Milanez Villela Advogados
Version 1.0 — effective as of June 19, 2026.
Milanez Villela Sociedade Individual de Advocacia (together with its professional structure, "Milanez Villela", the "Firm" or "we"), enrolled with the Brazilian Taxpayer Registry (CNPJ/ME) under No. 64.957.710/0001-97, with offices at Rua Tabapuã, 50, Suite 101, Itaim Bibi, São Paulo/SP, ZIP code 04140-090, provides legal advisory services in tax, corporate, regulatory, and contractual matters to large Brazilian companies and to multinational groups doing business in Brazil.
In the conduct of its professional activities, the Firm adopts institutional standards of governance, information security, and personal data protection commensurate with the level of responsibility undertaken with respect to its clients, professionals, suppliers, and other data subjects with whom it interacts.
This Privacy Notice (the "Notice") has been prepared in order to provide transparency regarding the personal data processing activities carried out by Milanez Villela, in compliance with Brazilian Federal Law No. 13,709, of August 14, 2018 — the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados — "LGPD"), and, where applicable, with the European Union General Data Protection Regulation ("GDPR") and U.S. state-level data protection legislation.
Milanez Villela generally acts as a controller of the personal data processed by it. In the course of the provision of legal services, however, personal data may be processed on behalf of and under the instructions of a client, in which case the Firm may act as a processor (referred to under the LGPD as operador), pursuant to Article 5, items VI and VII, of the LGPD.
For the purposes of this Notice, the definitions set forth in Article 5 of the LGPD apply. The following definitions are highlighted:
This Notice applies to the processing of personal data of the following categories of data subjects:
(i) Visitors to the website www.milanezvillela.com.br and to the Firm’s other digital platforms;
(ii) Clients — natural persons and the representatives, officers, and employees of corporate clients, as well as professional contacts qualifying as prospects;
(iii) Parties related to client matters — including counterparties, opposing counsel, experts, witnesses, and other third parties referenced in documents or whose identification is necessary to the appropriate conduct of the Firm’s professional activities;
(iv) Candidates applying for professional positions with the Firm;
(v) Suppliers and service providers, as well as their representatives and officers.
Personal data are collected directly from the data subject, provided by clients, obtained from public sources, or received from third parties in the context of the provision of legal services. The categories of personal data processed vary depending on the data subject and the purpose, and may include:
4.1. Identification and contact data: full name, individual taxpayer registration number (CPF), national identification document or equivalent, date of birth, nationality, marital status, postal address, telephone number, email address, and corporate-oriented social media profiles.
4.2. Professional and academic data: position, role, employer, academic background, professional history, practice areas, and publications.
4.3. Financial and tax data: banking information, corporate or individual taxpayer registration number (CNPJ or CPF), and other tax and registration information necessary for invoicing and payment processing.
4.4. Data related to the provision of legal services: information provided by clients or obtained during the engagement, as necessary for technical analysis, preparation of legal opinions and memoranda, conduct of administrative, judicial, or arbitral proceedings, or the performance of any other activities relevant to the engagement.
4.5. Browsing and device data: IP address, date and time of access, device identifiers, pages visited, source of access, and other data collected through strictly necessary cookies and statistical analytics tools used in connection with the website, as further described in Section 7.
4.6. Data related to job applications: curriculum vitae, identification data, academic background, professional history, salary expectations, and other information voluntarily provided by the candidate.
Personal data are processed by Milanez Villela for the purposes set forth below, in reliance on the legal bases provided for in Articles 7 and 11 of the LGPD:
Technical analysis; preparation of legal opinions, memoranda, and other work product; conduct of administrative, judicial, and arbitral proceedings; response to client consultations; management of the client-firm relationship; issuance of invoices; payment processing; and any other acts required for the performance of obligations undertaken before the client.
Legal basis: performance of a contract (Article 7, item V, of the LGPD) and the regular exercise of rights in judicial, administrative, or arbitral proceedings (Article 7, item VI, of the LGPD).
