to websites or apps that are not operated by us. When you click on a third-party link, you will be directed to that third-party's website or app. We have no control over the content, privacy policies, or practices of any third-party websites or services.

We maintain online presences on social networks to, among other things, communicate with customers and prospective customers and to provide information about our products and services. If you have an account on the same network, it is possible that your information and media made available there may be seen by us. In addition, the social network may allow us to contact you. As soon as we transfer personal data into our own system, we are responsible for this independently. This is then done to carry out pre-contractual measures and to fulfil a contract with you. For the legal basis of the processing carried out by the social media networks under their own responsibility, please refer to their data protection declarations.

Below is a list of social media networks on which we have an online presence:

• LinkedIn: Privacy Policy;
• Instagram: Privacy Policy.

We store your personal data for the period necessary to fulfil the purposes for which it was collected, in accordance with the legal, regulatory and contractual obligations to which we are subject.

Once this storage period is over, we delete the personal data or irreversibly anonymise it.

Our service providers

We collaborate with third parties ("Service Providers") to support our data processing. They are granted access to your personal data solely to the extent required to carry out their tasks.

Categories of Service Providers that can access your personal data:

• Cloud service, hosting and infrastructure providers;
• E-mail and communication service providers;
• IT software providers;
• Online meeting and scheduling platforms;
• Social media and content platforms;
• Third-parties engaged in your matter, such as counsels, banks and other payment providers, KYC/AML service providers and postal or courier providers;
• Third-parties who assist us with the security of our platforms.

Third-country transfers

Please note that we make use of Service Providers located in countries outside the EU/EEA. These third countries may not offer a level of data protection equivalent to that of the EU/EEA.

To ensure the security of your personal data during these transfers, we fulfil applicable legal obligations by adopting appropriate safeguards. These safeguards include:

• Transfers to countries that have received an adequacy decision from the European Commission.
• Implementation of standard contractual clauses provided by the European Commission, in accordance with Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as well as supplementary measures for the transfer, when we consider that such measures are necessary to guarantee a level of protection essentially equivalent to that of the EU.

In cases where the transfer to a third country is based on standard contractual clauses provided by the European Commission, you have the right to request a copy of the clauses under which your personal data is transferred to that third country. However, the contract may be redacted in those parts that must remain confidential (i.e. other people's personal data). You can request the applicable copies by contacting: paxlegal@paxlegal.pt.

In the event of a transfer to a third country where adequacy decisions or appropriate safeguards are absent, it may be possible for authorities in that third country, such as intelligence services, to access the transferred personal data. Consequently, the enforceability of your data subject rights may not be guaranteed.

We and/or our Service Providers transfer your personal data to and process it in the following countries outside the EU/EEA:

• United States of America, based on an Adequacy Decision from the EU Commission.

We implement reasonable technical and organizational measures that we consider appropriate to safeguard your personal data from manipulation, loss, or unauthorized access by third parties. Our security measures are continuously updated to align with advancements in technology.

We place significant emphasis on our internal practices. Our staff and Service Providers are bound by confidentiality and must comply with relevant data protection laws. Moreover, they are granted access to personal data only to the extent necessary for the performance of their respective duties or obligations.

While we value the security of your personal data, please bear in mind that no method of transmitting data over the internet or electronic storage can be guaranteed 100% secure. While we make every effort to employ commercially reasonable measures to protect your personal data, we cannot provide absolute security. We recommend using antivirus software, firewalls, and similar tools to enhance the protection of your system.

You possess the following data protection rights. To exercise these rights, please reach out to us at the provided address or send an email to: paxlegal@paxlegal.pt. Please be aware that we may ask you to verify your identity before addressing your request.

• Right to access: You have the right to request a copy of your personal data, which we will provide to you in an electronic format.
• Right to rectification: You can request us to rectify any inaccuracies or incompleteness in your personal data.
• Right to withdraw consent: If you've given your consent for the processing of your personal data, you have the right to withdraw it at any time, affecting future processing. Once we receive your withdrawal of consent, we will no longer process your personal data for the purpose(s) you initially consented to, unless there is another legal basis for processing.
• Right to erasure: You have the right to request the deletion of your personal data when it is no longer necessary for the purposes it was collected, or if it was processed unlawfully.
• Right to restrict the processing: You can request the limitation of our processing of your personal data in cases where you believe it to be inaccurate, processed unlawfully, or no longer needed for the original purpose, but cannot be deleted due to legal obligations or your own request.
• Right to data portability: You can request that we transmit your personal data to another data controller in a standard format (e.g., excel), if you provided this data to us and we processed it based on your consent or to fulfil contractual obligations.
• Right to object to the processing: If the legal basis for processing your personal data is our legitimate interest, you have the right to object to such processing based on your specific situation. We will respect your request unless we have a compelling ground for the processing that outweighs your interests.
• Right to file a complaint with a supervisory authority: If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a data protection supervisory authority. In the EU and EEA, you can exercise this right by contacting a supervisory authority in your country of residence, workplace, or where you believe the infringement occurred. You can find a list of the relevant authorities here: https://edpb.europa.eu/about-edpb/about-edpb/members.

We will respond to your requests within 30 days of receiving them. This response period may be extended if the request is particularly complex, which we will inform you of promptly. Within this period, we will respond to your request or inform you of the reasons why your request cannot be met.

Our Privacy Policy may be updated from time to time. We advise you to check this Privacy Policy periodically for any changes.

Changes to this Privacy Policy take effect from the moment they are published on this page.

If you have any inquiries or concerns regarding this Privacy Policy, please do not hesitate to contact us at:

• Patricio Pestana & Associados - Sociedade De Advogados SP RL
• Av. Eng. Duarte Pacheco, Amoreiras, Torre 1 – 14.º andar – Sala 1 1070-101, Lisboa, Portugal
• paxlegal@paxlegal.pt