GDPR

Information on the processing of personal data

Advokátní kancelář Stejskalová & Blechová, s.r.o., with registered office at Heršpická 5, 639 00 Brno (hereinafter referred to as " Law Firm", "our office" or " Administrator"), with full awareness of the fundamental right of individuals to the protection of personal data, handles personal data in such a way as to ensure the highest possible degree of security of your personal data. In particular, it ensures compliance with the obligations and standards set out in the applicable data protection legislation, in particular the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016; hereinafter referred to as "GDPR") and Act No. 110/2019 Coll., on the processing of personal data.

Below we would like to inform you about important information related to the processing of personal data that you provide to us in relation to the use of our services. 

1. Personal data administrator

The administrator of personal data is Advokátní kancelář Stejskalová & Blechová, s.r.o., registered office at Heršpická 5, 639 00 Brno, ID: 29258693, registered in the Commercial Register at the Regional Court in Brno, Section C, File 68810, tel. +420 513 034 885, e-mail: office@akhsb.cz 

2. Purpose of the processing of personal data

Our Law Firm processes your data primarily for the purpose of providing legal services to the clients, communicating through the website, email and telephone communications, fulfilling its legal obligations or protecting its legitimate interests.

The aforementioned processing of personal data in areas not requiring consent is based on necessity for the following reasons:

• performance of legal service contracts concluded with data subjects

• compliance with legal obligations to which the administrator is subject

• the protection of the legitimate interest of the controller

3. Overview of personal data processed (scope)

The following data will typically be processed: 

 

Personal data	Reason for request to provide personal data	Obligation to provide personal data	Possible consequence of not providing the data
data required for the conclusion of the contract or for the provision of legal services - name and surname (or name of the company), date of birth, permanent residence, address for delivery of documents, registration number	contractual and legal requirement	YES	not concluding the contract
academic title	contractual requirement - the data subject provides only on the basis of his or her consent	NO	not knowing the highest level of education attained
private e-mail	legitimate interest	NO	worsened level of communication
telephone number	legitimate interest	NO	worsened level of communication
bank account number	contractual requirement	NO	impossibility to provide financial transactions without cash
other information necessary for the provision of legal services	legitimate interest	NO	the impossibility or worsened possibility of providing legal services

4. Method of processing and protection of personal data

Personal data is processed both manually (e.g. client files, accounting, administration) and automatically (in particular through forms on the Law Firm's website and through e-mail services). Depending on its nature, the data is stored both in physical (data in files) and electronic form.

Personal data in physical form are stored in lockable areas of the office to which only employees bound by confidentiality obligations have access; electronic data are processed exclusively within a password-protected information system.

 

5. Processing and storage period

We store and process your personal data only for the period of time that is strictly necessary, i.e. for the duration of the mutual contractual relationship and for the period of time for which rights and obligations can be asserted against each other (i.e. according to the length of the limitation period or the duration of the court proceedings in which the mutual rights/obligations are subject to assessment), or for the period of time for which the controller is obliged to store personal data according to binding legislation (e.g. Act No, on advocacy, Act No. 499/2004 Coll., on archiving and filing services, or Act No. 253/2008 Coll., on certain measures against the legalization of the proceeds of crime and the financing of terrorism).

The disposal of personal data will be carried out by shredding in accordance with the Shredding Regulations and by irreversible deletion of files if the personal data was provided or stored in electronic form. 

6. Recipients of personal data and disclosure to third parties

The law firm discloses your personal data to the extent necessary only to authorized employees and cooperating attorneys, both of whom are bound by a legal or contractual duty of confidentiality. By the nature of the matter, some data is also available to accounting companies and the administrator of our law firm's computer network system.

Personal data may also be provided to courts, law enforcement authorities or other public authorities under a legal obligation. 

7. Client's rights in relation to the processing of personal data

Right of access to personal data: the data subject has the right to receive confirmation from our office as to whether or not the personal data relating to him or her is being processed and, if so, to receive access to that personal data and to the following information:

a)	processing purposes;
b)	the categories of personal data affected;
c)	the recipients or categories of recipients to which the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
d)	the intended period for which the personal data will be stored or, if this cannot be determined, the criteria used to determine that period;
e)	the existence of the right to request from the Law Firm the correction or erasure of personal data concerning the data subject or the restriction of their processing or to object to such processing;
f)	the right to file a complaint with the supervisory authority;
g)	all available information about the source of the personal data, unless it is obtained from the data subject;
h)	the fact that automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR takes place and, at least in those cases, meaningful information concerning the procedure used as well as the significance and foreseeable consequences of such processing for the data subject.

Upon request, the law firm will provide a copy of the personal data processed. For additional copies requested by the data subject, the law firm may charge a reasonable fee related to the administrative costs of processing the request. If the data subject makes the request in electronic form, the information shall be provided in the electronic form commonly used, unless the data subject requests otherwise.

Right to correction of inaccurate and completion of incomplete personal data: the data subject has the right to have inaccurate personal data concerning him or her corrected by the Law Firm without undue delay. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by providing an additional statement.

Right to be erased ("right to be forgotten"): The data subject has the right to have the Law Firm erase the personal data concerning the data subject without undue delay and the Law Firm is obliged to erase the personal data without undue delay if one of the following reasons applies:

a)	the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
b)	The data subject withdraws the consent on the basis of which the data was processed in accordance with the relevant provisions of the GDPR and there is no further legal basis for the processing;
c)	The data subject objects to the processing in accordance with Article 21(1) GDPR and there are no overriding legitimate grounds for the processing or the data subject objects to the processing in accordance with Article 21(2) GDPR;
d)	personal data have been unlawfully processed;
e)	the personal data must be erased to comply with a legal obligation under European Union or Member State law to which the administrator is subject;
f)	personal data has been collected in connection with the offer of information society services pursuant to Article 8(1) of the GDPR.

Right to restriction of processing of personal data: the data subject has the right to have the administrator restrict the processing of personal data in any of the following cases:

a)	The data subject denies the accuracy of the personal data for the time necessary for the Law Firm to verify the accuracy of the personal data;
b)	the processing is unlawful and the data subject refuses the erasure of the personal data and instead requests a restriction on its use;
c)	The law firm no longer needs the personal data for the purposes of processing, but the data subject requests it for the purpose of establishing, enforcing or defending legal claims;
d)	The data subject has objected to the processing pursuant to Article 21(1) of the GDPR until it is verified that the legitimate grounds of the administrator override the legitimate grounds of the data subject.

Right to data transferability: under the conditions set out in Article 20 of the GDPR, the data subject has the right to have the personal data processed by our office transferred to a third party.

Without limiting any other administrative or judicial remedies, every data subject has the right to lodge a complaint with the competent supervisory authority, which is the Data Protection Authority, if he or she considers that the processing of his or her personal data has infringed his or her rights under the GDPR. 

You can find more information on the rights and obligations under the GDPR on the website of the Office for Personal Data Protection (https://www.uoou.cz/gdpr-obecne-narizeni/ds-3938/p1=3938).