The protection of personal data

The protection of personal data of our clients and other natural persons is important to us. These terms and conditions specify in what manner we process personal data in the course of provision of legal services within the law firm Advokátska kancelária RELEVANS s. r. o., with its registered office: Dvořákovo nábrežie 8A, 811 02 Bratislava, organization identification number (IČO): 47 232 471, registration: Commercial Register of the District Court Bratislava I, Section: Sro, Insertion no. 69947/B, registered in the Register of Partnerships of Attorneys at Law maintained by the Slovak Bar Association. (hereinafter referred to as “We“). Should you have any questions, please contact us by phone at +421 2 323 54 602, by e-mail at office@relevans.sk or by mail to the address of our registered office: Dvořákovo nábrežie 8A, 811 02 Bratislava.

With regard to the processing of personal data we are governed by the Regulation (EU) 2016/679 of the European parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movementcoo of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance) (the “GDPR”) which governs your rights as a data subject as well, by those provisions of the Act no. 18/2018 Coll. on the Protection of Personal Data And on the Amending and Supplementing Certain Acts, which apply to us (in particular, Section 78) (the “Personal Data Protection Act”), by the Act no. 586/2003 Coll. on Advocacy and on Amending and Supplementing the Act no. 455/1991 Coll. on Trade Licensing (Trade Licensing Act) as amended (Section 18) (the “Advocacy Act”) as well as by other laws. We comply with the Code of Conduct adopted by the Slovak Bar Association (the “SBA”), which further specifies the processing of personal data by attorneys at law. Learn more about the SBA’s Code of Conduct at www.sak.sk/gdpr.

Why do we process personal data?

The processing of personal data from our part is necessary, particularly, in order to be able:

• to provide legal services to our clients and exercise the legal profession; and
• to comply with various legal, professional, and contractual obligations; and
• to protect our legitimate interests, of our clients and others; and
• to inform our clients and potential clients about legal news, or, where applicable, about the success of the law firm.

For what purposes and on what legal basis do we process personal data?

1. Exercise of profession (provision of legal services)

• Legal basis

compliance with a legal obligation under Art. 6 para. 1 (c) of the Regulation (EU) 2016/679 of the European parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance) (hereinafter referred to as “GDPR”), and, where necessary, the establishment, exercise or defence of legal claims pursuant to the Art. 9 para. 2 (f) of the GDPR

• Related legislation

Act no. 586/2003 Coll. on Advocacy and on the Amending and Supplementing the Act no. 455/1991 Coll. on Trade Licensing (Trades Licensing Act), as amended, Advocacy Code of Practice, Act no. 40/1964 Coll. Civil Code, as amended, and Act no. 513/1991 Coll. Commercial Code, as amended

• Categories of data subjects and of personal data processed

clients, clients’ adverse parties, and other data subjects whose personal data is strictly necessary to process in the provision of legal services

the scope of personal data processed: personal data within the scope which is strictly necessary to process in provision of legal services

• Duration of the processing

the list of names of clients and the client-file protocol kept electronically by the end of the calendar year and its printed form in the office without any time limit;

as regards other data, 10 years from the date on which all the conditions for depositing the file in the archives will have been met in accordance with the applicable regulations

2. Provision of other than legal services

• Legal basis

performance of a contract pursuant to the Art. 6 para. 1 (b) of the GDPR, and where applicable, also compliance with the legal obligation under Art. 6 para. 1 (c) of the GDPR

• Related legislation

Act no. 215/2016 Coll. on the Register of Public Sector Partners and on Amending and Supplementing Certain Acts, Act no. 305/2013 Coll. on the Exercise of Public Authority Powers via Electronic Means and on Amending and Supplementing Certain Acts (the e-Government Act), Act no. 40/1964 Coll. Civil Code, as amended, and Act no. 513/1991 Coll. Commercial Code, as amended, Act no. 116/1990 Coll. on Lease and Sublease of Non-residential Premises, as amended

