Terms of privacy protection and processing of personal data under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter the “GDPR”).
The lawyer as controller
Under Section 18(6) of the Advocacy Act (zákon o advokácii, Act No. 586/2003 Coll.), a lawyer processing personal data for the purposes of practising law has the status of a controller within the meaning of Article 4(7) of the EU General Data Protection Regulation (also referred to in this text as the “GDPR”). A lawyer also has the status of a controller when processing personal data for the purposes of practising law as the substitute of another lawyer within the meaning of Section 16 of the Advocacy Act.
A lawyer is entitled to ask a client, a prospective client or persons claiming to be clients to provide proof of their identity for the purposes of verifying their identity or fulfilling the lawyer's statutory or contractual obligations, and is entitled to scan, copy or otherwise record these documents.
The principle of data minimisation requires a lawyer to process only such personal data as are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. Processing personal data to an excessive extent – that is, processing personal data that are not needed to achieve the purposes of processing – is considered a breach of this principle.
When processing personal data, as a lawyer I am governed primarily by the GDPR, which also sets out your rights as a data subject, by those provisions of the Data Protection Act (zákon o ochrane osobných údajov) that apply to me (in particular Section 78), by the Advocacy Act (Section 18) and by other regulations. I comply with the code of conduct adopted by the Slovak Bar Association (SAK), which explains in more detail how lawyers process personal data. You are welcome to read this code of conduct at www.sak.sk/gdpr.
What personal data do we process?
We mainly process the following personal data: the details shown on your identity card, your e-mail address and your telephone number.
What legitimate interests do we pursue when processing personal data?
Where processing is based on Article 6(1)(f) of the GDPR, my legitimate interest is to protect our legitimate interests and claims; this concerns in particular the processing of personal data for the purpose of enforcing claims arising from legal relationships.
To whom do we disclose your personal data?
I disclose your personal data and the data of other natural persons only to the extent necessary and always subject to the recipient's duty of confidentiality, for example to persons we entrust with carrying out individual acts of legal services, to substitute or cooperating lawyers, to accounting advisers, to the SAK (for example in disciplinary proceedings) or to software providers.
Although, owing to our duty of confidentiality, our obligation to provide your personal data to public authorities is limited, we are obliged to prevent the commission of a criminal offence, and we likewise have a duty to report information in the field of preventing money laundering and terrorist financing.
For what purpose do we process your personal data?
I process your personal data for the purpose of properly providing the legal services arising from the Contract for Legal Services. The legal basis for processing personal data is the agreement on the provision of legal services.
To which countries do we transfer your personal data?
We do not intend to transfer your personal data across borders to third countries outside the European Economic Area (the EU, Iceland, Norway and Liechtenstein). We use secure cloud services from a verified provider within the EU jurisdiction. We do not carry out automated individual decision-making, including profiling.
Do we use artificial intelligence tools?
Yes, as an aid in our work – for example to process and summarise documents, to search legislation and case law, or to prepare background materials. We use exclusively professional tools within the firm's secure working environment, whose provider is contractually bound to confidentiality as a processor and may not use your data for its own purposes or for the training of AI models. We enter into these tools only the data necessary for the task in hand.
All information, including information processed with the help of AI, is covered by the lawyer's duty of confidentiality under Section 23 of the Advocacy Act (Act No. 586/2003 Coll.). Every output is personally checked by the lawyer, and AI does not make any automated decisions about you. If you would prefer AI tools not to be used in your matter, simply let us know by e-mail. You will find further details in the Client information.
How long do we keep your personal data?
We keep personal data for no longer than is necessary for the purposes for which they are processed. When retaining personal data, we follow the recommended retention periods set out in Resolution No. 29/11/2011 of the Presidium of the Slovak Bar Association.
How do we obtain personal data about you?
If you are our client, we most often obtain your personal data directly from you. In that case, providing your personal data is voluntary. Depending on the particular case, a client's failure to provide personal data may affect my ability to provide high-quality legal advice/legal services or, in exceptional cases, may even oblige us to decline to provide legal advice/legal services. We may also obtain personal data about my clients from publicly available sources, from public authorities or from other persons.
If you are not our client, we most often obtain your personal data from our clients or from other public or lawful sources, for example by requesting them from public authorities, from extracts from public registers, by gathering evidence on the client's behalf and so on. In that case I may obtain personal data about you without informing you and even against your will, on the basis of my statutory right and duty to practise law in accordance with the Advocacy Act.
What rights do you have as a data subject?
If we process personal data about you on the basis of your consent to the processing of personal data, you have the right to withdraw your consent at any time. Regardless of this, you have the right to object at any time to the processing of personal data based on a legitimate or public interest, as well as for the purposes of direct marketing, including profiling. As a client, you have the right to request access to your personal data and their rectification.
Where we process personal data in the course of providing legal services, neither you as a client nor any other natural person (for example the opposing party) has the right to object to such processing under Article 21 of the GDPR. Where personal data concern a client (regardless of whether the client is a legal or a natural person), other persons have neither the right of access to the data nor the right to data portability, owing to our statutory duty of confidentiality and with reference to Article 15(4) GDPR, Article 20(4) GDPR and Section 18(8) of the Advocacy Act: “A lawyer is not obliged to provide information on the processing of personal data or to allow access to or portability of personal data under a special regulation if doing so could lead to a breach of the lawyer's duty of confidentiality under this Act.”
You also have the right to lodge a complaint at any time with the Office for Personal Data Protection (Úrad na ochranu osobných údajov) or with the Slovak Bar Association.
Is providing personal data compulsory?
Information on whether the provision of personal data is a statutory or contractual requirement or a requirement necessary to enter into a contract, whether the data subject is obliged to provide the personal data, and the possible consequences of failure to provide such data:
We would like to inform you that the provision of personal data is partly required by law (for example by tax regulations) or may also arise from contractual provisions (for example information about a contractual partner). Where a contract needs to be concluded, for example a Contract for the Provision of Legal Services, the data subject provides us with their personal data, which we must then process. Failure to provide personal data would mean that the contract with the data subject could not be concluded.
Before providing us with personal data, the data subject is welcome to contact us and we will explain whether the provision of personal data is required by law or by contract or is necessary for concluding a contract, whether there is an obligation to provide personal data and what the consequences of not providing them would be.
Where can you turn if you feel that your personal data are not being processed in accordance with the law?
If you believe that your personal data are being processed in breach of the applicable legislation, please let us know at my e-mail address miro@repka.sk, in person or by telephone. Should we nevertheless fail to reach agreement on any point, you may lodge a complaint with the Office for Personal Data Protection. You will find details at: dataprotection.gov.sk/uoou.
Changes to the privacy terms
For us, the protection of personal data is not a one-off matter. The information we are obliged to provide to you in connection with our processing of personal data may change or cease to be up to date. For this reason we reserve the right to amend and change these terms at any time and to any extent. If we change these terms in a material way, we will bring the change to your attention, for example by a general notice on this website or by a separate notice sent by e-mail.
This policy has been in effect since 1 January 2021.
