Privacy notice

Last updated: October 20, 2026.

1. Data controller

CR&A Legal, Torre Generali, 23rd floor, office 23A, Obarrio, Panama City. For any matter about your data: info@cra.legal · +507 261-1472/73.

2. What data we collect

• Contact, appointments, assistant and events: name, email, phone, organization and what you tell us in your message.
• Calculator and contract requests: also, the services or contract you are interested in.
• Work with us: your application details, your LinkedIn profile and the CV you send us.
• Due diligence: identification data (ID card, passport, nationality, date of birth, address), occupation and company, source of funds, income ranges, politically exposed person status, directors, shareholders and ultimate beneficial owners, references and the copies of documents you attach. Part of this information is financial or specially protected, so we apply reinforced measures.

We only ask for the data needed for each purpose.

3. What we use it for

• Answering enquiries, scheduling appointments and preparing quotes.
• Providing the legal services you hire.
• Complying with the due diligence and anti-money laundering obligations the law places on the firm.
• Assessing applications and organizing training sessions.

We do not sell or rent your data, and we do not use it to send you advertising without your permission.

4. Legal basis

Your consent, which you give by ticking the box on each form; the steps prior to, or the performance of, the service you request; and, for due diligence, compliance with legal obligations, in particular Law 23 of 2015 on the prevention of money laundering.

5. Who we share it with

Only with the firm's authorized staff and with the technology providers that allow us to run the website, such as Wix.com, which hosts the forms and files. These servers may be outside Panama, for example in the United States; by sending a form, you authorize that international transfer. We require these providers to apply appropriate security measures. We will also disclose data to the authorities when a law or a court order requires it.

6. How long we keep it

• Enquiries, appointments, quotes, assistant messages and training requests that do not lead to a service: up to 2 years.
• CVs and applications: up to 1 year.
• Client and due diligence files, including their documents: for as long as the relationship lasts and for at least 5 years after it ends, as required by Law 23 of 2015.

While the relationship lasts, we update due diligence information every year or every two years, depending on the client's risk level. When the retention periods expire, we delete or anonymize the data.

7. How we protect it

The website uses an encrypted connection (HTTPS). Due diligence files and attached documents are stored in private records that only the authorized team can access, and they are not sent by email. The forms are protected against automated submissions. We review access regularly and, if a security incident affects your data, we will notify the authority and the people affected as required by law.

8. Your rights

You may request access to, rectification, cancellation, objection to and portability of your data, and withdraw your consent at any time. Write to info@cra.legal with the subject "Data protection" and a copy of your ID. We will answer within the periods set by law. If you are not satisfied, you may contact Panama's National Authority for Transparency and Access to Information (ANTAI). We cannot delete early the data the law requires us to keep.

9. Cookies and third-party services

The website does not use advertising or analytics cookies. It only stores in your browser the technical data needed to send the forms. YouTube videos load only when you press "play", in privacy-enhanced mode.

10. Minors

This website is not directed at minors. If a minor needs our services, a parent or guardian should contact us.

11. Changes to this notice

We may update this notice. We will publish each version here with its date.