• Categories of data subjects and of personal data processed

data subjects acting in statutory bodies of companies or cooperatives, shareholders, members of cooperative, employees, close persons, and other data subjects whose personal data is strictly necessary to process when providing services

the scope of personal data processed: personal data within the scope which is strictly necessary to process in provision of services

data subjects acting in statutory bodies of companies or cooperatives, shareholders, members of cooperative, employees, close persons, and other data subjects whose personal data is strictly necessary to process when providing services

the scope of personal data processed: personal data within the scope which is strictly necessary to process in provision of services

• Duration of the processing

10 years from the date on which all the conditions for depositing the file in the archives will have been met in accordance with the applicable regulations data on ultimate beneficiary owners for a period of 5 years from the date of termination of the ultimate beneficiary owner status in the relevant company, provided that the data are not part of the verification document available on the internet

3. Ensuring compliance with legal regulations and regulations of the Slovak Bar Association

• Legal basis

compliance with a legal obligation under Art. 6 para. 1 (c) of the GDPR, the legitimate interest of the attorneys at law or third parties under Art. 6 para. 1 (f) of the GDPR, public interest under Art. 6 para. 1 (e) of the GDPR or defence of legal claims under Art. 9 para. 2 (f) of the GDPR

• Related legislation

Act no. 586/2003 Coll. on Advocacy and on the Amending and Supplementing the Act no. 455/1991 Coll. on Trade Licensing (Trades Licensing Act), as amended, Advocacy Code of Practice, Act no. 297/2008 Coll. on Protection against Money Laundering and on Protection against Terrorist Financing and on Amending and Supplementing Certain Acts, Act no. 583/2008 Coll. on Crime Prevention and Prevention of Other Antisocial Activities and on Amending and Supplementing Certain Acts, the GDPR

• Categories of data subjects and of personal data processed

data subjects acting in statutory bodies of companies or cooperatives, shareholders, members of cooperative, employees, close persons, and other data subjects whose personal data is strictly necessary to process for the applicable purpose of processing

the scope of personal data processed: personal data within the scope which is strictly necessary to process the compliance with the obligations laid down by law

• Duration of the processing

10 years from the date on which all the conditions for depositing the file in the archives will have been met in accordance with the applicable regulations

4. Purposes related to the protection of legitimate interests, including monitoring of premises for the purpose of protection of property and health

• Legal basis

The legitimate interest of attorneys at law or third parties under Art. 6 para. 1 (f) of the GDPR

• Related legislation

the GDPR, Act no. 40/1964 Coll. the Civil Code, as amended, and Act no. 513/1991 Coll. the Commercial Code, as amended, Act no. 301/2005 Coll. the Criminal Procedure Code, as amended, Act no. 300/2005 Coll. the Criminal Code, as amended, Act no. 160/2015 Coll. the Contentious Civil Procedure Code, as amended, Act no. 161/2015 Coll. the Non-Contentious Civil Procedure Code, as amended, Act no. 162/2015 Coll. the Administrative Judicial Code, as amended, Act no. 71/1967 Coll. on Administrative Proceedings (Code of Administrative Procedure), as amended, Act no. 372/1990 Coll. on Offenses, as amended

• Categories of data subjects and of personal data processed

data subjects recorded on the video-surveillance footage

the scope of personal data processed: video recordings of the data subject

• Duration of the processing

15 days after the footage was made

5. Statistical purposes, archival purposes in the public interest and the purposes of historical and scientific research

• Legal basis

Art. 89 of the GDPR

• Related legislation

Art. 89 of the GDPR and the Archives Act

• Categories of data subjects and of personal data processed

clients, clients’ adverse parties, and other data subjects whose personal data is strictly necessary to process in the provision of legal services

the scope of personal data processed: personal data in archival documents

• Duration of the processing

10 years from the date on which all the conditions for depositing the file in the archives will have been met in accordance with the applicable regulations