Compliance with applicable tax, labor, civil, and procedural legislation; compliance with the rules of the Brazilian Bar Association (Ordem dos Advogados do Brasil — "OAB") and its Statute of the Brazilian Bar; response to legitimate requests from administrative and judicial authorities; and compliance with the obligations arising from Brazilian Federal Law No. 9,613/1998 (anti-money-laundering legislation) and related regulations, where applicable.
Legal basis: compliance with a legal or regulatory obligation (Article 7, item II, of the LGPD).
Establishment, exercise, or defense of the Firm’s rights in judicial, administrative, or arbitral proceedings, including the documentary evidence required to demonstrate the adequate provision of legal services and the corresponding entitlement to fees.
Legal basis: regular exercise of rights in judicial, administrative, or arbitral proceedings (Article 7, item VI, of the LGPD).
Distribution of institutional communications, legal alerts, newsletters, event invitations, and other informational materials to qualified professional contacts with whom the Firm maintains or has maintained a prior relationship, as well as to recipients who have expressed an interest in receiving such materials.
Legal basis: legitimate interest of the Firm in developing professional relationships and in non-promotional communication with its network of institutional contacts (Article 7, item IX, of the LGPD), with due regard to the data subject’s reasonable expectations; consent, where applicable (Article 7, item I, of the LGPD).
Maintenance of the security, integrity, and availability of the Firm’s website and digital platforms; prevention of fraud and improper use; and aggregate statistical analysis of website usage for continuous improvement purposes.
Legal basis: legitimate interest (Article 7, item IX, of the LGPD) and compliance with a legal obligation, in particular the retention of access logs required under Article 15 of Brazilian Federal Law No. 12,965/2014 (the Brazilian Internet Civil Framework — Marco Civil da Internet).
Receipt, review, and processing of curricula; assessment of the candidate’s fit for existing or potential vacancies; and the conduct of interviews and other selection-process stages.
Legal basis: preliminary procedures relating to a contract at the request of the data subject (Article 7, item V, of the LGPD) and legitimate interest in maintaining a talent pool (Article 7, item IX, of the LGPD).
Registration, qualification, and management of suppliers and service providers; payment processing; and contract management.
Legal basis: performance of a contract (Article 7, item V, of the LGPD) and compliance with a legal obligation (Article 7, item II, of the LGPD).
Owing to the nature of the legal profession, sensitive personal data may, on occasion, be processed by Milanez Villela where strictly necessary for the regular exercise of rights in judicial, administrative, or arbitral proceedings, or as a result of a legal or regulatory obligation, pursuant to Article 11, item II, of the LGPD. The processing of sensitive personal data is subject to enhanced safeguards and is limited to the minimum necessary to fulfill the specific purpose at hand.
The Firm’s website and institutional communications are not directed to children or adolescents. Any processing of personal data of minors will occur exclusively where strictly necessary for the provision of legal services — particularly in succession, family, or related matters — with due regard to the best interests of the child or adolescent, pursuant to Article 14 of the LGPD.
The Firm’s website uses strictly necessary cookies required for its operation, as well as aggregate statistical analytics technologies — in particular, Google Analytics — for the purpose of understanding, on an aggregate and non-identifiable basis, website usage patterns and improvement opportunities.
Strictly necessary cookies do not require prior consent, as they are essential for browsing. Cookies used for statistical analytics purposes may be disabled by the data subject through browser settings or through the consent management mechanism made available on the website itself.
The configuration of browsers to refuse all or part of the cookies may impair certain website functionalities.
