Privacy Policy
Last updated: 3 July 2026.
This Privacy Policy explains how Isabella Nogueira Sociedade Individual de Advocacia, the controller of the website www.isabellanogueira.com, processes personal data collected through this website, contact forms, digital communications, institutional content and related online channels.
This Policy has been prepared with reference to the Brazilian General Data Protection Law – Lei Geral de Proteção de Dados Pessoais, Law No. 13,709/2018 (“LGPD”) and, where applicable, Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), the UK General Data Protection Regulation (“UK GDPR”), and applicable United States state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), where their legal requirements apply.
The concrete application of each privacy law depends on the location of the data subject, the nature of the relationship with the controller, the services requested, the website features used and the statutory criteria for applicability of each law.
1. Controller
For the purposes of the LGPD and, where applicable, the GDPR, UK GDPR and other privacy laws, the controller of the personal data processed through this website is:
Isabella Nogueira Sociedade Individual de Advocacia
Official privacy contact:
contato@isabellanogueira.com.br
The controller determines the purposes and essential means of the processing of personal data collected through this website, its contact forms, communication channels, digital content and related functionalities.
2. Personal data we may collect
This website may collect personal data provided directly by the user, especially when the user completes a form, sends a message, requests contact, subscribes to communications, interacts with content or contacts the controller by e-mail, telephone, social media or any other channel indicated on the website.
The personal data collected may include name, surname, country of residence, subject of interest, e-mail address, telephone number, message content and any other information voluntarily provided by the user.
The website may also collect technical and browsing data, such as IP address, online identifiers, device type, operating system, browser, date and time of access, pages visited, source of access, interaction data, cookie preferences and information related to website security, performance and functionality.
These data may be collected directly by the controller or through technology providers, hosting services, security tools, contact forms, analytics tools, pixels, cookies, plug-ins, social media integrations and similar technologies.
3. Sensitive personal data and special categories of data
This website does not intentionally request sensitive personal data through general contact forms.
Users should avoid sending information concerning racial or ethnic origin, religious belief, political opinion, trade union membership, health, sex life, genetic data, biometric data, criminal records or other sensitive information, unless such information is strictly necessary for the analysis of a specific request and is voluntarily provided by the data subject.
If sensitive personal data or special categories of data are voluntarily submitted, they will only be processed when there is an appropriate legal basis, a legitimate purpose and concrete necessity for the analysis of the request, in accordance with the LGPD, the GDPR, the UK GDPR and other applicable laws.
4. Purposes of processing
Personal data may be processed for the following purposes:
To respond to requests submitted through the website or other communication channels; to make initial contact with potential clients; to understand the subject matter of the user’s enquiry; to provide information about professional services; to assess the possibility of assistance, proposal or engagement; to manage relationships with clients and potential clients; to comply with legal, regulatory, professional, tax or contractual obligations; to exercise rights in judicial, administrative or arbitral proceedings; to keep minimum records for security, audit, fraud prevention and proof of communication; to improve website navigation, security, functionality and performance; to analyse website traffic and content interaction; to manage institutional communications and digital presence; and to protect the rights of the controller, users and third parties.
5. Legal bases for processing
Where the LGPD applies, personal data may be processed on the basis of consent, performance of a contract or preliminary procedures related to a contract, compliance with a legal or regulatory obligation, regular exercise of rights in judicial, administrative or arbitral proceedings, legitimate interests and other legal bases provided under the LGPD, where applicable.
Where the GDPR or UK GDPR applies, personal data may be processed on the basis of consent, performance of a contract or steps taken prior to entering into a contract, compliance with a legal obligation, protection of vital interests, performance of a task carried out in the public interest where applicable, or legitimate interests pursued by the controller or by a third party, provided that such interests are not overridden by the rights and freedoms of the data subject.
Where processing is based on consent, the data subject may withdraw consent at any time by contacting the controller at the e-mail address indicated in this Policy or, where available, through the cookie preferences panel. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
6. Legitimate interests
When personal data are processed on the basis of legitimate interests, the controller will apply criteria of necessity, proportionality, transparency and data minimisation, considering the purpose of the processing, the reasonable expectations of the data subject and the potential impact on the data subject’s rights and freedoms.
