POLICY ON PROCESSING AND PROTECTION OF PERSONAL DATA

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, Act No. 110/2019 Coll. on the processing of personal data and other related legal regulations, the law firm BUCHTA, POKORNÝ & PARTNEŘI, advokátní kancelář (hereinafter referred to as the “Administrator”) provides the following information regarding the processing of personal data.

1. Administrator of personal data

The administrators of personal data are:

JUDr. Jiří Pokorný, Ph.D., advokát

registration number ČAK: 19111

IČO: 86944312

address: Blanická 1008/28, 120 00 Prague

e-mail: pokorny@bpplegal.eu

and

Mgr. Adam Buchta, attorney

ČAK registration number: 17632

IČO: 88247601

address: Blanická 1008/28, 120 00 Prague

e-mail: buchta@bpplegal.eu

(hereinafter referred to as the “Administrator”)

2. Principles and scope of personal data processing

The Administrator processes personal data only to the extent necessary to achieve specific, predetermined and legitimate purposes. The processing is carried out in accordance with the basic principles of personal data protection, in particular the principles of lawfulness, transparency, data minimization, accuracy, storage limitation, integrity and confidentiality.

3. Purposes of processing personal data

Personal data are processed, in particular, for the following purposes:

• providing legal services in accordance with the Law on the Bar,
• fulfilling obligations established by law (in particular in the field of accounting, archival affairs and other public law obligations),
• concluding and performing contractual relations,
• protecting the rights and legitimate interests of the administrator, in particular for the purposes of presenting or defending legal claims,
• ensuring the proper functioning and internal activities of the law firm,
• other purposes for which the data subject has consented.
  4. Legal grounds for processing

The processing of personal data is carried out on the basis of legal grounds determined by law, in particular:

• performance of a contract or measures preceding its conclusion,
• fulfillment of a legal obligation of the administrator,
• legitimate interest of the administrator or a third party,
• protection of vital interests,
• the consent of the data subject (if necessary).
  5. Processing of special categories of personal data

Special categories of personal data are processed only when necessary, in particular for the provision of legal services, including the establishment, exercise or defence of legal claims, or on the basis of explicit consent or other lawful basis.

6. Sources of personal data

Personal data are obtained, in particular:

• directly from data subjects,
• from public registers and open sources,
• from third parties in connection with the provision of legal services.

7. Categories of data subjects

The Administrator processes personal data, in particular, of the following persons:

• clients and their representatives,
• employees and job candidates,
• contractual partners and suppliers,
• other persons whose data are necessary for the provision of legal services.

8. Categories of personal data

The following are processed, in particular:

• identification and contact data,
• data related to contractual relations and the provision of legal services,
• data contained in cases and documents,
• special categories of personal data, if necessary.
  9. Recipients of personal data

Personal data may be transferred, in particular:

• to public authorities (e.g. courts, administrative bodies or criminal prosecution bodies),
• to IT service providers and other processors that ensure the functioning of the office,
• to other entities in cases provided for by law or at the client’s instructions.
  10. Method of processing personal data

Processing is carried out both in paper and electronic form, by automated and non-automated means. Only authorized persons who are obliged to maintain confidentiality have access to personal data.

11. Personal data protection

The administrator has implemented appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, loss or misuse.

No authorized person for personal data protection has been appointed.

12. Storage period for personal data

Personal data are stored for the period necessary to achieve the purpose of their processing, usually for the duration of the contractual relationship and after its termination for the period specified by law, in particular in the field of legal practice, archival matters and the protection of legal claims.

13. Rights of data subjects

The data subject has the right to:

• access their personal data,
• request the correction of inaccurate or incomplete data,
• request the erasure of personal data where there are legitimate grounds,
• request the restriction of processing,
• object to processing,
• receive their data in a portable format.

The data subject also has the right to file a complaint with the Office for the Protection of Personal Data if they believe that the processing of their personal data is carried out in violation of the law.

14. Final provisions

All information and actions taken in accordance with the GDPR shall be provided free of charge. In the event that the data subject’s requests are manifestly unfounded or excessive, in particular because of their repetitive nature, the administrator shall have the right to charge a reasonable fee or to refuse to comply with the request.