1. The Controller
ZVOLSKÝ ADVOKÁTI s.r.o., having its registered seat at Pařížská 1076/7, Prague 1 – Staré Město, Post Code 110 00, Identification No.: 066 68 739, registered in the Commercial Register maintained by the Municipal Court in Prague, Part C, Insert No. 286698 (hereinafter referred to as the “law firm”), processes manually, in paper and/or electronic form the personal data of individuals (hereinafter referred to as the “data subject”) as the controller and treats such data in accordance with existing legal regulations, in particular in accordance with regulation (EU) No. 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as “GDPR”) and according to Law No. 110/2019 Coll., on the Processing of Personal Data.
The aim of these principles is to inform the data subjects in particular about the legal grounds and purposes of processing of their personal data, about the categories of processed personal data, the period of the data´s storage, about the individual rights of the data subject on the protection of personal data including the possibilities and measures of their execution.
2. The legal grounds and purposes for the processing of personal data
The law firm processes personal data on the basis of legal titles laid down by the GDPR exclusively for the purposes given below and to the extent of fulfilling the purpose for which such data has been collected.
The personal data about:
- clients or potential clients is processed by the law firm on the grounds of (i) performing the contract on provision of legal services concluded with the client, or in order to take steps at the request of the client prior to entering into such a contract and (ii) complying with legal obligations, for the purposes of providing its service properly and complying with legal obligations as a provider of legal services and taxpayer. On the grounds of its (iii) legitimate interests, the law firm further addresses clients and potential clients for the purpose of dissemination of commercial communication in accordance with Law No. 480/2004 Coll., on Certain Information Society Services;
- third parties gathered in connection with providing legal services is processed by the law firm on the grounds of (i) the legitimate interests of the law firm and (ii) complying with legal obligations, for the purposes of the proper performance of the agreement on provision of legal services concluded with the client and fulfilling any underlying legal obligations arising from rules governing the practice of advocacy;
- suppliers is processed by the law firm on the grounds of performing the contract concluded with the supplier, for the purposes of the proper performance of the contract and for the purpose of fulfilling the associated legal obligations as a customer and taxpayer;
- jobseekers is processed by the law firm on the grounds of performing a contract, or rather in order to take steps at the jobseeker’s request prior to entering into such a contract, for the purpose of the potential entering into employment or any other similar agreement with the jobseeker and fulfilling the legal obligations of the law firm as a potential employer;
- employees is processed by the law firm on the grounds of performing the contract which establishes the employment relationship toward the employer, for the purpose of fulfilling the contractual and statutory obligations as an employer.
3. Categories of processing personal data
The law firm processes in particular the following categories of personal data:
- Identification data – title, name and surname, date of birth, Personal Identification Number, place of birth, nationality, Identification Number (IČO), Tax Identification Number (DIČ), registration number (of Czech Bar Association, Czech Medical Chamber, etc.), address of permanent residence, address of (home) residence etc.
- Contact information – email address, telephone number, delivery address etc.;
- Financial data – bank account number;
- Data about the relationship between the data subject and the law firm;
- Data necessary for the compliance of registration and statement duties of the law firm as an employer and tax payer;
- Data about the qualifications and work experience of the data subject as a jobseeker in the law firm;
- Data which was provided to the law firm by clients or third parties in the course of performing the contract on the provision of legal services or while performing activities which are closely related with the contract – for example family status and family situation, financial situation, data on existing/finalised/threatening legal/executional/administrative proceedings, data on possible criminal proceedings and criminal matters, data stemming from documents provided by the client, video/audio recordings etc.
The law firm does not process the so-called sensitive personal data apart from those cases, where the processing of such data in relation to the provision of legal services is necessary for the identification, exercise or defence of legal claims or if the court is acting within its judicial capacity. Such cases mainly refer to the data categories on the health status or on final criminal convictions.
4. The period of processing and storage of personal data
The law firm processes the personal data of clients and third parties according to point 2. section b) of these principles throughout the whole duration of the obligations arising from the contact on provision of legal services concluded with the client. Personal data on employees is processed by the law firm throughout the duration of the employment relationship and after its expiration up to the settling of mutual obligations. CVs and other documents of newly accepted employees become part of the employee´s personal record. CVs of unsuccessful applicants are kept for potential future cooperation for a maximum period of one (1) year after the sending of the CV or after the recruitment process has finished. The CVs are then shredded or disposed of accordingly. The duration of processing the data of suppliers, or their representatives, is defined by the period of the validity and effective period of the contract concluded with the supplier.
