PERSONAL DATA PROTECTION

1. Introductory Provisions

1. This document provides information on the processing of personal data by the law firm BRUNCKO & STRAKA, advokáti s.r.o., with its registered office at Plotní 332/73, 602 00 Brno (hereinafter referred to as the “Controller” or the “Law Firm”).

2. As a personal data controller, the Law Firm protects the personal data of its clients, employees, suppliers, and other persons with whom it comes into contact, and processes such data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (the “GDPR”), Act No. 110/2019 Coll., on the Processing of Personal Data, Act No. 85/1996 Coll., on the Legal Profession, as amended, and other applicable legal regulations.

3. These principles serve to inform data subjects about the purposes and scope of the processing of personal data, the legal basis for processing, retention periods, the rights of data subjects, and the methods for exercising such rights.

‍

2. Categories of Processed Personal Data

1. Our Law Firm processes personal data in the following categories:

2.1. Personal Data of Clients and Persons Acting on Their Behalf

1. If you contact us for the purpose of providing legal services, we will process your personal data to the extent necessary for the practice of law, in particular:

1. Identification data – academic titles, first name, last name, date of birth, personal identification number, company identification number (ID No.), tax identification number (VAT No.), identity document number;
2. Contact details – telephone number, e-mail address, permanent residence address or correspondence address;
3. Payment details – bank account number, invoicing details, information on charged and paid services;
4. Data relating to legal services – description of the legal matter, related documentation, data on proceedings (court, administrative, enforcement, etc.), information on represented persons;
5. Data relating to intermediary services;
6. Special categories of personal data – where strictly necessary for the provision of a specific legal service, we may process data concerning health status, criminal history, religious beliefs, political opinions, or similar data.

‍

2.2. Personal Data of Employees and Job Applicants

1. Within employment or pre-employment relationships, we process personal data of our employees and job applicants, in particular:

1. Identification and contact data – first name, last name, date of birth, address, telephone number, e-mail address, marital status;
2. Education and qualification data – achieved education, professional experience, certificates, references;
3. Payroll and tax data – salary amount, bank account number, health and social insurance contributions;
4. Recruitment process data – curriculum vitae, cover letter, interview records, references.

‍

2.3. Personal Data of Counterparties, Witnesses, Experts, and Other Persons in Connection with the Provision of Legal Services

1. Where necessary for the provision of legal services, we may process personal data of third parties, in particular counterparties, witnesses, court experts, and other persons involved in proceedings. In such cases, we process in particular:

• Identification data – academic titles, first name, last name, date of birth;
• Contact details – telephone number, e-mail address, permanent residence address or correspondence address.

‍

2.4. Personal Data of Potential Clients

1. If you express interest in our services and request information on legal advice options, we usually process:

1. Identification data – academic titles, first name, last name;
2. Contact details – telephone number, e-mail address.

‍

3. Legal Basis and Purposes of Personal Data Processing

1. The Law Firm processes personal data on the basis of at least one of the following legal grounds:

1. Performance of a contract, including contract negotiations – processing is necessary for the provision of legal services to clients or for the performance of contractual obligations towards employees and suppliers.
2. Compliance with a legal obligation – compliance with obligations imposed by legal regulations (e.g. the Act on the Legal Profession, AML legislation, tax regulations).
   • In relation to clients, in particular obligations arising from Act No. 85/1996 Coll., on the Legal Profession, as amended, and Act No. 253/2008 Coll., on Certain Measures Against the Legalisation of Proceeds of Crime and the Financing of Terrorism, as amended.
   • In relation to employees, in particular obligations arising from Act No. 262/2006 Coll., the Labour Code, Act No. 89/2012 Coll., the Civil Code, Act No. 586/1992 Coll., on Income Taxes, Act No. 48/1997 Coll., on Public Health Insurance, Act No. 187/2006 Coll., on Sickness Insurance, Act No. 582/1991 Coll., on the Organisation and Implementation of Social Security, Act No. 589/1992 Coll., on Social Security Contributions and Contributions to the State Employment Policy, all as amended, and other relevant legal regulations.
3. Legitimate interest – processing for the protection of our rights, debt recovery, communication with clients, or security measures, both in judicial proceedings and in relation to insurance companies.
4. Consent – processing for marketing purposes, receipt of newsletters, or retention of job applicants’ data for future opportunities. Consent may be withdrawn at any time in writing, and failure to grant consent does not affect the performance of a contract.

