Privacy Policy

1. Introduction

Consulto ("we", "our" or "site") is committed to protecting the privacy of visitors to our website consulto.pt. This Privacy Policy explains how we collect, use and protect your information in compliance with the EU General Data Protection Regulation (GDPR).

By using our site, you agree to the practices described in this policy.

2. Who We Are

Consulto is operated by iDigital Agency, headquartered at Yair Stern 23, Haifa, Israel.

Israel benefits from an adequacy decision by the European Commission (Decision 2011/61/EU), meaning the European Commission recognises that Israel provides an adequate level of personal data protection. Your data is handled with the same safeguards that would apply within the European Union.

General contact: info@consulto.pt

Privacy contact: privacidade@consulto.pt

3. Data We Collect

3.1 Browsing Data (Aggregate Analytics)

We use Cloudflare Web Analytics to understand how visitors use our site. This tool was specifically chosen because it is privacy-focused:

• Does not use tracking cookies
• Does not collect personally identifiable data
• Does not track individual users
• Only collects aggregate data: number of visits, pages visited, country of origin, device type

3.2 Contact Data

If you contact us via the contact form or by email, we collect:

• Name
• Email address
• Message content

Legal basis: Consent (Article 6(1)(a) GDPR) and performance of a contract or pre-contractual measures (Article 6(1)(b) GDPR).

4. User Account Data

If you create an account on Consulto (at /registar/criar-conta/), we collect the following data:

• Name — to identify your account
• Email — for communication and authentication
• Phone (optional) — for contact purposes, if provided
• Password — stored in encrypted form (hash), never in plain text

How we use this data

• Account management
• Managing and updating your professional profile
• Communication about the service and your profile

Legal basis

The legal basis for processing this data is the performance of a contract (Article 6(1)(b) GDPR) — the data is necessary to provide the service you requested when creating your account.

5. Lawyer and Law Firm Data

Consulto is a public directory of lawyers. To maintain the directory, we process data about lawyers registered with the Ordem dos Advogados (Portuguese Bar Association) and law firms.

What data we process

• Name and professional registration number (cédula)
• Professional address and contact details (phone, email, website)
• Practice areas and specialisations
• Affiliation with law firms

Source of this data

Profile data was obtained from the public register of the Ordem dos Advogados (OA) and from publicly available information. We did not collect this data directly from the listed professionals.

Pursuant to Article 14 GDPR, we inform you that the personal data included in profiles was not obtained directly from the data subjects, but from publicly accessible sources.

Legal basis

The legal basis for processing this data is legitimate interest (Article 6(1)(f) GDPR). Our legitimate interest is to operate a public directory that helps citizens find lawyers in Portugal. We consider that this interest does not override the rights of listed professionals, since the information is already public and its processing falls within Lei 6/2024 (Portuguese law liberalising the advertising of legal services).

How we use this data

• Maintaining and updating the directory
• Verifying the accuracy of profiles
• Contacting professionals about their profiles and available programmes

Rights of listed professionals

If you are a lawyer or representative of a firm listed on Consulto, you may at any time:

• Correct inaccurate or outdated data
• Request removal of your profile from the directory
• Object to the processing of your data

You can exercise these rights through our data removal request form or by contacting us directly:

To exercise any of these rights, please email privacidade@consulto.pt. We will respond within 30 days.

6. Email Communications

Types of email we send

Transactional emails (account-related):
If you have an account on Consulto, we may send you emails relating to the management of your account, profile and service features. The legal basis for these emails is the performance of a contract (Article 6(1)(b) GDPR).

Outreach emails to professionals:
We may contact lawyers and firms to inform them about Consulto and our programmes. The legal basis for these communications is legitimate interest (Article 6(1)(f) GDPR). All such emails include a clear option to unsubscribe.

How to unsubscribe

You can stop receiving our communications in two ways:

1. Unsubscribe link — included in all our emails
2. Direct email — write to privacidade@consulto.pt

After your request, you will be removed from our contact list within 5 working days.

Note: Note: If you have an account on Consulto, you will continue to receive transactional emails essential to your account (e.g. confirmations and security notifications), even after unsubscribing from other communications.

7. Purposes of Processing

Data is processed for the following purposes:

• Improving the functioning and content of the site
• Responding to enquiries and contact requests
• Complying with legal obligations
• Analysing usage trends in an aggregate and anonymous manner

8. Cookies

Consulto uses only strictly necessary cookies for the technical operation of the site. We do not use tracking, advertising or behavioural analytics cookies. Cloudflare Web Analytics does not use cookies.

For more information, see our Cookie Policy.

9. Data Sharing

We do not sell, rent or share your personal data with third parties for commercial or marketing purposes.

Your data may be shared only with:

• Cloudflare: Hosting and analytics (aggregate data, no personal identification)
• Supabase — Database hosting, user authentication and serverless functions. Data stored in the European Union region.
• Resend — Sending transactional and operational emails.
• Legal authorities: When required by law

10. International Transfers

Our service providers (such as Cloudflare) may process data on servers located outside the European Economic Area (EEA). In such cases, we ensure that adequate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

11. Data Retention

Contact data is retained only for as long as necessary to respond to your request or comply with legal obligations, not exceeding 2 years after the last contact. Aggregate analytics data does not identify individuals and is retained indefinitely.

12. Your Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of your personal data
• Right to rectification: Correct inaccurate or incomplete data
• Right to erasure: Request deletion of your data ("right to be forgotten")
• Right to restriction: Restrict processing of your data
• Right to portability: Receive your data in a structured format
• Right to object: Object to the processing of your data
• Right to withdraw consent: At any time, without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at privacidade@consulto.pt.

13. Right to Lodge a Complaint

If you believe that the processing of your data violates the GDPR, you have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD — Comissão Nacional de Proteção de Dados):

14. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure or destruction. Our site uses HTTPS encryption to protect data transmission.

15. Changes to This Policy

We may update this Privacy Policy periodically. Any changes will be published on this page with a revised update date. We recommend that you check this page regularly.

16. Contact

If you have questions about this Privacy Policy or about the processing of your data, please contact us: