This Privacy Policy explains how Atlantic Edge Universal Advisors, Lda (trading as Atlantic Advisory) collects, uses, shares and protects personal data, in compliance with Regulation (EU) 2016/679 — the General Data Protection Regulation (GDPR) — and Law No. 58/2019 of 8 August, which ensures its implementation in the Portuguese legal system.
1Data controller
- Entity
- Atlantic Edge Universal Advisors, Lda
- Company registration no. (NIPC)
- 517249251
- Registered office
- Rua dos Murças, n.º 15 – 3.º L, 9000-058 Funchal, Portugal
- Email
- geral@atlantic-advisory.pt
- Phone
- +351 214 064 192 (call to a national landline)
- Website
- atlantic-advisory.pt
For any question about personal data or the exercise of your rights, you can contact us by email at geral@atlantic-advisory.pt, with the subject «Data Protection», or by letter to the registered office address above.
2Scope
This Policy applies to the processing of personal data carried out through the atlantic-advisory.pt website, our forms, our contact channels (email, phone, social media) and in the context of commercial, pre-contractual and contractual relationships established with us.
The processing of personal data we carry out on behalf of our clients, in the provision of accounting, payroll, tax and corporate services, is governed by the respective service agreement and the corresponding data processing agreement entered into under Article 28 of the GDPR. In those cases, we act as processor and the client is the controller.
3Categories of personal data processed
- Identification and contact data: name, company, position, email address, phone number, address.
- Relationship data: content of the messages and requests you send us, communication history, information about the services you are interested in.
- Contractual and billing data: tax number (NIF/NIPC), billing and payment data, contractual documentation.
- Data required by law: identification details and documents needed to comply with the identification and due diligence duties set out in Law No. 83/2017 of 18 August (prevention of money laundering and terrorist financing).
- Job application data: CV, academic and professional background and any other information you send us through the Careers area or by email.
- Browsing data: IP address, device and browser type, pages visited, date and time of access, source of the visit and cookie identifiers (see our Cookie Policy).
We do not intentionally collect special categories of data (Article 9 GDPR), such as data concerning health, racial or ethnic origin, religious or political beliefs. Please do not include information of that nature in the messages you send us, unless strictly necessary and expressly requested by us.
4Purposes and legal bases for processing
We only process personal data when there is a valid legal basis under Article 6 of the GDPR:
| Purpose | Legal basis | Notes |
|---|
| Replying to contact, information or proposal requests | Pre-contractual steps at the data subject’s request — Art. 6(1)(b) | Submitting the form is your initiative. |
| Providing the contracted services and managing the client relationship | Performance of a contract — Art. 6(1)(b) | Includes day-to-day communication and billing. |
| Compliance with legal, accounting, tax and anti-money laundering obligations | Legal obligation — Art. 6(1)(c) | Law No. 83/2017; VAT Code; Corporate Income Tax (IRC) Code. |
| Sending newsletters and marketing communications | Consent — Art. 6(1)(a) | Freely given, specific consent, revocable at any time. |
| Communications about similar services to existing clients | Legitimate interest — Art. 6(1)(f), in conjunction with Art. 13-A of Law No. 41/2004 | With the option to object in every message. |
| Non-essential cookies and similar technologies (analytics, marketing) | Consent — Art. 6(1)(a) and Art. 5(3) of Law No. 41/2004 | Collected through the cookie banner. |
| Managing applications and recruitment processes | Pre-contractual steps — Art. 6(1)(b); consent for spontaneous applications — (a) | Kept in a database only with your consent. |
| Information security, fraud prevention and website maintenance | Legitimate interest — Art. 6(1)(f) | Interest in ensuring the integrity and availability of systems. |
| Establishing or defending rights in judicial, arbitration or administrative proceedings | Legitimate interest — Art. 6(1)(f) | Limited to what is strictly necessary. |
Where processing is based on consent, you can withdraw it at any time, without affecting the lawfulness of processing carried out on the basis of consent given before. Where it is based on legitimate interest, we have first balanced that interest against your fundamental rights and freedoms; you can ask us for information about that assessment and object to the processing.
5Mandatory or optional nature of providing data
In the website forms, fields marked as mandatory are needed for us to reply to your request; not providing them prevents us from following up on the contact. Providing data for newsletter purposes is optional and refusing has no consequence for access to the website or our services. Providing the data required by anti-money laundering legislation is mandatory and refusing means, under the law, that the business relationship cannot be established or maintained.
6Recipients and processors
We do not sell or transfer personal data to third parties for commercial purposes. Your data may be disclosed to:
- Service providers acting as processors, bound by a written contract under Article 28 of the GDPR: website hosting and maintenance, email and productivity services, newsletter platforms, web analytics tools, accounting and invoicing software, and archiving and IT security services.
