Privacy notice
This service exists to translate and certify official documents. Those documents are about you, and some of them are about the most sensitive parts of your life. This page says plainly what happens to them.
Last updated: 6 September 2026
translations@, privacy@ e contacttranslations@ogravata.com.
Who is responsible for your data
There are two, with separate responsibilities, and it is worth being precise about which is which.
O Gravata Consulting LLC (Florida, United States) is the party you deal with. It runs the website, receives your file, hosts it, takes the payment and sends you the messages about your order. It is the controller of the commercial side: your name and email, the order record, the payment and the invoice.
Klaus Luchtenberg, a lawyer registered with the Ordem dos Advogados (Portuguese Bar Association) under licence no. 58.638/L, is the controller of the document and its contents: what it says, how it is translated, what the certification declares, and the record of the act. He decides those things personally, under his own licence and under professional secrecy, and no commercial instruction can reach them.
Where the company holds your document — because it hosts the files and moves them between you and the lawyer — it does so on the lawyer's instructions and on his behalf, as a processor under Article 28 of the GDPR. That is written into the contract between them: it may not look inside your document for its own purposes, everyone with access is bound to confidentiality, the files are encrypted in transit and at rest, and no other supplier is brought in without the lawyer's written authorisation.
In practice: a question about your order is answered by the company; a question about your document, your translation or your certificate is answered by the lawyer.
Address for both: Av. de São Miguel 296, Atelier 10, CW-1, 2775-750 Carcavelos, Portugal.
Email for data protection matters: privacy@ogravata.com
No data protection officer has been appointed. Article 37(1)(c) of the GDPR requires one where the core activity consists of processing special categories or criminal conviction data on a large scale, and Recital 91 states expressly that processing concerning the clients of an individual lawyer is not large-scale processing. The European guidance on the point gives, as its example, a lawyer processing data relating to criminal convictions. That is this activity.
What we receive, and why that matters here
Two very different kinds of information reach us.
Your account and order details — name, email, country of residence, the language pair you need, and the record of your order and payment. Ordinary information, handled in an ordinary way.
The document itself — and this is where care is owed. The documents people send for certified translation are birth, marriage and death certificates, criminal record certificates, academic and medical records, powers of attorney, contracts. They routinely contain, about you and about third parties named in them:
- identification data, dates and places of birth, parentage and family relationships;
- identity, tax and social security numbers;
- in some documents, data concerning criminal convictions and offences (Article 10 GDPR) — a criminal record certificate is exactly that;
- in some documents, special categories of data (Article 9 GDPR) — health information in a medical record, or data revealing religious belief in a church record.
We do not ask for these categories and we do not seek them out. They arrive because they are printed on the document you need translated. We process them only to the extent required to translate and certify it.
Why we are allowed to process it
| What | Purpose | Legal basis |
|---|---|---|
| Name, email, order details | Providing the service you asked for; contacting you about your order | Performance of a contract — Art. 6(1)(b) GDPR |
| The document and its contents | Producing and certifying the translation | Performance of a contract — Art. 6(1)(b); for special categories, establishment, exercise or defence of legal claims — Art. 9(2)(f) |
| Criminal record data, where present | Translating the document you asked us to translate | Art. 10 GDPR, processed under the professional duties of a lawyer authorised under Portuguese law |
| Record of the certification act | Registration with the Ordem dos Advogados, which is a condition of the act's validity | Legal obligation — Art. 6(1)(c), under Art. 38(3) of Decree-Law 76-A/2006 |
| Payment records | Invoicing, accounting and tax | Legal obligation — Art. 6(1)(c) |
| Legibility and quality checks | Deciding whether a document can be worked from before you are charged | Performance of a contract — Art. 6(1)(b) |
The part most services do not tell you: automated processing
A first draft of your translation is produced with an artificial intelligence service, and the images of your document are analysed automatically to check whether they are legible and complete. This means the contents of your document are transmitted to a technology provider acting as our processor.
Three things about that arrangement:
- The provider processes the data only on our instructions, under a data processing agreement, and does not use it to train models. Under the arrangement currently in force, it retains the text sent and returned for 30 days for its own security purposes, and then deletes it.
