Information on the processing of personal data

The controller has not appointed a Data Protection Officer.

The controller hereby informs clients and other persons (‘data subjects’) of the processing of their personal data. Such information shall not relate to personal data of legal persons, including the name, legal form and contact details of legal persons.

Protection of personal data

The controller processes personal data in accordance with the law, in particular Act No 85/1996 Coll. on the Legal Profession and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“the Regulation”) and implementing provisions.

Personal data processed by the controller

Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

The controller shall only process personal data that are necessary for the proper provision of legal services and compliance with legal obligations.

The controller shall collect the personal data of its clients, potential clients and, where applicable, third parties necessary for the provision of legal services.

In particular, the controller processes the following data:

• • identification and contact details of the client and third parties;
  • billing details of the client and third parties;
  • the payment details of the customer and third parties;
  • business data (in particular, details of ongoing/finalised/threatening judicial/enforcement/administrative proceedings, details of criminal proceedings and criminal cases, financial situation information, bank account;
  • data from communication between them (in person, in writing, by telephone or otherwise).

The provision of personal data, at least to the essential extent, is necessary in order to fulfil contractual obligations. The provision of this information is therefore mandatory.

Sources of personal data

The personal data processed by the controller comes from the following sources:

• • data provided by the client when entering into the contractual relationship with the controller or during its duration;
  • data provided by the client on the basis of consent to the processing of personal data and the sending of personal communications;
  • the details you provided when filling in the contact form or any other communication from you;
  • and data available from public directories, registers and other publicly available sources.

Method of processing personal data

The processing of personal data does not involve automated decision-making or profiling within the meaning of Article 22(2) of the Regulation.

Personal data of data subjects are processed in electronic form by automated means, namely by means of the controller’s software.

Where manual processing is necessary or appropriate, the processing of personal data shall also take place manually through the controller or, where applicable, its employees or DPOs. However, such persons may process personal data only under the conditions and to the extent specified above and are bound by an obligation of confidentiality about personal data and security measures, the disclosure of which would jeopardise the security of the personal data.

Purpose of the processing of personal data

The controller processes personal data for the purpose of providing legal services pursuant to a legal service contract between the controller and the client.

The purpose of the processing of personal data is also to deal with your request and to exercise the rights and obligations arising from the contractual relationship between you and the controller.

There is no automatic individual decision-making by the controller within the meaning of Article 22 of the GDPR.

The controller further processes personal data for the purpose of fulfilling legal obligations, in particular pursuant to the Lawyers Act, Act No 563/1991 Coll., the Accounting Act, Act No 253/2008 Coll., the Act on certain measures against money laundering and terrorist financing and other relevant regulations.

Furthermore, the controller processes personal data, where justified, also in order to protect its interests, for example in the case of litigation or inspections by public authorities, where necessary, to demonstrate compliance.

The controller may also use personal data for direct marketing purposes based on a legitimate interest, in particular in the form of electronic commercial communications, the sending of information and novelties (e.g. legislative amendments). For the purposes of direct marketing, the controller uses personal data subject to prior consent. The data subject has the possibility to object to such processing, free of charge, or to withdraw consent, in writing, by post to the controller’s registered office address, or electronically to attorney@atlaw.cz.

Legal grounds for processing personal data

The legal basis for the processing of personal data is the performance of a contract for the provision of legal services, compliance with legal obligations, in particular in the case of customer identification or due diligence obligations pursuant to Act No 253/2008 on certain measures against money laundering; when declaring the authenticity of the signature or the submission of documentation or client file (including the minimum retention period for documentation), or in fulfilling other obligations of a lawyer under the Law on Legal Profession and related professional regulations; in the particulars of the regularisation of legal services and the minimum retention period for the relevant accounting/tax documents in accordance with the tax laws and the Accounting Act, and the legitimate interests of the administrator.

Duration of the processing of personal data

Personal data will be processed during the period of validity of the contract for the provision of legal services and will be handled in accordance with the applicable legislation, in particular the Law on the Legal Profession, Act No 499/2004 on Archives and File Service and amending certain Acts and Regulations. Upon expiry of the retention period of the personal data, the controller shall erase the personal data.

Recipients of personal data

The recipients and processors of personal data are the following:

• • public authorities (in particular courts and administrative authorities)
  • lawyers collaborating with the controller
  • accounting and tax advisors; and
  • other recipients, depending on the client’s interests, needs and instructions, or the data subject (in particular counterparties when dealing with them). 

All processors shall provide sufficient technical and organisational safeguards to ensure the security of personal data.

Security of personal data

The controller declares that it has taken appropriate technical and organisational measures to safeguard the personal data. The controller declares that only persons authorised by him have access to the personal data.

Data subject rights

Right of access to personal data

Data subjects shall have the right to obtain from the controller information as to whether they are processing their personal data, what data are concerned and how they are processed.

Right to rectification

Data subjects have the right to have incomplete personal data completed and inaccurate personal data concerning them corrected.

Right to object

Data subjects shall have the right to object to the processing of personal data where such processing is carried out for the purposes of the legitimate interests pursued by the controller.

Right to erasure

If the conditions laid down in the Regulation are met and if the data subject so requests, the data subject shall have the right to have personal data concerning him erased. In particular, personal data must be erased if they are no longer necessary for the purpose for which they were collected or processed.

Right to portability

Data subjects shall have the right to obtain the personal data provided by the controller in a normal and machine-readable format. It may subsequently transfer such data to another controller or, where technically possible, request that controllers transfer them to each other.

Right to restriction of processing

Data subjects have the right to have the controller restrict the processing of their personal data in the cases provided for in the Regulation. The data subject shall have the right to object at any time to processing which is based on the legitimate interests of the controller, a third party or is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

Right to lodge a complaint against the Data Protection Authority

Data subjects have the right to address their initiative to the Data Protection Authority, as the data protection supervisory authority, located in Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz, tel. 234665111, email: posta@uoou.cz or lodge a complaint.

In case of any questions or ambiguities regarding the handling of personal data, the client or other person may contact the controller in writing via the e-mail address attorney@atlaw.cz or in writing at the address of the lawyer’s registered office.

The client and other data subjects hereby acknowledge that, through the above information, he was informed by the controller of his rights and their protection pursuant to Articles 13 and 15-22 of the Regulation. By sending a message from the contact form on www.atlaw.cz you confirm that you are aware of the data protection conditions and that you accept them in their entirety.