Legal · Tax · Restructuring
Menu
ServicesSituationsExpertiseHow we workContact
Describe your situation

Privacy notice

How we process personal data when you use this website, send an enquiry through the form, when we provide legal services and in our other relationships.

Last updated:

1. Who the controller is

The controller is the law firm your matter concerns:

  • for legal services in Slovakia, KONFRERO Legal, s. r. o., Plynárenská 1, 821 09 Bratislava, Company ID 55 254 306, registered in the Commercial Register of the Bratislava III Municipal Court, section Sro, file 167144/B,
  • for legal services in the Czech Republic, KONFRERO Legal advokátní kancelář, s.r.o., Pod dráhou 1637/2, 170 00 Praha 7, Company ID 215 32 834.

For the use of the website konfrero.com (technical data, form protection and visitor statistics) the controller is KONFRERO Legal, s. r. o., which also operates the website. For an enquiry sent through the form, the controller is the firm the matter concerns; until that is clear, it is KONFRERO Legal, s. r. o.

Send questions, requests and complaints to office@konfrero.com or by post to the registered office of the relevant firm.

2. What this notice covers

This notice covers the processing of personal data:

  • when you use the website konfrero.com,
  • when we communicate by email, phone or through the form,
  • when we provide legal services,
  • in our relationships with suppliers and other business partners,
  • when we meet our legal and professional obligations,
  • when we protect our legitimate interests.

We process data under Regulation (EU) 2016/679 (GDPR), the Slovak Data Protection Act No. 18/2018 Coll., the Slovak Act No. 586/2003 Coll. on the Legal Profession, the professional rules and code of conduct of the Slovak Bar Association, and in the Czech Republic Act No. 110/2019 Coll. on personal data processing, Act No. 85/1996 Coll. on the Legal Profession and the professional rules of the Czech Bar Association. We process only the data we need for a given purpose, and only for as long as necessary.

3. What data we process

  • Identification data: in particular name, surname, date of birth, birth number.
  • Contact data: in particular phone number, address, email address, profiles on online platforms.
  • Payment data: in particular account number, bank, payment references and other payment details.
  • Data related to the engagement: depending on the matter, for example age, occupation, income, marital status.
  • Special categories of data: only where the matter requires it, for example data on health or data relating to criminal offences.
  • Data we create: in particular internal client and file references.
  • Website and form data: described in section 6.

4. Where the data comes from

If you are our client, we obtain data mainly from you, and also from public sources, public authorities or other persons.

If you are not our client (for example an opposing party or a witness), we obtain data mainly from our clients, public registers, public authorities or when securing evidence. In that case we may obtain it without your knowledge, because the practice of law requires it under the Legal Profession Act.

  • Providing legal services. Performance of a contract (Art. 6(1)(b) GDPR), legal obligation (point (c)) or legitimate interest (point (f)). Laws: the Legal Profession Acts and professional rules, civil and commercial law.
  • Other contracts (for example with suppliers). Performance of a contract, legal obligation or legitimate interest. Laws: civil and commercial law, in Slovakia also the Register of Public Sector Partners Act and the e-Government Act.
  • Legal and professional obligations, in particular anti-money laundering (Slovak Act No. 297/2008 Coll., Czech Act No. 253/2008 Coll.) and whistleblower protection (Slovak Act No. 54/2019 Coll., Czech Act No. 171/2023 Coll.). Legal obligation, legitimate interest or public interest (Art. 6(1)(c), (e), (f) GDPR).
  • Protecting rights and property. Legitimate interest (Art. 6(1)(f) GDPR). Laws: procedural codes, civil and commercial law, criminal law.
  • Marketing, for example sending articles. Consent (Art. 6(1)(a) GDPR), or legitimate interest for existing clients. Laws: the Legal Profession Acts, electronic communications and advertising law.
  • Accounting and tax. Legal obligation (Art. 6(1)(c) GDPR) under accounting and tax law.
  • Job applicants. Consent (Art. 6(1)(a) GDPR). Laws: labour codes, the Legal Profession Acts.
  • Website and form. Described in section 6.

6. What we process when you use the website

The form. When you write to us through the form, we process your name, email or phone and company (if given), the message, the chosen topic, the language, the page you wrote from, the link that brought you to the form (for example a typical case) and the time it was sent.

  • Purpose: to reply to you and to check that we have no conflict of interest.
  • Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our duty as attorneys to avoid conflicts of interest (Art. 6(1)(c) GDPR).
  • Retention: if no engagement follows, we delete the message no later than 1 year after our last exchange. If you engage us, it becomes part of the matter file.

