In accordance with the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council, hereinafter referred to as the “Regulation”), we provide information on the processing of personal data.

1. Our contact details for data protection matters
1.1. Our company Jansa Mokrý Otevřel & partners s.r.o., law firm acts as a so-called data controller. In case of questions, requests or objections relating to the processing of personal data, please contact our contact details below:
written contact:

Jansa Mokrý Otevřel & partneři s.r.o., law firm
Sokola Tůmy 743/16
70900 Ostrava
Czech Republic
Electronic contact:
lawyer@lawyer.cz

1.2. We do not have a Data Protection Officer.

2. When is your personal data processed?
2.1. Your personal data may be processed in the following cases:

• you have communicated with us in writing or electronically (e.g. by email) and have provided us with personal data,
• you are our client – a natural person or a natural person doing business,
• you are an employee or other representative of our client – a legal entity,
• you are an entrepreneurial natural person or an employee of a legal person with whom we have contracted as a client for your services or goods,
• you are an applicant for employment with our law firm.

2.2. This information on the processing of personal data applies to all of the above.

3. Legal basis for processing personal data, method and purpose of processing

We are entitled to process your personal data even without your consent:

• to the extent necessary for the conclusion of the contract or for the performance of our obligations under the contract,
• to the extent necessary to comply with a legal obligation imposed on us by a legal provision, such as a law,
• to the extent necessary for the purposes of our legitimate interests.

We also provide more detailed information on the individual legal bases for processing personal data:

3.1. Negotiation, conclusion and subsequent performance of the contract
3.1.1 We process personal data because it is necessary for the conclusion of a contract with you, the natural person, and the subsequent performance of the obligations and exercise of the rights agreed in the contract (Article 6(1)(b) of the Regulation).
3.1.2 The purpose of the processing of personal data is the conclusion of the contract and the subsequent performance of our obligations and exercise of rights under the contract, in particular the provision of legal services, the performance of obligations under the employment relationship or the payment for services or goods supplied by you.
3.1.3 What personal data we process: for the above purpose, we process your identification data (first name, surname, in some cases date of birth or birth number) and address data (residential address, or delivery address, e-mail address, telephone number), descriptive data, if you provide it in the contract or related communication (academic degree) and, where applicable, other personal data related to the legal service provided (these may also be special categories of personal data).
3.1.4 The contract negotiated or entered into is most often a contract for the provision of legal services, contracts entered into employment relationships, as well as purchase or work contracts or contracts for the provision of services where we act as purchasers or principals.

3.2. Compliance with a legal obligation imposed on us by law
3.2.1 We also process your personal data because it is necessary to comply with legal obligations to which we are subject (Article 6(1)(c) of the Regulation).
3.2.2 These legal obligations include, in particular, the issuing, receipt and archiving of tax documents (inter alia, under the Accounting Act, the Value Added Tax Act), the maintenance and archiving of the lawyer’s file, including email communications, contact details and records of services provided), the transmission of personal data to the CAK authorities (under the legislation on certain measures against the legalization of the proceeds of crime and the financing of terrorism).
3.2.3 The purpose of processing personal data is to fulfil our legal obligations, in particular in the field of accounting, tax regulations, regulations  overning the practice of law and other legal regulations.

3.3. Reaching clients through direct marketing
3.3.1 We process our clients’ personal data for direct marketing purposes because it is necessary for the purposes of our legitimate interests (Article 6(1)(f) of the Regulation).
3.3.2 We may send commercial communications to your e-mail address, which you have provided to us as a client or as a representative of a client in connection with the provision of legal services, even without your express consent, but only with an offer of our legal services or information and news directly related to the legal services we provide, changes in legislation or new case law of the courts.
3.3.3 The purpose of processing personal data is to enable us to inform our clients about the legal services we provide and any changes in the law that may affect our clients. We consider this necessary for the purposes of our legitimate interests. You may object to this processing of your personal data (see section 6.6) or notify us that you no longer wish to receive commercial communications.
3.3.4 What personal data is processed: only the e-mail address or name and surname.

3.4. Processing of personal data necessary to protect our legitimate interests
3.4.1 We also process personal data in order to enter into a contract with a legal entity that you represent (most often as a member of the statutory body or as an employee) and subsequently communicate with it or provide legal services to it, or for other legitimate reasons, which we are, however, obliged to disclose to you.
3.4.2 The above processing is necessary for the purposes of our legitimate interests (Article 6(1)(f) of the Regulation).
3.4.3 The purpose of the processing of personal data is to properly identify our clients or their representatives and for the purpose of communication or defence for the establishment, exercise or defence of legal claims.
3.4.4 What personal data is processed: identification data (first name, surname, in some cases date of birth or birth number) and address data (residential address, or delivery address, e-mail address, telephone number) or descriptive data if you provide it (academic degree), any other personal data necessary for our legitimate interest (e.g. personal data necessary for us to provide legal services).

3.5. Processing of personal data on the basis of your consent
We only process your personal data on the basis of your consent to the processing of your personal data in the following cases:

3.5.1 Job applicants

• We process the personal data of job applicants to the extent necessary for the duration of the relevant selection procedure for the purpose of negotiating and concluding an employment contract (see Article 3.1).
• We only process unsolicited CVs and other personal data sent to us by job applicants, as well as personal data of job applicants who have not been recruited, on the basis of the applicant’s explicit consent to the processing of his/her personal data.

