Privacy Policy

Last updated: 18 October 2026

1. Who we are

This Privacy Policy explains how Baker and Co Associates LDA and its affiliate Baker and Co Associates LLC-FZ (together “Baker & Co”, “we”, “us”, “our”) collect, use, share and protect personal data when you visit our website bakerandco.pt, contact us, use our eligibility checker, register for an event, apply for a job, or become our client.

Controller. For visitors to bakerandco.pt and for persons in the European Economic Area (EEA), the controller (“responsável pelo tratamento”) is Baker and Co Associates LDA, Av. António Augusto de Aguiar, n.º 24, 3.º Esq., Office 14, Lisbon, Portugal, phone +351 926 869 908.

Joint controller. Our affiliate Baker and Co Associates LLC-FZ, Office 102, Dubai Supreme Court Complex, Umm Hurair 2, Dubai, United Arab Emirates (phone +971 4 584 9553, WhatsApp +971 50 706 6734, websites bakerandco.ae and ar.bakerandco.ae), works with us on enquiries and cases, and the two companies may share personal data and systems, such as our in-house client relationship management (CRM) system, where needed for an enquiry or case. Where both companies jointly decide why and how your personal data is processed, they act as joint controllers under Article 26 of the GDPR (see section 2). Baker and Co Associates LLC-FZ has designated Baker and Co Associates LDA as its representative in the European Union for the purposes of Article 27 GDPR.

2. Scope of this policy and joint controllers

This policy applies to personal data we process about website visitors, people who contact us or submit enquiries (including through Facebook and Instagram lead forms), newsletter subscribers, event attendees, job applicants, clients, and family members or dependants included in a client’s application. It does not apply to the data practices of third-party websites, platforms or authorities, which have their own policies.

This policy is an information notice. The services we provide to clients are governed by our client engagement agreement and our Terms and Conditions. If there is any conflict between those terms and this policy about how we handle personal data, this policy prevails.

Joint controller arrangement (Article 26 GDPR)

Baker and Co Associates LDA and Baker and Co Associates LLC-FZ have agreed how they share responsibility for personal data they process jointly. In essence:

• Baker and Co Associates LDA is your main point of contact for persons in the EEA and for users of bakerandco.pt. It provides this privacy information, receives and coordinates requests to exercise your rights, and handles communication with the CNPD.
• Baker and Co Associates LLC-FZ is responsible for the processing it carries out on cases managed from Dubai and for the systems it operates, and supports the LDA in answering your requests.
• Each company is responsible for applying appropriate security measures to the systems it controls and for notifying the other without delay of any personal data breach.
• Whatever the arrangement, you may exercise your rights against either company, and they will cooperate to respond.

3. Summary

• We collect the personal data you give us (for example through enquiry and assessment forms, our eligibility checker, WhatsApp, phone and email), data from Meta lead forms, and limited technical data from your device.
• We use it to answer your enquiry, assess your eligibility, provide our immigration and residency services, run our business and, where you agree, send marketing and measure and improve our advertising.
• Your case may require sensitive data, such as passport data and, where an authority requires it, health or criminal-record certificates. We handle it only for your case, with extra safeguards.
• We share data with immigration authorities, embassies and consulates, with our professional partners (lawyers, investment and real-estate partners, translators), with our service providers and with authorities where the law requires. We never sell your personal data for money.
• Non-essential cookies (analytics and advertising) are used only with your consent, which you can change at any time through “Cookie settings”.
• You have rights over your data, including access, correction, deletion and objection, depending on where you live.
• We cannot guarantee any visa, residency or citizenship outcome. Decisions are made by the competent authorities.

4. Personal data we collect

4.1 Data you give us

Context	Personal data
Enquiry and assessment forms, eligibility checker	Name, email address, phone/WhatsApp number, nationality, country of residence, the programme you are interested in, financial details (for example budget, income, assets or source of funds), professional details (for example occupation, employer, qualifications, experience), and any other information you choose to provide.
Facebook and Instagram lead forms	The details you submit in the Meta lead form (typically name, email, phone number and answers to our questions), together with information about the advertisement and form you responded to.
Newsletter sign-ups	Name (if given), email address, language preference and your subscription choices.
Event registrations	Name, contact details, the event you registered for, attendance, and any questions or requirements you share.
Job applications	CV, cover letter, contact details, employment and education history, skills, right-to-work information, references and any other information in your application.
Client case files	Identity data (for example passport, ID card, photographs, date and place of birth, nationality, civil status); family data (spouse, children, parents and other dependants, marriage and birth certificates); financial data (bank statements, proof of income, assets, investments, source of funds and source of wealth, tax documents); employment data (contracts, employer letters, CV, qualifications); travel and immigration history (visas, residence permits, entry and exit records); addresses; and any other document an authority requires, which may include health certificates, medical insurance and police or criminal-record certificates.
Communications	The content and details of your communications with us by phone, email and WhatsApp, including messages, documents and voice notes you send.