‍

4. Method of Obtaining and Retention Period of Personal Data

1. The personal data we process are obtained directly from the data subject, or from the data subject’s employer or a close person whose personal data are provided to us by the client for the proper provision of services.

2. Personal data processed on the basis of your consent are retained only for the duration of the consent or until the purpose of processing has been fulfilled.

3. Personal data are processed primarily for the duration of the contractual relationship and for the period required by applicable legal regulations. After termination of the contractual relationship, personal data may be retained for up to 10 years, if required by legal obligations or for the protection of legitimate interests. Personal data of job applicants are retained for the duration of the recruitment process and, where consent has been granted, also after its completion for potential future opportunities.

4. Personal data are processed and retained only for the period necessary to fulfil the purpose for which they were collected or for the period required by law:

1. Performance of contracts, contractual documentation, and legal services – for the duration of the contractual relationship and subsequently for 10 years after its termination;
2. Compliance with legal obligations – in accordance with applicable statutory regulations;
3. Protection of legitimate interests – generally for a period of 3 years from the commencement of processing, unless otherwise stipulated by special legal regulations or unless it becomes necessary to retain the data for a longer period in connection with a specific case;
4. Marketing purposes – for the duration of consent, or until consent is withdrawn;
5. Client identification records under AML legislation – for a period of 10 years from the execution of the transaction.

‍

5. Transfer of Personal Data to Third Parties

1. Personal data may be shared only where necessary with:

1. public authorities (courts, administrative authorities, the Czech Bar Association);
2. IT service providers, accounting and tax advisors;
3. other attorneys-at-law in connection with client representation.

2. Personal data are not transferred outside the European Union unless required by law or based on the data subject’s consent.

‍

6. Form of Personal Data Processing

1. Personal data and copies of provided documents are processed and stored in both paper and electronic form.

‍

7. Rights of Data Subjects

1. In accordance with the GDPR, you have the right:

1. to information, in particular as to whether, why, and how your personal data are processed;
2. of access to personal data – you may ascertain whether your personal data are processed, for what purpose, and in what form; in the case of repeated requests, a fee may be charged for additional copies;
3. to rectification of inaccurate or incorrect personal data and to completion of incomplete personal data;
4. to withdraw consent to the processing of personal data;
5. to erasure of personal data (“right to be forgotten”), if:
   
   1. the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
   2. you withdraw consent and the Law Firm has no other legal ground for processing;
   3. you object to processing and there are no overriding legitimate grounds for processing;
   4. you object to processing for direct marketing purposes;
   5. the personal data have been processed unlawfully;
   6. erasure is required to comply with a legal obligation;
6. to restriction of processing, if:
   • you contest the accuracy of the personal data, for the period necessary to verify their accuracy;
   • the processing is unlawful and you request restriction instead of erasure;
   • the personal data are no longer needed for processing purposes, but you require them for the establishment, exercise, or defence of legal claims;
   • you have objected to processing, pending verification of whether your legitimate grounds override those of the Law Firm;
7. to data portability, in particular to receive personal data concerning you in a structured, commonly used, and machine-readable format and to transmit those data to another controller;
8. to object to the processing of personal data;
9. not to be subject to automated decision-making, including profiling;
10. to be informed of a personal data breach;
11. to lodge a complaint – you may at any time contact the Office for Personal Data Protection (www.uoou.cz) by e-mail at posta@uoou.cz or at Pplk. Sochora 27, 170 00 Prague 7.

2. You may exercise your rights by e-mail at: office@bruncko-straka.cz.