3.5.2 Cookies and website visit data

• We use Google Analytics to collect information regarding traffic to our website www.lawyer.cz, however, we have set up IP anonymisation within this service. This means that we do not process any personal data of visitors to our website.

4. Period of storage of personal data
4.1. We only process personal data for the time necessary to fulfil the purpose of the processing or for the time required by law.
4.2. We also specify the period for which your personal data will be stored or the criteria for determining this period. The storage period varies depending on the method and purpose of the processing of personal data:

5. Where do we process and to whom do we provide your personal data?

5.1. Place of processing

5.1.1 We process personal data in the Czech Republic or in EU member states.

5.2. Recipients of personal data

5.2.1 If you are a client of our law firm, we only disclose your personal data to authorised employees and to data controllers, which are cooperating attorneys or other recipients (e.g. notaries, experts, tax advisors), but only to the extent necessary and for the purpose of the contract or other legal reason for processing personal data (in particular in connection with the performance of obligations under the law). As a client, we will always inform you of such transfer of personal data, including the identification of the specific recipient.
5.2.2 We process personal data processed in paper form for the duration of the processing exclusively within the framework of the files and accounting documents kept at the registered office of our law firm.
5.2.3 We process personal data processed in electronic form using equipment located on the property of our law firm, and through server services provided by Microsoft Ireland Operations Limited as data processor.
5.2.4 We use third parties in their capacity as data processors to carry out certain activities within the purposes of processing personal data as set out above. With the exception of the processors referred to in the previous clause, these include:

• accounting service providers,
• postal or transport service providers.

5.2.5 Depending on the nature of the legal services we provide to you, your personal data may be transferred to third parties (in the context of communication with the counterparty, making submissions in specific judicial or administrative proceedings, etc.), but always to the extent necessary for the proper provision of legal services under the concluded contract and to protect your interests.

6. Your rights in relation to our processing of your personal data
6.1. We process your personal data in a fair and transparent manner, in accordance with the law. We set out below the rights you have in relation to the processing of your personal data.

6.2. Right to access and rectify your personal data
6.2.1 You have the right to access personal data relating to you as a so-called data subject, under the conditions set out in Article 15 of the Regulation.
6.2.2 If you believe that the personal data we process about you is inaccurate or incomplete, you have the right to ask us to correct or complete it.

6.3. Right to erasure (“right to be forgotten”), right to restriction of processing
6.3.1 You have the right to request that we delete personal data concerning you without undue delay, but only if one of the grounds set out in Article 17 of the Regulation applies.
6.3.2 You have the right to restrict processing in any of the cases listed in Article 18 of the Regulation.

6.4. Right to portability of personal data
6.4.1 In cases where processing is based on your consent (Article 3.5) or the performance of a contractual obligation (Article 3.1), and where the processing is also carried out by automated means, you have the right to obtain personal data relating to you in a structured, commonly used and machine-readable format and, where applicable, the right to transmit such data to another party without hindrance.
6.4.2 You also have the right to ask us to transfer your personal data to another entity that acts as a so-called data controller, provided that it is technically feasible to do so.
6.4.3 Currently, there is no automated processing of personal data based on the legal bases set out in Articles 3.1 and 3.5).

6.5. Right to withdraw consent to the processing of personal data
6.5.1 If you have given us consent to process personal data for purposes that require such consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent given prior to withdrawal.

6.6. Right to object to the processing of personal data concerning you
6.6.1 You have the right to object to the processing of personal data concerning you where we process personal data on the basis of Article 6(1)(f) of the Regulation, i.e. for the purposes of our legitimate interests; we justify processing for the purposes of sending commercial communications (Article 3.3) and for the reasons set out in Article 3.4.
6.6.2 On the basis of an objection, we are required to assess, in accordance with Article 21(1) of the Regulation, whether our legitimate interest in processing is based on such compelling reasons that outweigh your rights and freedoms. If such compelling reasons are not present, we will cease processing your personal data to the extent that the objection may apply.

6.7. Right to lodge a complaint with the supervisory authority
6.7.1 You have the right to lodge a complaint with a supervisory authority if you believe that the processing of personal data is in breach of the law. You may lodge a complaint with the supervisory authority, which is:

The Office for Personal Data Protection (OPPD)
Pplk. Sochora 27
170 00 Prague
www.uoou.cz

6.8. How to exercise the right?
6.8.1 You can exercise your data protection rights in writing or electronically at the addresses listed in Article 1 above. Please note that we are entitled, in case of doubt, to verify the identity of the person who has made the request or objection and, for this purpose, to require verification of the applicant’s identity in person at our office, sending the request in writing with a certified signature, or sending the request electronically via the applicant’s data box or via e-mail bearing a valid electronic signature based on a qualified certificate. The rights under Article 6 cannot be exercised by
telephone.

7. Other circumstances of the processing of your personal data
7.1. Except where we are obliged to request your personal data from you under the legislation on certain measures against money laundering and terrorist financing (Article 3.2.2.), the provision of personal data by you is voluntary where no legislation requires you to do so. However, if you refuse to provide personal data to the extent required for a particular processing purpose, we may not be able to fulfil that purpose and, depending on the nature of the relationship, we may be obliged not to enter into a contractual relationship with you or to terminate an existing relationship or to cease communication with you.
7.2. Our Firm does not carry out any personal data processing activity involving automated processing or profiling within the meaning of Article 22 of the Regulation.