- Nothing produced automatically is ever delivered to you. A lawyer reads the whole translation, corrects it and adopts it as his own before anything is certified. The certification is a personal act made on his honour and could not lawfully be otherwise.
- There is no automated decision-making with legal effects within the meaning of Article 22 of the GDPR. The automated steps produce a draft and a quality assessment; a person decides.
If you would rather your document were not processed this way, tell us before you upload it and we will quote for a translation prepared without it. It costs more and takes longer, and that is the honest trade.
Who else sees your data
| Recipient | Why | Where |
|---|---|---|
| Technology provider for translation drafting and image checks | Processor, under contract, no training on your data | United States, under Standard Contractual Clauses |
| Stripe | Taking payment; your card details are entered on Stripe's page and are never seen or stored by us | Ireland and United States, under Standard Contractual Clauses |
| O Gravata Consulting LLC | Runs the website, receives and hosts your file, and passes it to the lawyer — as his processor, on his instructions | United States, under Standard Contractual Clauses agreed between the lawyer and the company |
| DigitalOcean, LLC | Hosting provider. The infrastructure the company uses to store the files | United States (New York) |
| Postal operator | Only if you order a printed original | Portugal / destination country |
| Ordem dos Advogados | Registration of the certification act, which the law requires | Portugal |
We do not sell personal data, we do not share it for advertising, and we do not disclose it to anyone else except where the law obliges us to — and even then, professional secrecy limits what may be disclosed and by what procedure.
Transfers outside the European Union
Some of the providers above are established in the United States. Those transfers are made under Standard Contractual Clauses approved by the European Commission, together with supplementary measures including encryption in transit and at rest and contractual limits on onward disclosure. You may ask us for a copy of the safeguards in place.
How long we keep things
| What | How long | Why |
|---|---|---|
| The document you sent us | 90 days after delivery | Long enough to deal with a question or a correction. After that it serves no purpose: you hold the original, and the certification does not depend on our copy |
| The certified translation and its certification term | 5 years | It is the record of an act performed on the lawyer's honour and under his licence. If the fidelity of the translation is ever questioned, this is what answers it |
| Record of the certification act | Kept by the Ordem dos Advogados, not by us | The registration lives in the Bar's system, which is what makes it verifiable by anyone, at any time, with the code printed on your certificate |
| Invoicing and accounting records | 10 years | Portuguese tax law for the lawyer's invoices; United States record-keeping for the company's |
| Documents refused as illegible, never paid for | 30 days | Long enough for you to send a better copy; no reason to keep them after that |
When a period ends, files are deleted. You can ask us to delete your document earlier than that, and we will, except where keeping it is required by the obligations above.
Your rights
You have the right to ask for access to your personal data, to have it corrected, to have it erased, to have processing restricted, to object to processing, and to receive your data in a portable form. Where processing rests on your consent, you may withdraw it at any time without affecting what was done before.
Write to privacy@ogravata.com. We answer within one month. We may need to verify your identity first — for obvious reasons, we will not hand someone's birth certificate to whoever writes in asking for it.
One limit worth stating honestly: professional secrecy and the record-keeping duties attached to a certified act mean that some data cannot be erased on request while those duties last. Where that applies to you, we will tell you which data, and why.
If you believe your data has been mishandled, you may complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134 — 1.º, 1200-651 Lisboa, www.cnpd.pt. You may also complain to the supervisory authority where you live.
Security
Files are transmitted over encrypted connections and stored encrypted. Access is limited to the lawyer and, where applicable, to a person assisting under his supervision and bound by the same duty of secrecy. Card details are entered on the payment provider's own secure page and never pass through this website.
Cookies
This site uses only what it needs to work — a session cookie to keep your order together while you are on the page. There is no advertising cookie and no third-party tracking. If that changes, this page changes first and you will be asked before anything non-essential is set.
Children
The service is not directed at children and we do not knowingly open accounts for them. Documents concerning children — a child's birth certificate, for instance — are frequently and legitimately sent by a parent or legal representative, and are processed on the same basis as any other document.
Changes
If this notice changes, the date at the top changes with it. Where a change materially affects how your data is handled, we will tell you by email before it takes effect.