The law firm processes and stores personal data for a period necessary for the compliance of purposes stated in point 2. of these principles. This data is subsequently dealt with according to the existing legislation, especially according to Law No. 85/1996 Coll., of the Law on the Legal Profession, Law No. 499/2004 Coll., the Act on Archival Science and Records Management and on the changes of certain laws and GDPR.
5. Recipients of personal data
The law firm provides processed personal data to other physical and legal entities, public authorities, agencies or to other subjects (hereinafter referred to as the “recipient”) only to such a necessary extent as to fulfil the individual purposes of processing and on the grounds of the appropriate legal titles for the processing of personal data.
Among the recipients of personal data processed by the law firm may belong:
- public authorities, subjects responsible for exercising the assigned duties in public interest (courts, administrative authorities, notaries, bailiffs, etc.);
- suppliers of the law firm in the area of information technology services (including website maintenance), accounting, taxing and other services connected with provision of legal services (for example cooperating lawyers, tax advisers, experts, interpreters, translators, etc.);
- contracting partners of the law firm within the span of personal data of the data subject, whose data transfer or sharing with the recipient is necessary and arises from the contractual or functional inclusion of the data subject within the law firm;
- other recipients according to the needs and instructions of the data subject/client.
6. The rights of the data subject
Data subjects have in particular the following rights concerning the protection of their personal data:
- The right to access to personal data – the data subject has the right to obtain information from the law firm on whether the data subject´s personal data is being processed, and if so, what is the data in question and in what way is it being processed;
- The right to rectification – the data subject has the right to have the law firm rectify inaccurate data which is related to the data subject at his/her demand without undue delay; the data subject has the right to amend any incomplete personal data whenever necessary;
- The right to erasure (“the Right to be forgotten”) – the data subject has the right to have the law firm erase all personal data that the law firm is processing about the subject data, if the conditions under the GDPR are met and if the subject data requires such an act.
- The right to restriction of processing personal data – in certain cases, the data subject has the right to request the law firm to limit processing of his or her personal data (i.e. that the law firm only retains the data and does not process it in any way);
- The right to object to the processing of personal data – the data subject has the right to object, at any time, to the processing of personal data which is based on the grounds of justified interests of the law firm, a third party, or is necessary for the completion of a task in public interest or during the exercise of public authority;
- The right to data portability – the data subject has the right to obtain personal data from the law firm which he or she has provided to the law firm and which has undergone automatized data processing, or has the right to forward the data to another controller in a structured, commonly used and machine-readable format;
- The right to lodge a complaint – the data subject has the right to lodge a complaint with the Office for Personal Data Protection of the Czech Republic (Pplk. Sochora 27, 170 00 Praha, www.uoou.cz.), if it has been revealed or if there is suspicion that the processing of his or her personal data is in conflict with the existing legislation;
- The right to withdraw consent toward the processing of personal data – in cases where the processing of personal data is based on consent of the data subject, the data subject has the right to withdraw his consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
For more information on the rights of the data subjects, go to the following website of the Office for Personal Data Protection of the Czech Republic: www.uoou.cz/6-prava-subjektu-udaj/d-27276.
In order to exercise any of the above mentioned rights, as also in the case of any further questions, comments or complaints concerning the processing of personal data, the data subject can contact the law firm on email address: firstname.lastname@example.org via a data message on data box address: dgrwppu or in writing at the address of the law firm’s registered office: Pařížská 1076/7, Prague 1 – Staré Město, Post Code 110 00. In order to exercise its rights, the data subject can use the standardized application form which is downloadable here: The Application Form To Exercise The Rights Of The Data Subject.
We would also like to notify that in the case of any repeated or manifestly unfounded requests for execution of the above mentioned rights, the law firm is authorized to charge an appropriate sum which includes the administrative costs connected with the handling of the request, or to refuse the request entirely.
For more information on cookies, what cookies you have saved on your browser and how to use and erase them correctly go to www.allaboutcookies.org.
8. Information updates
These principles can be updated at any time as a result of changes in the policies of the law firm concerning the processing and protection of personal data or concerned legislation. The law firm will inform data subjects about all significant changes of these principles via the law firm´s web pages.
ZVOLSKÝ ADVOKÁTI s.r.o., 25 May, 2018