Privacy Policy

1. Identification

This Privacy Policy applies to the website www.tobias.adv.br and is maintained by:

TOBIAS SOCIEDADE INDIVIDUAL DE ADVOCACIA, a law firm registered with the Brazilian taxpayer registry (CNPJ) under No. 07.959.689/0001-25, with its registered office at Av. Augusto Meyer, No. 40, Suite 501, Porto Alegre/RS, CEP 90550-110, represented herein by Thiago Jard Tobias e Silva Bezerra, admitted to the Brazilian Bar Association (OAB/RS) under No. 61.313 ("Tobias ADV", "we").

This policy describes how we collect, use, store and protect the personal data of visitors to our website, in accordance with Brazil's General Data Protection Law (Lei nº 13.709/2018 — LGPD).

By using this website, you agree to the practices described in this document.

2. What data we collect

We collect personal data in four main situations:

2.1 Contact form

When you fill in our contact form, we collect: name, email, phone number and the content of the message sent.

2.2 Downloading institutional material

When you request a download of our firm profile, we collect: your email address, voluntarily provided in exchange for the material.

2.3 Browsing the website

While you browse the website, we automatically collect usage data through cookies and analytics tools, such as: IP address, device and browser type, pages visited, time spent on the site, and the source of your visit (e.g., whether you arrived via search, social media, or a direct link).

2.4 Contact via WhatsApp

If you start a conversation through the WhatsApp button available on the website, the handling of your data in that conversation is also governed by WhatsApp's own privacy policy, in addition to this one.

3. What we use your data for

We use the data we collect to:

• Respond to messages sent through the contact form;
• Send the institutional material requested;
• Contact you regarding matters related to our services, when requested by you;
• Understand how the website is used, so we can continuously improve it (using aggregated and anonymized data whenever possible);
• Comply with legal or regulatory obligations, when applicable.

We do not use your data to send paid advertising, sell it to third parties, or for any purpose not described in this policy.

4. Legal basis for processing

We process your personal data based on the following legal grounds set out in the LGPD:

• Consent (Art. 7, I): when you voluntarily fill in a form or request contact;
• Legitimate interest (Art. 7, IX): for analyzing browsing activity and improving the website experience, always respecting your expectations and rights as a data subject;
• Compliance with a legal or regulatory obligation (Art. 7, II): when applicable, due to rules governing the practice of law.

5. Who we share your data with

We do not sell or rent your personal data. We may share data with:

• Technology service providers that operate the website's infrastructure (hosting, email and form tools);
• Traffic analytics tools, such as Google Analytics, which may collect browsing data under their own privacy policies;
• Public authorities, when required by law, court order, or a request from a competent government body.

Any third parties that may have access to personal data are contractually bound to handle it with the same diligence and confidentiality described here.

6. Cookies

Our website uses cookies for basic functionality and for traffic analysis.

• Necessary cookies: essential for the website to function, and cannot be disabled.
• Analytics cookies: used to understand how visitors use the website (most-visited pages, time spent, traffic source), on an aggregated basis and anonymized whenever possible.

You can manage or disable cookies directly in your browser settings. Disabling cookies may affect some of the website's features.

7. How long we keep your data

We keep your personal data only for as long as necessary to fulfill the purposes described in this policy, or for the period required by legal and regulatory obligations applicable to the practice of law, whichever is longer. After that period, the data is securely deleted or anonymized.

8. Your rights as a data subject

Under the LGPD, you have the right to:

• Confirm whether we process your data;
• Access the data we hold about you;
• Correct incomplete, inaccurate or outdated data;
• Request the anonymization, blocking or deletion of unnecessary data, or data processed in violation of the law;
• Request the portability of your data to another service provider;
• Request the deletion of data processed based on your consent;
• Withdraw your consent at any time;
• Object to processing carried out on other legal grounds, when applicable;
• Obtain information about who we share your data with.

To exercise any of these rights, please contact us at contato@tobias.adv.br

9. Security

We adopt reasonable technical and organizational measures to protect your personal data against unauthorized access, loss, alteration or leakage. Despite our efforts, no system is entirely free of risk — should we identify a significant security incident, we will follow the procedures required by the LGPD, including notifying affected data subjects when applicable.

10. Professional secrecy

As a law firm, Tobias ADV is also subject to the duty of professional secrecy set out in Brazil's Bar Statute (Lei nº 8.906/1994) and the OAB Code of Ethics and Discipline. Information exchanged in the context of an attorney-client relationship receives additional protection, beyond what is described in this policy.

11. Changes to this policy

This Privacy Policy may be updated from time to time to reflect changes in our practices or in legal requirements. The date of the last update will always be shown at the top of this document. We recommend reviewing this page periodically.

12. Contact

Questions, requests or complaints related to this Privacy Policy or to the processing of your personal data may be sent to:

TOBIAS SOCIEDADE INDIVIDUAL DE ADVOCACIA

Av. Augusto Meyer, 40, Suite 501 — Porto Alegre/RS — CEP 90550-110

Email: contato@tobias.adv.br