Where you give us data about another person (for example a spouse, child or other dependant), see section 16.

Providing personal data is voluntary, but if you do not provide the data we need for an enquiry, an application or a legal requirement, we may be unable to answer you or provide our services.

4.2 Data we collect automatically

When you use our websites we, and our service providers, collect technical data such as IP address, approximate location derived from it, device and browser type, pages viewed, time spent, referring website, and interactions with forms and buttons. With your consent where required, we use cookies and similar technologies for analytics and advertising (see section 7).

Our first-party cookie bc_src records how you reached our website: the referring website, marketing campaign parameters (UTM tags), advertising click identifiers (such as Google or Meta click IDs) and your landing page. If you submit an enquiry form, this source information is attached to the internal notification we receive about your enquiry so that we know which channel brought you to us. Where consent is required, this cookie is set only after you accept analytics cookies.

4.3 Data from other sources

• Meta Platforms (Facebook and Instagram), when you submit a lead form in one of our advertisements.
• Family members or representatives who apply on your behalf or include you in a family application.
• Authorities, embassies, consulates and partners involved in your case (for example decisions, requests for information, legal opinions, translations and investment or property documentation).
• Analytics and advertising providers (Google and Meta), which give us aggregated or pseudonymous reports about the performance of our website and advertisements.

5. Sensitive personal data

Immigration and residency applications can require data that the law treats as sensitive or special category data, such as passport and government identification numbers, citizenship and immigration status, health information (for example medical certificates or insurance required by an authority), biometric data (for example photographs used for identification) and criminal-record data (for example police clearance certificates). Some documents may also reveal racial or ethnic origin or religious beliefs.

We collect and use this data only where it is needed for the service you have asked for or required by the authority concerned, and only:

• with your explicit consent, which we ask for when your case begins;
• where it is necessary to establish, exercise or defend legal claims; or
• where the processing is otherwise permitted or required by applicable law.

We do not use sensitive data for marketing, advertising or profiling, and we do not sell or share it for cross-context behavioural advertising. Access is restricted to staff and partners working on your case. You can withdraw your consent at any time, but this will not affect processing already carried out and may mean we can no longer progress your application.

Please do not send sensitive documents through our website forms, social media messages or lead forms. We will tell you how to send case documents securely once your case begins.

6. How we use your data and our legal bases

The table below lists our purposes and, for persons covered by the EU GDPR or UK GDPR, the legal basis we rely on. Under the UAE Personal Data Protection Law, we rely on your consent or on the exceptions the law provides (such as performance of a contract you have requested, compliance with a legal obligation, or the establishment or defence of legal claims).

Purpose	Legal basis (GDPR / UK GDPR)
Responding to enquiries, assessment requests, eligibility-checker submissions and lead-form submissions; contacting you by phone, email or WhatsApp about your request	Steps taken at your request before entering into a contract (Art. 6(1)(b)); our legitimate interest in responding to people who contact us (Art. 6(1)(f))
Providing our services: assessing eligibility, preparing, translating and submitting applications, liaising with authorities, embassies, consulates and partners, and managing your case	Performance of our contract with you (Art. 6(1)(b)); for sensitive data, your explicit consent (Art. 9(2)(a)) and the establishment, exercise or defence of legal claims (Art. 9(2)(f)); for criminal-record data, Art. 10 GDPR together with your consent where national law allows it (in the UK, the conditions in Schedule 1 to the Data Protection Act 2018)
Processing data about family members and dependants included in an application	Performance of the contract with the main applicant and our legitimate interest in processing the family application requested (Art. 6(1)(b) and (f)); explicit consent for sensitive data (Art. 9(2)(a)), given by the person concerned or by a parent or guardian
Managing our client relationships and CRM, keeping records, billing, quality control and training	Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)); legitimate interests in running our business efficiently (Art. 6(1)(f))
Sending newsletters, event invitations and information about our services	Your consent (Art. 6(1)(a)); or, for existing clients where the law permits, our legitimate interest in telling you about similar services (Art. 6(1)(f)), with the right to opt out at any time
Organising events and webinars	Performance of a contract or steps at your request (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f))
Website analytics, attribution of enquiries to marketing channels (bc_src cookie), advertising measurement and remarketing through Google and Meta	Your consent (Art. 6(1)(a)) and, for cookies, Article 5(3) of the ePrivacy Directive as implemented by Portuguese Law No. 41/2004 and the UK Privacy and Electronic Communications Regulations (PECR)
Recruitment: assessing job applications	Steps at your request before entering into a contract (Art. 6(1)(b)); legitimate interests in recruiting suitable staff (Art. 6(1)(f))
Keeping our websites and systems secure, preventing fraud and misuse	Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c))
Complying with laws, regulations, court orders and lawful requests from authorities; establishing, exercising or defending legal claims	Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)); Art. 9(2)(f) for sensitive data

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can ask us for more information about this balancing test. Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

7. Cookies, analytics and advertising

We use cookies and similar technologies (such as pixels, tags and local storage). Strictly necessary cookies are always active. Analytics, attribution and advertising cookies are used only if you accept them in our cookie banner. You can change your choices at any time through the “Cookie settings” link in the footer of every page. Full details, including a list of cookies, are in our Cookie Policy.

• Google Analytics and Google Ads (via Google tag and Google Tag Manager) help us understand how visitors use our websites and measure and improve our advertisements, including remarketing. We use Google Consent Mode v2: until you consent, Google tags do not read or write analytics or advertising cookies and we send Google signals indicating that you have not consented to ad storage, ad user data, ad personalisation or analytics storage. Google may then use cookieless signals for aggregated, modelled measurement. Google’s use of data is described at policies.google.com/technologies/partner-sites.
• Meta Pixel (Facebook and Instagram) measures the effectiveness of our advertisements and helps us show ads to people who visited our websites or people with similar interests. It is loaded only after you accept advertising cookies. Meta processes data under its own policies; for our use of the Meta Pixel and Meta Business Tools, Meta and we may act as joint controllers for the collection and transmission of data to Meta, and Meta is an independent controller for its subsequent processing. See facebook.com/privacy/policy.
• Advanced matching. If you accept advertising cookies, contact details you enter in our forms (such as email address and phone number) may be converted into an irreversible code (“hashed”) in your browser and sent with the Meta Pixel event so that Meta can match the visit to an account and measure our ads. Meta does not receive the details in readable form from us.
• Facebook and Instagram lead forms. When you submit a lead form in one of our ads, Meta collects the data on its platform and passes it to us. We use it only to respond to your enquiry and for the purposes in this policy, and we do not sell it or combine it with data from other advertisers. Meta’s own processing is governed by Meta’s privacy policy.
• Personalised ads and interest-based advertising. Google and Meta may use the data collected through their tags to show you our ads on other websites and apps. You can also manage ad preferences in your Google account (adssettings.google.com) and Meta account settings.
• Global Privacy Control. We treat a Global Privacy Control (GPC) signal from your browser as a request to opt out of advertising cookies and of any “sale” or “sharing” of personal data, as described in section 14.4.

8. Marketing communications

We send newsletters and marketing messages by email, phone or WhatsApp only where you have consented or where the law otherwise permits it (for example to existing clients about similar services, where allowed). You can opt out at any time by using the unsubscribe link in any email, replying “STOP” to a WhatsApp message, or contacting us at info@bakerandco.ae. We keep a record of your opt-out so that we can respect it. Opting out of marketing does not affect service messages about an enquiry or case.

9. Who we share your data with

We never sell your personal data for money. We share personal data only as follows:

• Our affiliate Baker and Co Associates LLC-FZ (Dubai, UAE), where it is involved in your enquiry or case or provides shared systems.
• Immigration authorities, government agencies, embassies and consulates to which your application is submitted or which request information about it.
• Professional partners involved in your case, such as lawyers, investment and real-estate partners, translators and, where relevant, due-diligence providers required by the programme. These partners may act as independent controllers and are bound by professional and legal duties of confidentiality.
• Service providers (processors) who process data on our behalf under contract, including our website host and content delivery network (Hostinger), website tools (WordPress, Elementor, WPForms and related plugins), email, telephony and messaging providers (including WhatsApp), IT, document storage and security providers, and analytics and advertising providers (Google and Meta). They may use the data only on our instructions and must protect it.
• Authorities, courts, regulators and law-enforcement bodies where we are required by law or where it is necessary to establish, exercise or defend legal claims, or to protect the rights, property or safety of our clients, our staff or others.
• Professional advisers (such as auditors, accountants, insurers and legal advisers) under duties of confidentiality.
• A successor business in the event of a merger, acquisition or transfer of all or part of our business, subject to this policy.
• Anyone else with your consent or at your direction.

10. International transfers

We operate from Portugal and the United Arab Emirates, and our work necessarily involves sending data to other countries, including Spain and other EU member states, the United Arab Emirates, the United Kingdom, Caribbean citizenship-by-investment countries and any other country whose programme you apply for. Our service providers may also process data in other countries, including the United States and the EU.

Some of these countries do not provide the same level of data protection as your home country. Where the law requires, we protect transfers by:

• transferring to countries recognised as providing adequate protection (for example, under EU law, the United Kingdom, and recipients in the United States certified under the EU–US Data Privacy Framework);
• using the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, or other safeguards permitted by applicable law, including for transfers between our affiliated companies in Portugal and the UAE (the UAE does not benefit from an EU adequacy decision);
• relying, where no other safeguard is available, on the fact that the transfer is necessary for the performance of a contract with you or concluded in your interest (for example submitting your application to a foreign authority), on your explicit consent, or on the establishment, exercise or defence of legal claims (Article 49 GDPR); and
• for transfers from the UAE, the conditions set out in Articles 22 and 23 of the UAE Personal Data Protection Law.

Immigration authorities in the destination country will process your data under their own laws, over which we have no control. You can ask us for more information about transfers and the safeguards used, including a copy of the relevant safeguards.

11. How long we keep your data

Data	Retention period
Enquiries, assessment requests, eligibility-checker submissions, lead-form leads and event registrations that do not become a client case	24 months after our last contact with you
Client case files	For the duration of the case plus 5 years, or longer where a law requires it (for example tax, accounting or anti-money-laundering rules) or where needed to establish, exercise or defend legal claims
Job applications and CVs	12 months after we receive your application, unless you join us or ask us to delete it sooner
Newsletter subscriptions	Until you unsubscribe; we then keep your email address on a suppression list so that we do not contact you again
Cookies	As set out in our Cookie Policy

When a retention period ends, we delete or anonymise the data. Backups are overwritten on a rolling basis. Partners, authorities and independent controllers retain data under their own policies and laws.

12. Security

We use appropriate technical and organisational measures to protect personal data, such as encrypted connections (HTTPS), access controls limited to staff who need the data, strong authentication, confidentiality obligations for staff and partners, and contracts with our service providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs that is likely to put your rights at risk, we will notify you and the competent authorities as required by law.

13. Your rights

Depending on where you live and the law that applies, you may have the right to:

• be informed about how we process your data and access a copy of it;
• correct inaccurate or incomplete data;
• delete your data (“right to erasure”);
• restrict or stop processing;
• object to processing based on legitimate interests, and to direct marketing at any time;
• data portability, i.e. receive your data in a structured, machine-readable format or have it sent to another organisation;
• withdraw consent at any time;
• not be subject to decisions based solely on automated processing that produce legal or similarly significant effects;
• opt out of the “sale” or “sharing” of personal data, targeted advertising and profiling (US state laws); and
• complain to a supervisory authority (see section 21).

How to exercise your rights. Email info@bakerandco.ae with “Privacy request” in the subject line, or contact us using the details in section 21. To protect you, we may need to verify your identity before acting on a request, and we will ask only for the information we need to do so. You can use an authorised agent where the law permits; we may ask for proof of their authority. We respond within the time required by applicable law (for example, one month under the GDPR and UK GDPR, which may be extended by two further months for complex requests, and 45 days under the CCPA, extendable once by 45 days). Requests are free of charge unless they are manifestly unfounded or excessive.

These rights are not absolute. We may refuse or limit a request where the law allows, for example where we must keep data to comply with a legal obligation, to establish or defend legal claims, or where a request would disclose another person’s data. We will explain our reasons. We will not discriminate against you for exercising your rights.

14. Additional information for your region

14.1 European Economic Area and Portugal

For persons in the EEA, we process personal data in accordance with Regulation (EU) 2016/679 (GDPR), Portuguese Law No. 58/2019 of 8 August, and Portuguese Law No. 41/2004 of 18 August (as amended) on privacy in electronic communications. Baker and Co Associates LDA in Lisbon is the controller for visitors to bakerandco.pt and persons in the EEA, acting jointly with Baker and Co Associates LLC-FZ as described in section 2, and is the EU representative of Baker and Co Associates LLC-FZ. You have the rights described in section 13, including the right to object at any time to processing for direct marketing, and the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD) or another EEA supervisory authority.

14.2 United Arab Emirates

We process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and any executive regulations and decisions issued under it. Under the PDPL you have the right to obtain information about your data, to data portability, to correction or erasure, to restriction of processing, to stop processing, and to object to decisions based on automated processing. Where we rely on consent, it is specific, clear and unambiguous, and you may withdraw it at any time. If you are not satisfied with our response, you may complain to the UAE Data Office or its successor federal authority. Where you deal with us in a UAE free zone that has its own data protection law, that law may also apply.

14.3 United Kingdom

For persons in the United Kingdom, we process personal data in accordance with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended. You have the rights described in section 13 and may complain to the Information Commissioner’s Office (ICO).

14.4 United States

This section applies to residents of US states with consumer privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), to the extent those laws apply to us. It supplements the rest of this policy.

Categories of personal information collected in the last 12 months (sources, purposes and recipients are described in sections 4, 6 and 9):

Category (CCPA)	Examples	Disclosed for a business purpose to	“Sold” or “shared”?
Identifiers	Name, email, phone/WhatsApp number, IP address, cookie and advertising identifiers, passport number	Service providers; partners and authorities at your direction	Online identifiers only, to Google and Meta through advertising cookies, if you have not opted out
Customer records (Cal. Civ. Code § 1798.80(e))	Contact details, financial information, employment and education details	Service providers; partners and authorities at your direction	No
Protected classification characteristics	Age, nationality, citizenship, marital status, sex, and (where an authority requires it) medical condition	Partners and authorities at your direction; service providers	No
Commercial information	Services requested or purchased, programme interest	Service providers	No
Internet or other electronic network activity	Pages viewed, referrer, campaign and click data, interactions with our website and ads	Service providers	Yes, to Google and Meta through advertising cookies, if you have not opted out
Geolocation data	Approximate location derived from IP address (not precise geolocation)	Service providers	Approximate location only, through advertising cookies, if you have not opted out
Audio and electronic information	WhatsApp voice notes and messages, emails	Service providers	No
Professional or employment-related information	Occupation, employer, CV, work history	Partners and authorities at your direction; service providers	No
Education information	Qualifications and certificates	Partners and authorities at your direction; service providers	No
Inferences	Likely interest in a programme, derived from enquiries and website use	Service providers	Through advertising cookies, if you have not opted out
Sensitive personal information	Passport and government ID numbers, citizenship or immigration status, health information, biometric information (photographs), and data that may reveal racial or ethnic origin or religious beliefs	Partners and authorities at your direction; service providers	No

Sale and sharing. We do not sell personal information for money. However, allowing Google and Meta to collect online identifiers and browsing data through advertising cookies on our websites may be considered a “sale” or “sharing” for cross-context behavioural advertising, or “targeted advertising”, under some US state laws. You can opt out at any time by clicking “Your Privacy Choices / Do Not Sell or Share My Personal Information” in the footer of our websites (which opens our cookie settings) and turning off advertising cookies, by enabling Global Privacy Control in your browser, or by emailing info@bakerandco.ae. We do not sell or share sensitive personal information, and we do not knowingly sell or share the personal information of consumers under 16.

Sensitive personal information. We use sensitive personal information only to provide the services you request and for other purposes permitted by the CCPA regulations, and not to infer characteristics about you. Where a state law requires your consent to process sensitive data, we obtain it.

Retention. We keep each category for the periods in section 11.

Your rights. Subject to applicable law, you may request to know what personal information we have collected, used, disclosed, sold or shared; to access, correct or delete it; to receive a portable copy; and to opt out of sale, sharing, targeted advertising and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not use personal information for such profiling. We will not discriminate against you for exercising these rights. We do not offer financial incentives in exchange for personal information.

Appeals. If we decline your request, you may appeal by emailing info@bakerandco.ae with “Privacy appeal” in the subject line. We will respond within the period required by your state’s law. If you are not satisfied, you may contact your state Attorney General.

14.5 Other countries

If you live in another country with data protection laws, we will handle your personal data in line with this policy and the mandatory requirements of those laws, and you may have additional rights under them. Contact us to exercise them.

15. Children

Our websites and services are not directed at children, and we do not knowingly collect personal data directly from anyone under 18. We process the personal data of children only when a parent or legal guardian provides it as part of a family application, and only for that application. The parent or guardian is responsible for providing the data, giving any required consent on the child’s behalf, and informing the child where appropriate. If you believe a child has given us personal data without a parent or guardian, please contact us and we will delete it.

16. Your responsibilities

• Accuracy. You are responsible for ensuring that all information and documents you provide to us are true, accurate, complete, up to date and authentic, and for telling us promptly of any change. Immigration authorities may refuse applications, impose bans or take other action where information is inaccurate, incomplete or misleading. To the extent permitted by law, we are not responsible for consequences arising from information or documents you or your representatives supply that are inaccurate, incomplete, misleading or not genuine.
• Data about other people. If you give us personal data about another person, such as a family member, dependant, employer or referee, you confirm that you are entitled to do so, that you have informed them about this policy, and, where their consent is required (for example for sensitive data), that you have obtained it or are their parent or legal guardian.
• Security of your accounts. Please keep your email, WhatsApp and other accounts you use to communicate with us secure, and tell us immediately if you suspect unauthorised access.

17. No guarantee of outcomes and limitation of liability

No guarantee of outcomes. Decisions on visas, residence permits, citizenship and related applications are made solely by the competent governmental authorities, at their discretion and under laws and policies that may change at any time. We do not and cannot guarantee that any application will be approved, the time it will take, or that any programme will remain available on the same terms. Information on our websites, in our eligibility checker and in our communications is general information and not a promise of any outcome.

Limitation of liability. To the fullest extent permitted by applicable law, we are not liable for decisions, delays or acts of governmental authorities, embassies, consulates or independent third parties, for losses caused by inaccurate, incomplete or false information supplied to us, or for indirect or consequential losses arising from your use of our websites. Our liability for services we provide to clients is governed by the client engagement agreement.

What we do not exclude. Nothing in this policy excludes or limits: (a) liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for wilful misconduct or gross negligence; (b) your rights under data protection law, including any right to compensation for damage caused by an infringement (for example under Article 82 of the GDPR or UK GDPR); or (c) any other liability or right that cannot be excluded or limited by law, including your statutory rights as a consumer (for example under UAE Federal Law No. 15 of 2020 on Consumer Protection, Portuguese Decree-Law No. 446/85 on general contractual clauses and consumer law, or the UK Consumer Rights Act 2015).

18. Eligibility checker and automated decisions

Our eligibility checker uses the answers you give to produce an indicative, general result about which programmes may suit you. It is a guide only: it does not make any decision about you, it is not a determination of eligibility by any authority, and a member of our team reviews your situation before we give advice. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Advertising platforms such as Google and Meta may use automated means to decide which ads to show; you can control this through our cookie settings and your account settings with those platforms.

19. Third-party websites and platforms

Our websites link to, and we communicate through, third-party websites and platforms, such as government portals, Facebook, Instagram, WhatsApp and Google. Their privacy practices are governed by their own policies, and we are not responsible for them. Please review their policies before giving them personal data.

20. Changes to this policy

We may update this policy from time to time to reflect changes in our services, technology or the law. We will post the updated version on this page with a new “Last updated” date and, where changes are significant, we will take reasonable steps to inform you (for example by email or a notice on our website). Where the law requires your consent to a change, we will ask for it.

21. Contact us and complaints

For any question about this policy or your personal data, or to exercise your rights, contact:

• Baker and Co Associates LDA (controller and EU representative): Av. António Augusto de Aguiar, n.º 24, 3.º Esq., Office 14, Lisbon, Portugal. Phone: +351 926 869 908. Email: info@bakerandco.ae (please write “Privacy request – Portugal” in the subject line).
• Baker and Co Associates LLC-FZ (joint controller): Office 102, Dubai Supreme Court Complex, Umm Hurair 2, Dubai, United Arab Emirates. Phone: +971 4 584 9553. WhatsApp: +971 50 706 6734.

If you are unhappy with how we have handled your personal data, please contact us first so that we can try to resolve your concern. You also have the right to complain to a data protection authority, including:

• Portugal / European Economic Area: the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal, www.cnpd.pt. You may also complain to the supervisory authority in the EEA country where you live or work or where the alleged infringement took place.
• United Kingdom: the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk, helpline 0303 123 1113.
• United Arab Emirates: the UAE Data Office or its successor federal authority responsible for personal data protection.
• United States: the California Privacy Protection Agency or California Attorney General (California residents), or the Attorney General of your state.

This policy is available in Portuguese, English and Arabic. If there is any inconsistency between language versions, the Portuguese version prevails for data subjects in Portugal and the English version prevails in all other cases, to the extent permitted by law.