- External professionals and advisers subject to a duty of confidentiality (lawyers, auditors, certified accountants).
- Public authorities, where there is a legal obligation to disclose, namely the Tax and Customs Authority, Social Security, Banco de Portugal, the Financial Intelligence Unit, courts and supervisory authorities.
- Entities involved in corporate transactions, in the event of a merger, demerger or acquisition, with data protection obligations maintained and data subjects informed where legally required.
7International data transfers
We prefer providers that store and process data within the European Economic Area (EEA). Where a transfer to a third country is necessary, it is only carried out under one of the safeguards set out in Chapter V of the GDPR, namely:
- an adequacy decision by the European Commission applicable to the country or certification framework concerned;
- standard contractual clauses approved by Implementing Decision (EU) 2021/914, accompanied, where necessary, by supplementary technical and organisational measures.
You can ask us for information about specific transfers and a copy of the safeguards applied, using the email address given in point 1.
8Retention periods
We keep data only for as long as necessary for the purposes for which it was collected, or for the periods required by law:
| Data | Retention period |
|---|
| Contact requests that did not lead to a contractual relationship | 2 years from the last contact |
| Contractual documents and correspondence with clients | For the duration of the contractual relationship and 10 years after it ends |
| Invoicing, accounting and tax supporting documents | 10 years (Article 40 of the Commercial Code and applicable tax legislation) |
| Identification and due diligence records (anti-money laundering) | 7 years after the end of the business relationship (Law No. 83/2017) |
| Newsletter subscribers | Until consent is withdrawn or an objection is made |
| Spontaneous applications and recruitment processes not concluded with a hire | 12 months, unless you consent to a longer period |
| Access and security records (logs) | Up to 12 months |
| Cookies and similar identifiers | According to the periods set out in the Cookie Policy |
Once these periods end, data is securely deleted or irreversibly anonymised. Periods may be extended where necessary to establish or defend rights in pending proceedings.
9Data security
We apply technical and organisational measures appropriate to the risk, under Article 32 of the GDPR, including: encrypted communications (TLS/HTTPS), access control based on the need-to-know principle, strong authentication on critical systems, regular backups, internal data protection and information security policies, binding all staff to confidentiality and professional secrecy duties, and careful selection of processors.
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the CNPD within 72 hours and, where the risk is high, we will also inform the affected data subjects, under Articles 33 and 34 of the GDPR.
10Your rights
As a data subject, you have the following rights:
- Access
- Obtain confirmation of whether your data is processed and access that data (Art. 15).
- Rectification
- Correct inaccurate data or complete incomplete data (Art. 16).
- Erasure
- Request deletion of data, in the situations provided for by law (Art. 17).
- Restriction of processing
- Restrict processing in certain circumstances (Art. 18).
- Portability
- Receive the data you provided to us in a structured, commonly used format and transmit it to another controller (Art. 20).
- Objection
- Object to processing based on legitimate interest and, at any time and without giving reasons, to processing for direct marketing purposes (Art. 21).
- Withdrawal of consent
- At any time, with effect for the future (Art. 7(3)).
To exercise these rights, send a request to geral@atlantic-advisory.pt or to the registered office address. We may ask for additional information to confirm your identity where there are reasonable doubts. We will reply within one month, extendable by two further months in particularly complex cases, in which case you will be informed.
To unsubscribe from marketing communications, simply click the unsubscribe link included in each message.
11Complaints
If you believe that the processing of your data breaches the applicable law, you can lodge a complaint with the supervisory authority:
CNPD — Comissão Nacional de Proteção de Dados (Portuguese Data Protection Authority)
Av. D. Carlos I, n.º 134, 1.º, 1200-651 Lisboa
Phone: +351 213 928 400 · Email: geral@cnpd.pt
www.cnpd.pt ↗
We would appreciate it if you contacted us first, so that we can try to resolve the matter directly with you.
12Automated decisions and profiling
We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you, under Article 22 of the GDPR.
13Minors
Our services and website are intended for professionals, companies and adults. We do not intentionally collect data from children under 16. If you become aware that a minor has provided us with personal data without proper authorisation, please contact us so that we can delete it.
14Links to third-party sites
Our website may contain links to third-party sites, which have their own privacy policies and for which we are not responsible. We recommend reading those policies before providing personal data to those sites.
15Changes to this Policy
This Policy may be updated whenever justified, namely due to changes in legislation, in our practices or in the services provided. The version in force is always the one published on this page, with its date. In the event of substantial changes, we will inform data subjects by appropriate means, namely by email or a prominent notice on the website.