6. Accounting and tax purposes

• Legal basis

compliance with a legal obligation under Art. 6 para. 1 (c) of the GDPR

• Related legislation

specific accounting and tax administration laws

• Categories of data subjects and of personal data processed

employees, cooperating persons, suppliers and customers and their employees, and the data of other data subjects which result from tax and accounting records

the scope of personal data processed: personal data of the data subjects in the accounting tax documents

• Duration of the processing

10 years following the year to which these relate

7. Business communication

• Legal basis

the legitimate interest of the attorneys at law under Art. 6 para. 1 (f) of the GDPR

our legitimate interest is to find the most suitable service provider that fits the needs of the law firm

• Categories of data subjects and of personal data processed

suppliers and customers and their employees, or where necessary, other persons communicating on their behalf

the scope of personal data processed:common personal data of the data subjects (especially, identification data and contact details)

• Duration of the processing

5 years after the year in which the communication ended

8. Business agenda record keeping and registration and notification of changes to the Commercial Register of the Slovak Republic and the Trade Register of the Slovak Republic and the Register of Public Sector Partners

• Legal basis

compliance with a legal obligation under Art. 6 para. 1 (c) of the GDPR

• Related legislation

Act no. 530/2003 Coll. on the Commercial Register and on Amending and Supplementing Certain Acts, Act no. 513/1991 Coll. the Commercial Code, as amended, Act no. 455/1991 Coll. on Trade Licensing (Trade Licensing Act), as amended, Act no. 757/2004 Coll. on the Courts of Law and on Amending and Supplementing Certain Acts, Act no. 315/2016 Coll. on the Register of Public Sector Partners and on Amending and Supplementing Certain Acts

• Categories of data subjects and of personal data processed

executive directors, shareholders, employees, and close persons

the scope of personal data processed: personal data within the scope which is strictly necessary to process the compliance with the  obligations resulting from the applicable legal regulations

• Duration of the processing

5 years following the year in which the organization ceased to exist

data on ultimate beneficiary owners for a period of 5 years from the date of termination of the ultimate beneficiary owner status in the relevant company, provided that the data are not part of the verification document available on the internet

9. Sending legal updates

• Legal basis

the legitimate interest of the attorneys at law under Art. 6 para. 1 (f) of the GDPR or the consent under Art. 6 para. 1 (a) of the GDPR

our legitimate interest is to provide clients, former clients, as well as those data subjects having given their consent, with legal news and updates

• Categories of data subjects and of personal data processed

clients and persons who have given their consent to the processing of their e-mail address for the purpose of receiving legal updates the scope of personal data processed: e-mail address

• Duration of the processing

3 years from the date on which the data subject gave his or her consent to the processing of his/her personal data for that purpose

10. Company promotion (including publishing client references and opinions on cooperation with us)

• Legal basis

the consent of the data subject under Art. 6 para. 1 (a) of the GDPR

• Categories of data subjects and of personal data processed

executive directors, employees and cooperating persons

the scope of personal data processed: contact details and photo of the data subject

• Duration of the processing

up to the end of the calendar year in which the employment contract, cooperation agreement or contractual relationship was terminated

11. Communication with potential clients who contact the law firm through the contact e-mail address

• Legal basis

the legitimate interest of the attorneys at law under Art. 6 para. 1 (f) of the GDPR

our legitimate interest is to respond to queries from potential clients

• Categories of data subjects and of personal data processed

potential clients

the scope of personal data processed: e-mail address and personal data provided in mutual communication

• Duration of the processing

for the time necessary for the purpose of reply

12. Correspondence (written, electronic), registry administration and mail correspondence register

• Legal basis

compliance with a legal obligation under Art. 6 para. 1 (c) of the GDPR, legitimate interest under Art. 6 para. 1 (f) of the GDPR

our legitimate interest is to respond to queries, offers and other correspondence of potential clients, service providers, or employees