Legitimate interests may support, for example, security measures, fraud prevention, maintenance of minimum contact records, improvement of the website, analysis of interactions, exercise or defence of rights and institutional communications related to services previously requested by the user.
7. Cookies and similar technologies
This website may use cookies and similar technologies to ensure proper functioning of the website, maintain user preferences, improve security, understand browsing patterns, measure performance, analyse traffic, integrate external content and improve the user experience.
Strictly necessary cookies may be used to enable essential website functions, security, page loading, fraud prevention and preference management.
Analytics, performance, advertising, social media or third-party cookies may depend on the settings available in the cookie banner, cookie preferences panel or user browser, according to the requirements of applicable law.
Where required by law, non-essential cookies will only be used after prior, free, informed and unambiguous consent. Users may accept, reject or manage categories of cookies when this functionality is available.
Users may also configure their browsers to block, delete or alert them about cookies. Disabling certain cookies may affect the functionality, performance or browsing experience of the website.
8. Analytics, pixels and behavioural advertising
This website may use analytics tools, pixels, tags or similar technologies to understand page interactions, measure campaigns, evaluate content performance and improve digital communication.
Where these tools involve tracking, behavioural advertising, sharing with third parties or processing that depends on consent, they will be used in accordance with the user’s choices and applicable legal requirements.
This website is not intended to sell personal data. If, in the future, technologies are used in a manner that may be characterised as a “sale” or “sharing” of personal information under applicable United States state privacy laws, appropriate notices and choice mechanisms will be made available, including, where legally required, a “Do Not Sell or Share My Personal Information” option.
9. Electronic communications and marketing
The controller may send electronic communications related to requests made by the user, information about services, institutional content or relevant updates.
Where required by law, marketing communications will depend on prior consent or will include a clear unsubscribe mechanism. Users may request to stop receiving communications at any time by contacting contato@isabellanogueira.com.br or by using the unsubscribe link, when available.
10. Sharing of personal data
Personal data may be shared, when necessary and compatible with the purposes described in this Policy, with technology providers, hosting providers, website maintenance services, information security providers, form tools, e-mail platforms, communication tools, analytics providers, marketing platforms, social media platforms, technical consultants, accounting or legal advisers, public authorities, regulatory bodies, courts, administrative entities or third parties where there is a legal obligation, an order from a competent authority, contractual necessity or the need to exercise or defend rights.
The website may be developed, hosted or supported by third-party technology providers, including Wix. Such providers may process personal data as processors, service providers or equivalent roles, according to their own terms, privacy documentation and technical configurations.
When users interact with external functionalities, links, plug-ins, videos, analytics tools, cookies or social media features, they may also be subject to the privacy policies and terms of the relevant third-party platforms.
11. International transfers of personal data
Because this website may use third-party technology infrastructure, including hosting, security, forms, e-mail, analytics, social media and digital tools, personal data may be stored, accessed or processed outside Brazil.
Where the LGPD applies, international transfers of personal data will observe the applicable legal mechanisms under Brazilian data protection law.
Where the GDPR or UK GDPR applies, transfers of personal data to third countries or international organisations will be carried out under an adequacy decision, standard contractual clauses, appropriate safeguards or other legally permitted transfer mechanisms, as applicable.
12. Data retention
Personal data will be retained for as long as necessary to fulfil the purposes for which they were collected, to comply with legal, regulatory, tax, professional or contractual obligations, to exercise or defend rights, to prevent fraud, to maintain legitimate records and to protect the legal interests of the controller.
When personal data are no longer necessary, they may be deleted, anonymised or retained only where permitted by applicable law.
13. Security
The controller adopts reasonable and proportionate technical, administrative and organisational measures designed to protect personal data against unauthorised access, loss, destruction, alteration, disclosure or any form of inappropriate or unlawful processing.
Such measures may include access controls, use of reputable technology providers, privacy settings, restriction of permissions, maintenance of necessary records, review of digital tools and internal procedures compatible with the nature and volume of the data processed.
No digital environment is completely risk-free. Users should also take appropriate precautions, including avoiding the submission of excessive or unnecessary information through open forms and protecting their own devices, e-mail accounts, passwords and communication channels.
