Last updated: 20 October 2026
This Policy is published at https://www.euronex.pt/privacy-policy.html (Portuguese version: https://www.euronex.pt/politica-de-privacidade.html).
This Privacy Policy explains how personal data is processed when collected through the website www.euronex.pt, its contact forms and advertising lead forms (Google and Meta), and in the course of providing legal services.
It is governed by Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), Portuguese Law no. 58/2019 of 8 August, and Portuguese Law no. 41/2004 of 18 August (electronic communications and cookies). For data subjects located in Brazil, or whose data is collected for the purpose of offering services in Brazil, Brazilian Law no. 13,709/2018 (General Personal Data Protection Law – LGPD) also applies.
This English version is provided for convenience. In case of discrepancy, the Portuguese version prevails.
1. Data controller
The data controller is André Graça, a lawyer in individual practice, registered with the Portuguese Bar Association (Ordem dos Advogados, professional licence no. 66932P) and with the Brazilian Bar Association (OAB 217835/SP), practising under the trade name Euronex.
- Tax ID (NIF): 309660513
- Professional address: Rua Orfeão do Porto, n.º 205, 6.º B, 4150-798 Porto, Portugal
- Telephone: +351 911 790 146
- Privacy contact email: andre@euronex.pt
"Euronex" is the name of this website and the brand under which the services are promoted. The brand is owned by EURODREAMS ASSESSORIA CONSULAR LTDA (São Paulo, Brazil), which does not process personal data of users of this website.
Data Protection Officer (DPO / LGPD "Encarregado")
No Data Protection Officer has been designated, as this is not mandatory under Art. 37 GDPR. All requests concerning personal data may be sent to andre@euronex.pt, which is the communication channel with data subjects and supervisory authorities. For LGPD purposes, this address serves as the "encarregado" communication channel under Art. 41 LGPD and ANPD Resolution CD/ANPD no. 2/2022 (small-scale processing agents).
2. Personal data we process
a) Data you provide via the website and advertising lead forms (Google Ads and Meta – Facebook/Instagram):
- name;
- email address;
- telephone number (including WhatsApp, if you provide it);
- answers to qualification questions, such as monthly passive income (in ranges), expected timeframe for moving to Portugal, type of procedure sought and interest in receiving a service proposal;
- the content of messages you send us.
b) Technical and advertising campaign data:
- Google ad click identifiers (gclid, gbraid, wbraid);
- the lead identifier generated by Meta (lead ID) and the source campaign/form;
- only if you consent to advertising: data processed by the Google Ads tag (identifiers stored in cookies and in the browser's local storage, IP address, browser, conversion page and date/time) and, when you submit a form, your email, phone number, first name and last name converted in your browser into an irreversible code (SHA-256 hash) before being sent to Google (see sections 3 and 9);
- technical data needed for the operation and security of the site, processed by the hosting provider (e.g. IP address and server access logs).
c) Data provided in the course of legal services (only if you become our client): identity and travel documents, marital status and parentage data, data on family members and dependants, income information, employment status, criminal record, address and other documents required for the relevant procedure (for example, before AIMA, IRN or consular posts). Some of this data may be sensitive or special-category data; it will be processed only to the extent strictly necessary for the engagement and with the applicable legal safeguards.
We do not request special-category data (e.g. health, ethnic origin or religion) through the website or ads. Please do not include such data in contact messages.
