Privacy Policy

1. Our commitment to your information

Osvaldo Quintero understands the value and sensitivity of the information we handle. The confidentiality and protection of the personal data of our clients, users and everyone else we deal with is a priority of our service.

As legal professionals and providers of legal services, we are bound by ethical, professional and legal duties of confidentiality. All information received within the attorney–client relationship is handled under strict standards of secrecy. This duty is additional to the lawyer’s professional privilege, applies throughout the entire period of processing and survives the end of the professional relationship. We also adopt measures to protect any information —personal or corporate— stored or processed by our organisation.

This Policy describes how we collect, use, store and share the personal data entrusted to us. It supplements any prior agreement, whether oral or written, relating to the processing of personal, commercial or financial information.

2. Controller and contact details

The controller of your personal data is:

• Controller: Osvaldo Quintero, attorney in practice in the Republic of Panama.
• Email: tradslegal@outlook.com
• Telephone:
• Address for notices: San Francisco, Panama City, Republic of Panama.

3. Scope

This Policy applies:

• To Osvaldo Quintero, in his capacity as controller of personal data processing.
• To any natural person whose personal data we process. Law 81 of 2019 protects the data of natural persons; nevertheless, information about legal entities that we handle is safeguarded under the same standards of confidentiality.
• When we use the terms “we” or “our”, we refer to Osvaldo Quintero or to his business name “tradslegal”.
• When we use “you” or “data subject”, we refer to the natural person whose personal data is being processed.

4. Legal framework

Our handling of personal data is based principally on:

• Law 81 of 2019, on the Protection of Personal Data.
• Executive Decree 285 of 2021, implementing Law 81 of 2019.

These rules govern the processing of personal data in the Republic of Panama, including due diligence obligations, retention of information and disclosure of data to the competent authorities where legally required. The supervisory authority in this field is the National Authority for Transparency and Access to Information (ANTAI).

5. Key definitions

For the purposes of this Policy:

• Personal data: any information concerning natural persons that identifies them or makes them identifiable.
• Sensitive personal data: data relating to the data subject’s private sphere, or whose improper use may give rise to discrimination or entail a serious risk to them; for example, racial or ethnic origin, religious, philosophical or political beliefs, trade union membership, health data, sexual life or orientation, and genetic or biometric data, among others.
• Data processing: any operation on personal data —collecting, storing, organising, using, communicating, transferring or erasing, among others— whether automated or not.
• Consent: an expression of the data subject’s will by which their data is processed.
• Transfer: to disclose, publish, communicate, exchange or transmit data, by any means, to persons other than the data subject.
• Controller: the party that decides the purposes, means and scope of the processing. Under this Policy, Osvaldo Quintero.
• Database custodian: the party that, in the name and on behalf of the controller, keeps and safeguards the database.

6. Principles governing the processing

We act in accordance with the following principles:

• Fairness: personal data must be collected without deceit or falsehood and without fraudulent, unfair or unlawful means.
• Purpose: personal data must be collected for specified purposes and must not subsequently be processed for incompatible or different purposes, nor kept longer than necessary for the purposes of the processing.
• Proportionality: only data that is adequate, relevant and limited to the minimum necessary for the purpose for which it is required may be requested.
• Accuracy: personal data must be accurate and kept up to date so that it truthfully reflects the data subject’s current situation.
• Data security: controllers must adopt the technical and organisational measures necessary to guarantee the security of the data in their custody, particularly where the data is considered sensitive, and must inform the data subject as soon as possible if the data has been taken without authorisation or there are sufficient indications that its security has been breached.
• Transparency: all information or communication to the data subject about the processing of their data must be in plain and clear language.
• Confidentiality: all persons involved in the processing of personal data are bound to secrecy or confidentiality in respect of it, even after their relationship with the data subject or the controller has ended, preventing unauthorised access or use.
• Lawfulness: for the processing of personal data to be lawful, it must be collected and processed with the prior, informed and unambiguous consent of the data subject, or on a legal basis.
• Portability: the data subject has the right to obtain from the controller a copy of their personal data in a structured, generic and commonly used format.

7. How we obtain your data and what we use it for

We collect personal data directly from you when you make enquiries in person, by telephone or electronically; when you accept and use our services; or when you write to us by email or messaging. We may also obtain it from publicly accessible sources or from the competent authorities, where necessary for the matter we are handling.