Personal data may be shared by Milanez Villela, always within the limits of the purposes described in this Notice and subject to appropriate technical and contractual safeguards, with the following categories of third parties:
(i) Service providers and processors supporting the Firm’s activities — including, by way of example, technology solution providers, cloud-based services, electronic signature platforms, management systems, and automation tools;
(ii) External professionals and correspondent firms — including partner attorneys, opining counsel, experts, sworn translators, accountants, and auditors, where required for the appropriate conduct of the engagement;
(iii) Public authorities and judicial bodies — in compliance with a legal or regulatory obligation, in response to a legitimate request from a competent authority, or for the regular exercise of rights in judicial, administrative, or arbitral proceedings;
(iv) Financial institutions and payment service providers — for purposes of invoicing, collection of fees, and other financial transactions;
(v) Third parties potentially involved in corporate transactions that may affect the Firm, subject to appropriate confidentiality safeguards.
Sharing is guided by the principle of necessity and is limited to the minimum data indispensable to the intended purpose.
In the conduct of its activities, Milanez Villela makes use of technology solutions provided by international processors (including, by way of example, productivity and cloud-storage services in the Microsoft 365 ecosystem, design tools, electronic signature platforms, and services for the distribution of institutional communications), whose servers may be located outside Brazilian territory.
In such cases, international transfers of personal data are carried out on the basis of the legal grounds set forth in Article 33 of the LGPD, in particular:
International processors are selected on the basis of their maturity in information security, their internationally recognized certifications, and their demonstrated alignment with applicable personal data protection legislation.
Personal data are retained for the period necessary to fulfill the purposes for which they were collected, subject to the following general parameters:
(i) Data related to client matters: for the duration of the contractual relationship and, following its termination, for the period necessary to comply with applicable legal, regulatory, and statutory obligations, as well as to defend the rights of the Firm and of the client itself in judicial, administrative, or arbitral proceedings. As a general rule, this period is 10 (ten) years following the conclusion of the matter or the contractual relationship, in line with the general statute of limitations set forth in Article 205 of the Brazilian Civil Code and with the professional document retention period established under OAB regulations.
(ii) Financial and tax data: for the periods set forth in applicable tax and accounting legislation, subject to the minimum five-year period set forth in Article 173 of the Brazilian Tax Code, or such longer period as may be required under specific legislation.
(iii) Data of non-selected candidates: for up to 2 (two) years following the conclusion of the relevant selection process, unless the data subject indicates otherwise.
(iv) Contact data for institutional communications and newsletters: for as long as the professional relationship or the legitimate interest of the Firm subsists, or until the data subject expresses opposition.
(v) Browsing data and cookies: for the technical periods corresponding to the purpose of each cookie, subject to the minimum six-month period set forth in Article 15 of the Brazilian Internet Civil Framework for application access logs.
Upon expiry of the applicable retention periods and the conclusion of the relevant processing purposes, personal data are deleted or anonymized, except in the cases set forth in Article 16 of the LGPD.
Technical and organizational measures are adopted by Milanez Villela, in proportion to the nature of the personal data processed and the size of the Firm, with a view to ensuring the confidentiality, integrity, and availability of the information under its responsibility, including, among others:
Notwithstanding the measures adopted, no security solution is entirely immune to failure. In the event that the Firm identifies a security incident that may give rise to relevant risk or harm to the data subjects, the measures set forth in Article 48 of the LGPD shall be adopted, including notification to the ANPD and to the affected data subjects, where applicable.
Under Article 18 of the LGPD, data subjects may, upon request submitted to the DPO, exercise the following rights in connection with their personal data processed by Milanez Villela:
(i) Confirmation of the existence of processing;
(ii) Access to the data;
(iii) Correction of incomplete, inaccurate, or outdated data;
(iv) Anonymization, blocking, or deletion of unnecessary or excessive data, or of data processed in non-compliance with the LGPD;
(v) Portability of the data to another service or product provider, subject to ANPD regulations;
(vi) Deletion of personal data processed on the basis of consent, except in the cases set forth in Article 16 of the LGPD;
(vii) Information regarding the public and private entities with which the Firm has shared the data subject’s personal data;
(viii) Information regarding the possibility of withholding consent and the consequences of such refusal;
(ix) Withdrawal of consent, pursuant to Article 8, paragraph 5, of the LGPD;
(x) Opposition to processing carried out on the basis of one of the grounds dispensing with consent, in the event of non-compliance with the LGPD;
(xi) Review of decisions made solely on the basis of automated processing of personal data — which, in the context of the Firm’s activities, is generally not applicable, since legally relevant decisions are at all times subject to human review.