• Related legislation

Act no. 586/2003 Coll. on Advocacy and on Amending and Supplementing the Act no. 455/1991 Coll. on Trade Licensing (Trades Licensing Act), as amended, Advocacy Code of Practice, Act no. 305/2013 Coll. on the Exercise of Public Authority Powers via Electronic Means and on Amending and Supplementing Certain Acts (the e-Government Act), Act no. 395/2002 Coll. on Archives and Registries and on Amending and Supplementing Certain Acts

• Categories of data subjects and of personal data processed

data subjects – senders and recipients of correspondence and other data subjects whose personal data are entered in the mail correspondence register

the scope of personal data processed: title, first name, surname, e-mail address, or, where applicable, other identification data, where applicable, information on the amount owed, enforcement, litigation proceedings, if any, for the benefit of, or against the data subject, and other personal data which form the contents of the correspondence or electronic mailbox

• Duration of the processing

10 years after the book of incoming mail and the book of outgoing mail become full, i.e. from the date of receipt or date of sending of the last mail entered in the book

13. Selection of employees and pre-contractual labour relations

• Legal basis

compliance with a legal obligation under Art. 6 para. 1 (c) of the GDPR, compliance with a contractual obligation under Art. 6 para. 1 (b) of the GDPR, in order to implement measures at the request of the data subject and prior to the entering into a contract to which the data subject is to be a party

• Related legislation

Act no. 311/2001 Coll. Labour Code, as amended

• Categories of data subjects and of personal data processed

job applicants

the scope of personal data processed: personal data in a CV or, where applicable, in a document about the highest level of education achieved

• Duration of the processing

6 months after the end of the selection procedure

14. Human resources and salaries

• Legal basis

compliance with a legal obligation under Art. 6 para. 1 (c) of the GDPR, legitimate interest under Art. 6 para. 1 (f) of the GDPR

• Related legislation

Act no. 586/2003 Coll. on Advocacy and on Amending and Supplementing the Act no. 455/1991 Coll. on Trade Licensing (Trades Licensing Act), as amended, other regulations in the area of ​​labour law, including the Social Insurance Act, the Old- Age Pension Savings Act, the Health Insurance Act, as amended

• Categories of data subjects and of personal data processed

employees, former employees, cooperating persons and close persons

the scope of personal data processed: employee personal number, title, name, surname, surname at birth, address of permanent residence, address of temporary residence, date of birth, birth number, identity card number, place of birth, age, status, nationality, citizenship, all data and other records stated in the official document on education, signature, contact details (especially, phone number and e-mail), job title, basic salary, personal allowance, performance allowance and other job-title related components, data on time worked, bank account details of natural persons, amounts affected by enforcement ordered by a court or administrative authority, monetary punishments and penalties, as well as compensations imposed onto employees by enforceable decisions of the competent authorities, unlawfully received amounts of social insurance benefits and old-age pensions or any advances thereof, of state social benefits, social assistance benefits and allowances to social assistance benefits, monetary allowances for compensations of social consequences of severe disability, which the employee is obliged to return, based on an enforceable decision under a special regulation, data on incapacity for work, data on important personal obstacles to work, data on changed working ability, data on employers, work position and date of commencement of work in the public interest or work activity, data on family members within the scope: name, surname, address, date of birth, current school, details of spouse, children’s parents within the scope: name, surname, date of birth, birth number, address, details of employment certificate, data on employee’s registration in the register of unemployed citizens, data on maternity leave, parental leave, data on grant of pension, type of pension, name of the health insurance company where the employee is insured, personal data processed on certificates, certificates of passed examinations and educational activities, data stated in CVs, language skills, personal data in the scope of copied official documents: marriage certificate, birth certificate, certificate of highest level of education achieved

• Duration of the processing

personal files up to 70 years of age, employee payroll records – 50 years after the termination of the employment, payrolls, sickness insurance (applications, de-registrations, changes, benefits), incapacity for work and other payroll documentation – 10 years following the year to which they relate, income tax declarations, salary deductions, salary documents – 5 years, annual leaves, occupational health and safety, attendance – 5 years after the termination of the employment

