1. Who is the controller of your data
The controller is the law firm Aurea Legal, with its registered office at Hybernská 1033/7, Nové Město, 110 00 Prague 1, Czech Republic, Company ID: [to be added].
In providing legal services, each of the firm's attorneys acts as an independent controller. You may contact us on data protection matters at our registered office or by e-mail at any of the addresses listed under Contact.
The firm has not appointed a data protection officer; it is not required to do so.
2. What data we process
- Identification and contact data
- Name, title, date of birth, personal identification number, address, identity document number, e-mail, telephone, business name, company ID, VAT ID.
- Data relating to the legal service
- Data contained in contracts, filings, correspondence, documents and other materials you provide to us or that we obtain in connection with the matter — including data on counterparties and other persons involved.
- Financial data
- Bank details, billing data, and records of services rendered and invoiced.
- AML data
- Data obtained when identifying and screening a client under Act No. 253/2008 Coll., on selected measures against the legitimisation of proceeds of crime and financing of terrorism, including copies of identity documents and beneficial ownership data.
- Website data
- Standard server operational data (IP address, time and type of request, browser type). See section 8.
3. Why we process data and on what legal basis
- Providing legal services
- Legal basis: performance of a contract (Art. 6(1)(b) GDPR); for third-party data, our legitimate interest or the client's legitimate interest in the proper provision of the service (Art. 6(1)(f) GDPR).
- Compliance with legal obligations
- In particular under Act No. 85/1996 Coll. on the Legal Profession, AML legislation, and accounting and tax rules. Legal basis: Art. 6(1)(c) GDPR.
- Pre-contractual communication
- Handling your enquiry sent by e-mail or made by telephone. Legal basis: steps prior to entering into a contract (Art. 6(1)(b) GDPR) or our legitimate interest in replying (Art. 6(1)(f) GDPR).
- Protection of our rights and claims
- Establishment, exercise and defence of the firm's legal claims. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
- Website operation and security
- Ensuring the availability and security of the site. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
We process special categories of data (such as health data or data on criminal convictions and offences) only where necessary for the establishment, exercise or defence of legal claims, in accordance with Art. 9(2)(f) GDPR.
4. Where the data comes from
We obtain data primarily from you. We may also obtain it from our clients (where it concerns counterparties and other persons involved), from public registers (the Commercial Register, Land Register, Insolvency Register, Register of Beneficial Owners), from public authorities, and from other persons involved in the matter.
5. Who we share data with
We disclose personal data only to the extent necessary and subject to the attorney's duty of confidentiality:
- co-operating attorneys, trainee lawyers and staff of the firm;
- courts, public authorities and other persons, where required for the legal service or by law;
- service providers processing data on our behalf under a processing agreement (IT and hosting, accounting, archiving, postal and courier services);
- experts, interpreters, notaries, tax advisers and other professional advisers engaged on the matter.
We do not transfer personal data to third countries outside the European Economic Area unless the nature of the legal service requires it; in that case we ensure appropriate safeguards under Chapter V GDPR.
6. How long we keep data
- Client file: for the duration of the engagement and thereafter for the period set by professional rules and limitation periods, usually 5 years from the close of the matter.
- AML data: 10 years from the transaction or the end of the business relationship.
- Accounting and tax records: as required by accounting and tax legislation, usually 5 to 10 years.
- Enquiries that did not lead to an engagement: no longer than 1 year from the last communication.
- Server logs: no longer than 6 months.
7. Your rights
In relation to the processing of your personal data you have the right:
- of access to your personal data and to a copy of the data processed;
- to rectification of inaccurate data and completion of incomplete data;
- to erasure, where there is no ground for continued processing;
- to restriction of processing;
- to data portability for data you provided to us and that we process by automated means on the basis of a contract or consent;
- to object to processing based on legitimate interest;
- to withdraw consent at any time, where processing is based on consent.
The exercise of some rights may be limited by the attorney's duty of confidentiality under Section 21 of the Act on the Legal Profession and by obligations under AML legislation — to that extent we may be unable to accommodate a request, and we will tell you why.
You can make a request at the firm's registered office or by e-mail. We will handle it within one month of receipt; in complex cases we may extend this by a further two months and will notify you.
8. Cookies, analytics and site operation
This website uses no cookies, contains no analytics or advertising tools, and does not track visitor behaviour. Fonts are served directly from our own server, so an ordinary visit triggers no request to any third party.
The web server records standard operational data (IP address, date and time of request, requested address, browser type) to keep the site running and secure. These records are kept for no longer than 6 months.
The site links to third-party websites (such as the Czech Bar Association or a mapping service). Data processing on those sites is governed by their operators' policies.
9. Supervisory authority
If you believe that the processing of your personal data infringes data protection law, you may lodge a complaint with the supervisory authority:
Office for Personal Data Protection (Úřad pro ochranu osobních údajů)
Pplk. Sochora 727/27, 170 00 Prague 7 — Holešovice, Czech Republic
www.uoou.cz
We would appreciate the chance to resolve the matter with you first — most situations can be settled directly.
10. Changes to this policy
We may update this policy from time to time, particularly if our processing or the applicable law changes. The current version is always available at this address.