Privacy policy

Information on the processing of personal data

Advokátska kancelária Samec & partners, s. r. o. (the “controller” or the “law firm”) processes personal data in accordance with Regulation (EU) 2016/679 (GDPR), Slovak Act No. 18/2018 Coll. on the Protection of Personal Data and Act No. 586/2003 Coll. on the Legal Profession (in particular Section 18(6) and Section 23 on a lawyer’s duty of confidentiality).

We follow the Code of Conduct for the processing of personal data by lawyers under the GDPR adopted by the Slovak Bar Association. You can find it on the Slovak Bar Association website.

This information is provided under Articles 13 and 14 of the GDPR. It explains how we collect, use and protect personal data, including data submitted through the forms on this website.

I. Controller

II. Purposes of processing

1. Providing legal services

• Purpose: legal advice, representation and other legal services.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with a lawyer’s legal obligations under the Legal Profession Act (Art. 6(1)(c) GDPR).
• Data categories: name, surname, date of birth, birth number, address, contact details and information about the legal matter.
• Retention period: for the duration of the legal services and then 10 years after the representation ends (Section 23(8) of the Legal Profession Act).

2. Booking a consultation through the website form

• Purpose: handling your consultation request and arranging an appointment.
• Legal basis: performance of a contract and steps taken at your request before entering into it (Art. 6(1)(b) GDPR).
• Data categories: name, surname, email, phone number, area of law, type of consultation (in person, online, by phone), preferred date and time and a short description of your situation.
• Retention period: 3 years after the consultation.

3. Contact form, emails and phone calls

• Purpose: dealing with questions and enquiries from people interested in our legal services.
• Legal basis: the controller’s legitimate interest in responding to enquiries related to its work (Art. 6(1)(f) GDPR).
• Data categories: name, email, phone number (if provided), subject and content of the message.
• Retention period: 1 year after the last communication, unless a contract is concluded.

The forms on this website do not store your IP address or browser details. We only keep the information you enter in the form and the consent you confirm when submitting it.

4. Accounting and tax obligations

• Purpose: bookkeeping, issuing invoices and meeting tax obligations.
• Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR) under Act No. 431/2002 Coll. on Accounting and Act No. 222/2004 Coll. on VAT.
• Data categories: billing details and payment transactions.
• Retention period: 10 years (the statutory period for keeping accounting records).

5. Website statistics (Google Analytics)

• Purpose: measuring website traffic so we know which pages visitors find useful.
• Legal basis: consent (Art. 6(1)(a) GDPR) given in the cookie banner.
• Data categories: truncated IP address, browser and device details, pages visited and time of visit.
• Retention period: 26 months.
• Google Analytics only loads after you consent. Without consent, no measurement script runs.

6. Google Maps

• Purpose: showing the location of our office on a map.
• Legal basis: consent (Art. 6(1)(a) GDPR) in the “Maps and third-party content” category, or your click to display the map.
• The map is provided by Google, which processes your IP address when the map is displayed and may set its own cookies. Without consent the map is not loaded.

A detailed list of cookies and how to manage them is on the Cookies page.

III. Obligation to provide personal data

Providing personal data for legal services (point II.1) is a contractual requirement. Without identification and contact details we cannot conclude a contract for legal services. Likewise, the details in the consultation form (point II.2) are needed to handle your booking.

Data for accounting and tax purposes (point II.4) is a statutory requirement. Consent to statistics and to Google Maps (points II.5 and II.6) is voluntary, and refusing it has no effect on our services or on your use of the website.

IV. Automated decision-making and profiling

The controller does not carry out automated individual decision-making or profiling within the meaning of Article 22 GDPR.

V. Recipients of personal data

We share personal data only to the extent necessary for the purpose of processing, with the following recipients:

• courts and public authorities when representing clients in court and administrative proceedings,
• opposing parties and their lawyers in out-of-court negotiations and court proceedings,
• accounting service providers to the extent needed for bookkeeping,
• Google (Google Analytics and Google Maps) only with your consent; Google is certified under the EU-US Data Privacy Framework,
• ZONER, a.s. (email service provider, Czech Republic, EU) for sending and receiving email,
• the website hosting provider, whose servers run this website and store messages sent through the forms,
• providers of artificial intelligence tools acting as processors (see section VI).

We do not transfer personal data outside the EU and EEA, except to processors certified under the EU-US Data Privacy Framework or providing appropriate safeguards under Article 46 GDPR.

VI. Artificial intelligence tools

When providing legal services, the firm may use software tools including artificial intelligence, mainly for research, analysis and drafting documents. For information covered by professional confidentiality or for personal data, it uses only enterprise tools acting as processors under Article 28 GDPR, based on a data processing agreement with contractual confidentiality, a ban on using the data for training and appropriate technical and organisational measures (in particular encryption and access control). Processing takes place primarily in the EU and EEA. A lawyer always reviews the output and bears full responsibility for the final content. This approach follows the rules on using artificial intelligence in legal practice approved by the Slovak Bar Association.

VII. Data protection officer

The controller is not required to appoint a data protection officer under Article 37 GDPR. For any data protection matter, please contact the controller directly using the details in section I.

VIII. Your rights

As a data subject, you have the following rights under the GDPR:

• right of access (Art. 15 GDPR): to confirm whether we process your data and to access it,
• right to rectification (Art. 16 GDPR): to correct inaccurate data and complete incomplete data,
• right to erasure (Art. 17 GDPR): where the purpose no longer applies or there is no legal basis,
• right to restriction of processing (Art. 18 GDPR) in the cases set out in the GDPR,
• right to data portability (Art. 20 GDPR): to receive your data in a structured, machine-readable format,
• right to object (Art. 21 GDPR) to processing based on legitimate interest,
• right to withdraw consent (Art. 7(3) GDPR) at any time, without affecting the lawfulness of processing before withdrawal; you can change your cookie consent in the cookie settings,
• right to lodge a complaint with the supervisory authority, the Office for Personal Data Protection of the Slovak Republic.

You can exercise your rights by email at kancelaria@aksamec.sk or in writing to our registered office.

IX. A lawyer’s duty of confidentiality

Under Section 23 of the Legal Profession Act, a lawyer must keep confidential everything learned in the course of practising law. This duty has no time limit, continues after the legal services end and also applies to the firm’s employees and associates. It gives your data an additional layer of protection beyond the GDPR.

X. Security of personal data

We have taken appropriate technical and organisational measures against unauthorised access, alteration, disclosure or destruction of data, in particular:

• encrypted website communication (HTTPS and TLS),
• secure access to electronic case files and documents,
• physical security of the office premises,
• regular data backups,
• a duty of confidentiality for everyone who handles personal data.

XI. Supervisory authority

Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, phone: +421 2 3231 3214, email: statny.dozor@pdp.gov.sk, web: dataprotection.gov.sk.

The practice of law is supervised by the Slovak Bar Association, Kolárska 4, 813 42 Bratislava, www.sak.sk.

XII. Sources of personal data

We obtain personal data mainly from you directly. When providing legal services, we may also obtain it from public sources (land register, commercial register, register of debtors) and from public authorities, to the extent necessary to protect the client’s rights and legitimate interests.

XIII. Changes to this information

We update this information from time to time. The current version is always on this page. We will announce significant changes on the website.