The exercise of data subject rights may be limited on legitimate grounds, in particular:
(i) Where full compliance with the request would be inconsistent with the performance of a legal or regulatory obligation applicable to the Firm, including the document retention obligations imposed by tax and procedural legislation, as well as by OAB regulations;
(ii) Where the retention of the data is necessary for the regular exercise of the Firm’s rights in judicial, administrative, or arbitral proceedings;
(iii) Where compliance with the request would entail the disclosure of information related to other clients, matters, or third parties, or would compromise the professional privilege protected under Brazilian Federal Law No. 8,906/1994 (the Statute of the Brazilian Bar) and the OAB Code of Ethics and Discipline.
Requests must be addressed to the DPO, as indicated in Section 16, and must include:
Requests will be responded to within the shortest reasonably feasible period and, in any event, within the time frames provided for under the LGPD and ANPD regulations. Additional documentation may be requested for purposes of confirming the requester’s identity and the legitimacy of the request.
Institutional communications of a non-promotional nature — including legal alerts, newsletters, event invitations, and informational materials related to the Firm’s practice areas — may be distributed to qualified professional contacts.
Such communications are based, as applicable, on the consent of the data subject (where obtained through a specific subscription form) or on the legitimate interest of the Firm, in the context of previously established professional relationships or of qualified institutional contacts, with due regard to the data subject’s reasonable expectations.
The data subject may at any time object to such communications or withdraw consent previously granted, through the unsubscribe mechanism made available in the communications themselves or through a request addressed to the DPO.
Although Milanez Villela is based in Brazil and contracts its services exclusively with legal entities incorporated under Brazilian law, a significant portion of its clients are part of international corporate groups with parent entities in the European Union, the United Kingdom, or the United States of America.
In that context, where applicable and consistent with Brazilian law, the Firm adopts standards and principles aligned with:
(i) The European Union General Data Protection Regulation (Regulation (EU) 2016/679), particularly with respect to transparency, the data minimization principle, the adoption of safeguards in international transfers, and the response to data subject rights requests;
(ii) U.S. state-level data protection legislation, in particular the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"), with respect to transparency and the recognition of data subject rights.
Requests based on such foreign legislation will be reviewed on a case-by-case basis, subject to the limitations imposed by Brazilian law, in particular the professional privilege of the legal profession.
This Notice may be amended from time to time, with a view to its improvement, to alignment with legislative developments, or to reflect changes in the Firm’s internal practices. The current version is at all times made available at www.milanezvillela.com.br, with an indication of the date of the most recent update. Data subjects are encouraged to consult the Notice periodically.
In compliance with Article 41 of the LGPD, Milanez Villela has designated a Data Protection Officer, responsible for acting as a communication channel among the Firm, data subjects, and the ANPD.
For the exercise of the rights set forth in this Notice, for clarifications regarding personal data processing, or for any other related request, data subjects may use the following contact channel:
Data Protection Officer
Email: privacidade@milanezvillela.com.br
Postal address: Rua Tabapuã, 50, Suite 101, Itaim Bibi, São Paulo/SP, ZIP code 04140-090, Brazil.
This Notice is governed by the laws of the Federative Republic of Brazil, and in particular by the LGPD and the other rules applicable to the legal profession, to professional privilege, and to personal data protection.
The Courts of the Judicial District of the City of São Paulo, State of São Paulo, are designated as the competent venue for any disputes arising in connection with this Notice, without prejudice to the legal prerogatives available to the data subject as a consumer.
Milanez Villela Advogados
www.milanezvillela.com.br
Last updated: June 19, 2026
This English version of the Privacy Notice is provided for convenience purposes only. In the event of any inconsistency between this English version and the Portuguese version of the Privacy Notice, the Portuguese version shall prevail.
