Personal Data Processing Policy

1. Who is the Data Controller

The data controller is:

JUDr. Jan Šafář, Attorney
Reg. No. ČAK 22120
Address: Spáčilova 569/27, 767 01 Kroměříž
Company ID: 24057118

(hereinafter referred to as the “Attorney”).

The Attorney treats personal data as confidential and processes them in accordance with applicable legal regulations, in particular GDPR (Regulation (EU) 2016/679 of the European Parliament and Council) and related Czech legislation.

As the controller, the Attorney determines the purposes and means of processing personal data used in the practice of law and related activities.

2. Scope of these policies

These policies apply mainly to the processing of personal data:

• when using the Attorney’s website,
• when communicating by e-mail, telephone, or in person,
• when providing legal services to clients,
• in cooperation with suppliers and business partners,
• for compliance with legal obligations of the Attorney,
• for protecting the legitimate interests of the Attorney or third parties.

This document also explains what data is processed, why, to whom it may be disclosed, how long it is retained, and the rights of data subjects.

3. Purpose of personal data processing

The Attorney may process personal data for the following purposes:

a) Contract fulfillment

Primarily for concluding and fulfilling contracts for legal services, actually providing legal services in accordance with applicable regulations, and for contractual relations with business partners (e.g., cooperating offices, service or product providers).

b) Legal obligations

Primarily obligations under accounting and tax regulations, obligations related to the management of legal files, and obligations towards public authorities according to relevant legal regulations.

c) Protection of the Attorney’s legitimate interests

For example, for protecting the rights and legally protected interests of the Attorney, including client identification and verification under the advocacy and AML laws.

d) Protection of third parties’ legitimate interests

Especially those of clients, within the limits of legal practice and related laws.

e) Handling requests submitted via online forms

For example, through contact forms or registration for professional or educational events.

f) E-mail communications

Sending information related to services, professional content, links to related online content (e.g., videos, social media, e-books), if the legal basis for processing allows.

4. Types of personal data processed

The scope depends on the purpose. Typically:

• Identification data (name, surname, title, date of birth, personal ID number),
• Contact data (address, e-mail, phone),
• Billing and accounting data (Company ID, VAT ID, account number),
• Data related to specific legal cases,
• Technical data obtained from website usage (e.g., IP address or site behavior).

Specifically, the Attorney may process:

• Name, surname, contact address, e-mail, phone number, IP address
  – for contract fulfillment, legal obligations, legitimate interest protection, form requests, and e-mail communications.
• Account number, Company ID, VAT ID, personal ID, date of birth, and other client or third-party info
  – for contract fulfillment, legal obligations, and protection of legitimate interests.

Some data may also be collected and evaluated automatically (e.g., website traffic statistics).

5. Cookies, remarketing, and analytics

Cookies

Cookies are small data files stored on the user’s device for website functionality and session identification. Cookies themselves do not store personally identifiable data. Users can refuse cookies (except strictly necessary ones) when visiting the site.

Remarketing cookies

Cookies may also be used for remarketing, analyzing user behavior, and showing relevant advertising.

Google Analytics

The website may use Google Analytics to measure website traffic and evaluate user behavior.

6. Recipients of personal data

The Attorney only shares personal data with individuals who need them for the processing purpose and to the extent necessary, based on a legal title. Typically, these include authorized employees, cooperating attorneys, and contracted processors.

Specific recipients related to website usage:

By law, some personal data may also be shared with public authorities (e.g., law enforcement) if required.

7. Third-party personal data

The Attorney may process personal data of third parties obtained during legal services or contractual relationships (e.g., employees of clients, suppliers, opposing parties).

Such data is processed only to the extent necessary and in compliance with the law. Retention depends on contract duration, legal obligations, and the need to protect rights.

8. Data retention

Personal data is kept only as long as necessary for the processing purpose, legal obligations, or protection of rights and legitimate interests.

• Duration of contractual relationship,
• Legal regulations (accounting, tax, professional rules),
• Need to protect legal claims in a specific case.

Retention overview by processing purpose:

Note on e-mails: Personal data may also be processed under § 7(3) Act No. 480/2004 Coll., to send business communications about the Attorney’s own services/products (e.g., newsletter) unless the recipient opts out.

9. Data subject rights

• Right to access personal data,
• Right to correct incomplete or inaccurate data,
• Right to erasure (under conditions of law),
• Right to restriction of processing,
• Right to data portability,
• Right to object to processing,
• Right to lodge a complaint with the Office for Personal Data Protection (www.uoou.cz).

Unjustified, excessive, or repeated requests may incur a reasonable fee or be refused.

10. Details of rights

Access

Right to know whether personal data is processed and to access it and related information.

Correction

Right to correct or complete inaccurate/incomplete data.

Erasure

Request erasure if data is no longer needed, processed unlawfully, or legal basis no longer exists.

Restriction

Temporary retention or limited processing may be requested where allowed by law.

Data portability

If processing is based on contract or consent and automated, data may be transferred to another controller, respecting third-party rights.

Objection

Right to object, particularly against processing based on legitimate interest; processing stops unless overriding legal reasons exist.

11. Limitation due to legal practice

Due to legal confidentiality, some requests may be limited if processing involves specific legal cases or client/third-party protection.

12. How to exercise rights & more info

Further information is available at the Attorney’s office or via contact e-mail. Identity verification may be required (personally or via qualified electronic method).

Supervisory authority: Office for Personal Data Protection
Web: www.uoou.cz

13. Final provisions

Effective from 25.2.2025; may be updated with changes in law, services, or technology. Some rights may be limited for legal case-related personal data.

More info at the office: Spáčilova 569/27, 767 01 Kroměříž or email safar@advokatsafar.cz.

Requests are usually submitted in person on a prescribed form; may also be sent by e-mail, post, or via electronic mailbox with qualified electronic signature.

Supervisory authority: Office for Personal Data Protection, Web: www.uoou.cz.