Privacy Policy

4. PERSONAL DATA PROCESSING PERIOD

We process personal data for the period stated in the table above. When the period for which we have a valid purpose for processing personal data expires, we will delete this personal data. If the legal basis is consent, we process personal data only for the duration of its validity, or until its withdrawal.

5. SCOPE OF PROCESSED PERSONAL DATA

We primarily process ordinary personal data about you that you provide to us or that we obtain from other sources, electronically via email, by post, or by other means.

We process special categories of personal data (so-called sensitive personal data) about you only within the scope of fulfilling our advocacy duties in the context of contractual relations, which we base on a relevant legal basis in conjunction with a relevant exception from the prohibition of processing sensitive data under Art. 9(2) GDPR.

6. FROM WHAT SOURCES DOES THIS INFORMATION COME?

Personal data is generally collected directly from the data subject within contractual relations or originates directly from public registers, publicly available sources, and other sources (e.g., courts, police, and administrative bodies) that we accessed within the practice of advocacy.

7. WHO IS THE RECIPIENT OF PERSONAL DATA

We provide your personal data only in justified cases and only to the necessary extent to the following categories of recipients:

• To the necessary extent, to our contractual partners whom we need for our normal operation and realization of contractual relations (Microsoft Server Exchange, AlfaPro – IT administrator, Single Case s. r. o. – cloud administrator, LinkedIn, Facebook, Google, D.P.F., spol. s r. o. – accounting, etc.);
• To the necessary extent to other entities in cases where the law imposes a right or obligation to provide your personal data, or if it is necessary for the protection of our legitimate interests (e.g., courts, Police, etc.).

8. AUTOMATED DECISION-MAKING AND PROFILING

Your personal data is not and will not be used for automated individual decision-making or profiling.

9. TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES

Your personal data may, in certain cases, be transferred to third countries outside the European Union. When using tools from Facebook and Google, personal data may be transferred to the United States of America (USA). The manner in which these companies handle personal data is stated in their privacy policies available on their websites.

Transfer of personal data to the USA is carried out in accordance with Art. 6(1)(a) GDPR (lawfulness of processing based on consent of the data subject) and Art. 49(1)(a) GDPR, as it concerns a transfer to a third country for which adequate guarantees of personal data protection comparable to EU standards do not exist. Such transfer of personal data to the USA is therefore associated with risk and may only take place based on the explicit consent of the data subject.

According to the decision-making practice of the Court of Justice of the European Union (CJEU), appropriate safeguards, enforceable rights, and effective legal remedies must ensure that the level of protection of the rights of data subjects when transferring personal data to a third country is essentially equivalent to the level of protection guaranteed within the European Union (CJEU judgment in case C-311/18 of July 16, 2020, point 5). The assessment of the level of protection must take into account the contractual terms between the controller in the EU and the recipient in the third country, as well as relevant aspects of the recipient’s legal system, including public authorities’ access to the transferred data.

By decision in case C-311/18 (so-called Schrems II), the CJEU declared invalid Commission Implementing Decision (EU) 2016/1250 on the adequacy of the protection provided by the EU-U.S. Privacy Shield. This abolished the possibility of transferring personal data to the USA based on an adequacy decision under Article 45 GDPR.

This was followed by the Austrian Data Protection Authority, which in the NOYB case stated that Google is a provider of electronic communication services under the US legal system (§§ 1881(b)(4) and 1881a of the FISA Act), and therefore, processed personal data may be provided to US intelligence services. The Austrian authority concluded that such access by US authorities is not in accordance with Article 44 GDPR (the general principle for transfers).

As noted above, on 10.07.2023, the EU-U.S. Data Privacy Framework (hereinafter, “Framework”) was adopted by Commission Decision No. 2023/1795. A complaint against the Framework was filed with the European Court of Justice on 03.09.2025, and its decision is expected in the coming months.

In addition, your personal data may be transferred to third countries outside the EU (e.g., Turkey or Israel) to facilitate mutual contacts. Such a transfer will take place only under the following conditions:

• If you express explicit consent to the transfer after being informed of the risks resulting from the absence of an adequacy decision and appropriate safeguards in the third country, or
• If the transfer is necessary for the performance or conclusion of a contract between you and us, or for the implementation of pre-contractual measures taken at your request, or
• If the transfer is necessary for the establishment, exercise, or defense of legal claims, or
• If appropriate safeguards exist, mainly through standard contractual clauses on data protection, concluded with the contractual partner in the third country.