14. Data subject rights under the LGPD
Under the LGPD, data subjects may request, where applicable, confirmation of the existence of processing, access to personal data, correction of incomplete, inaccurate or outdated data, anonymisation, blocking or deletion of unnecessary or excessive data or data processed in breach of the law, data portability, information about sharing, information about the possibility of refusing consent and the consequences of refusal, withdrawal of consent and review of decisions made solely on the basis of automated processing of personal data.
Requests may be sent to contato@isabellanogueira.com.br.
For security reasons, the controller may request information necessary to verify the identity of the requester before processing the request.
15. Additional rights for individuals in the European Economic Area, the United Kingdom or Switzerland
Where the GDPR, UK GDPR or equivalent rules apply, data subjects may have the right to access, rectify, erase, restrict processing, object to processing, receive data portability, withdraw consent and not be subject to decisions based solely on automated processing that produce legal effects or similarly significant effects.
Data subjects may also lodge a complaint with a competent data protection authority, without prejudice to contacting the controller first through the e-mail address indicated in this Policy.
Where required by applicable European or United Kingdom law, additional information regarding an EU representative, UK representative, Data Protection Officer or competent supervisory authority may be made available as a supplement to this Policy.
16. Additional information for residents of California and other United States jurisdictions
Where the CCPA/CPRA or other United States state privacy laws apply, residents of covered jurisdictions may have specific rights, including the right to know what categories of personal information are collected, used, disclosed, sold or shared; the right to access personal information; the right to request correction of inaccurate personal information; the right to request deletion of personal information; the right to opt out of the sale or sharing of personal information; the right to limit the use and disclosure of sensitive personal information; and the right not to be discriminated against for exercising privacy rights.
For transparency purposes, this website may collect, within the limits described in this Policy, the following general categories of personal information: identifiers, contact details, internet or network activity information, approximate location derived from IP address, professional or commercial information voluntarily provided by the user and limited inferences related to website interaction or service interest.
This website is not intended to sell personal information. If cookies, pixels or third-party technologies are used in a manner that may be interpreted under a specific United States state law as “sharing” for cross-context behavioural advertising, appropriate choice and opt-out mechanisms will be made available where legally required.
Privacy requests from United States residents may be sent to contato@isabellanogueira.com.br. The controller may request additional information to verify the identity of the requester and process the request securely.
17. Children and adolescents
This website is not directed to children or adolescents and is not intended to collect personal data from minors.
If the accidental processing of personal data relating to a child or adolescent is identified without an appropriate legal basis, the information may be deleted or processed in accordance with instructions from the legal guardian and applicable law.
Where applicable law requires parental consent, specific authorisation or additional restrictions for the processing of minors’ data, such requirements must be observed before any processing takes place.
18. Automated decision-making
This website does not, as a rule, adopt decisions based solely on automated processing of personal data that produce legal effects or significantly affect the data subject.
If automated tools are used in the future for segmentation, lead qualification, profiling or relevant decision-making, the data subject will be properly informed and may exercise the rights provided under applicable law.
19. Third-party websites and social media
This website may contain links to Instagram, Facebook, YouTube, TikTok, LinkedIn and other external platforms.
When users click on such links or interact with content in third-party environments, they become subject to the privacy policies, terms of use, cookie practices and data processing activities of those platforms.
This Privacy Policy applies only to the processing of personal data carried out within this website and channels directly managed by the controller. It does not apply to third-party practices over which the controller has no control.
20. How to exercise privacy rights
Any request relating to this Privacy Policy, the processing of personal data or the exercise of rights under the LGPD, GDPR, UK GDPR, CCPA/CPRA or other applicable privacy laws may be sent to:
contato@isabellanogueira.com.br
The controller will evaluate requests in accordance with applicable law, the nature of the request, the identity verification requirements and any legal or professional obligations that may justify the retention or restriction of certain data.
21. Changes to this Privacy Policy
This Privacy Policy may be updated at any time to reflect legal, regulatory, technological, operational or business changes.
The version in force will always be the version published on this page, with the date of the last update indicated at the beginning of the document.
Material changes may be communicated through a notice on the website or by other reasonable means, where appropriate.
22. Contact
For questions about this Privacy Policy, the processing of personal data or the exercise of privacy rights, please contact: