Privacy and Data Policy

1. Identity of the Data controller

BC LEGAL S.A.C., registered under RUC No. 20616287592, with its registered office at Jr. Monte Rosa 255, 4th floor, Chacarilla del Estanque, Santiago de Surco district, Lima province and department (hereinafter, the “Firm”), is responsible for the processing of personal data it collects in the course of its professional activities and through its contact channels.
For inquiries regarding this Policy or the processing of personal data, please contact us at administracion@bclegal.pe

2. Regulatory framework

The processing of personal data is carried out in accordance with Law No. 29733, the Personal Data Protection Act; its Regulations, approved by Supreme Decree No. 016-2024-JUS; and all other applicable rules, guidelines, and provisions issued by the National Authority for the Protection of Personal Data.

3. Scope of this Policy

This Policy describes how the Firm handles the personal data of individuals who interact with the Firm, including, as applicable:

clients and prospective clients, as well as their representatives, authorized agents, employees, contacts, and other individuals involved in matters entrusted to the Firm;
website users and individuals who submit inquiries via forms, email, or other channels;
subscribers to newsletters, legal alerts, publications, and invitations;
applicants for job positions, pre-professional or professional internships, and candidates to provide services;
suppliers, contractors, and their representatives or contacts;
visitors and attendees of meetings, events, seminars, or activities organized by the Firm; and
other individuals whose data is lawfully processed in the course of the Firm’s activities.

The processing of personal data carried out in connection with the provision of legal services will also be conducted in compliance with applicable duties of confidentiality and professional secrecy.

4. Categorías de datos personales

The categories of personal data that the Firm may process will depend on its relationship with each data subject and the corresponding purpose. These may include:

identification and contact information, such as first and last names, identification number, address, email address, and phone number;
obtained through cookies or similar technologies; and
professional and employment information, such as company, job title, profession, experience, education, and career history;
economic, financial, contractual, or billing information, when necessary for the relationship with the Firm;
data provided in inquiries, requests, proposals, contracts, communications, or documentation related to the provision of legal services;
applicant data, such as resumes, education, experience, references, and other information necessary for the selection process;
data on suppliers and contractors necessary for the contracting, administration, and payment of services;
access and security data, when required for entry into facilities or the protection of individuals and information;
technical and browsing data, such as IP addresses, device identifiers, browser information, access logs, and data
sensitive data or other special categories of information, only when its processing is necessary and legally permitted

5. Origen de los datos personales

The Firm may obtain personal data: directly from the data subject, through forms, emails, phone calls, meetings, contracts, documents, or communications;

from clients, prospective clients, or third parties who provide information necessary for a consultation, evaluation, or the provision of legal services;
from suppliers or duly authorized third parties;
from publicly available sources permitted by law; and
through the website, technological tools, and digital channels used by the Firm.

When data is not obtained directly from the data subject, the Firm will comply with the disclosure obligations required under applicable regulations.

6. Finalidades del tratamiento

The Firm will process personal data solely for specific, explicit, and lawful purposes. The applicable purposes will depend on the relationship with each data subject.

6.1 Clients, prospective clients, and individuals involved in legal matters

respond to inquiries, requests for information, and requests for proposals or quotes;
evaluate the possibility of establishing a professional relationship, including conflict-of-interest checks when applicable;
provide, manage, monitor, and follow up on contracted legal services;
manage communications, meetings, documentation, deliverables, and other activities inherent to the professional relationship;
manage proposals, contracts, billing, collections, payments, and other administrative processes related to the services;
comply with applicable legal, regulatory, tax, professional, or ethical obligations;
respond to requests from competent authorities and exercise or defend the rights of the Firm or its clients, as applicable;
conduct internal controls, audits, risk management, security, business continuity, and service improvement; and
maintain records and evidence of the professional relationship for the applicable periods.

6.2 Website users and people who submit inquiries

respond to contact requests, inquiries, or requests submitted through the website or other channels;
manage access to and the operation of the services available on the website;
protect the security, availability, and integrity of the website and its digital channels; and
collect usage metrics or statistics when applicable and provided that the relevant conditions are met.

6.3 Subscribers, professional contacts, and lead generation

Where applicable and provided there is the necessary legal authorization or consent, the Firm may process data for the following purposes:

to send newsletters, legal alerts, publications, invitations to events, and content of professional interest;
to provide institutional information about the firm, its activities, or services;
to manage professional and academic networking activities; and
to carry out advertising or business development activities.

When such purposes require consent, it will be requested separately, and the data subject may revoke it or exercise their right to object through simple, free-of-charge mechanisms.

6.4 Applicants and candidates

manage applications for job openings, internships, or recruitment processes;
evaluate the applicant's profile, experience, and education;
coordinate interviews, assessments, and other stages of the process

6.5 Suppliers and Contractors

evaluate, hire, and manage relationships with suppliers and contractors;
manage orders, contracts, payments, invoicing, and administrative documentation;
comply with legal, tax, accounting, and contractual obligations; and
manage access, security, and operational coordination as appropriate.

