1. Who processes the data
Acosta Advogados, a law firm registered with the OAB/SP under no. 33,777, headquartered at Rua Santa Cruz, 106, Centro, Tatuí/SP, CEP 18270-320, Brazil, is the controller of the personal data received through this website.
Data protection officer: Anderson Rodrigues Elias. Contact: contato@acostaadvogados.com.br.
2. What data the website receives
Contact form
Name, e-mail, phone or WhatsApp (optional), subject (optional) and the message you write, plus the date on which you accepted this policy and the version accepted. To prevent abuse, the server also stores a pseudonymized code generated from the IP address with a secret key; the IP address itself is not stored.
Access logs
Like any website, the server records the IP address, the date and time of each access and the page requested. These logs are kept for 6 months, as required by article 15 of the Brazilian Internet Civil Framework (Law 12,965/2014).
Preferences in your browser
Your choice of theme (light, dark or automatic) and your choice about cookies are stored only in your browser. This information is not sent to the firm.
Measurement and marketing, only with your consent
If you accept the measurement cookie, the website loads Microsoft Clarity, a usage analytics tool from Microsoft. It records how the pages are used: clicks, scrolling, mouse movements or screen taps, the path between pages, the type of device, browser and screen, the address of the page and an approximate location inferred from the IP address. With these records, Microsoft generates heatmaps and recordings of visits. What you type in the contact form is hidden and does not appear in the recordings. In addition, the website reports three events to Clarity, by name only: a tap on a WhatsApp button, a tap on a phone number and a form submitted. Nothing you type is sent along.
If you also accept the marketing cookie, the website also loads the Meta Pixel, a tool from Meta, the company that operates Facebook and Instagram. It records the visit to each page and, when you submit the form or tap a WhatsApp button, a contact event that reports only the origin (form or WhatsApp). Nothing you type in the form (name, e-mail, phone, subject or message) is sent to Meta.
Along with these events, Meta receives technical browsing data, such as the address of the page visited, the IP address, the type of browser and device and the cookie identifiers described in item 8. Without your acceptance, the Meta Pixel and Clarity are not loaded and nothing is sent to Meta or Microsoft. On the Health Law and Corporate Criminal Law pages (Portuguese version of the site), neither is loaded, even if you have accepted the cookies, and the browser does not report which page you came from.
Google Maps
On the contact page, the map of the offices is provided by Google. If you accepted the measurement and marketing cookies, it opens on its own, and Google receives the access data from then on. For those who declined, did not choose or revoked, the map opens only after you click “Show map”.
3. What the data is used for
The form data is used only to reply to your message, by e-mail or WhatsApp, and for the preliminary steps of a possible engagement. The legal bases are your consent and the performance of preliminary procedures related to a contract (article 7, items I and V, of the Brazilian General Data Protection Law, LGPD). The access logs are kept to comply with a legal obligation (article 7, item II).
The firm does not use the form data for advertising, does not sell it and does not send messages you did not ask for.
Microsoft Clarity data is used to understand how people use the website and to fix what makes reading or contacting us difficult, not to identify you. Meta Pixel data is used to measure visits to the website and to show, on Facebook and Instagram, informational content from the firm, such as articles and videos, to those who have already visited the website. The legal basis, in both cases, is your consent (article 7, item I, of the LGPD), which you can revoke at any time, as described in item 8.
4. Who the data is shared with
The data is stored on the firm’s server, hosted by Hostinger, with storage in São Paulo, Brazil. The notice of each new contact arrives in the mailbox contato@acostaadvogados.com.br, maintained by LocaWeb, in Brazil. These providers process the data only to provide the service.
If you accept the measurement cookie, the Clarity data described in item 2 is sent to Microsoft, which also processes it under its own privacy policy. If you also accept the marketing cookie, the Meta Pixel data is sent to Meta, on the same terms. Both companies may process this data on servers outside Brazil, including in the United States. This international transfer is based on your specific and highlighted consent, given in the cookie notice (article 33, item VIII, of the LGPD). If you do not accept, nothing is sent and there is no transfer. The Google map, when loaded, sends access data to Google, as described in item 8.
There is no other sharing, except by court order or legal obligation.
5. For how long
The form messages are automatically deleted from the website database 24 months after being sent. If the contact results in an engagement, the necessary information moves to the client file, which follows the firm’s retention rules. Access logs are kept for 6 months. Cookie periods are in item 8.
6. Your rights
You may request, at any time, confirmation that we process your data, access to it, correction, deletion, portability and information about sharing, and you may revoke your consent (article 18 of the LGPD), which you can also do at any time through the “Cookie preferences” link in the footer. Just write to contato@acostaadvogados.com.br. You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).
7. Security and confidentiality
The website uses an encrypted connection (HTTPS), and access to the data is restricted to the firm. Submitting the form does not create a lawyer-client relationship: for that reason, the firm asks you not to send documents or sensitive information through it. The details of your matter are handled afterwards, under professional secrecy.
9. Changes
This policy may be updated. The version in force and the date of the last change are always at the top of this page.
Version 1.2 (October 26, 2026): addition of Microsoft Clarity, with measurement consent, of the _clck and _clsk cookies, of the international transfer of data to Microsoft, of the automatic opening of the Google map for those who accepted measurement and marketing, and of the exclusion of the Corporate Criminal Law and Health Law pages from the Meta Pixel and Clarity. The cookie choice was requested again from everyone.
Version 1.1 (October 16, 2026): addition of the Meta Pixel, with consent, and of the cookie choice by category.
Version 1.0: October 15, 2026.