Principles of personal data processing
Chrenek, Toman, Kotrba advokátní kancelář spol. s r.o. (hereinafter the “Law Office”), with its registered office in Prague 1, at Těšnov 1/1059, Postal Code 11000, Id. No.: 28505913, registered in the Commercial Register kept by the Municipal Court in Prague under File No. C 146526, is a personal data controller within the meaning of the General Data Protection Regulation (2016/679; GDPR).
The Law Office protects all personal data it processes as strictly confidential and handles them in accordance with the applicable and effective generally binding legal regulations in the area of personal data protection, as well as the Legal Profession Act.
The principles of personal data processing inform the data subjects in particular of the legal basis and purposes of personal data processing, the legitimate interests of the controller in the processing of personal data, the categories of personal data being processed, the time of their storage, as well as the possibilities and ways in which data subjects may exercise their rights to personal data protection.
B. LEGAL BASIS AND PURPOSES OF PERSONAL DATA PROCESSING, LEGITIMATE INTERESTS OF THE CONTROLLER
The Law Office processes personal data, in particular:
I. In the provision of legal services on the basis of agreements concluded with the clients of the Law Office (including related communication with clients and third parties);
II. In communication with candidates for employment in the Law Office;
III. In the context of labour-law relationships;
IV. In the performance of contractual legal relationships with the Law Office’s suppliers;
V. In the performance of the Law Office’s legal obligations;
VI. While protecting legitimate interests of the Law Office;
VII. When sending general legal and similar information and communications to the clients of the Law Office, or to persons who requested such information and communications from the Law Office, or have expressed their consent thereto;
VIII. In any communication between the data subject and the Law Office outside the above-specified framework (paragraphs I. to VII.).
Legitimate interests of the Law Office as the controller include, in particular, the interest in proper and safe operation of the Law Office, performance of the executed agreements (including ensuring adequate and up-to-date legal information to its clients) and the interest in the possibility of legitimate and effective enforcement of the claims following from these agreements.
C. CATEGORIES OF THE PERSONAL DATA PROCESSED
Advokátní kancelář zpracovává zejména následující kategorie osobních údajů:
The Law Office processes, in particular, the following categories of personal data:
I. Identification details – name, surname, academic degree, date of birth, birth identification number, company Id. No., tax Id. No., etc.;
II. Contact details – address, telephone number, e-mail, etc.;
III. Financial details – bank account number;
IV. Data subject’s relationship to the Law Office;
V. Information necessary for the performance of the registration and reporting duties of the Law Office in its role as an employer;
VI. Information on the qualification and working experience of the data subject as a candidate for employment in the Law Office;
VII. Data provided to the Law Office by its clients or their legal counsels within the performance of a legal services agreement;
VIII. Any other personal data not explicitly defined above provided by the data subject to the Law Office.
D. PERIOD OF STORAGE OF PERSONAL DATA
Personal data will be processed by the Law Office for the necessary period of time, but at least during the term of an agreement entered into with the data subject, or during the term of effect of the contractual legal relationship in relation to which the personal data of the data subject are processed; the personal data will be processed longer provided that this is required by a legal regulation, or if such processing is justified by the need for or potential of full settlement of claims under a contractual legal relationship concluded between the Law Office as the data controller and the data subject, or a third party, if personal data of the data subject are processed in this respect.
E. RECIPIENTS OF PERSONAL DATA
Subject to exceptions within the meaning of Art. 4 (9) of the General Data Protection Regulation, recipients of personal data may include:
I. Public authorities, or entities entrusted with the performance of tasks in public interest;
II. Suppliers of the Law Office in the area of information systems services, accounting, tax and other services related to the provision of legal services (e.g., co-operating attorneys-at-law, experts, interpreters, translators, etc.);
III. Contractual partners of the Law Office within the scope of the data subject’s personal data whose transfer or sharing with the recipient is necessary and follows from the labour or functional position of the data subject in the Law Office;
IV. Other recipients according to the needs and instructions of the data subject / client.
F. PERSONAL DATA SECURITY
The Law Office takes care to ensure security of personal data obtained in the course of its activities. Organisational and technical measures have been adopted that sufficiently protect these personal data in both electronic and physical form against accidental or unlawful destruction, loss, alteration or unauthorised disclosure, taking into account the importance of their processing.
G. RIGHTS OF THE DATA SUBJECT
Personal data protection regulations grant the following rights to data subjects:
I. The right of access to personal data – the data subject has the right to obtain from the controller (Law Office) information on whether the data are being processed and, if so, what data are being processed and in what manner;
II. The right to rectification/supplementation of personal data – the data subject has the right to have the controller (Law Office) rectify inaccurate personal data concerning him/her without undue delay; incomplete personal data may be supplemented by the data subject at any time;
III. The right to erasure of personal data (“right to be forgotten”) – the data subject has the right to have the controller (Law Office) destroy the personal data processed in respect of the data subject if certain conditions are met and the data subject so requests;
IV. The right to restriction of personal data processing – the data subject has the right to have the processing of his/her personal data restricted by the controller (Law Office) in certain cases;
V. The right to object to personal data processing – the data subject has the right to object at any time to the processing based on the legitimate interests of the controller (Law Office), third party or necessary for the performance of a task carried out in public interest or in the exercise of official authority;
VI. The right to portability of personal data – the data subject has the right to obtain from the controller (Law Office) personal data provided to the controller (Law Office) in a standard and machine-readable format; subsequently, the data subject may transfer these data to another controller; if technically possible, the data subject has the right to request that the controllers transfer the personal data among themselves;
VII. The right to withdraw consent to personal data processing – if the controller (Law Office) processes personal data of the data subject on the basis of the data subject’s consent, the data subject has the right to withdraw this consent at any time.
A data subject who is in any way dissatisfied with the processing of his/her personal data by the controller (Law Office) may lodge a complaint:
I. to the controller (Law Office) in writing at the following address: Advokátní kancelář Chrenek, Kotrba spol. s r.o., Těšnov 1/1059, 110 00 Prague 1, or by e-mail at email@example.com; or
II. Office for Personal Data Protection: Pplk. Sochora 27, 170 00 Prague 7.