Personal data processing policy
Dear visitors and clients,
This document fulfils our information obligation towards you in accordance with Articles 12, 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as “GDPR“).
A. Who is the controller of the personal data, which you have provided, and how can you contact us?
The controller of the personal data provided by you is VEPŘEK CASKA VLACHOVÁ advokátní kancelář s.r.o. , with its registered office at Husova 242/9, 110 00 Prague 1, ID No.: 29016088, registered in the Commercial Register maintained by the Municipal Court in Prague, file No. C 160129 (hereinafter referred to as the “Company“).
B. For what purposes do we process your personal data and what is the legal basis for processing your personal data?
We process your personal data primarily in connection with the provision of legal services to you or services related to the advocacy services (e.g. custody services). We thus process your personal data in order to fulfil the purpose of the contract you have concluded with us and on the basis of which we provide you with the relevant services (processing pursuant to Article 6(1)(b) GDPR).
We also process your personal data for the purposes of fulfilling the obligations imposed on the Company by the legislation on the prevention of money laundering and terrorist financing (hereinafter referred to as “AML“) and other legal regulations (e.g. regulations governing the advocacy, obligations imposed by employment law or tax regulations) (processing pursuant to Article 6(1)(c) and (e) of the GDPR).
We also process your personal data for the purposes of the legitimate interests of our Company. These legitimate interests are the protection of the Company’s property, the assertion or defense of legal claims or the conduct of proceedings, the defense of the legitimate interests of the Company’s clients, etc. (processing pursuant to Article 6(1)(f) GDPR). In this context, we would like to inform you that you have the right to object pursuant to Article 21 GDPR to the processing of your personal data on the grounds of our legitimate interests as defined above.
Your personal data may also be processed for the purposes of marketing and promotion of the Company’s services, either on the basis of your consent or in accordance with the legitimate interests of our Company.
C. What categories of your personal data do we process?
As a rule, we process the following personal data:
- name and surname/ business name
- date of birth/birth number/ID number
- address/permanent or other residence/registered office
- Gender
- Your contact details: phone number, e-mail
- Other information on your identification documents (photo, citizenship, nationality, number of your identification document)
- Cookies (on our website www.vcv.cz)
- Your signature in case you make a legal action against us in written form
In exceptional cases, the Company may also process so-called sensitive personal data (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data, data on health or on sex life or sexual orientation), or personal data relating to criminal convictions and offences or related security measures. Such personal data will only ever be processed by the Company if necessary (in particular in connection with the provision of legal services to you or one of our clients) and under the conditions set out in the law (in particular the provisions of Article 9 of the GDPR).
D. Who is the recipient of your personal data?
The recipient of your personal data is primarily our Company in connection with the provision of legal services.
The Company may share your personal data with its employees and cooperating attorneys, attorneys or law firms operating in other jurisdictions, clients, accounting or tax advisors, experts, translators or interpreters, or processors or other data controllers (e.g. cloud or other IT service providers) to the extent necessary depending on the purpose of the processing of the personal data.
The Company may also transfer your personal data to third parties if it has the legal obligation or right to do so, in particular at the request of public authorities if they have the right to request such data under applicable law or in the context of legal or other proceedings.
E. Will your personal data be transferred abroad?
In exceptional cases, your personal data may be transferred to persons in other countries if the purpose of the use of the personal data requires it, e.g. in the case of the need to use a law firm or an expert in that country in connection with the provision of legal services. Transfers of personal data abroad will always be made in accordance with the requirements of the GDPR and other legislation.
F. How long will your personal data be processed by the Company?
We will process your personal data for as long as necessary to fulfil the purposes described in section B. above. The retention period for client files, i.e. including personal data contained therein, is set out in the Bar Rules and is five (5) years from the date on which the lawyer ceased to provide legal services. Documents arising in connection with the administration of assets (e.g. custody agreements) are retained by the lawyer for ten (10) years from the date on which the administration ceases. Personal data processed for the purpose of fulfilling legal obligations under the AML shall be retained for a period of ten (10) years after the transaction outside the business relationship or the termination of the business relationship.
G. How will your personal data be processed? How will your personal data be protected?
Your personal data is processed mainly in electronic form and in a non-automated manner in the Company’s electronic system or in the electronic system of the persons to whom the personal data will be transferred. These data are stored on a hard drive in the Czech Republic. Personal data processed in paper form are stored in a locked office.
Our Company maintains appropriate technical and organisational measures to ensure that the personal data we process about you is adequately protected against loss, misuse or unauthorised access, disclosure, alteration or destruction.
H. What are your rights in relation to the processing of personal data?
We hereby inform you of your rights related to the processing of your personal data:
- You have the right to request access to your personal data in accordance with Article 15 of the GDPR (including the right to obtain confirmation from the Company as to whether or not personal data relating to you is being processed by the Company and, where applicable, the right to be provided with a copy of the personal data being processed).
- You have the right to rectification of the personal data provided pursuant to Article 16 GDPR.
- You have the right to request the erasure of your personal data pursuant to Article 17 of the GDPR.
- You have the right to request restriction of the processing of your personal data pursuant to Article 18 GDPR.
- You have the right to the portability of your personal data to another controller pursuant to Article 20 GDPR, i.e. you can ask us to transfer your personal data to another controller.
- You have the right to object to the processing of your personal data by our Company where our Company processes personal data for the purposes of its legitimate interests or the legitimate interests of third parties, including objecting to the processing of your personal data for direct marketing. You can object via the contact details set out in part J. hereof.
- You have the right to lodge a complaint against us as the controller of your personal data with the supervisory authority, which is the Office for Personal Data Protection (https://www.uoou. cz/) (Article 77 GDPR). The supervisory authority in the case of obligations under the AML Act is primarily the Czech Bar Association (https://www.cak.cz/).
If you decide to exercise any of the above rights, we are obliged to identify you, i.e. to verify whether the person to whom the personal data processed by us relates is requesting the exercise of the rights.
I. Is the provision of your personal data a prerequisite for the provision of services by the Company?
The processing of personal data for the purpose of performance of the contract is necessary for the performance of the obligations arising from the contract. Failure to provide personal data may mean that our Company will not be able to fulfil the obligations arising from the contract. The processing of your personal data is also necessary in order to comply with our legal obligations under AML regulations. The processing of other personal data is based on the legitimate interest of the Company or the legitimate interest of the Company’s clients.
J. How to contact us?
You can contact us regarding the processing of your personal data in writing at our law office, i.e. VEPŘEK CASKA VLACHOVÁ advokátní kancelář s.r.o. , Husova 242/9, 110 00 Prague 1. You can also contact us by phone at +420 222 220 775 or by e-mail at info@vcv.cz.
Instead of you, we may be contacted about the processing of the personal data provided by you by a representative of your choice who proves his/her authorization to us by a written power of attorney.
This Policy may be updated or amended. The current version of the Policy can be found on the Company’s website www.vcv.cz.