Privacy Policy
This Privacy Policy explains how Atlantic Edge Universal Advisors, Lda (trading as Atlantic Advisory) collects, uses, shares and protects personal data, in compliance with Regulation (EU) 2016/679 — the General Data Protection Regulation (GDPR) — and with Portuguese Law no. 58/2019 of 8 August, which implements it in Portugal.
1.Data controller
Atlantic Edge Universal Advisors, Lda
Company registration / VAT number (NIPC): 517249251
Registered office: Rua dos Murças, 15 – 3.º L, 9000-058 Funchal, Portugal
E-mail: geral@atlantic-advisory.pt
Telephone: +351 214 064 192
Website: atlantic-advisory.pt
For any data protection matter or to exercise your rights, contact us at geral@atlantic-advisory.pt, marking your message "Data Protection", or by post to the registered office above.
2.Scope
This Policy applies to the processing of personal data carried out through the website atlantic-advisory.pt, our forms and contact channels (e-mail, telephone, social media), and in the context of commercial, pre-contractual and contractual relationships with us.
Personal data that we process on behalf of our clients when providing accounting, payroll, tax and corporate services is governed by the relevant services agreement and the corresponding data processing agreement entered into under Article 28 GDPR. In those cases we act as a processor and the client is the controller.
3.Categories of personal data
- Identification and contact data: name, company, job title, e-mail address, telephone number, postal address.
- Relationship data: the content of your messages and requests, communication history, services of interest.
- Contract and billing data: tax number, billing and payment details, contractual documentation.
- Data required by law: identification details and documents needed to comply with customer due diligence obligations under Portuguese Law no. 83/2017 of 18 August (anti-money laundering and counter-terrorist financing).
- Recruitment data: CV, academic and professional background and any other information you send through the Careers section or by e-mail.
- Browsing data: IP address, device and browser type, pages visited, date and time of access, referral source and cookie identifiers (see our Cookie Policy).
We do not knowingly collect special categories of data (Article 9 GDPR), such as health data, racial or ethnic origin, or religious or political beliefs. Please do not include such information in your messages unless strictly necessary and expressly requested by us.
4.Purposes and legal bases
We only process personal data where a valid legal basis under Article 6 GDPR applies:
| Purpose | Legal basis | Notes |
|---|---|---|
| Responding to enquiries, information requests and proposals | Steps taken at your request prior to entering a contract — Art. 6(1)(b) | Submitting the form is your own initiative. |
| Providing contracted services and managing the client relationship | Performance of a contract — Art. 6(1)(b) | Includes day-to-day communication and invoicing. |
| Compliance with legal, accounting, tax and anti-money laundering obligations | Legal obligation — Art. 6(1)(c) | Law no. 83/2017; Portuguese VAT and corporate income tax codes. |
| Sending newsletters and marketing communications | Consent — Art. 6(1)(a) | Freely given, specific and withdrawable at any time. |
| Communications about similar services to existing clients | Legitimate interest — Art. 6(1)(f), read with Art. 13-A of Law no. 41/2004 | An opt-out is offered in every message. |
| Non-essential cookies and similar technologies (analytics, marketing) | Consent — Art. 6(1)(a) and Art. 5(3) of Law no. 41/2004 | Collected through the cookie banner. |
| Managing applications and recruitment processes | Pre-contractual steps — Art. 6(1)(b); consent for unsolicited applications — Art. 6(1)(a) | Retention in a talent pool only with your consent. |
| Information security, fraud prevention and website maintenance | Legitimate interest — Art. 6(1)(f) | Our interest in secure and available systems. |
| Establishing, exercising or defending legal claims | Legitimate interest — Art. 6(1)(f) | Limited to what is strictly necessary. |
Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand. Where it is based on legitimate interests, we have carried out a balancing test against your rights and freedoms; you may request information about that assessment and object to the processing.
5.Whether providing data is mandatory
Fields marked as required in our forms are necessary for us to respond to your request; without them we cannot follow up. Providing data for newsletter purposes is optional and refusing has no effect on your access to the website or to our services. Providing the data required under anti-money laundering legislation is mandatory and, by law, refusal prevents us from establishing or continuing the business relationship.
6.Recipients and processors
We do not sell or otherwise make personal data commercially available to third parties. Your data may be disclosed to:
- Service providers acting as processors, bound by written agreements under Article 28 GDPR: website hosting and maintenance, e-mail and productivity services, newsletter platforms, web analytics tools, accounting and invoicing software, and archiving and IT security services.
- External professionals and advisers bound by confidentiality duties (lawyers, auditors, certified accountants).