15. Network security

• Legal basis

the legitimate interest of the attorneys at law under Art. 6 para. 1 (f) of the GDPR

our legitimate interest is to ensure the security of data located in the IT system of the law firm by recording logs on actions carried out by individuals within the network infrastructure of the firm

• Categories of data subjects and of personal data processed

employees, cooperating persons

the scope of personal data processed: identification data and data related to the person’s activities

• Duration of the processing

1 year after the year in which the log was recorded

16. Requests made by data subjects

• Legal basis

compliance with a legal obligation under Art. 6 para. 1 (c) of the GDPR,

• Related legislation

GDPR

• Categories of data subjects and of personal data processed

data subjects exercising their rights as data subjects

the scope of personal data processed: identification and contact personal data within the scope of the request and response to the request

• Duration of the processing

5 years following the year in which the request was made

To whom do we disclose your personal data?

We disclose the personal data of our clients and other natural persons only to the extent necessary while always maintaining the confidentiality of the recipient of the data to e.g. :

1. our employees,
2. the persons we entrust with the performance of individual acts of legal services, to attorneys at law who represent us or cooperate with us,
3. our accounting advisors,
4. IT service providers, providers of software equipment and support to our law firm, including employees of such persons,
5. the Slovak Bar Association (e.g. in case of disciplinary proceedings)
6. the Office for Personal Data Protection of the Slovak Republic
7. the tax office, the competent court, the law enforcement authorities and other relevant public authorities to which we provide personal data of individuals due to our compliance with the obligations under the applicable laws.

Although, due to our duty of confidentiality, we have a limited obligation to disclose your personal data to public authorities, we are obliged to preclude any commitment of any criminal offense and have also a duty to report any information regarding prevention of money laundering and terrorist financing.

Based on contractual cooperation with attorneys at law/ law firms in the provision of legal services (we will provide you with information on cooperating attorneys at law/ law firms upon receipt of your request to e-mail: office@relevans.sk), we act as joint controllers as we jointly process your personal data. By agreement among the joint controllers, we have determined the joint purposes and means of processing your personal data, and have determined the respective responsibilities for the compliance of the joint controllers with the obligations under the GDPR. We and the aforementioned attorneys at law/ all above-mentioned law firms are parties to the agreement currently in force.

The basic part of the above-mentioned agreement of joint controllers is the agreement that We are the controller which provides the data subjects with the information under Art. 13 and 14 of the GDPR, as well as the controller which receives any and all requests made by the data subjects vis-à-vis any joint controller. This is without prejudice to the right of the data subject under Article 26 para. 3 of the GDPR to exercise his or her rights under the GDPR vis-à-vis any of the cooperating attorneys at law/ law firms.

To which countries do we transfer your personal data?

Transfer of personal data of recipients of the newsletter containing legal news to the third countries outside the European Economic Area (EU, Iceland, Norway and Liechtenstein), or international organization is not executed, while we do not intend such cross-border transsmision.

We do not make any automated individual decision-making regarding your personal data, including profiling.

For how long do we store your personal data?

We store personal data as long as necessary for the purposes for which the personal data are processed. When storing personal data, we follow the recommended storage periods in accordance with the Resolution of the Council of the Slovak Bar Association No. 29/11/2011, e.g.:

• After the book of incoming mail and the book of outgoing mail become full, the attorney at law shall store it for a period of ten years from the date of receipt or date of sending of the last mail registered in the book;
• The inventory list shall be archived by the attorney at law for ten years after it was drawn up;
• Where the list of names of clients and the client-file protocol is kept by the attorney at law electronically, by the end of the calendar year its printed form shall be created and stored in the office without any time limit;
• The retention period of any client file before shredding is 10 years and shall start from the date when all the conditions for storage of the file in the archive are met.