3. Purposes and legal bases
| Purpose | GDPR legal basis | LGPD legal basis |
|---|---|---|
| Responding to contact and information requests, assessing your profile and sending a service proposal at your request | Pre-contractual steps at the data subject's request (Art. 6(1)(b)) | Preliminary procedures related to a contract (Art. 7, V) |
| Providing legal services and managing the client relationship (including invoicing) | Performance of a contract (Art. 6(1)(b)) | Performance of a contract (Art. 7, V) and regular exercise of rights (Art. 7, VI) |
| Compliance with legal and professional obligations (tax, accounting, professional secrecy and duties under the Statute of the Portuguese Bar Association; anti-money laundering, where the services provided fall within the scope of Law no. 83/2017) | Legal obligation (Art. 6(1)(c)) | Compliance with a legal or regulatory obligation (Art. 7, II) |
| Sending marketing communications (legislative updates, newsletters, campaigns) | Consent (Art. 6(1)(a)) | Consent (Art. 7, I) |
| On-site advertising: Google Ads conversion measurement ("Lead" conversion on form submission) and remarketing lists | Consent given in the cookie banner (Art. 6(1)(a) and Art. 5 of Law 41/2004) | Consent (Art. 7, I) |
| Website leads — enhanced conversions: on form submission, sending your email, phone number, first and last name to Google as SHA-256 hashes | Advertising consent given in the cookie banner (Art. 6(1)(a)) | Consent (Art. 7, I) |
| Website leads — offline conversions: when your request is internally classified as "qualified", sending the click identifier (gclid/gbraid/wbraid) linked to the request to Google Ads | Advertising consent given in the cookie banner (Art. 6(1)(a)) | Consent (Art. 7, I) |
| Meta instant-form leads: sending a "qualified lead" event to Meta (via the Conversions API), with the lead ID and hashed identifiers | Legitimate interest (Art. 6(1)(f)) — see note below | Legitimate interest (Art. 7, IX, and Art. 10) |
| Internal recording of the campaign or form your request came from in our contact management system, with no disclosure to third parties | Legitimate interest (Art. 6(1)(f)) | Legitimate interest (Art. 7, IX, and Art. 10) |
| Website security, abuse prevention and defence of rights in judicial or administrative proceedings | Legitimate interest (Art. 6(1)(f)) | Legitimate interest (Art. 7, IX) and regular exercise of rights (Art. 7, VI) |
Website leads and advertising consent: enhanced conversions and offline conversions rely solely on the advertising consent you give in the cookie banner (ad_storage and ad_user_data signals). The click identifier is only stored if you accepted. If you rejected cookies, your request has no click identifier attached and nothing is sent to Google: your request is processed only to reply to you. You may withdraw consent at any time (section 9); withdrawal does not affect data already sent.
Meta leads — legitimate interest and balancing test: when you contact us through an instant form on Facebook or Instagram, an event indicating that the lead was qualified may be sent to Meta, in order to measure and optimise the campaign that generated it. We have balanced this interest against your rights:
- the data was already generated on Meta's own platform, when you completed the form;
- we send only the minimum necessary (the lead ID and hashed identifiers), without your form answers or any other information about your case;
- no new profile is created beyond measuring the campaign concerned;
- this is a use you can reasonably expect when responding to an ad.
You have the right to object to this processing at any time (Art. 21 GDPR; Art. 18, § 2, LGPD), simply by emailing andre@euronex.pt. Once you object, no further events concerning your lead are sent.
Internal recording of the source of a request: we have an interest in knowing which campaigns generate contact requests. This record stays in our internal system, involves no decisions about you and is not shared with advertising platforms. You may object at any time (section 8).
We do not carry out solely automated decision-making, including profiling, that produces legal effects or similarly significantly affects you. Qualification answers only guide the first contact; your case is always assessed by a lawyer.
4. Professional secrecy
All information you provide in a consultation or engagement is subject to lawyers' professional secrecy under the Statute of the Portuguese Bar Association (Law no. 145/2015 of 9 September) and, where applicable, the Brazilian Statute of the Legal Profession and the OAB (Law no. 8,906/1994). Data is disclosed to third parties only where necessary to perform the engagement, with your authorisation, or where required by law.
5. Recipients and processors
Your data may be accessed by the controller's staff bound by confidentiality duties, to the extent necessary for their functions, and by the following service providers acting as processors (operators, under the LGPD) on our behalf and on our instructions or, where indicated, as independent controllers:
| Provider | Service |
|---|---|
| Google (Google Ireland Ltd. / Google LLC) | Google Ads (advertising, conversion measurement, enhanced and offline conversions, remarketing); Google Workspace (email, document storage, calendar) |
| Meta Platforms (Meta Platforms Ireland Ltd. / Meta Platforms, Inc.) | Facebook and Instagram instant forms (lead ads) and the Conversions API ("qualified lead" events); WhatsApp / WhatsApp Business, when you choose to communicate this way |
| Zapier, Inc. (USA) | Automated integration: receives website form data (webhook) and Meta leads and sends them to Pipedrive; sends offline conversions to Google Ads and "qualified lead" events to Meta |
| Plane Marketing Digital LTDA (Bravun, bravunleads.com), CNPJ 60.729.912/0001-20, Itajubá/MG, Brazil | Integration of Meta leads with Pipedrive |
| Pipedrive OÜ | Contact and client management (CRM), where requests received from the website and from Meta are recorded |
| Hostinger International Ltd. (Larnaca, Cyprus) | Website hosting |
Note on advertising platforms: when you complete a Meta lead form or interact with Google ads, those platforms also process data for their own purposes, as independent controllers or, for certain operations, as joint controllers with us, in accordance with their privacy policies (Google: policies.google.com/privacy; Meta: www.facebook.com/privacy/policy).