- Public authorities, where disclosure is legally required — in particular the Portuguese Tax and Customs Authority, Social Security, Banco de Portugal, the Financial Intelligence Unit, courts and supervisory authorities.
- Parties to corporate transactions, in the event of a merger, demerger or acquisition, with data protection obligations remaining in force and data subjects informed where legally required.
7.International transfers
We give preference to providers that store and process data within the European Economic Area (EEA). Where a transfer to a third country is necessary, it takes place only under a safeguard provided for in Chapter V GDPR, namely:
- an adequacy decision of the European Commission applicable to the country or certification framework concerned;
- standard contractual clauses adopted by Implementing Decision (EU) 2021/914, together with supplementary technical and organisational measures where required.
You may request details of specific transfers and a copy of the safeguards applied, using the contact details in section 1.
8.Retention periods
We keep personal data only for as long as necessary for the purposes for which it was collected, or for the periods required by law:
| Data | Retention period |
|---|---|
| Enquiries that did not lead to a contractual relationship | 2 years from the last contact |
| Contractual documents and client correspondence | For the duration of the relationship and 10 years thereafter |
| Invoicing, accounting and tax supporting documents | 10 years (Article 40 of the Portuguese Commercial Code and applicable tax law) |
| Customer due diligence records (anti-money laundering) | 7 years after the end of the business relationship (Law no. 83/2017) |
| Newsletter subscribers | Until consent is withdrawn or you object |
| Unsolicited applications and unsuccessful recruitment processes | 12 months, unless you consent to a longer period |
| Access and security logs | Up to 12 months |
| Cookies and similar identifiers | As set out in the Cookie Policy |
Once these periods expire, data is securely deleted or irreversibly anonymised. Periods may be extended where necessary to establish, exercise or defend legal claims in pending proceedings.
9.Security
We implement technical and organisational measures appropriate to the risk, in accordance with Article 32 GDPR, including: encryption of communications (TLS/HTTPS), access control on a need-to-know basis, strong authentication for critical systems, regular backups, internal data protection and information security policies, confidentiality and professional secrecy undertakings from all staff, and careful selection of processors.
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the CNPD within 72 hours and, where the risk is high, also inform the affected data subjects, under Articles 33 and 34 GDPR.
10.Your rights
As a data subject you have the right to:
- Access — obtain confirmation as to whether your data is processed and access it (Art. 15);
- Rectification — have inaccurate data corrected or incomplete data completed (Art. 16);
- Erasure — request deletion of your data in the cases provided for by law (Art. 17);
- Restriction — restrict processing in certain circumstances (Art. 18);
- Portability — receive the data you provided in a structured, commonly used format and transmit it to another controller (Art. 20);
- Object — object to processing based on legitimate interests and, at any time and without giving reasons, to processing for direct marketing (Art. 21);
- Withdraw consent — at any time, with effect for the future (Art. 7(3)).
To exercise these rights, write to geral@atlantic-advisory.pt or to our registered office. We may ask for additional information to confirm your identity where we have reasonable doubts. We will respond within one month, extendable by two further months in complex cases, in which case we will inform you.
To unsubscribe from marketing communications, simply use the unsubscribe link included in every message.
11.Complaints
If you believe the processing of your data infringes applicable law, you may lodge a complaint with the supervisory authority:
CNPD — Portuguese Data Protection Authority
Av. D. Carlos I, 134, 1.º, 1200-651 Lisbon, Portugal
Telephone: +351 213 928 400 · E-mail: geral@cnpd.pt
www.cnpd.pt
We would be grateful if you contacted us first, so that we can try to resolve the matter directly with you.
12.Automated decision-making and profiling
We do not take decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 GDPR.
13.Minors
Our services and website are intended for professionals, businesses and adults. We do not knowingly collect data from children under 16. If you become aware that a minor has provided us with personal data without proper authorisation, please contact us so that we can delete it.
14.Third-party links
Our website may contain links to third-party websites, which have their own privacy policies and for which we are not responsible. We recommend reading those policies before providing personal data to such sites.
15.Changes to this Policy
This Policy may be updated where warranted, in particular following legislative changes or changes to our practices or services. The version in force is the one published on this page, with its date. Where changes are substantial, we will inform data subjects by appropriate means, such as e-mail or a prominent notice on the website.
Atlantic Edge Universal Advisors, Lda · NIPC 517249251 · Rua dos Murças, 15 – 3.º L, 9000-058 Funchal, Portugal · geral@atlantic-advisory.pt
See also our Cookie Policy and Terms and Conditions of Use.