8. Legal basis for the processing

We process your data on the following bases:

• Your prior, informed and unambiguous consent.
• Performance of the contractual relationship for legal services to which you are a party.
• Compliance with legal obligations binding on us, including due diligence, document retention and responding to requests from the competent authority.
• The establishment, exercise or defence of a right in judicial or administrative proceedings.

9. Clients and prospective clients

We may collect information for:

• Full identification: name, date of birth, identity document, nationality and role within a legal entity.
• Contact and billing: address, email address, telephone and taxpayer registration number (RUC).
• Due diligence: compliance with due diligence and Know Your Client policies.

Information may be verified against public sources, the competent authorities or specialised providers, where necessary to meet legal or contractual obligations.

10. Purposes of the processing

• Provision of legal services.
• Contract management and billing.
• Conflict-of-interest checks.
• Compliance with regulatory obligations.
• Responding to judicial or administrative requests.

11. Data retention period

Data will be kept for as long as the purposes of the processing subsist, unless a legal obligation imposes a different period or the data is necessary for the defence of claims. Once that period has elapsed, the data is securely deleted or destroyed.

12. Sensitive personal data

The practice of the profession may in some cases require the processing of sensitive personal data where it is necessary for the matter entrusted to us. In such cases:

• We request your prior, express and unequivocal consent.
• We limit the processing to what is strictly necessary for the matter.

13. Website

14. Email, messaging and social media

We communicate with our clients by email and through messaging applications. These services are operated by international companies that set their own privacy policies and technical conditions, a situation entirely beyond our control.

Our accounts on platforms such as LinkedIn, Facebook, Instagram and YouTube are governed by each network’s own privacy policy. We do not collect personal data through these platforms, nor do we provide legal advice by those means.

15. Sharing and transfers of data

We may share data:

• With our authorised personnel, subject to the duty of confidentiality.
• With external providers —expert witnesses, translators, banks, money remittance houses for client payments, among others— as part of the legal service you have requested.
• With the competent authorities where there is a legal obligation or a duly reasoned request.

Every transfer relies on one of the lawfulness conditions of Law 81 of 2019 —principally your consent, performance of the professional engagement, or compliance with a legal obligation— and is limited to the minimum data necessary.

We do not transfer, sell or assign data for third-party advertising purposes.

We do not keep client files or databases in cloud storage services: the information resides on equipment under our direct control. The email and instant messaging we use to communicate with you run on third-party platforms.

16. Information security

We apply physical, technical and organisational measures proportionate to the volume and nature of the information we process, in accordance with the data security principle and Executive Decree 285 of 2021. Among others:

• Files are kept physically and on dedicated equipment, outside the cloud.
• Physical files are stored with restricted access.
• We make periodic backups under our own control.
• Access is limited to those who need to know the information by reason of the engagement, bound in writing by the duty of confidentiality.
• Documentation that is no longer necessary is securely destroyed or deleted.

17. Accuracy and updating

The data subject is responsible for keeping their information up to date and for notifying us of any relevant change.

18. Data subject rights (access, rectification, erasure, objection and portability)

You may exercise the following inalienable rights at any time, free of charge:

• Access: to know what data of yours we process, its origin, the purposes, the recipients and the retention period.
• Rectification: to correct data that is incorrect, incomplete, inaccurate, out of date or irrelevant.
• Erasure: to request deletion of your data when it is no longer necessary or lacks a legal basis.
• Objection: to object to a particular processing on well-founded and legitimate grounds, and to withdraw your consent.
• Portability: to receive a copy of the data you have provided to us, in a structured and commonly used format.

19. How to exercise your rights

Requests must be sent by email to tradslegal@outlook.com, stating:

• The right you wish to exercise and the specific data it concerns.
• In the case of rectification, the correction requested and the document supporting it.
• A means of contact so we can send you our reply.

Each right is exercised separately, and exercising one does not exclude the others.

20. Automated decision-making

We do not take decisions based solely on the automated processing of your personal data, nor do we build profiles that produce legal effects concerning you or cause you detriment.

21. Effective date and amendments

This Policy took effect on 4 September 2026. We reserve the right to amend it to reflect regulatory changes or better practices. The version in force will be available on our website and will be provided on request.