Attorneys at law are subject to professional rules, which specify the obligations of attorneys at law under the Advocacy Act according to which there are certain circumstances that prolong our storage periods of personal data or prevent us from shredding some documents for obvious reasons. For example:

• The client file containing the originals of the documents handed over to the attorney at law by the client may not be shredded;
• Client-file protocols and lists of client names may not be shredded;
• Client files or any part thereof, which the attorney at law is obliged to submit to the state archive, may not be shredded;
• Any client file subject to any proceedings before any court, state administration body, law enforcement authorities, the Slovak Bar Association, related to the contents of the client file or the substance of which was formed by any action or omission of the attorney at law in providing legal aid in the matter of and to the client, may not be shredded.

How do we collect personal data about you?

If you are our client, in most cases we collect your personal data directly from you. In this case, obtaining your personal data is voluntary. Depending on the particular case, any non-provision of personal data by a client may affect our ability to provide quality legal advice or, in exceptional cases, our obligation to refuse to provide legal advice. We may also collect personal data about our clients from publicly available sources, from public authorities or from other persons.

If you are not our client, we often collect your personal data from our clients, or from other public or lawful sources, such as by requesting public authorities, from extracts from public registers, by obtaining evidence for the benefit of the client, and so on. In such a case, we may collect your personal data without informing you and even against your will based on our legal entitlement as well as obligation to carry out advocacy in accordance with the Advocacy Act.

What rights do you have as a data subject?

As a client, you shall have the right to request access to your personal data as well as any rectification thereof. Where we process personal data with regard to the provision of legal services, you, neither as a client, nor as any other natural person (e.g. an adverse party) shall have the right to object to such processing under Article 22 of the GDPR. If the personal data relates to a client (regardless of whether the client is a legal entity or a natural person), with reference to Art. 15 para. 4 of the GDPR, 20 para. 4 of the GDPR and Section 18 para. 8 of the Advocacy Act, no other persons shall have the right to access data or the right to portability due to our statutory duty of confidentiality: “An attorney at law shall not be obliged to provide information on the processing of personal data, to allow access or portability of personal data under a special regulation, if it could lead to a breach of the duty of confidentiality of the attorney at law under this Act.” Also, you shall have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic or the Slovak Bar Association.

Cookies processing

Cookies are:

Small text files stored on your computer that allow an analysis of your website use. The information stored by cookies may be retrieved by the website when you visit it again at a later date. Cookies are also necessary to ensure that all processes on the website run smoothly. In addition, cookies allow the user to re – use the website easier for the user: information stored in cookies since the first visit, the language setting does not need to be retype. This adjusts the website to a certain extent to your individual needs (in case the same device is used to access the website).

Our site uses the Cookiebot CMP platform when processing cookies, which allows us to monitor and document any type of tracking on our website, display relevant information about website users and automatically obtain and record all user consents. The user might give his consent to the use of cookies even to a limited extent, or not give his consent at all. Our website is fully functional even without granting this consent or granting it only to a limited extent. You can change or revoke your consent to cookies at any time on our website.

If consent is granted, we use cookies for the following reasons:

Providing an optimal service adapted to the client’s requirements. For example, some information that was shown to you during your first visit will not be shown to you again. Of course, we ensure organizational and technical procedures for the protection of your personal data and to prevent the loss of information and illegal actions.

We use following cookies data:

Necessary – serve to the website accessibility by enabling basic functionality such as site navigation and access to secure areas of the website. Without these cookies, the website cannot function properly.

Preferences – allow a website to remember information that changes the way the website behaves or looks, such as your preferred language or the region you are in.

Statistics – help us to understand how users of our websites interact with the website by anonymously collecting and reporting information.

Marketing – used to track users of our website. The intent is to serve ads that are relevant and engaging to individual users, and thus more valuable to publishers and third-party advertisers.

Changes to privacy policy

Privacy is not a one-off thing for us. The information regarding our personal data processing that we are required to provide to you may be subject to changes or may no longer be up-to-date. For this reason, we reserve the right to modify and change these terms and conditions at any time and to any extent necessary. In the event these terms and conditions change substantially, we shall bring such change to your attention e.g. by way of a general notice on this website or by a specific notification via e-mail.