Public authorities and bodies: in the course of an engagement, and only to the extent necessary, your data may be disclosed to AIMA – Agency for Integration, Migration and Asylum, IRN – Institute of Registries and Notary, consular posts, civil registries, courts, the Tax Authority or other competent bodies, and to other professionals (e.g. translators or correspondent lawyers) with your knowledge. It may also be disclosed to authorities where required by law.
We do not sell your personal data.
6. International transfers
Some of the providers listed may process data outside the European Economic Area (EEA), notably in the United States (e.g. Zapier, which receives website form data, and the parent companies of Google and Meta). In such cases, transfers are based on:
- the European Commission adequacy decision on the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795), where the recipient is certified; and/or
- the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914), with supplementary measures where necessary.
As regards Brazil, the European Commission has recognised that Brazil ensures an adequate level of protection (Commission Implementing Decision (EU) 2026/179 of 26 January 2026, published in the Official Journal of the European Union, L series, on 28 January 2026), so transfers from the EEA to Brazil may take place on the basis of that decision (Art. 45 GDPR). Brazil has reciprocally recognised the adequacy of the European Union (ANPD Resolution CD/ANPD no. 32 of 26 January 2026).
For LGPD-governed data transferred outside Brazil, transfers are based on Art. 33 LGPD, namely the ANPD's recognition of the adequacy of the European Union (Resolution CD/ANPD no. 32/2026; Art. 33, I, LGPD), the standard contractual clauses approved by the ANPD (Resolution CD/ANPD no. 19/2024) or, where applicable, necessity for the performance of a contract or preliminary procedures at the data subject's request.
You may request further information on the applicable safeguards at andre@euronex.pt.
7. Retention periods
| Category | Period |
|---|---|
| Contacts and leads who do not become clients | 24 months from the last contact, unless consent is withdrawn or an objection is made earlier |
| Consent-based marketing data | Until consent is withdrawn or up to 24 months without interaction, whichever occurs first |
| Client data and documents | For the duration of the engagement and up to 1 year after it ends. Data and documents that the law requires us to keep for longer (rows below) are kept only for the statutory period and solely for that purpose. Where a dispute or claim is pending, the necessary data is kept until it is finally resolved |
| Tax and accounting documents | 10 subsequent calendar years (Art. 118 of the Portuguese Personal Income Tax Code (CIRS), Art. 52 of the Portuguese VAT Code (CIVA) and Art. 19 of Decree-Law no. 28/2019 of 15 February), or until the tax assessment limitation period expires, if longer |
| Data collected for anti-money laundering purposes | Where the services provided fall within the scope of Law no. 83/2017, the data is retained for 7 years after customer identification or the end of the business relationship and, for transaction records, after the transaction is carried out (Art. 51 of Law no. 83/2017) |
| Cookies | As set out in the table in section 9 |
After these periods, data is deleted or anonymised.
8. Your rights
Under Articles 15 to 22 GDPR and Art. 18 LGPD, you have the right to:
- confirmation and access to your data;
- rectification of inaccurate or incomplete data;
- erasure of data, in the cases provided by law;
- restriction of processing;
- data portability;
- object to processing based on legitimate interest and, at any time, to processing for direct marketing;
- anonymisation, blocking or deletion of unnecessary, excessive or unlawfully processed data (LGPD);
- information about the entities with which your data is shared and about the possibility of refusing consent and its consequences (LGPD);
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
- not be subject to solely automated decisions and, under the LGPD, request review of such decisions.