Abuse protection. The form is protected by Cloudflare Turnstile. To tell people from automated programs it processes technical browser data and your IP address. Its script loads only once you start filling in the form. Legal basis: our legitimate interest in protecting the website and our systems (Art. 6(1)(f) GDPR).

Technical data. Our hosting provider processes your IP address and technical request data on every visit in order to deliver and protect the website. Our application uses the IP address only briefly, to limit repeated submissions, and does not store it.

Visitor statistics. We use Cloudflare Web Analytics. It uses no cookies or other browser storage and builds no visitor profiles. We see aggregate figures only, such as visits per page.

Searching the services list. When a search in the services list finds nothing, we store only the search words, the page language and the month, and add one to its count. We store no IP address, no exact time and no browser identifier, so a search cannot be linked to anyone. Searches containing digits, an “@” or a web address are never sent. Purpose: to learn which services clients look for. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). These are aggregate figures that we do not link to any person.

Cookies. This website uses no cookies and no browser local storage. That is why there is no consent banner.

7. Legitimate interests

We rely on legitimate interest only where your interests or fundamental rights and freedoms do not override it. Our legitimate interests are in particular protecting our rights and legally protected interests, protecting property, direct marketing to existing clients, managing relationships with clients and business partners, and protecting the website.

You may object to such processing on grounds relating to your particular situation. An objection to direct marketing is always granted, without further assessment.

8. Who receives the data

We share data only as far as necessary and always under professional secrecy, in particular with:

  • our staff and persons we instruct to carry out individual steps of legal services,
  • substitute and cooperating attorneys,
  • interpreters, translators and accounting advisers (as processors),
  • the bar association (for example in disciplinary proceedings),
  • IT service and software providers (as processors), in particular:
    • Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland: website hosting (Azure), email and internal handling of enquiries (Microsoft 365),
    • Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA: form protection (Turnstile) and visitor statistics (Web Analytics).

Although we are bound by professional secrecy, the law requires us to prevent the commission of a crime and to report suspicious transactions under anti-money laundering and counter-terrorist financing law.

9. Transfers outside the EU and automated decisions

We process data in the European Economic Area. The exception is Cloudflare, which may process technical website data in the United States. Cloudflare is certified under the EU-US Data Privacy Framework, covered by the European Commission’s adequacy decision of 10 July 2023.

We do not use automated decision-making or profiling.

10. How long we keep the data

  • Legal services and other contracts: for the term of the contract and 10 years after it ends, unless a specific law requires otherwise.
  • Legal and professional obligations: for the period set by the relevant laws, or as long as we need to show that we met them.
  • Protecting rights and property: as a rule 10 years, longer only where pending proceedings in a specific matter require it.
  • Marketing: until you withdraw consent or object.
  • Accounting and tax: for the period set by accounting and tax law.
  • Job applicants: for the selection process and, if you consented, for as long as the consent lasts.
  • Form enquiries with no engagement: no longer than 1 year after our last exchange.

11. Do you have to give us your data?

Giving us data is as a rule voluntary. Without some data, however, we may not be able to provide or continue a service, for example where the law requires it (client identification) or where we cannot assess the matter without it.

12. Your rights

  • Withdraw consent, where processing is based on consent, at any time, for example by email to office@konfrero.com. Withdrawal does not affect processing before it or processing on another legal basis.
  • Access: confirmation of whether we process your data, and information on the purpose, categories of data, recipients, retention, source, your rights and safeguards for transfers outside the EU.
  • Rectification of inaccurate data and completion of incomplete data.
  • Erasure, in particular where the data is no longer needed, where you withdraw consent and there is no other legal basis, where your objection succeeds, where the data was processed unlawfully, or where the law requires erasure.
  • Restriction of processing, in particular where you contest the accuracy of the data, where processing is unlawful and you ask for restriction instead of erasure, where you need the data, or while we assess your objection.
  • Data portability for data we process by automated means on the basis of consent or contract.
  • Object to processing based on legitimate or public interest (section 7).
  • Lodge a complaint with a supervisory authority:
    • Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, www.dataprotection.gov.sk,
    • Office for Personal Data Protection (Czech Republic), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz.

Exercise your rights by email to office@konfrero.com or by post to the registered office of the relevant firm. We reply within one month; for complex requests we may extend this by two further months and will tell you in advance. If we have reasonable doubts about your identity, we may ask you to confirm it.

An attorney does not have to provide information, access or portability where doing so would breach the duty of confidentiality (Section 18(8) of the Slovak Act No. 586/2003 Coll., Section 21 of the Czech Act No. 85/1996 Coll., Art. 15(4) and Art. 20(4) GDPR).

13. Changes

We update this notice when our processing changes. The date of the last change is shown above.