Detailed information on personal data processing:

Google Ireland Limited and Google Cloud EMEA Limited (Google, Google Analytics)

• General information: https://policies.google.com/privacy?hl=en-US
• Standard contractual clauses: https://business.safety.google/adscontrollerterms/sccs/
• Additional safeguards: https://services.google.com/fh/files/misc/safeguards_for_international_data_transfers.pdf
• Explanation: https://support.google.com/analytics/answer/9019185?hl=en

Meta Platforms Ireland Limited (Facebook)

• General information: https://www.facebook.com/policy.php
• European data transfer addendum: https://www.facebook.com/legal/EU_data_transfer_addendum
• Standard contractual clauses: https://www.facebook.com/help/566994660333381
• Additional safeguards: https://about.fb.com/news/2021/03/steps-we-take-to-transfer-data-securely/

10. RIGHTS OF DATA SUBJECT REGARDING PERSONAL DATA PROCESSING

If we process personal data of the data subject based on the exercise of legitimate interest under Art. 6(1)(f) GDPR:

• Right to object – The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning the data subject.

If we process personal data of the data subject based on granted consent under Art. 6(1)(a) GDPR:

• Right to withdraw consent – The data subject has the right to withdraw consent for the processing of personal data for the purpose for which consent was granted at any time.

Other rights of the data subject are:

• Right of access – The data subject may request access to personal data that the Law Firm processes about them at any time. The Law Firm will also provide a copy of the processed personal data.
• Right to rectification – The data subject may request the correction of inaccurate or incomplete personal data that the Law Firm processes about the data subject at any time.
• Right to erasure – The data subject may request the deletion of their personal data at any time if one of the following situations occurs:
  • The data subject withdrew the provided consent for personal data processing;
  • Personal data was processed unlawfully;
  • Personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
  • Personal data must be deleted to comply with a legal obligation established by EU law or the law of a Member State applicable to the Law Firm.
• Right to restriction of processing – The data subject may request the Law Firm to restrict the processing of their personal dataat any time if one of the following situations occurs:
  • The data subject contested the accuracy of the personal data, for a period enabling the Law Firm to verify the accuracy of the personal data;
  • The processing of personal data is unlawful, but the Law Firm refused to delete this data, and instead, the data subject requests restriction of its use;
  • The data subject objected to the processing of their personal data pursuant to Art. 21(1) GDPR, pending verification whether the legitimate grounds of the Law Firm override those of the data subject.
• Right to data portability – If the Law Firm processes personal data based on the consent of the data subject or because it is necessary for the performance of a contract to which the data subject is a party, and at the same time the processing is carried out by automated means, the data subject has the right to receive the personal data concerning them, which the data subject provided to the Law Firm, in a structured, commonly used, and machine-readable format, provided that this right must not adversely affect the rights and freedoms of others.
• Right to lodge a complaint – The data subject has the right to lodge a complaint with the supervisory authority, the Office for Personal Data Protection of the Slovak Republic, Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, Slovak Republic https://dataprotection.gov.sk/sk/.

11. HOW CAN THE DATA SUBJECT EXERCISE THEIR RIGHTS?

The data subject can exercise their rights orally, in writing, or electronically via the contact details listed above. Without undue delay, the Law Firm will provide information on action taken on your request, no later than one month from the receipt of the request.

The Law Firm may request additional information necessary to confirm the identity of the data subject if it has reasonable doubts about the identity of the natural person who exercised their rights via the data subject rights request. It is the Law Firm’s obligation to prevent the provision of personal data to an unauthorized person. If this period needs to be extended in justified cases, the Law Firm will inform the data subject in a timely manner.

If the request for the exercise of data subject rights is manifestly unfounded or excessive, in particular because of its repetitive character, the Law Firm reserves the right to refuse to act on the request for the exercise of data subject rights or to charge a reasonable fee to the , taking into account the administrative costs of providing it.