Some rights may be limited by professional secrecy or by statutory retention obligations.
How to exercise them: send a request to andre@euronex.pt or by post to Rua Orfeão do Porto, n.º 205, 6.º B, 4150-798 Porto, Portugal. We may ask for additional information to verify your identity. Exercising your rights is free of charge.
Response time: we respond within one month of receipt, extendable by two further months where necessary given the complexity, with prior notice (Art. 12(3) GDPR). For data subjects covered by the LGPD, confirmation of existence of processing or access in full format is provided within 15 days of the request (Art. 19, II, LGPD); simplified confirmation is provided immediately.
Complaints: you have the right to lodge a complaint with the competent supervisory authority:
- Portugal: Comissão Nacional de Proteção de Dados (CNPD) – www.cnpd.pt
- Brazil: Autoridade Nacional de Proteção de Dados (ANPD) – www.gov.br/anpd
We recommend contacting us first so that we can try to resolve the matter directly.
9. Cookies and similar technologies
Cookies and local storage (localStorage) allow information to be stored on your device. The site uses only two categories:
- Necessary: essential for the site to work and to record your cookie choice. No consent required.
- Advertising: Google Ads conversion measurement, enhanced conversions, offline conversions and remarketing lists. Only enabled if you accept.
The site does not use Google Analytics, the Meta Pixel or Google Tag Manager. The site's fonts and scripts are hosted on the site's own server: before you consent, the site loads no third-party resources and makes no requests to Google.
Consent banner. On your first visit, our own banner is shown, with "Accept" and "Reject" buttons of equal prominence. The Google Ads tag (gtag.js, ID AW-16551118208) is only loaded after you click "Accept". At that point, the Google Consent Mode v2 signals (ad_storage, ad_user_data, ad_personalization) are set to "granted"; if you reject, the tag is not loaded.
Recording your choice. Your choice (accept or reject), its date and its validity are stored in your browser's local storage under the key euronex_consent_v2 for 6 months, after which we ask again.
Changing or withdrawing consent. You can change your choice at any time via the "Cookie settings" link in the footer of every page. If you withdraw consent, the stored click identifiers (euronex_gclid, euronex_gbraid, euronex_wbraid) are deleted, consent is set to "denied" and no further data is sent to Google from your browser. You can also delete cookies and site data in your browser settings.
| Name | Type / domain | Category | Purpose | Duration |
|---|---|---|---|---|
| euronex_consent_v2 | Local storage (euronex.pt) | Necessary | Store your cookie choice (status, date and validity) | 6 months |
| euronex_gclid / euronex_gbraid / euronex_wbraid | Local storage (euronex.pt) | Advertising | Store the Google ad click identifier to attribute the conversion to your request | 90 days; only after consent |
| _gcl_au | Cookie (euronex.pt), set by Google | Advertising | Google Ads conversion measurement | 90 days; only after consent |
| IDE, test_cookie, ar_debug | Third-party cookies (doubleclick.net – Google) | Advertising | Google ad remarketing, measurement and debugging | Up to 13 months; only after consent |
Google cookie durations follow Google's documentation and may be changed by Google.
10. Minors
Our services and communications are not directed at minors. Minors' data is processed only where they are dependants in family immigration procedures, provided and managed through their parents or legal representatives, and in the child's best interests (Art. 14 LGPD).
11. Security
We apply appropriate technical and organisational measures to protect data against unauthorised destruction, loss, alteration, disclosure or access, including encrypted communications (HTTPS), access control with strong authentication, need-to-know access, processing agreements with data protection safeguards, and confidentiality and professional secrecy duties. No system is entirely risk-free; in the event of a personal data breach likely to result in a risk to you, we will notify the competent authority and, where required, the affected data subjects.
12. Links to other websites
The site may contain links to third-party websites (e.g. public bodies or social networks). We are not responsible for their privacy practices.
13. Changes to this policy
We may update this Policy to reflect legal changes or changes to our services. The version in force is always the one published on this page, with the date of the last update. Material changes will be highlighted on the site.
14. Contact
For any question about this Policy or your personal data: andre@euronex.pt | +351 911 790 146 | Rua Orfeão do Porto, n.º 205, 6.º B, 4150-798 Porto, Portugal.
Last updated: 20 October 2026