6.6 Visitors and event attendees

manage registration and access to the Studio's facilities for security purposes;
organize meetings, events, seminars, or institutional activities;
maintain records of entry and exit as appropriate

7. Consent and Treatments Permitted by Law

When the processing of personal data requires consent, the Firm will request it in a manner that is freely given, prior, express, unambiguous, and informed, in accordance with applicable regulations.
In cases where the law permits processing without consent, the Firm will process the data only within the circumstances, purposes, and limits established by the regulations.
Sensitive data will be processed only when necessary and provided that the special conditions required by law are met.

8. Personal Data Databases

Personal data may be included in one or more personal data databases owned by the Firm, in accordance with the data subject’s category and the purposes described in this Policy.

9. Whether the data is required or optional

The forms or channels used by the Firm will indicate, where applicable, what information is required to process a request, evaluate a contract, provide a service, or fulfill an obligation. Failure to provide required information may prevent the Firm from adequately processing the request or managing the corresponding relationship.
The provision of data intended exclusively for additional or promotional purposes will be optional where applicable.

10. Recipients, data processors, and third parties

The Firm may disclose personal data to authorities, public entities, advisors, auditors, or other third parties when there is a legal obligation, a valid request, a need related to the provision of services, or authorization in accordance with applicable regulations.

Likewise, the Firm may engage service providers who process personal data on its behalf, such as providers of cloud services, web hosting, email, document management, technical support, security, electronic signatures, communications, human resources, accounting, billing, analytics, or other services necessary for its operations.
Where applicable, such providers will be subject to confidentiality and security obligations and must process data in accordance with the Firm’s instructions and applicable regulations.

11. Domestic transfers and cross-border flows

Certain providers, platforms, or recipients may be located outside Peru or may store information in other countries. In such cases, the Firm will carry out cross-border transfers of personal data in accordance with the requirements of Peruvian law and will adopt the applicable measures or safeguards.

12. Retention period

Personal data will be retained for as long as necessary to fulfill the purposes for which it was collected and, thereafter, for the periods required to comply with legal, contractual, regulatory, or professional obligations or to address any potential liabilities arising from the relationship.
Once the applicable periods have expired, the data will be deleted, anonymized, blocked, or retained only when there is a legal obligation or basis that permits it.

13. Security and Confidentiality

The Firm takes reasonable and appropriate technical, organizational, and legal measures to protect personal data against loss, alteration, unauthorized access, processing, disclosure, or use, taking into account the nature of the information and the risks associated with its processing.
Access to the data is limited to individuals and third parties who need to know it in order to perform their duties or for the stated purposes. These individuals are subject to confidentiality obligations and, where applicable, to professional secrecy obligations.

14. Personal Data Security Incidents

The Firm has mechanisms in place to identify, assess, contain, document, and manage incidents that could compromise personal data. When required by law, it will make the appropriate communications or notifications to the National Authority for the Protection of Personal Data, the affected data subjects, or other competent authorities within the legally applicable timeframes.

15. Rights of data subjects

The data subject may exercise the rights recognized under Peruvian personal data protection regulations, including, as applicable, the rights to information, access, updating, inclusion, rectification, cancellation or deletion, objection, prevention of disclosure, and revocation of consent.
To exercise these rights, the data subject or their representative must submit a request that verifies their identity, identifies the right they wish to exercise, and provides the necessary information for processing the request.

16. Channel for exercising rights

Email: administracion@bclegal.pe
Address: Jr. Monte Rosa 255, 4th floor, Chacarilla
The Firm will process requests within the timeframes established by current regulations. If the data subject believes that their request has not been properly addressed, they may file a complaint with the National Authority for the Protection of Personal Data through the legally available mechanisms.

17. Cookies y tecnologías similares

The Firm’s website may use cookies and similar technologies necessary for its operation and security and, where applicable, technologies designed to collect statistics, remember preferences, measure site usage, or personalize content.
When a cookie or similar technology requires consent, the Firm will provide mechanisms to inform the user and manage their preferences.

18. Technological tools, automation, and artificial intelligence

The Firm may use technological, automation, or artificial intelligence tools to support certain internal or professional activities. When such tools involve the processing of personal data, their use must be in accordance with the disclosed purposes, confidentiality and security obligations, and other applicable requirements.
If the Firm implements automated decision-making or profiling for which the regulations require specific information to be provided to the data subject, it will provide the corresponding information and mechanisms.

19. Data on Children and Adolescents

The Firm’s website and services are not specifically intended for children or adolescents, unless expressly stated otherwise.
When it is necessary to process the personal data of minors in connection with a legal service or other activity, the Firm will apply the special conditions regarding information, consent, and protection provided for by current regulations.

20. Changes to this policy

The Firm may modify or update this Policy as a result of regulatory changes, guidance from the authorities, changes in its activities, new processing activities, technological changes, or improvements to its privacy practices.
The current version will be posted on the Firm’s website. When a modification requires a new notification or consent, the Firm will take the appropriate measures.

21. Contact

If you have any questions regarding this Policy or the processing of your personal data, you may contact the Firm at:
Company Name: BC LEGAL S.A.C.
Email: administracion@bclegal.pe

​Privacy and Data Policy